Endpoint Security Event Management System

UNCLASSSIFIED

UNCLASSIFIED

1 Contracting Officer’s Representative (COR) 2 Endpoint Security Event Management System 3 Performance Requirements 4 Performance Standards 5 Incentives 6 Place of Performance 7 Period of Performance 8 Security Requirements 9 Government Furnished Software (GFS)/Government-Furnished Equipment (GFE)/ Government-

Furnished Information (GFI)

10 GFS

11 Phase-In and Phase-Out Transition 12 Data Rights 13 Other Pertinent Information or Special Considerations 14 Section 508 Accessibility Standards 15 Cybersecurity Maturity Model Certification (CMMC)

Tables of Figures

Table 1- 3.1.1 Deliverables .......................................................................................... Error! Bookmark not defined.

Table 2 - 3.1.2 Deliverables

Table 3 - 3.1.3 Deliverables

Table 4 - 3.1.4 Deliverables

Table 5 - 3.1.5 Deliverables

Table 6 - 3.1.6 Deliverables

Table 7 - 3.1.7 Deliverables

Table 8 - 3.1.8 Deliverables

Table 9 - 3.1.9 Deliverables

Table 10 - 3.1.10 Deliverables

Table 11 - 3.1.11 Deliverables

Table 12 - 3.2.1 Deliverables

Table 13 - 3.3.1 Deliverables

Table 14 - 3.3.2 Deliverables

Table 15 - 3.3.3 Deliverables

Table 16 - 3.3.4 Deliverables

Table 17 - 3.3.5 Deliverables

Table 18 - 3.3.6 Deliverables

Table 19 - 3.3.7 Deliverables

Table 20 - 3.3.8 Deliverables

Table 21 - 3.3.9 Deliverables

Table 22 - 3.3.10 Deliverables

Table 23 - 3.4.1 Deliverables

Table 24 - 3.4.3 Deliverables

Table 25 - 3.3.4 Deliverables

Table 26 - 3.4.5 Deliverables

Table 27 - 3.4.6 Deliverables

Table 28 - 3.5.1 Deliverables

Table 29 - 3.5.2 Deliverables

Table 30 - 3.5.3 Deliverables

Table 31 - 3.5.4 Deliverables

Table 32 - 3.5.5 Deliverables

Table 33 - 3.5.6 Deliverables

Table 34 - 3.6.1 Deliverables

Table 35 - 3.6.2 Deliverables

Table 36 - 3.7.2 Deliverables

Table 37 - 3.8.7 Deliverables

PERFORMANCE WORK STATEMENT (PWS)

Award/Mod Effective Version Date

Contract Number: To be determined (TBD)

Task Order Number: TBD

Contractor Name TBD

Tracking Number: 842674854

Follow-on to Previous Contract and

Task Order Number:

HC108422F0258, W15P7T22F0093

1 Contracting Officer’s Representative (COR).

a. Primary COR: See DITCO Additional Text G1 – Points of Contact

b. Property Administrator: See DITCO Additional Text G1 – Points of Contact

2 Contract or Task Order Title. Endpoint Security Event Management System (ESEMS). Cyber Security as a

Service for the DOW Information Network - Army (DOWIN -A); Engineering, Integration, Delivery and

Support Services; and Education and Training.

2.1 Background: The ESEMS team provides cyber security architecture, tools, and operational support for

DOWIN-A transport systems, computing systems, and data. Supported environments include: The DOWIN-

A enterprise global systems, to include endpoints, infrastructure, and transport, as well as Tactical Network environments that operate in Disconnected Delayed Intermittent Latency (D-DIL) networks and include a variety of systems designed by the Defense Industrial Base that are unique to Tactical Operations. Tactical units can often operate in extremely limited network environments which require unique considerations for capabilities integration. To modernize, work must be done to fine-tune within different Configuration Items within the tactical portfolio and within different unit formation types (example: Division, Brigade, Expeditionary Signal Battalion, etc), as well as conduct pilot activities with units to collect metrics and determine final baseline recommendations. Further, other systems from different stakeholder agencies previously mentioned must also be supported with integration work on systems to enable them to modernize security on systems that use Tactical Network Transport. Currently implemented cyber-security capabilities will ultimately need to be replaced to achieve a more seamless, secure environment that also enables visibility to Regional Cyber Centers (RCC) and the Global Cyber Center (GCC) operated by Network

Enterprise Technology Command (NETCOM), as well as cyber security data collection and analysis performed by Army Cyber Command (ARCYBER) Big Data Platform. Project Manager (PM) Command and

Control Infrastructure (PM C2I) will lead this modernization effort for Capabilities Portfolio Executive

Command and Control Information Networks (CPE C2IN) and collaborate with each stakeholder to ensure a functioning capability that meets needs can be achieved.

2.2 Objectives: The Army seeks to provide a Cyber Security Architecture for Army Networks that secure our critical infrastructure and endpoints against cyber-attacks and threats, continually modernizes and improves existing posture based on emerging requirements, and achieves the responsiveness and flexibility required to support Army readiness and the warfighting mission. The current security services architecture integrates capabilities such as: Microsoft Defender for Endpoint, Sentinel, Elastic stack and

Elastic Defend, TYCHON, Forescout, Cisco Identity Services Engine (ISE), Cribl, various firewalls both

Cisco and Palo Alto NextGen, and Identity, Credential, and Access Management (ICAM) services from

DOW and Army ICAM services. The stakeholder community includes Tactical Units, NETCOM, ARCYBER, and varied Acquisition community Capabilities Portfolios. This is a significant integration effort that requires Elastic Certified Engineering consulting services and other categories of Cyber Security

Engineering support to assist lab testing, vulnerability evaluation and hardening activities, and piloting and prototypes, that will span multiple years. The goal is to produce a codified baseline for varied unit types supported by various project managers, integrate each of the stakeholder communities and their systems, and support these efforts with training to build stakeholder expertise with the capabilities. The contractor for this task order should possess in-house lab capabilities and skillsets to support the overall effort.

2.3 Scope: The mission scope is expanded from current on-prem solutions to establish a more centralized, cloud-enabled operational model leveraging the Army Enterprise Cloud (AECC) environment. This expansion aims at consolidation of on-prem local infrastructures to significantly reduce the physical and administrative footprint across all Continental United States (CONUS) and Outside the Continental United States

(OCONUS) theaters. Additionally, Unified Security Information and Event Management (USIEM) is targeted for installment as part of the Army Global Unified Network (AGUN) architecture and its infrastructure and will expand tool use beyond Security Information and Event Management (SIEM)-only to critical network management and monitoring functions.

2.3.1 Mission and Lifecycle Management:

The mission encompasses the full lifecycle management of endpoint protection and the Comply-to-Connect

(C2C) framework across the Army’s unified endpoints. This includes all Army components, Army National

Guard, Army Reserve, Army active-duty posts, camps and stations, and Tactical networks. In addition, this includes all organizations with services from NETCOM that connect to the DOWIN-A.

2.3.2 Technical Ecosystem and Networks:

This involves the engineering, integration, operation, maintenance, and standardization of:

The USIEM ecosystem.

2.3.3 The NETCOM Edge environment.

The integration of big data analytics across both Non-classified Internet Protocol Router Network (NIPR), Secret Internet Protocol Router Network (SIPR) networks, and Tactical Networks.

2.3.4 Global Reach (CONUS & OCONUS Support):

The contractor shall provide seamless, 24/7/365 end-to-end engineering, operational, and sustainment support across all CONUS and OCONUS theaters of operation. This includes supporting forward-deployed tactical units, regional hub nodes, and RCC to ensure consistent endpoint security posture and USIEM parity regardless of geographic location or bandwidth constraints.

2.3.5 Service Centralization & Footprint Reduction:

To streamline operations, enhance security oversight, and reduce the physical hardware, software, and administrative footprint at the Theaters, the Contractor shall:

a. Migrate and Centralize: Transition of decentralized local endpoint management and security analytics tools into the centralized AECC and AGUN hosting environments.

b. Reduce Theater Footprint: Consolidate local server infrastructure, edge databases, and redundant software licensing by leveraging AECC shared services, enterprise-level cloud repositories, and standardized virtual enclaves.

c. Optimize Enterprise Services: Maintain high availability and rapid local recovery capabilities while shifting the primary processing, heavy analytics, and long-term USIEM storage workloads to centralized AECC environments, thereby minimizing tactical-edge computing resource requirements. Support Tactical integrations with the Army’s Next Generation Command and

Control (NGC2) platforms and data environment, as well as supporting legacy Tactical instantiations and programmed modernization efforts.

3 Performance Requirements

3.1 Task 1 – Endpoint Detection and Response (EDR). The Contractor shall provide comprehensive endpoint security, operations, and maintenance across the DOWIN-A. This includes the management of cloud, hybrid, and on-premises environments utilizing the Army’s Microsoft Defender for Endpoint (MDE) and Elastic

Defend to ensure robust, multi-layered protection for all enterprise endpoints.

• The Contractor shall operate, maintain, and secure MDE on End User Devices (EUDs) managed within the Army Unified Directory Services (AUDS), which encompasses approximately 90-95% of the total

Army EUD inventory.

• The Contractor shall manage and deploy a Hybrid Cloud DOWIN-A ecosystem supporting non-AUDS endpoints and servers, on NIPR, SIPR, Mission Partners environments and Tactical networks. The

Contractor shall maximize the use of the Army Cloud and AECC architecture and centralize to minimize the footprint in CONUS and OCONUS. This environment shall support the remaining DOWIN-A non-

AUDS endpoints and servers.

• The Contractor shall deploy and maintain Elastic Defend to provide comprehensive, multi-layered endpoint security protection and data collection for all on-premises endpoints across the DOWIN-A.

• The Contractor shall ensure contractor own, contractor operated (COCO) hardware, software, network devices are compliant for Quantum readiness in accordance with (IAW), National Security

Memorandum - NSM-10, National Institute of Standards and Technology (NIST) Federal Information

Processing Standards (FIPS), FIPS 203, FIPS 204, and FIPS 205.

3.1.1 Subtask 1 – Timeline Execution Performance.

The Contractor shall adhere to the following geographical and infrastructure requirements for the deployment of the

Elastic Defend solution:

1. Primary Hosting: The Contractor shall manage the primary Elastic Defend environment in OCONUS and

CONUS locations.

2. Continuity of Operations (COOP): The Contractor shall establish and maintain a fully functional backup hosting location within CONUS. Government approval for designation location.

3. Hardware Provisioning: The on-premises infrastructure required for Elastic Defend operations may be provisioned utilizing either Government Furnished Equipment (GFE) or Contractor Furnished/Contractor

Owned Equipment (CFE/COE), subject to final Government approval.

4. Comprehensive plan detailing the onboarding of personnel, transfer of knowledge, and assumption of

MDE/Elastic Defend operations.

5. Detailed design of the three EDR architectures (Core, Hybrid-Managed, Zero Trust) and the integration of

MDE/Elastic Defend.

6. Strategy for deploying the hybrid cloud ecosystem on AECC, specifically targeting cloud/hybrid endpoints.

7. Detailed documentation of security controls applied to both on-premises (Elastic) and cloud (AECC) nodes.

8. Procedures for identifying, tracking, reporting and remediating advanced malicious cyber activities on

DOWIN-A.

9. Status of MDE and Elastic Defend client updates, vulnerability definitions, and system compliance metrics.

10. Metric-driven report detailing endpoint agent health, directory synch status including on-prem and AUDS

EUDs, and network performance.

11. Procedures for failover from the primary OCONUS Elastic hosting environment to the backup CONUS site.

12. Verification of AUDS EUDs and AECC hybrid endpoints are actively secured and monitored.

13. Develop, deliver, implement, and continuously maintain a comprehensive Concept of Operations

(CONOPS). The CONOPS shall detail the Contractor’s strategy, technical approach, and operational procedures for executing the 24/7/365 global ESEMS managed service across DOWIN-A.

Deliverables: (Note: All deliverables shall be maintained on NETCOMs repository, as directed by the Government.)

Table 1- 3.1.1 Deliverables

To be provided at RFQ

3.1.2 Subtask 2 – System Design & System Engineering Performance.

Performance Requirements:

The Contractor shall:

1. Implement Application Controls and Custom Controls on Elastic Defend:

a. Approved applications.

b. Default deny all applications from running on an endpoint except those specifically authorized (at least configurable by file location, hash, reputation score, and/or software Public Key

Infrastructure (PKI) signature)

c. Prevent known threats for on-premises and cloud environments.

d. Blocking removable media (RM).

e. Exceptions in allowing RM for specified users, endpoint, and external device.

f. Define the activities on an endpoint that generates alerts.

g. On-demand malware scanning of endpoint hard drives, files, and folders.

h. Schedule malware scanning of endpoint hard drives, files, and folders.

i. Integrated controls to block threats found by EDR solution.

j. Block known threats coming from threat intelligence service.

k. Control blocking executables from running on Compact disc, Digital Video Disc (DVD), external drives, Universal Serial Bus (USB) drives, and memory cards.

l. Distribute updates to controls for blocking files, applications, and executables to each endpoint within one business day of a change.

2. Elastic Event Log collections that capture time, date, event name, event type, event outcome, source

Internet Protocol (IP) address, source host name, destination IP address, destination host name, object name, object type, and geographical information.

a. Implement Cyber Operational Attribute Management System (COAMS) tags.

3. Elastic Defend Data Loss Prevention (DLP).

4. Alert malicious code coming from email, web, and network file transfers in Elastic Defend.

a. Prevent execution of malicious code coming from email, web, and network file transfers.

b. Monitor endpoints for malicious activity using signature based and signature-less methods.

c. Implement signature based and signature-less methods.

d. Custom threat mitigations.

e. Detect and respond using signature, signature-less, heuristic and behavior-based approaches.

f. Monitor signature version at each endpoint.

g. Delete or quarantine malware without human intervention when detected.

h. Prevent execution of malicious code in documents, in memory, and in the registry.

i. Sharing of information between endpoint security products to enable quick identification and remediation of threats.

j. Integrate external systems for dynamic malware analysis.

5. Single user interface in Elastic Defend for managing functionality/deployment and implement role base access controls.

6. Elastic Defend with Microsoft Sentinel, C2C, and USIEM integrations.

14. MDE Active mode to enforce endpoint security policies or, when MDE Active mode configuration shortfalls exist and Army, Defense Information Systems Agency (DISA) and DOWIN-A security policy cannot be enforced, submit case ticket to Army Enterprise Management Platform (AESMP) requesting Microsoft Tier

4 support.

15. Monitor MS Graph Application Programming Interface (API) integrations and submit new integrations.

16. Submit Request for Change (RFC) for Ports, Protocols and Systems (PPS) and Case Tickets for endpoint security policies and capabilities integration via the NETCOM DOWIN-A Change Advisory Board (CAB).

17. Recommend MDE DLP policies for standard baseline.

18. MDE Custom detection rules, YARA and Kusto Query Language (KQL) rule translation.

19. Recommend new internal tags and collaborate with the GCC.

20. MDE Alerts:

a. Manage, initiate automated investigations, run scans, collect investigation packages and download portal executable (PE) files.

b. Configure alert suppression settings, manage folder exclusions for automation, onboard and offboard devices, manage email notifications, manage evaluation lab, and manage allowed/blocked lists for indicators.

c. Monitor Incident and Alert queues in Microsoft EDR.

21. Secure MDE device discovery, attack surface reduction, controlled folder access, discover and track protected devices and unprotected devices from exploits, network protection for incident of compromise(s), web content filtering, on-demand scans, and manage and update Microsoft Defender for Antivirus.

22. Onboard supported devices to MDE via Microsoft Intune.

23. Perform product risk and security assessment, Red Teaming, as designated by the Government, simulating adversary, in attempt to identify and exploit potential weaknesses within the Army’s network. Identify attack path that breaches Army security defenses through real-world attack techniques and identify misconfigurations and coverage gaps.

Deliverables: (Note: All deliverables shall be maintained on NETCOMs repository, as directed by the Government.)

Table 2 - 3.1.2 Deliverables

3.1.3 Subtask 3 – Continuity & Infrastructure Footprint Performance.

Performance Requirements:

The Contractor shall:

1. Design, implement, and maintain a highly resilient architecture that ensures uninterrupted endpoint protection across the DOWIN-A.

2. Establish and maintain a primary Elastic Defend hosting environment in an approved OCONUS location, with a fully synchronized, operational backup hosting environment located within CONUS.

3. In the event of a catastrophic failure, network degradation, or directed isolation of the primary OCONUS site, seamless failover of all Elastic Defend telemetry, routing, and management capabilities to the CONUS backup location without loss of endpoint protection or data corruption.

4. Maintain continuous data replication between the OCONUS and CONUS locations, ensuring Event Logs, threat intelligence feeds, and policy baselines are synchronized to meet Government-defined Recovery

Point Objectives (RPO) and Recovery Time Objectives (RTO).

5. Execute a comprehensive COOP failover test bi-annually. The Contractor shall provide a formal After-

Action Report (AAR) to the Government within ten (10) business days of test completion, detailing failover times, data integrity status, and any required remediation.

6. Ensure the underlying infrastructure—whether utilizing the AECC, GFE, or CFE—meets the performance demands of a global 24/7/365 mission.

7. Maintain a minimum of 99.9% system availability for all Contractor-managed EDR backend infrastructure

(excluding scheduled Government-approved maintenance windows).

8. The infrastructure footprint shall be engineered to dynamically support the data ingest, processing, and log storage for the designated DOWIN-A endpoints and servers managed via the Hybrid/Elastic ecosystem, with burst capacity to handle peak threat-event logging.

9. Configure data polling, telemetry transmission, and update distributions (such as the 1-business-day control update requirement) to minimize bandwidth consumption over the DOWIN-A. The Contractor shall utilize load balancing, local caching, and optimized API queries (e.g., MS Graph API) to prevent network degradation at tactical or bandwidth-constrained endpoint locations.

10. If the Government directs a transition between GFE and CFE for on-premises hosting, the Contractor shall ensure performance parity. The Contractor is responsible for continuous monitoring of hardware health, storage capacity, and compute utilization across all Elastic Defend nodes, submitting predictive upgrade requests before resource exhaustion impacts operational security.

Deliverables: (Note: All deliverables shall be maintained on NETCOMs repository, as directed by the Government.)

Table 3 - 3.1.3 Deliverables

3.1.4 Subtask 4 – Integration Performance.

1. Engineer, operate, and maintain seamless, bi-directional (where applicable) integrations between the EDR endpoint ecosystems (Elastic Defend and MDE) and DOW/Army enterprise cybersecurity platforms. All integrations must utilize secure, encrypted protocols (e.g., Transport Layer Security (TLS) 1.2 or higher) and adhere to DOW Impact Level 5 (IL5) data transit standards and Impact Level 6 (IL6) data transit standards.

2. Integrate Elastic Defend and MDE telemetry with the Army's USIEM to ensure enterprise-wide visibility and centralized alerting.

3. Contractor owned and Government owned infrastructure logs (system, event, etc) shall be transmitted to

Gabriel Nimbus or other government data repositories as directed.

4. Configure Elastic Defend and MDE to continuously forward event logs, security alerts, and compliance metrics to USIEM without data degradation or unacceptable latency.

5. All transmitted data adheres to normalized schemas (e.g., Elastic Common Schema [ECS]) and dynamically applies required metadata, including geographic information and COAMS tags, to ensure

USIEM parsers can accurately ingest the data.

6. Support USIEM rule tuning by providing endpoint context, ensuring USIEM analysts can correlate EDR endpoint alerts with broader network-level intrusion detection events.

7. Ensure Elastic Defend and MDE provide real-time health, signature version, and policy compliance status to Forescout upon endpoint network connection.

8. If Forescout detects an endpoint lacks a compliant EDR agent or updated signatures, the Contractor’s integration shall support automated routing to remediation Virtual Local Area Network (VLAN) until the endpoint is verified as secure by EDR telemetry.

9. Synchronize unmanaged/unprotected device discovery data between MDE/Elastic Defend and Forescout to identify blind spots within the DOWIN-A footprint.

10. Engineer data connectors capable of transmitting large sets of raw endpoint telemetry (signature-less/behavioral detection logs, process executions, file creations) to Gabriel Nimbus, scaling dynamically to handle peak data bursts.

11. Ensure the data structured for Gabriel Nimbus enables ARCYBER analysts to execute complex queries and behavioral analytics across historical Elastic Defend and MDE datasets.

12. Document, monitor, and maintain API connections (e.g., Microsoft Graph API, RESTful APIs) interfacing with Microsoft Sentinel, Gabriel Nimbus, Microsoft Endpoint Configuration Manager (MECM), AESMP, Azure Identity, Entra Identity (Identity and Access Management (IDAM) services), and threat intelligence.

13. Configure Elastic Defend and MDE to automatically ingest, parse, and apply Indicators of Compromise

(IOC) and threat intelligence feeds from approved external sources to enable proactive, automated blocking of known threats.

14. Define, develop, and integrate necessary data feeds to required Army and/or DOW systems. These include but not limited to DISA Continuous Monitoring and Risk Scoring (CMRS), threat event data to Army’s designated SIEM repositories, provide analytics to inform operations and provide data sources, data flows, and sensor feeds to interface their analytic output into Government data analysis platforms. The Contractor shall provide stable, reliable, and effective data transfer to DOWIN federated servers and the associated repository for DOW reporting.

Deliverables: (Note: All deliverables shall be maintained on NETCOMs repository, as directed by the Government.)

Table 4 - 3.1.4 Deliverables

3.1.5 Subtask 5 – Test and Evaluation (T&E) Performance.

The Contractor shall:

1. Establish, document, and execute a comprehensive T&E program.

2. Validate that all EDR components (Elastic Defend, MDE, and associated infrastructure) meet performance, security, and interoperability standards prior to enterprise-wide deployment continuously throughout the lifecycle of the contract.

3. Maintain an isolated, representative evaluation lab environment simulating the DOWIN-A network to test configurations, Attack Surface Reduction (ASR) rules, and software updates.

4. Support Government-led User Acceptance Test (UAT) by providing test plans, scripts, and access to the lab environment.

5. Execute controlled, phased deployments (e.g., Alpha, Beta, Release Candidate rings) to validate performance on a subset of endpoints before authorizing full enterprise distribution.

6. Fully support Government-authorized Red Team assessments, penetration testing, and adversary emulation exercises. The Contractor shall ensure these activities can be safely executed to test EDR detection and automated response capabilities without disrupting legitimate mission operations.

7. Perform continuous, automated vulnerability scanning of the backend EDR infrastructure

(OCONUS/CONUS Elastic nodes, AECC cloud instances) and remediate identified vulnerabilities in accordance with DOW/DISA timelines.

8. Periodically simulate maximum endpoint load (up to 20% endpoints) to evaluate the processing, memory, and network bandwidth performance of the EDR architectures.

9. Test and validate that Gabriel Nimbus and USIEM data pipelines can handle simulated, high-volume data bursts (e.g., a massive malware outbreak scenario) without dropping logs or crashing the Elastic Defend or

MDE backend.

10. Implement a rapid testing protocol to evaluate threat intelligence updates, YARA/KQL rules, and new malware signatures within the mandated one (1) business day deployment Service Level Agreement (SLA), ensuring that updates do not cause "false positive" mission disruptions or system crashes on EUDs.

11. Continuously test and validate API connections (e.g., Microsoft Graph API) and data flows to external systems (ex.: Forescout, AESMP, Sentinel). Any degradation in telemetry forwarding must generate an immediate alert to the Contractor's operations team.

Deliverables: (Note: All deliverables shall be maintained on NETCOMs repository, as directed by the Government.)

Table 5 - 3.1.5 Deliverables

3.1.6 Subtask 6 – Implementing Risk Management Framework (RMF) Performance.

The Contractor shall:

1. Execute the RMF lifecycle in accordance with Department of War Instruction (DOWI) 8510.01 and NIST

SP 800-37. This applies to all EDR architectures spanning the Elastic Defend environments

(OCONUS/CONUS) within the AECC.

2. Develop, implement, and maintain the System Security Plan (SSP) detailing the operational environment, network boundaries, and security controls mapped to NIST PQSP 800-53 (Revision 5) baselines appropriate for an IL5, IL6 and Tactical networks.

3. Apply, test, and validate DISA Security Technical Implementation Guides (STIGs) and Security

Requirements Guides (SRGs) across all operating systems, applications, and network devices within the

Contractor-managed EDR footprint.

4. Upload, organize, and manage all RMF artifacts, test results, topology diagrams, and security policies within the DOW Enterprise Mission Assurance Support Service (eMASS) system.

5. Develop, update, and actively remediate vulnerabilities tracked in the Plan of Action and Milestones

(POA&M). The Contractor shall provide mitigation strategies and resolve findings based on Government-approved timelines (e.g., resolving Critical/High findings within mandated DISA timeframes).

6. Utilize automated tools (e.g., Assured Compliance Assessment Solution (ACAS) and Nessus) to continuously scan the backend EDR infrastructure for vulnerabilities and configuration drift.

7. Ensure that all EDR administrative and security logs are continuously audited, protected from tampering, and retained in accordance with DOW IL5, IL6 and Tactical records management directives.

8. Ensure all deployed cloud-native EDR components comply with the DOW Cloud Computing Security

Requirements Guide (CC SRG) for IL5, IL6, and Tactical, specifically safeguarding Controlled

Unclassified Information (CUI), Classified and Tactical mission data.

Deliverables: (Note: All deliverables shall be maintained on NETCOMs repository, as directed by the Government.)

Table 6 - 3.1.6 Deliverables

3.1.7 Subtask 7 – Operate, Maintain & Secure (OMS) Performance.

The Contractor shall:

1. Provide continuous, 24/7/365 operations, maintenance, and security support for 800,000+ endpoints across the DOWIN-A. Operations shall be synchronized globally from the primary hub at Gosselin Barracks, Fort

Huachuca, AZ, remote personnel shall be within a 120 miles radius from the nearest installation and distributed staff across all supported Army Security Operation Centers, as designated by the Government.

2. Ensure site Information Technology (IT) resources designated as high value by the Authorizing Official

(AO) must be remotely managed only via a Windows privileged access workstation (PAW) (reference:

Windows PAW STIG :: Version 2, Release: 1 Benchmark Date: 01 Nov 2021) or an alternative solution that meets or exceeds the requirement as stated in the Windows PAW STIG :: Version 2, Release: 1 Benchmark

Date: 01 Nov 2021 (or latest version). A high-value IT resource is defined as any IT resource whose purpose is considered critical to the organization or whose loss or compromise would cause a significant impact on the organization.

3. Operate, maintain, and secure MDE on EUDs managed within the AUDS, encompassing the DOWIN-A endpoint footprint.

a. Configure and maintain MDE in "Active Mode" to strictly enforce Army Endpoint Security

Policies. If Active Mode configuration shortfalls exist preventing policy enforcement, the

Contractor shall immediately submit a case ticket to the AESMP requesting Microsoft Tier 4 support.

b. Continuously discover unprotected devices, evaluate the attack surface, and onboard supported

EUDs to MDE utilizing Microsoft Intune.

c. Actively monitor Incident and Alert queues within the Microsoft EDR portal. The Contractor shall manage automated investigations, configure alert suppression settings, manage folder exclusions, and maintain allowed/blocked lists for IOCs.

4. Operate, maintain, and secure Elastic Defend on the remaining endpoints and servers, maximizing the use of the AECC architecture and designated on-premises nodes (OCONUS/CONUS).

a. Implement and strictly utilize a single user interface within Elastic Defend for managing all agent functionality, policy deployments, and telemetry collection across the hybrid enterprise.

b. Maintain strict Application Controls within Elastic Defend, enforcing a "Default Deny" posture for all unapproved applications (enforced via file location, hash, reputation score, or PKI signature).

c. Actively manage and update policies to block unauthorized RM, prevent execution of malicious code (via email, web, and network file transfers), and implement DLP rules.

5. Continuous health, connectivity, and effectiveness of all deployed endpoint agents (both MDE and Elastic).

a. Distribute updates to security controls (blocking files, applications, executables) and malware signatures to each managed endpoint within one (1) business day of a change or release.

b. Monitor signature versions and agent health at each endpoint, proactively identifying and remediating endpoints that have fallen offline, failed to update, or require software patching.

6. Secure the endpoint ecosystem against advanced cyber threats.

a. Configure both MDE and Elastic Defend to delete, quarantine, or isolate malware and compromised endpoints without human intervention upon detection of critical threats.

b. Monitor endpoints for malicious activity utilizing a layered approach that includes signature-based, signature-less, heuristic, and behavior-based detection methods.

c. Schedule recurring malware scans of endpoint hard drives, files, and folders, and execute on-demand scans to support active threat-hunting or incident investigation packages.

Deliverables: (Note: All deliverables shall be maintained on NETCOMs repository, as directed by the Government.)

Table 7 - 3.1.7 Deliverables

3.1.8 Subtask 8 – Change Management Performance.

The Contractor shall:

1. Adhere to established NETCOM and PM Change Management processes. No modifications to baseline security policies, agent configurations, or network integrations shall be deployed to the production

DOWIN-A enterprise without formal Government adjudication and approval.

2. Utilize the NETCOM DOWIN-A CAB process to propose, justify, and document all substantive changes to the EDR endpoint security posture.

a. Document and submit a formal RFC for all new, modified, or retired ASR rules, firewall configurations, EDR policies, and anti-virus baselines. These submissions must align with DOW and Army enterprise policies.

b. Provide technical subject matter experts (SMEs) to attend CAB meetings, defend submitted RFCs, address stakeholder concerns, and adjudicate feedback prior to final CAB approval.

c. Submit RFCs to authorize any new or modified PPS required for EDR telemetry, MDE/Elastic

Defend agent communication, or infrastructure synchronization.

d. Submit Authorized Service Interruption (ASI) to the GCC.

3. Utilize the authorized AESMP—currently ServiceNow, or its successor—as the central system of record for incident tracking, problem management, and complex integration requests.

a. Submit and track case tickets within AESMP for endpoint security capability integrations, troubleshooting systemic agent failures, and coordinating cross-domain service requests.

b. Immediately submit a case ticket via AESMP requesting Microsoft Tier 4 support when MDE

Active mode shortfalls exist that prevent the enforcement of Army/DISA/DOWIN security policies.

c. Utilize AESMP workflows (or other authorized GCC channels) to recommend new internal tagging conventions, MS Graph API integrations, and DLP baseline modifications, ensuring collaborative adjudication with the GCC.

4. Ensure that all approved changes executed via the CAB or AESMP are accurately reflected in the overarching DOWIN-A Configuration Management Database (CMDB) and the Contractor’s own SSP within ten (10) business days of implementation.

Deliverables: (Note: All deliverables shall be maintained on NETCOMs repository, as directed by the Government.)

Table 8 - 3.1.8 Deliverables

To be provided at RFQ

3.1.9 Subtask 9 – Threat Intelligence Sharing Performance.

Performance Requirements:

The Contractor shall:

1. Establish and maintain existing and future Government threat intelligence platform ensuring existing bi-directional threat intelligence architecture is consistent. This architecture must ensure the rapid ingestion, analysis, and dissemination of actionable threat intelligence across the entire EDR ecosystem (MDE, Elastic Defend, and associated analytical platforms) to aggressively defend the DOWIN-A.

2. Ensure that threat intelligence is not siloed between disparate endpoint security products.

a. Engineer and maintain automated workflows to share IOCs and threat artifacts seamlessly between

MDE and Elastic Defend. An IOC identified on an MDE endpoint must be rapidly shared and blocked on the Elastic Defend footprint, and vice versa.

b. Utilize DOW-approved, standardized threat intelligence sharing protocols (e.g., STIX/TAXII) to facilitate automated machine-to-machine sharing of tactics, techniques, and procedures (TTPs) and IOCs.

3. Integration with External Threat Intelligence Platforms (TIP)

a. Manage and integrate EDR tools with enterprise Threat Intelligence Platforms and directly with feeds provided by the GCC and ARCYBER.

b. Configure the EDR environment to automatically ingest approved external threat feeds and dynamically apply custom threat mitigations (e.g., blocking known malicious IPs, domains, and file hashes) across all managed endpoints without requiring manual human intervention.

4. Dynamic Malware Analysis Integration.

a. Integrate EDR (Elastic Defend and MDE) with external, DOW-approved systems for dynamic malware analysis and sandboxing.

b. When signature-less, heuristic, or behavior-based alerts detect an unknown, potentially malicious payload, the Contractor shall ensure the system can automatically securely package and route the artifact to the external dynamic analysis system for detonation and scoring.

c. Upon receiving a malicious verdict from the dynamic analysis system, the Contractor shall ensure the resulting IOCs are immediately injected back into the EDR defensive posture to block the threat globally across the DOWIN-A.

5. YARA/KQL Translation and Custom Rules.

a. Actively manage, translate, and deploy custom detection rules utilizing industry standards such as

YARA and KQL, ensuring that intelligence bulletins provided by the GCC can be rapidly operationalized into functional queries within both Elastic and MDE environments.

6. Cyber Indicators.

a. Maintain constant awareness of the status of the highly dynamic operating environment - collects, processes, analyzes, and disseminates cyber warning assessments.

Deliverables: (Note: All deliverables shall be maintained on NETCOMs repository, as directed by the Government.)

Table 9 - 3.1.9 Deliverables

To be provided at RFQ

3.1.10 Subtask 10 – Reporting and Visibility Performance.

Performance Requirements:

The Contractor shall:

1. Provide comprehensive, accurate, and timely reporting to ensure Army leadership maintain continuous visibility into the security posture, operational health, and compliance status of the EDR endpoint enterprise (MDE and Elastic Defend).

2. Dashboarding and Real-Time Visibility:

a. Develop, configure, and maintain a role-based, unified security dashboard accessible to designated

Government personnel (e.g., GCC, ARCYBER, NETCOM). This dashboard must aggregate telemetry from both MDE and Elastic Defend to provide a single pane of glass for enterprise visibility. The dashboard shall always be accessible and available without any encumbrance.

b. Display near real-time metrics, including but not limited to active threat alerts, agent health status

(online/offline), anomalous behavior, signature-update compliance, discovered unmanaged devices, and incident queue volumes.

c. Display near real-time CORA inspectable items to support site and enterprise inspections.

3. Scheduled Security and Operational Reporting:

a. Provide a weekly rollup detailing the health of endpoints footprint. The report must include metrics on telemetry data connections (API health), update distribution compliance, and open

AESMP Tier 4 escalation tickets.

b. Provide a comprehensive monthly security review. This summary shall analyze trends in malicious cyber activities, detail the efficacy of deployed ASR/Custom rules, report on DLP triggers, and summarize Red Team/Penetration testing remediation efforts.

c. Provide continuous visibility into defensive operations by documenting and updating all TTPs related to incident response, telemetry integration, and threat hunting.

4. Ad-Hoc and Incident Reporting:

a. In the event of a critical security breach, widespread malware outbreak, or catastrophic infrastructure failure (e.g., loss of OCONUS Elastic node), the Contractor shall notify the designated Government COR and the GCC via phone and encrypted email within one (1) hour of discovery.

b. Upon Government request, the Contractor shall rapidly generate "Flash Reports" or executive slide decks to brief senior Army leadership on emerging cyber threats, significant architectural changes, or urgent security postures.

5. Documenting Integration Procedures:

a. Formally document and provide visibility into all integration procedures for telemetry data connections via the Microsoft Defender for Endpoint Graph API and Elastic APIs. This documentation must explicitly cover connections to MECM, AESMP, C2C orchestrator

(Forescout), Nessus, Intune, Azure, Adaptive Security Appliance (ASA) CISCO (Virtual Private

Network (VPN)), Active Directory (AD) & Azure Active Directory (AAD), IDAM, Virtual

Hypervisors, Elastic, Sentinel and any other Government designated platforms.

Deliverables: (Note: All deliverables shall be maintained on NETCOMs repository, as directed by the Government.)

Table 10 - 3.1.10 Deliverables

To be provided at RFQ

3.1.11 Subtask 11 – Training and Documentation Performance.

Performance Requirements:

The Contractor shall:

1. Develop, deliver, and continuously update comprehensive training and documentation to ensure

Government personnel (e.g., Army cyber analysts, system administrators, and helpdesk technicians) are fully equipped to utilize, monitor, and support the EDR endpoint ecosystem (MDE and Elastic Defend).

2. Enterprise Documentation:

a. Document step-by-step standard operating procedures (SOPs) and defensive TTPs for incident response, threat hunting, device onboarding via Microsoft Intune, and quarantine remediation.

b. Maintain accurate, detailed topology and data flow diagrams reflecting EDR architecture.

c. Develop automated response playbooks and manual execution runbooks for handling common alerts, investigating portal executable (PE) files, and executing disaster recovery / failover processes between the OCONUS and CONUS nodes.

d. All documentation must be reviewed quarterly and updated within fifteen (15) business days following any major system upgrade, API change, or architectural modification.

e. Maintain a repository of all products produced by the Contractor in an approved Government repository and easily accessible by the Government. This includes but is not limited to drafts, diagrams, presentation briefs, TTPs, information papers, executive summaries, knowledge guides, SOPs, and asset list.

3. Training Program and Execution:

a. Develop online instructor lead, training videos and training materials specifically tailored for:

i. Site Reviewers/System Administrators: Basic agent troubleshooting, alert suppression, and device onboarding. Policy deployment, CAB/RFC submission procedures, and infrastructure health monitoring.

ii. Tier 2/3 Cyber Analysts: Advanced threat hunting (using YARA/KQL), MDE custom detections, dynamic malware analysis loopback, and USIEM/Gabriel Nimbus log correlation.

iii. Provide training via multiple modalities, including instructor-led virtual sessions, recorded on-demand modules, and Over-the-Shoulder (OTS) / On-the-Job Training (OJT) at the primary hub (Gosselin Barracks), ad-hoc training locations (Government approval required) and distributed Army RCCs, Tactical unit sites and the GCC.

iv. As the enterprise transitions from varied Commercial Off-The-Shelf (COTS) products to new capabilities, the Contractor shall provide specialized Delta Training to upskill

Government analysts on the new cloud-native and cloud-hybrid capabilities.

4. Knowledge Management and Transfer:

a. Populate and maintain a searchable Knowledge Base (e.g., within AESMP/ServiceNow or a

Government-approved Wiki) containing FAQs, known error workarounds, and integration guides.

b. Upon contract completion or transition, the Contractor shall conduct a formal knowledge transfer phase to ensure the Government or a successor contractor can seamlessly assume operations without loss of mission effectiveness.

Deliverables: (Note: All deliverables shall be maintained on NETCOMs repository, as directed by the Government.)

Table 11 - 3.1.11 Deliverables

To be provided at RFQ

3.2 Task 2 – Post Quantum Cryptography (PQC).

Performance Requirements:

The Contractor shall:

1. Provide a solution designed to provide comprehensive PQC to assess, report, discover, inventory, and report cryptography used in all DOW systems for national security systems (NSS) and non-national security systems, business systems, weapon systems, cloud computing capabilities, mobile devices, physical access control systems, internet of things, unmanned systems, and operational technology, regardless of classification, location, network connection, type, purpose, or use.

2. Scan, identify, and catalog all cryptographic assets across the enterprise, including workstations, servers, and network devices.

3. Perform a comprehensive risk assessment on the inventoried cryptographic assets. The risk scoring methodology must align with the NIST RMF and specifically address vulnerabilities related to quantum computing threats.

4. Analyze and report on the readiness of existing hardware to support migration to PQC algorithms. This includes assessing processor capabilities, memory, and other relevant hardware specifications.

5. Provide reports and data sets formatted to assist DISA with defining and implementing PQC standards for

CMRS.

6. Provide a user-centric interface that allows filtering based on Capability with the following characteristics:

technology stack, cryptographic inventory dashboard, risk-scoring visualization, hardware readiness view and actionable insights.

Deliverables: (Note: All deliverables shall be maintained on NETCOMs repository, as directed by the Government.)

Table 12 - 3.2.1 Deliverables

3.3 Task 3 – Comply to Connect (C2C)

3.3.1 Subtask 1 Discovery, Identification and Categorization.

Performance Requirements

The Contractor shall:

1. Implement and maintain established DOWIN-A and Army policy to rapidly identify and categorize devices that are discovered.

2. Assign devices to established endpoint categories.

3. Deploy Security Policy Orchestrator.

4. Identify and block shadow IT / unauthorized endpoints.

5. Determine what actions will be automated/manual.

6. Implement initial Network Access Control (NAC).

7. Establish near-real time awareness of all devices.

8. Determine level of automation workflow.

9. Establish an Inventory of all authenticated and authorized devices, publish hardware/software (HW/SW) inventory to designated repository.

3.3.1.1 Interrogate.

Performance Requirements

The Contractor shall:

1. Inspect devices prior to full network connection.

2. Verify security compliance.

3. Periodically re-validate configuration of endpoints currently connected to the Environment.

3.3.1.2 Remediate.

Performance Requirements

The Contractor shall:

1. Separate non-compliant endpoints to a remediation VLAN or implement appropriate Access Control List

(ACL) to restrict access to necessary remediation processes only.

2. Automatically determine remediation steps required.

3. Automatically implement remediation steps.

4. Automatically validate STIG compliance.

5. Monitor changes since last contact with device.

6. Validate remediation actions.

7. Generate a report of actions taken, generate trouble ticket if automation fails.

3.3.1.3 Authorize Connection.

Performance Requirements

The Contractor shall:

1. Full NAC capability will deny or provide limited or full device access based on device secure configuration, vulnerability management compliance, device type, and location.

2. Validate devices seeking access to various network segments.

3. Establish and automate access level of device.

4. Quarantine non- compliant devices.

5. Integrate with ICAM. Complete operational performance assessment.

3.3.1.4 Enforce Policy, Report and Continuously Monitor.

Performance Requirements

The Contractor shall:

1. Non-compliant machines or users will not be given access.

2. Continuously assess device configuration compliance.

3. Threats or vulnerabilities identified will leverage automated or manual mitigation processes.

4. C2C will block network access to non-compliant endpoints and attempt to remediate.

5. Fully integrate with the selected ICAM and Governance Risk Management Compliance (GRC) solutions.

Deliverables: (Note: All deliverables shall be maintained on NETCOMs repository, as directed by the Government.)

Table 13 - 3.3.1 Deliverables

3.3.2 Subtask 2 Continuity & Infrastructure Footprint Performance.

Performance Requirements

The Contractor shall:

1. Design, implement, and maintain a highly resilient architecture that ensures uninterrupted endpoint protection across DOWIN-A.

2. In the event of a catastrophic failure, network degradation, or directed isolation of the primary site, seamless failover of all C2C telemetry, routing, and management capabilities to the designated backup location without loss of endpoint protection or data corruption.

3. Maintain continuous data replication between the primary and secondary locations, ensuring Event Logs, threat intelligence feeds, and policy baselines are synchronized to meet Government-defined RPO and

RTO.

4. Execute a comprehensive COOP failover test annually. The Contractor shall provide a formal AAR to the

Government within ten (10) business days of test completion, detailing failover times, data integrity status, and any required remediation.

5. Ensure the underlying infrastructure—whether utilizing the AECC, GFE, or CFE—meets the performance demands of C2C global mission.

6. Maintain a minimum of 99.9% system availability for all Contractor-managed C2C backend infrastructure

(excluding scheduled Government-approved maintenance windows and authorized service outages).

7. Configure data polling, telemetry transmission, and update distributions (such as the 1-business-day control update requirement) to minimize bandwidth consumption over DOWIN-A. The Contractor shall utilize load balancing, local cache, and optimized API queries to prevent degradation of C2C services.

8. If the Government directs a transition between GFE and CFE for on-premises hosting, the Contractor shall ensure performance parity. The Contractor is responsible for continuous monitoring of hardware health, storage capacity, and compute utilization across all Elastic Defend nodes, submitting predictive upgrade requests before resource exhaustion impacts operational security.

Deliverables: (Note: All deliverables shall be maintained on NETCOMs repository, as directed by the Government.)

Table 14 - 3.3.2 Deliverables

To be provided at RFQ

3.3.3 Subtask 3 Integration Performance.

Performance Requirements

The Contractor shall:

1. Engineer, operate, and maintain seamless, bi-directional (where applicable) integrations between C2C and

DOW/Army enterprise cybersecurity platforms.