ATO Cybersecurity Program Engineering and Technical Services Draft SOW.pdf

ATO Cybersecurity Program, Engineering & Technical Services

Attachment A: Statement of Work

Federal Aviation Administration

Contents A.1 Introduction

A.1.1 Background

A.1.2 Scope

A.2 General

A.2.1 Terminology

A.2.2 References/Applicable Documents

A.2.3 Government Furnished Property (GFP)

A.2.3.1 Wireless Internet Access and Remote Access to the FAA Intranet

A.2.3.2 Workspace, Telephones and Computers at Government Sites

A.2.4 Inherently Governmental Functions

A.2.5 Security Requirements

A.2.6 Deliverables

A.2.7 Clauses

A.2.8. Segregation of Funds

A.2.9 Telework

A.2.10 Contract Type

A.3 Task Requirements

A.3.1 Task 1 – Program Management and Strategic Support (OPS and F&E Funded)

A.3.1.1 Task Order Management

A.3.1.2 Kickoff Meeting

A.3.1.3 Program Management Review (PMR)

A.3.1.4 Project Management Plan (PMP)

A.3.1.4 Monthly Status Reports (MSR)

A.3.1.5 Quality Control Plan (QCP)

A.3.1.6 Project Schedule

A.3.1.7 Task Order Transition-In and Transition-Out Support

A.3.2 Task 2 – Program Control & Governance

A.3.2.1 SSO Support (OPS and F&E Funded)

A.3.2.2 Budget Management Support (OPS and F&E Funded)

A.3.2.3 Privacy Management Support (OPS Funded)

A.3.2.4 Data Call Management Support (OPS Funded)

A.3.2.5 Audit Management Support (OPS Funded)

A.3.2.6 Standard Operating Procedures and Program Management Planning Support (OPS Funded)

A.3.2.7 Policy Management Support (OPS Funded)

A.3.3 Task 3 - Enterprise Architecture Support

A.3.3.1 Enterprise and System Architecture (OPS and F&E Funded)

A.3.3.2 Cyber Supply Chain Risk Management (OPS Funded)

A.3.3.3 Cybersecurity Strategic Planning and Analysis (OPS and F&E Funded

A.3.3.4 New Entrants Evaluation (OPS and F&E Funded)

A.3.3.5 Technology and Capability Insertion (OPS and F&E Funded)

A.3.3.6 Cybersecurity Architecture Planning and Analysis (OPS and F&E Funded)

A.3.4 Task 4 - Cybersecurity Engineering Support (OPS and F&E Funded)

A.3.4.1 Cybersecurity Requirements Development Support (OPS and F&E Funded)

A.3.4.2 Cybersecurity Tools Development, Management, and Operations (OPS Funded)

A.3.4.3 Domain Subject Matter Experts (OPS and F&E Funded)

A.3.4.4 Cyber Engineering Review Support (OPS and F&E Funded)

A.3.4.5 Enterprise Solution Development (OPS and F&E Funded)

A.3.4.6 Cybersecurity Monitoring Standards, Requirements and Management Support (OPS and F&E Funded)

A.3.5 Task 5 - NAS Cybersecurity Workforce development (OPS Funded)

A.3.6 Task 6 – Integration, Outreach and Planning Support (OPS Funded)

A.3.6.1 Cybersecurity Exercise Support (OPS Funded)

A.3.6.2 Stakeholder Engagement Support (OPS Funded)

A.3.6.3 Data and Information Management Support (OPS Funded)

A.4 Contract Execution

A.4.1 Labor

A.4.2 Travel

A.4.3 Other Direct Costs (ODCs)

A.4.4 Period of Performance

A.4.5 Place of Performance

A.4.6 Invoicing and Payment

A.1 Introduction This Statement of Work (SOW) is being issued by Federal Aviation Administration's (FAA) Air Traffic Organization (ATO) National Airspace System (NAS) Security and Enterprise Operations (NASEO) Directorate. The NASEO Directorate supports the U.S. Airspace Management and NAS services and infrastructure from a global perspective. The ATO Cybersecurity Group (ACG), a line of business under NAS Security and Enterprise Operations (NASEO) within the Air Traffic Organization (ATO), is the lead organization for governing, implementing, and managing cybersecurity controls for NAS.

A.1.1 Background

The FAA’s NASEO Directorate is one of seven (7) Technical Operations Service units that provide safe and efficient flight services through responsive and cost-effective maintenance of the NAS facilities, systems, and equipment. The enterprise products under NASEO management deliver air traffic control operational and administrative services that are integral to the proper functioning of the NAS. NASEO provides around the clock operational management of the NAS services and infrastructure from a global perspective to include accurate and timely situational awareness of NAS operations to support collaborative decision making for the prevention and mitigation of events affecting NAS operations.

The Federal Aviation Administration (FAA) NAS Security and Enterprise Operations (NASEO) (AJW-B) have a requirement to minimize the impact of cyber security events or incidents in support of availability and restoration requirements for ATO systems and services. The FAA runs a multi-faceted cybersecurity program to protect the NAS in accordance with Federal Information Security Management Act (FISMA).

The President has declared that the “cyber threat is one of the most serious economic and national security challenges we face as a nation” and that “America’s economic prosperity in the 21st century will depend on cyber security”. The Air Traffic Organization (ATO) Cybersecurity Strategic Plan advances progress toward a National Airspace System (NAS) mission space in which critical infrastructure remains secure and resilient; where critical and essential services continue to function under a range of cyber conditions; where NAS cyber security capabilities adapt to changing cyber threats and NAS operations withstand or rapidly recover from disruptions. The ever-increasing capability of cyber adversaries demand in-depth institutional knowledge of the critical infrastructure, which must be maintained to ensure resiliency of the mission space.

The ATO Cybersecurity Group (ACG) is responsible for the overall management of the ATO Cybersecurity. Their role is to integrate cybersecurity functions into NAS and ATO operations and provide an enterprise-wide view of cybersecurity risk with cybersecurity strategic planning. ACG secures NAS and ATO operated systems through authorization, continuous monitoring and ensuring compliance. The foundation for ATO Cybersecurity is about understanding and managing the risk to protect and enable the operational mission.

A.1.2 Scope

The Contractor must furnish the necessary personnel, materials, equipment, facilities, travel, and support in accordance with this SOW. The Contractor must provide the appropriate program management, and project control necessary to manage this Task Order; ensure that the cost, schedule, and quality requirements are continually tracked, and the status communicated to the FAA; and ensure that this Task Order is successfully completed.

The scope of this Task Order includes strategic management consulting, subject matter expertise, and analytical support to facilitate the end state organizational and functional capabilities for the FAA via both Facilities & Equipment (F&E) and operational (OPS) funding.

Products derived from the effort will include the collection of data and creation of actionable artifacts needed to develop, transform, and mature the organization’s capabilities.

The core services include Tasks as follows:

Task 1 – Program Management and Strategic Support

Task 2 – Program Control & Governance Support

Task 3 – Enterprise Architecture Support

Task 4 – Cybersecurity Engineering Support

Task 5 – NAS Cybersecurity Workforce Development

Task 6 – Integration, Outreach, and Planning

A.2 General

A.2.1 Terminology

Within this SOW and associated task orders, references to “the Contractor” apply to the ATO Cybersecurity Program, Engineering and Technical Services Support Contractor, its teammates, and subcontractors.

A.2.2 References/Applicable Documents

The Contractor must ensure all work is in full compliance with regulations expressed in the following procedures, orders, and programs unless otherwise directed by the Contracting Officer’s Representative (COR). In the event of a conflict between this SOW and any of the applicable document cited within, the requirements of this SOW take precedence.

In providing Cybersecurity services required under this contract, the Contractor must comply with the applicable FAA orders, directives, and policies listed below. The Contractor is responsible for reviewing all applicable documents and understanding their impact on the delivery of the required services. Applicable documents are subject to revision, and it is the Contractor’s responsibility to ensure that the most current version of each document is used and that the new applicable documents are adopted, as required.

FAA Acquisition Management Policy:

http://fast.faa.gov/AMP_TOC.cfm

FAA Acquisition Toolset:

http://fast.faa.gov/

ID Badge Online Application:

https://my.faa.gov/org/linebusiness/ash/programs/id_badge.html

Personnel Security Program:

https://www.faa.gov/regulations_policies/orders_notices/index.cfm/go/document.infor mation/documentID/1040448

Safety Management Information System (SMIS) https://smis.faa.gov/home.asp

Corporate Work Plan:

https://corporateworkplan.faa.gov:7011/CWPPortal/faces/cwpHome

Technical, regulatory, policy, and security documents:

http://www.faa.gov/regulations_policies/orders_notices/index.cfm/go/documen t.list/parent TopicID/184

Executive Order (EO) 13636 Improving Critical Infrastructure Cybersecurity

Presidential Policy Directive (PPD) – 21, Critical Infrastructure Security and Resilience

Federal Information Security Management Act (FISMA) of 2002

OMB Memorandum M-14-03, Enhancing the Security of Federal Information and Information Systems http://fast.faa.gov/AMP_TOC.cfm http://fast.faa.gov/ https://my.faa.gov/org/linebusiness/ash/programs/id_badge.html https://www.faa.gov/regulations_policies/orders_notices/index.cfm/go/document.information/documentID/1040448 https://www.faa.gov/regulations_policies/orders_notices/index.cfm/go/document.information/documentID/1040448 https://corporateworkplan.faa.gov:7011/CWPPortal/faces/cwpHome http://www.faa.gov/regulations_policies/orders_notices/index.cfm/go/document.list/parent%20TopicID/184 http://www.faa.gov/regulations_policies/orders_notices/index.cfm/go/document.list/parent%20TopicID/184 https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity https://www.cisa.gov/sites/default/files/2023-01/ppd-21-critical-infrastructure-and-resilience-508_0.pdf https://www.congress.gov/bill/107th-congress/house-bill/3844 https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2014/m-14-03.pdf

Order JO 1370.114, Implementation of FAA Telecommunications Infrastructure Services and IS Requirements in the NAS

FAA Order 1370.121B, FAA Information Security and Privacy

National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, as amended

NIST Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, as amended

NIST Special Publication (SP) 800-82, Guide to Industrial Control Systems (ICS) Security, as amended

NIST Special Publication (SP) 800-137, Information Security Continuous Monitoring for Federal Information Systems and Organizations, as amended

Order 1370.121 FAA Information Security and Privacy Program and Policy

FAA Branding:

https://www.faa.gov/documentLibrary/media/order/branding_writing/Branding _Order_17006.pdf

508 Compliance:

https://my.faa.gov/tools_resources/it_services_support/stay_compliant/section _508.html

FAA Quality Insurance Section 3.10.4 of the Acquisition Management System (AMS):

https://fast.faa.gov/docs/acquisitionManagementPolicy/acquisitionManagement Policy.pdf

Forms:

http://www.faa.gov/library/forms/ https://my.faa.gov/content/dam/myfaa/org/linebusiness/ato/operations/technical_operations/neo/issp/authorization/media/JO_1370_114.pdf https://www.faa.gov/regulations_policies/orders_notices/index.cfm/go/document.information/documentID/1040976 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-137.pdf https://employees.faa.gov/documentLibrary/media/Order/FAA_Order_1370.121A_Final_WEB.pdf https://www.faa.gov/documentLibrary/media/order/branding_writing/Branding_Order_17006.pdf https://www.faa.gov/documentLibrary/media/order/branding_writing/Branding_Order_17006.pdf https://my.faa.gov/tools_resources/it_services_support/stay_compliant/section_508.html https://my.faa.gov/tools_resources/it_services_support/stay_compliant/section_508.html https://fast.faa.gov/docs/acquisitionManagementPolicy/acquisition http://www.faa.gov/library/forms/

A.2.3 Government Furnished Property (GFP)

The Contractor is responsible and accountable for all FAA property provided to the Contractor under this Task Order. The Contractor must comply with associated Government property clauses and contract requirements, including submission of an annual GFP Report. Upon Task Order expiration, the Contractor must return all GFI/GFP back to the FAA. The Contractor must deliver all FAA property in accordance with this SOW or when requested by the COR.

The FAA will make GFP available for Contractor personnel requiring direct access to GFI and/or systems located behind the FAA’s network firewall. This includes the FAA Contractor PIV card, FAA Contractor email address, and FAA laptop with appropriate software and hardware.

The Contractor must only use FAA approved laptops in the performance of work under this Task Order.

A.2.3.1 Wireless Internet Access and Remote Access to the FAA Intranet

When required to perform the specific duties and roles assigned under this contract, the Government may provide, at no expense to the Contractor, mobile broadband modems, and remote access to the FAA Intranet to CO-authorized Contractor personnel. Government approvals of mobile broadband modems and FRAC accounts for remote access will be reassessed annually on an individual basis.

A.2.3.2 Workspace, Telephones and Computers at Government Sites For Contractor personnel working under a Government Site Rate as defined in Section B, the Government will provide workspace, a computer, software, a telephone, and access to network printers and fax machines for the performance of assigned work efforts under this contract.

Contractor personnel must comply with the Government’s applicable usage policies for all GFP.

A.2.4 Inherently Governmental Functions The Contractor must not perform any inherently governmental functions, as identified in the Office of Federal Procurement Policy Letter 11-01. These are functions that are so intimately related to the public interest as to require performance by Federal Government employees.

These functions include activities that require either the exercise of discretion in applying Federal Government authority or the making of value judgements in making decisions for the Government. Support under this contract is limited to non-decision-making activities that do not bind the Government, such as analysis, studies, and assistance. Contract employee recommendation must be forwarded to a government employee for review and consideration.

A.2.5 Security Requirements

The Contractor must possess a minimum Secret Facility Security Clearance (FCL) issued by the Defense Counterintelligence and Security Agency (DCSA) prior to accessing classified information. The Contractor must comply with all provisions of the DD Form 254, Contract Security Classification Specification, during task order performance. All contractors must maintain an active secret level security clearance. Some subtasks may require access up to Top Secret Security Level. Security clearance requirements per task will be defined by the COR in conjunction with ATO leadership as the mission develops and threat models evolve.

A.2.6 Deliverables

This section describes 1) the products and tangible end results that are expected from each task contained in the previous section, 2) the date each deliverable is due, and 3) the FAA acceptance criteria. The Contractor must verify that all submitted deliverables conform to applicable FAA policies, standards, and guidelines as listed in Section 2 of this SOW and any specific formatting requirements when directed by the COR.

All days are business days unless otherwise specified. The Contractor may presume that a deliverable has been accepted unless the COR rejects it in writing within 15 days of its submission. If rejected, the FAA will provide rationale to the Contractor for the rejection. The Contractor will have ten (10) business days or date agreed to by Contractor and CO/COR to resubmit rejected deliverable.

The following provisions and the applicable SOW Section(s) (as listed in the Acceptance Criteria for each deliverable in the table below) govern the FAA’s final acceptance of each deliverable:

AMS Clause 3.10.4-5 Inspection - Time and Material and Labor Hour (April 1996)

AMS Clause 3.10.4-4 Inspection of Services -Both fixed price & Cost Reimbursement (April 1996)

The following is a table of required deliverables. Deliverables must be sent directly to the COR via electronic mail. All Delivery Schedule dates beyond the Base Period are stated with the understanding the applicable Option Periods have been exercised.

DS

Deliverables Acceptance Criteria Tasks DID Format Delivery Schedule

1. TO Kickoff Contractor Briefing

Staffing plan, deliverables schedule, and questions/next steps must be accurate, complete, submitted on time, and prepared as required in the PWS Tasks and the Template provided.

1 N/A MS Power Point Template

One (1) business day prior to Task Order Kickoff meeting

2. Kickoff Meeting Report

Minutes/Decision Notes and action items must be accurate, complete, submitted on time, and prepared as required in the SOW Tasks.

1 N/A Microsoft Office Suite

Ten (10) business days after Kickoff Meeting

3. Project Management Status Report and Performance and Cost Report

The report must provide the specific information called for in the DID for all the activities under this Task Order.

1 FAA-

PM-

and

DI-

FNCL-

80912

Microsoft Office Suite

15th of each month

3. Project Management Status Report and Funds and Man-Hours Expenditure Report

The report must provide the specific information called for in the DID for all the activities under this Task Order.

1 FAA-

PM-

and

DI-

FNCL-

80331A

Microsoft Office Suite

15th of each month

4. Program Management Plan (Base Year + Option Years)

Program Management Plan must be accurate, complete, on time, and is prepared in accordance with the SOW A.3.1.4. Reviewed

1 N/A Microsoft Office Suite

Initial 45 days after Task Order (TO) award.

by NASEO Management and approved by the

COR.

Updated as required.

5. Program Detailed Schedule (Base Year + Option Years)

Schedule must be accurate, complete, on time, and is prepared in accordance with the SOW 3.1.6 Reviewed by NASEO Management and approved by the

COR.

1 N/A Microsoft Office Suite

Initial schedule 45 days after TO award.

Updated as required.

6. Program Management Review (Base Year + Option Years)

PMR document must be accurate, complete, on time, and is prepared in accordance with the SOW Tasks. Reviewed by NASEO Management and approved by the

COR.

All N/A Microsoft Office Suite

Monthly

7. Transition-In Transition Plan

(Base Year)

Transition-In Transition Plan is accurate, complete, submitted on time in the COR approved format and prepared as required in the SOW.

1 N/A Microsoft Office Suite

30 business days after Task Order award

8. Transition-In Inventory Report

(Base Year)

Transition-In Inventory Report is accurate, complete, submitted on time in the TC and COR approved format and prepared as required in the PWS.

1 N/A Microsoft Office Suite

Three (3) business days after completion of Transition- In Inventory

9. Quarterly Transition-In Inventory Report

(Base Year + Option Years)

Transition-In Inventory Report is accurate, complete, submitted on time in the TC and COR approved format and prepared as required in the PWS.

1 N/A Microsoft Office Suite

Updates quarterly or within two

(2) business days of major changes

10. Transition-Out Plan Transition-Out Plan is accurate, complete, submitted on time in the

1 N/A Microsoft Office Suite

60 business days

COR approved format and prepared as required in the PWS.

before the end of the Task Order

11. Phase-Out Inventory Report

Phase-Out Inventory Report must identify all equipment and documentation returned by the Contractor, including a detailed list of all discrepancies between the Phase-In Inventory Report and the Phase-Out Inventory Report and prepared as required in the PWS. TC and COR approval required.

1 N/A Microsoft Office Suite

15 business days prior to the end of Task Order

A.2.7 Clauses

AMS 3.1.1 – Clauses and Provisions Incorporated by Reference (July 2019)

This SOW or contract, as applicable, incorporates by reference the provisions or clauses listed below with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make the full text available, or offerors and contractors may obtain the full text via Internet at: https://fast.faa.gov/contractcaluses.cfm

This task order will be subject to AMS Rights in Data clause 3.5-16 Rights in Data – Special Works clause.

A.2.8. Segregation of Funds

The FAA plans to obligate both Facilities & Equipment (F&E) funds as well as Operations (OPS) funds on this TO. The Government will use the OPS funds for the portions of the SOW that represent operational expenses and F&E funds for the portions of the SOW that represent F&E expenses.

The Contractor must submit all invoices in accordance with Section A.4.6 of this SOW and FAA AMS Clause 3.11-28. In addition, invoices must provide detail to disclose all hours worked for each labor category mapped to the applicable SOW Task Section.

https://fast.faa.gov/contractcaluses.cfm

The Contractor must perform the work described under the portions of the SOW that represent expenses only to the level of funding that the FAA obligates/provides on the TO.

The Contractor must notify the contracting officer (CO) in writing when expenditures amount to 75% of the total funding currently obligated on the TO.

With each obligation, the Contractor must include the amount of funds needed and every subsequent incremental funding action, the FAA will identify how much of the incremental funding is available and show a cumulative total for each (by SOW Section). With each obligation, the FAA will also identify how much of the funding provided apply to each section of the SOW.

A.2.9 Telework

The Government will decide what work, if any, may be performed remotely, i.e., telework, by Contractor employees when determined to be in the best interest of the Government in meeting work requirements. The Contractor must define all remotely sited work or telework and submit in advance to the Contracting Officer and Contracting Officer Representative (COR) for approval.

A.2.10 Contract Type

The contract type of this Task Order is Time & Materials/Firm Fixed Price (T&M/FFP) hybrid.

Before exercising an option period, the Government will review the requirement at that time and determine whether FFP or FFP/T&M hybrid is more feasible for the Task Order.

The Contractor must perform services in accordance with the SOW and only to the level of funds obligated to the Task Order (the Not-to-Exceed Ceiling Amount), in accordance with AMS Clause 3.3.1-39 Funding - Time-and-Materials and Labor-Hour Contracts.

The Government will incrementally fund this Task Order.

A.3 Task Requirements The Contractor must conduct the tasks described in the following sections. The Contractor must manage performance under this Task Order, to include all the necessary technical, business, and administrative planning; organizing; managing; coordinating; tracking (e.g. cost, schedule, deliverables); performance management; risk management; resource management; data management; and subcontract management (if applicable) required to perform all requirements successfully.

A.3.1 Task 1 – Program Management and Strategic Support (OPS and F&E Funded)

The Contractor must:

• Provide an overall Task Order Manager function to manage all contractor performance and to serve as the focal point for the FAA in Task Order execution, as described in A.3.1.1 of this SOW.

• Support the ATO Cybersecurity Group Management Team on Program functions, ensuring that identified tasks are performed efficiently, accurately, on time, and in compliance with the requirements.

• Participate as an advisor of a government-led team.

• Attend the Kickoff Meeting and prepare reports as described in A.3.1.2

• Prepare a Project Management Status Report (PMSR) to provide a synopsis of the project’s activity over the reporting period in accordance with DID FAA-PM-004 (undated).

• Meet with the Contracting Officer (CO), COR, and Technical Customer (TC) for a Program Management Review (PMR) sixty (60) days after Task Order award date and every month at a mutually agreed upon location and format when directed by COR, as described in A.3.1.3.

• Develop a Project Management Plan within 45 days of award, as described in A.3.1.4.

• Provide program support that encompasses the development and execution of multiple tasks/projects: stakeholder engagement, program outreach, and tracking of associated work assignments and deliverables. This support also requires engagement with other FAA offices, other Government Agencies, and external Public/Private Partners for activities directly relevant to the support of the ATO Cybersecurity Program efforts. The Contractor must perform project functions to include the following:

o Provide support for projects and activities at the team level, including: developing internal statements of work/requirements products; developing a Master Program Plan and Detailed Schedule of Cybersecurity activities, projects, and task-specific milestones.

o Support the preparation, review and maintenance of reports, guidance and plans including, but not limited to: Strategic Plans, External Reports (e.g., General Accountable Office (GAO), Office of Inspector General (OIG), Cybersecurity Framework (CSF), and internal/external guidance and reports.

o Prepare briefings and white papers in support of executive, management, or team presentations on program status covering all related initiatives to management or other FAA work groups that may be supporting Cybersecurity activities.

o Support the development and implementation of strategy for centralized Cybersecurity Asset Management to comply with Office of Management and Budget (OMB) mandates.

o Develop, maintain, and report program metrics in collaboration with program host organization.

o Support the development of program budget formulation and execution.

o Support Management of ATO Cybersecurity F&E budget lines including CIT reviews, Resources Planning Documents, white sheets, OMB-300 and other required activities.

o Support and track OPS and F&E funding reviews, briefings, meetings, and planning.

o Provide support for correspondence preparation, file maintenance, create and produce documentation and presentation materials, perform editing, incorporate graphic services, and document assembly and binding o Evaluate/propose streamlined acquisition processes necessary to support NAS Cybersecurity objectives.

o Develop and Maintain NAS Cybersecurity Risk Management processes (including implementation of the Risk, Issue and Opportunity (RIO) process, as appropriate).

• Provide support for calendar administration, including managing calendars, booking meetings, and providing meeting support.

• Provide support for meetings and forums for the Program Office to include preparing briefings, recording minutes, coordinating, and tracking issues, action plans, and resolution as requested by the COR.

A.3.1.1 Task Order Management

The Contractor must provide program management support to perform identified tasks efficiently, accurately, on time, and in compliance with the requirements. The Contractor must participate as a member of a Federal Aviation Administration (FAA) led team when directed the

COR.

A.3.1.2 Kickoff Meeting

The Government will conduct a Kickoff Meeting. The Government plans to conduct this meeting ten (10) business days after Task Order award with a date, time, and location determined by the Government. The purpose of the meeting is to review the SOW requirements and ensure the Contractor has a clear understanding of the scope of work and deliverables. The Contractor must prepare a Task Order Kickoff Contractor Briefing, attend the Kickoff Meeting, and prepare the Task Order Kickoff Meeting report. The Contractor must attend the Kickoff Meeting and must prepare the following reports:

• Kickoff Meeting Contractor Briefing – Details the Contractor’s staffing plan, deliverable schedule, and questions/next steps to be discussed at the Task Order Kickoff Meeting.

• Kickoff Meeting Report – Documents meeting minutes and action items.

A.3.1.3 Program Management Review (PMR)

The Contractor must meet monthly with the PMO and COR for a Program Management Review (PMR) at a mutually agreed upon location and format when directed by the COR. The PMR which may be held in-person or remotely must include discussion of the following:

Contract/Task Order Information;

• Financial Summary to include: o Cost by Task Order and Project, o Current and cumulative costs traceable to the SOW tasks, o Variance from projected costs, and o Cost projections for each task;

• Task Order Staffing Summary;

• Performance Summary to include:

o Achievements against milestones, o Performance and quality issues o Significant risks (including schedule risks), and o Communication/Personnel issues;

• Action Item Summary; and

• Subcontractor Status, if any.

The Contractor must provide all PMR materials at least five (5) business days prior to the scheduled meeting. The Contractor must prepare and deliver PMR minutes including action items, issues, resolutions, or specific FAA instructions no later than five (5) business days after the meeting.

A.3.1.4 Project Management Plan (PMP)

The Contractor must provide a Project Management Plan (PMP) within 45 days of award that describes the approach for developing and institutionalizing National Airspace System (NAS) ATO Cybersecurity Program Concepts. The PMP must include each task of this SOW as follows:

• Description of the planned schedule to include all milestones and deliverables;

• Identification of each process step required for completing the work;

• Period of time needed to accomplish each step;

• Description of the staffing resources allocated to each task, i.e., staffing plan; and

• Rationale for the project organization, staff utilization, and other resource allocations.

The Contractor must keep the PMP current and resubmit the PMP for COR approval within five

(5) business days of any proposed changes that result in a schedule impact of more than ten (10) business days.

A.3.1.4 Monthly Status Reports (MSR)

The Contractor must provide Monthly Status Reports (MSRs) on the 10th day of 1st full month following Task Order start and the 10th day of every month thereafter. The Contractor must provide an MSR that documents the activities of the previous month and identifies planned activities for the following month. The Contractor must deliver the reports to the COR, and the reports must include, at a minimum, the following information:

• Overview of work completed, work in progress, and work planned for each task;

• Hours expended by task, labor category, and personnel;

• Status of individual deliverables;

• Identification of risk areas with recommended remedial actions;

• Status of all outstanding risks identified in previous MSRs; and

• Any additional information pertinent to the FAA in administering the performance of this effort or when directed by the COR.

A.3.1.5 Quality Control Plan (QCP)

The Contractor must develop and maintain a Quality Control Plan (QCP) to provide requirements specified in this SOW within 10 days after Task Order Award. The QCP must support the FAA’s Quality Assurance Surveillance Plan (QASP), which the FAA will use to monitor Contractor performance. The COR will review and approve the QCP, which must include the following:

• Identify the standards that are applicable to this effort;

• Include procedures for complying with those standards;

• Identify metrics and techniques for measuring quality and performance;

• Include an approach for eliminating the causes of unsatisfactory performance, i.e., procedures to identify, prevent, and ensure non-recurrence of defective services; and

• Address Task Order and SOW task level performance for applicable tasks.

The Contractor must perform Quality Assurance (QA) functions in accordance with the FAA approved QCP. The Contractor must review and update the approved QCP upon any changes to the Task Order (e.g., additional duties, staffing changes, new quality assurance measures) or when directed by the COR. The Contractor must submit QCP updates to the COR within 15 business days of the FAA’s request.

A.3.1.6 Project Schedule

The Contractor must provide a project schedule 45 days from Task Order start and provide updates on the 10th day of the month following initial submission that aligns with the PMP per Section 3.1.4 and includes the following:

• Key milestones depicted at both the program and task level;

• Task level resource requirements; and

• Program and Task level end results/deliverables that the Contractor must produce.

A.3.1.7 Task Order Transition-In and Transition-Out Support A.3.1.7.1 Transition-In Plan and Period The first 30 business days from date of Task Order award constitute the Transition-In Period. To ensure a smooth transition in the change of work effort from the current contract, the Contractor must provide support during this time and submit a Transition-In Plan for COR approval within ten (10) business days after Task Order award that describes actions necessary for a successful transition of operational responsibilities to the Contractor. The Contractor must prepare and deliver a Transition-In Plan that includes:

• A transition Work Breakdown Structure (WBS);

• Recommendations for work observance accomplished by current employees;

• Recommendations for staffing field offices;

• A schedule that details time to complete all staffing requirements, including new hiring of personnel; security clearances, if required; training requirements and identification of training, if necessary, of Contractor employees; completion of the development of work plans and procedures; and QCP/procedure updates; and

• Identification of personnel available during the Transition-In period.

The Transition-In Plan must describe an integrated and comprehensive approach for successful transition, including transition of activities started but not yet completed, from the existing Task Order to this effort and estimated resource requirements from the incumbent. The Contractor must use this time to implement operating procedures described in the Transition-In Plan. The Contractor will be allowed access to facilities to familiarize the Contractor’s supervisors, key personnel, and staff with equipment, reporting, work scheduling, and procedures. The COR will arrange for access to Government facilities. The Contractor personnel must observe the performance of services defined within this Task Order during the Transition-In period. However, the Contractor’s actions to staff personnel and established procedures must not interrupt services at any time during this period.

A.3.1.7.2 Transition-In Inventory

The Contractor must collaborate with the Government to conduct a joint inventory of the Government Furnished Property (GFP) within 20 business days after Task Order award, as required by the COR. During the inspection/inventory, the Contractor must identify the equipment and documentation to transfer for Contractor use. The Contractor must prepare, certify, and submit a detailed Transition-In Joint Inventory Report as a result of the joint inventory. The Contractor must maintain the Inventory List as provided by the FAA throughout the life of the Task Order and provide quarterly updates. Report to the Government within two

(2) business days from the time of occurrence any major changes occurring between quarterly updates.

A.3.1.7.3 Transition-Out Transition Plan

• The last 60 to 90 business days of the Task Order constitute the Transition-Out Period.

During this period, personnel of the succeeding Contractor must observe operations and performance methods of the Contractor. This must allow for orderly turnover of artifacts/deliverables and ensure continuity of services. The Contractor must not defer any requirements for avoiding responsibility or transfer such responsibility to the succeeding Contractor before the end of the last performance period. The transfer of all property will be used by the Government after Task Order completion must take place during the Transition-Out Period. The Transition-Out transition must be in accordance with the Transition-Out Transition Plan.

• No later than 90 business days prior to the expiration of the Task Order and in Collaboration with the FAA, the Contractor must draft and deliver, for TC and COR approval, a Transition-Out Transition Plan. The plan must cover the transition timeframe established by the TC and the COR. The Transition-Out Transition Plan must address the plans and procedures necessary to ensure continuity of operations.

A.3.1.7.4 Transition-Out Inventory

The Contractor and the succeeding Contractor must conduct a joint inventory of GFP. The Contractor must prepare, certify, and submit a Phase-Out Inventory Report for approval by the Government. The inventory will include the same data as required for the Phase-In inventory.

The Contractor must note all valid discrepancies arising from the inventory. A Government representative will determine the validity of the discrepancy. If it is determined that the Contractor is responsible for the discrepancy, the Contractor must correct the discrepancy prior to performance expiration, or the cost of repair is deducted from the final payment to the Contractor. At the completion of the last performance period, the Contractor must return the same property or property equal in type, kind, quality, and quantity of items as originally furnished by the Government and accepted by the Contractor. Return property no longer required during the execution of the Task Order within ten (10) calendar days of the end of its use and document the return as part of the Contractor’s inventory management. Government property must be in the same or better condition as when originally furnished, less normal wear and tear.

• Inventory includes all source code delivered or made accessible no later than two (2) weeks prior to the end of the Task order expiration.

A.3.1.7.5 Transition-Out Execution The Contractor must provide support to execute transition-out in accordance with the Transition-Out Plan. The Contractor must not disrupt or adversely impact the provision of services and must achieve a smooth and orderly transfer of responsibility to the successor. The Contractor must fully cooperate with the succeeding Contractor and the Government and make available all Contractor equipment, material and services required for the continued performance of the service.

Additionally, approximately 15 business days prior to the Task Order’s end date, the Contractor must provide the following to the COR:

All documentation as of the most recent revision.

Final status/financial report, including a projection of activities for the remainder of the Task Order.

Transition-Out Inventory Report.

Participate in a closeout meeting with the FAA (details and participants determined by the COR).

The Contractor must return all FAA security badges, if issued, to the COR by closeout of the Task Order.

A.3.2 Task 2 – Program Control & Governance

The Contractor must support the Directorate and ATO in performing System Security Officer (SSO) functions for each ATO-owned system, both OPS and F&E, throughout its lifecycle. Support activities include, but are not limited to, the following:

A.3.2.1 System Security Officer (SSO) Support (OPS and F&E Funded)

• System Change Management:

o Establish/maintain procedures with ATO system Program Offices (PO) to ensure awareness of all system changes being proposed.

o Participate in the system configuration management process, including applicable Configuration Control Boards (CCB).

o Assess system configuration changes for impact on security posture.

o Identify enterprise security services that may be applicable to system changes.

o Integrate system changes into the security Authorization process.

o Review system security acquisition documentation, including security documents required by the Acquisition Management System (AMS) process.

o Ensure appropriate security requirements are incorporated into applicable system contractual documents.

o Identify and support integration of applicable enterprise security services for system acquisitions.

• System Authorization:

o Coordinate system initial security Authorization activities and Information Security Continuous Monitoring (ISCM) activities as required to maintain Ongoing Authorization.

o Review system security authorization documentation to ensure completeness, accuracy, and compliance.

o Maintain system security Authorization information in the Security Management Assessment and Reporting Tool (SMART).

• System Remediation:

o Create, track, update, validate and close system vulnerability remediation of Plan Of

Actions & Milestones (POA&M).

o Coordinate risk acceptance requests, to include rationale and identification of compensating controls.

o Maintain system security POA&M information in SMART.

• System Security Lifecycle Management:

o Support the establishment and maintenance of AMS Cybersecurity processes and documentation.

o Ensure NAS systems are Cybersecurity compliant prior to NAS operations.

A.3.2.2 Budget Management Support (OPS and F&E Funded)

• Provide overall F&E and Ops Budget Management:

o Support Management of ATO Cybersecurity F&E budget lines including CIT reviews, Resources Planning Documents, white sheets, OMB-300 and other required activities.

o Support and track OPS and F&E funding reviews, briefings, meetings, and planning.

o Verify FAA Cybersecurity Plan of Action and Milestones (POA&M) remediation and track all associated Cybersecurity remediation funding obtained under this effort.

A.3.2.3 Privacy Management Support (OPS Funded)

• Ensures that privacy related documents for systems entering an authorization are completed and submitted for adjudication in accordance with the Authorization and Information Security Continuous Monitoring (ISCM) Schedule.

o Review System Owner submitted privacy documents and related artifacts for completeness and accuracy and provide feedback/recommendation as required.

o Ensure that privacy documentation delivery meets established schedules and/or deadlines.

o Assist in the tracking of all privacy documentation submittal to the FAA Privacy office and report any potential delay in the adjudication of the documents.

o Track the SO’s development and completion of Privacy documents such as PTAs and provides status report.

o Report on any significant or controversial emerging issues.

o Ensure compliance with privacy requirements and manage the privacy risks to

NAS and its environment associated with the processing of PII.

o Ensure that Privacy POA&Ms are updated accordingly in SMART or ATOM (as appropriate) and CSAM o Assist in the development of weekly report on PTA and privacy activities/status.

o Ensure that the KSN Privacy site is updated on a weekly basis and that users are aware on how to find their documents.

o Work closely with ACG teams on documenting privacy requirements for the ATO

Cybersecurity Tailored Controls.

o Communicate with stakeholders to ensure that privacy requirements are met.

o Provide timely, concise, and thorough privacy support and policy guidance.

o Ensure that SSO and SOs are appraised of status of ongoing privacy actions and sensitive/controversial issues as they arise.

A.3.2.4 Data Call Management Support (OPS Funded)

• Ensures that data call responses are submitted within the agreed upon or stipulated request dates.

o Coordinate the gathering of- and -consolidate required information requested by the different data call requester for submission.

o Review for completeness and accuracy all data call responses and if required communicates/collaborates with SSO and SO to ensure responses are complete.

o Assist, proactively, in providing guidance through meetings and one-on-one conversations with the SSOs and SOs on data call request.

o Track and report on data call responses at the requested frequency from management and on a weekly basis.

o Provide status metrics on data calls completion or pending actions.

o Assist in managing short-term turnaround data call request.

o Assist in the conduct of follow-ups on data calls request with SOs.

o Collaborate and assist in the preparation of briefings to be presented at different forums.

o Escalate non-responsiveness on Data Cal.

o Assist in communicating with stakeholders to ensure Data Call responses meets requested information and responses are provide by the requested due date.

o Provide support and policy guidance ensuring that SSOs and SOs clearly understands the request.

o Assist in ensuring that SSOs, system owner’s and their organization are appraised of the importance and status of ongoing actions such as data calls.

o Assist the SSOs to update data call requests responses from system owners.

o .

o Assist in data calls tracking and is updates.

o Assist in coordinating and working closely with the SSOs and SOs ensuring that data calls responses are appropriately documented and reviewed prior to submission.

o Assist in the establishment of communications via telecom with stakeholders to provide additional information or guidance on data call requests.

A.3.2.5 Audit Management Support (OPS Funded)

• Ensures that audits responses are submitted within the agreed upon or stipulated request dates.

o Assist in the coordination of gathering information and consolidates required information requested by the different auditors requester for submission.

o Review for completeness and accuracy all audit responses and if required communicates/collaborates with SSO and SO to ensure responses are complete.

o Assist, proactively, in providing guidance through meetings and one-on-one conversations with the SSOs and SOs on the request.

o Track and report on audits at the requested frequency from management and on a weekly basis o Provide status metrics on audits completion or pending actions.

o Assist in the conduct of follow-ups on audit request with System Owners.

o Collaborate and assist in the preparation of briefings to be presented at different forums o Escalate non-responsiveness for assistance.

o Assist in effectively communicating with stakeholders to ensure Audits responses meets requested information and responses are provide by the requested due date.

o Provide support and policy guidance ensuring that SSOs and SOs clearly understands the request.

o Assist in ensuring that SSOs, system owner’s and their organization are appraised of the importance and status of ongoing actions such as data calls.

o Assist the SSOs to update data call requests responses from system owners.

o Assists in the preparation of weekly status report. Report should include, but not limited to, all tasks completed and pending actions.

o Assist in coordinating and working closely with the SSOs and SOs ensuring that audits responses are appropriately documented and reviewed prior to submission.

o Assist in the establishment of communications via telecom with stakeholders to provide additional information or guidance on data call requests.

A.3.2.6 Standard Operating Procedures and Program Management Planning Support (OPS Funded)

The Contractor must:

• Assist in the development, review, and maintenance of NAS Cybersecurity Standard Operating Procedures (SOP) and processes (e.g., Engineering, Acquisition Management Systems (AMS), Joint Resource Council (JRC), and OIB).

• Establish and maintain on-line data repositories and reference libraries of program documentation that are accessible by authorized stakeholders.

• Assist in ensuring that Project Plans and SOPS associated with authorization and POA&M remediation are developed and tracked for completion.

• Track document reviews and responses and reports on status on all document reviewed within Team.

• Ensure that all PMPs and SOPs development are tracked, and progress is reported.

• Escalate to management if PMP, SOPs or policy development are not meeting delivery due dates.

• Ensure that all documents are posted in the ACG PC&G KSN site in their respective categories (PMPs, SOPs, Plans, Policies, etc.) and in the Approved Document repository folder.

• Assist in the development of weekly status report to management. Report should include, but not limited to, all tasks completed and pending actions.

• Collaborate in the assessment of new tools, that will facilitate the security documentation process and asset management.

A.3.2.7 Policy Management Support (OPS Funded)

• Support the development, publishing, and enforcement of ATO Cybersecurity policy.

• Support the integration of critical infrastructure industry best practices into ATO policy.

• Works closely with ACG team in the development of ATO cybersecurity policies or plans ensuring that:

o Policies are developed in a timely manner.

o Collaborative review is conducted.

o Development of briefings on the policy or plan to be presented to the ACG manager, Director, AODR and AO o Policy or plan is entered into the appropriate review and signature process.

• Ensure that internal/external policy and document reviews are completed by assigned due dates.

• Comments are collected and consolidated to represent Team response.

• Assist team members through the policy development process.

• Ensure that new policies enter the AGC process of review and concurrences.

• Track new ACG policies progress and report as it moves through the AGC process.

• Provide timely, concise and thorough document…