Attach 14-Task 12 Cybersecurity ISSO Support.pdf

Information Technology Support Services (ITSS)

Task Statement of Work

(TSOW 12)

Information Systems Security Officer

(ISSO) Support Enterprise Services Center

6500 South MacArthur Boulevard Oklahoma City, OK 73125 dated 15 Nov 2022

Statement of Work

Task Reference No.: Task 12 (previous contract Task 15)

Task Name: AMK-231 Information System Security Officer (ISSO) Support for the Enterprise Service Center, Office of Information Technology

Work Originator: Cybersecurity Support Services Section (AMK-231)

Task Type: Labor Hour

Period of Performance: April 1, 2022 – March 30, 2025

1.0 Introduction

1.1 Organization

• Identification Department of Transportation (DOT) Federal Aviation Administration (FAA) Mike Monroney Aeronautical Center (MMAC) Enterprise Services Center (ESC) Information & Digital Services (I&D) Division (AMK-200) Cybersecurity Services Branch (AMK-230) Cybersecurity Support Services Section (AMK-231)

• Mission

Providing professional and quality Cybersecurity services enabling our customers to achieve their business and mission goals.

2.0 Project Background and Objectives

Enterprise Services Center (ESC):

The Enterprise Services Center’s (ESC) Cybersecurity Services Branch is a Department of Homeland Security (DHS) Cybersecurity & Infrastructure Security Agency (CISA) vetted Federal Shared Services Provider (FSSP) under the Cyber Quality Services Management Organization (QSMO) program that delivers outsourcing solutions of Cybersecurity Services to a wide variety of clients across various agencies in the U.S. Federal Government.

AMK-231 - Cybersecurity Support Services Section:

ESC’s Cybersecurity Support Services Section (AMK-231) provides Cybersecurity Services and resources for user communities when information security needs and support services materialize. The services provided are part of life cycle management of information systems.

3.0 Scope of Work

3.1 Cybersecurity Support Services Section (AMK-231)

The primary goal of this ISSO support role is to assist federal information system owners in the interpretation of security policies and procedures as well as the development and maintenance of system security documentation including - but not limited to - System Security Plans (SSP), System Characterization Document (SCD), contingency planning and incident response documentation (e.g., Information System Contingency Plan (ISCP), ISCP Test Plan, ISCP Test After Action Report (AAR), Incident Response Plan), Account Management Plans, Configuration Management Plans, media handling documents and procedures, audit log monitoring procedures, privacy documents (e.g., Privacy Threshold Analysis/Assessment, and Privacy Impact Assessment), Interconnection/Information Exchange documents (e.g., Memorandums of Understanding (MOU), Memorandums of Agreement (MOA), Interconnection Security Agreements (ISA)), and other related system lifecycle support documents such as Security Impact Analysis or Risk Acceptances. Additionally, the ISSO support role assists system owners in performing periodic system documentation reviews to ensure the information system is A) compliant with existing security policies and procedures; B) documentation supports external audit/assessments (e.g., annual SOC1 and IG audits); C) documentation and artifacts are prepared and available for Continuous Monitoring Assessments (CMA) and Security Assessments (SA) in support of system authorization. ISSO support activities also include the creation/update/closure of Plans of Action and Milestones (POA&Ms) to address items identified during these engagements. ISSO support activity also includes the attending of meetings and reviewing of technical solutions to ensure security is appropriately considered. Ultimately, this role assists system owners in ensuring proper operational security posture is maintained to protect the information system, program, or designated IT asset(s) by serving as an adviser on all matters involving Cybersecurity.

4.0 Technical Requirements

The contractor will provide the level of support required by the Cybersecurity Support Services Section for ISSO support services on systems and/or teams as assigned. The work, which typically fluctuates depending on changing requirements and customer need as recorded in security policy and guides such as the U.S.

Department of Transportation Cybersecurity Compendium, Federal Aviation Administration Information Security and Privacy: FAA implementation of NIST Controls, Federal Aviation Administration Security Authorization (SA) Handbook, and the DOT Security Weakness Management Guide.

Milestones may overlap, run concurrently, and are tied to advertised project timelines and deadlines. Therefore, priority order and deadline alterations must be discussed with the contractor Task lead and coordinated with Federal staff on an ongoing basis.

4.1 Qualifications

Knowledge of and/or skills in the following areas are required:

• Cybersecurity o Understanding of business security practices and procedures.

o Knowledge of common operating systems.

o Knowledge of networking technologies.

o Ability to consolidate detailed information system security data into specified formats, statistical charts and graphs, and textual material for clarity.

o Knowledge of National Institute of Technology and Standards (NIST) publications and Federal Information Security Management Act (FISMA) requirements and how they apply to Information Systems.

o Ability to prepare and support information system authorization process by applying knowledge of the NIST Risk Management Framework (RMF) to include but not limited to 800-34, 800-37, 800-53, and 800-53A.

o Experience implementing and evaluating administrative security procedures, personnel security, security incident handling, security awareness and training.

o Knowledge of physical and logical access control best practices o Ability to plan, coordinate, schedule, and track security mitigation activities to completion.

o Experience with IT workflow management software.

o Ability to upload, monitor, and update documentation including Plan of

Actions and Milestones (POA&Ms) and Risk Assessments into a FISMA inventory system.

• Functional Skills o Aptitude to collaborate and communicate with a wide variety of individuals, both inside and outside the immediate organization, to obtain/share information, support audits, and implement security processes.

o Knowledge and training in SAFe Agile Framework.

o Proficiency in reviewing and modifying technical documentation o Skilled in conveying complex programs and policies in an objective manner consistent with the targeted audience o By using excellent human relation skills, ISSO Support is expected to communicate the cybersecurity requirements to a community of diverse backgrounds and Information Technology expertise o Outstanding time management skills are required to balance multiple time sensitive tasks o Experience with Microsoft Office tools is required

5.0 Deliverables

5.1 AMK-231 ISSO Support (Labor Hour)

• ISSO Support will be assigned to multiple systems and a functional team listed further below:

o Participate in vulnerability, risk and threat assessments, and other activities for analyzing the risk for information systems and assist with recommending suitable measures to manage those risks (as assigned and within expiration date).

o Assist system owners in maintaining annual authorization packages for assigned systems, including managing and controlling changes to the system and assessing the security impact of those changes (within deadline, i.e., package expiration date).

o Assist system owners in evaluating the technical accuracy and completeness of a system’s Security documents (e.g., SSP, SCD, PTA, PIA, AMP, CMP, MOU, ISA, Audit and Media Handling Procedures).

o Assist system owners in evaluating existing or new security requirements to include presenting findings/observations in an open forum for other team members.

o Report to Information System Security Manager (ISSM) or Information System Owner (ISO) any unauthorized access, identified system failures, or suspected defects that could lead to an unauthorized disclosure, loss of integrity, or loss of system availability (within 1 hour).

o Create, review, update and/or submit for closure Plan of Action and Milestones (POA&Ms) per NIST, the DOT Security Weakness Management Guide, FAA Order 1370.121, and the AMK-231 POA&M Process Job Guide.

o Acknowledge ad hoc requests within 1 day and work with teams’ schedule to meet customers' requirements (e.g., participate in ISS compliance reviews/data calls, vulnerability, threat, and risk assessments on server scans, PBC tracker requests, respond to Information Technology Service Management (ITSM) tickets, customer consultation requests, meetings with internal ISSOs, respond to inquiries regarding cyber incidents which impact the assigned information systems, varying writing assignments, status reports, and other administrative security procedures).

o Coordinate with appropriate functional team to perform various ISSO duties.

• Functional team deliverables described below:

o Interface and Privacy Agreements Team

Review system interconnection documentation (e.g., MOU, ISA, SSP) for accuracy and completeness annually per NIST SP 800-47, Managing the Security of Information Exchanges, and coordinate recommended changes between SMEs and Approval Authority.

Review, privacy related documentation (e.g., PTA, PIA, SORN, SSP) for accuracy and completeness. Provide guidance to ISSOs and coordinate changes recommended by the FAA/DOT Privacy Officer.

Document, submit for approval, and track system interconnections and privacy agreements.

Participate in DOT MOU Policy working group.

Participate and perform Privacy Risk Assessments.

Provide support services for SORN completion.

o Information Assurance Team

Actively participate in Scaled Agile Framework (SAFe) events and activities as a representative of AMK-231. This would include, but is not limited to, Program Increment (PI) Planning events, weekly Agile Release Train (ART) team sync meetings, and coordinating the completion of cybersecurity documentation and requirements (ex.

POA&Ms, SIAs) between SAFe SMEs and ISSOs teams.

Review SIAs for completeness and accuracy, and track SIAs until approval/completion.

Document and track data calls.

o Contingency Planning Team

Develop, validate, and maintain information system contingency plans and procedures for assigned information systems and their components based on guidelines contained in NIST SP 800-34 and using existing templates.

Plan, coordinate, evaluate, and facilitate the testing of assigned information system contingency plans (classroom or functional) and document test results using existing templates and include in the information system assessment package (within deadline, i.e., prior to annual assessment start date).

Provide advice in the development of Business Impact Analysis (BIA) and the contingency test plan (annually for all systems assigned and prior to expiration date).

o Vulnerability Management Team

Review POA&Ms submitted for closure for completeness and accuracy; provide feedback as necessary to ISSOs if corrections are needed.

Submit reviewed POA&Ms for closure to appropriate entity (ISSM, IV&V) and update POA&M Summary Worksheet.

Run Weekly and Monthly Trending CSAM POA&M Reports to document and track POA&M progress and portfolio risk analysis for senior leadership per AMK-231 POA&M Reports Job Guide.

Act as a liaison during assessments per AMK-231 Assessment Support Guide.

o Configuration Management Team

Reviews SSPs for accuracy and completeness; provides feedback to

ISSO team for corrective action.

Reviews external security documentation (e.g., SCD, CMP, Media

Handling Procedures, Audit Log Monitoring Procedures, AMP, Architecture Diagrams) for accuracy and completeness; provides feedback to ISSO team for corrective action.

Uploads SSP control implementation statements into appropriate FISMA record (e.g., CSAM).

NOTE: All training and testing will be completed annually. All required security documentation will be included with the SSP and updated at least once per calendar year by dates dictated by AMK-231 project plans and/or assessment milestone dates.

Continuous quality and consistency reviews will be performed, and changes will be performed no less than annually and in accordance with the Department of Transportation Office of Inspector General annual audits. Notice of Findings Reports

(NFR) status with plans for resolution will be reviewed at least annually. Plan of Action and Milestones will be reviewed and updated at least quarterly.

6.0 Reporting Requirements

Technical progress review meetings will be conducted between the Government Project Manager and the contractor representative as needed.

7.0 Travel and Per Diem

Travel may be required for this task. All travel will be coordinated and approved in advance by the Contracting Officer in accordance with the terms and conditions of the contract.

8.0 Government Furnished Services

The FAA will give contractor personnel access to its facilities during normal duty hours during the duration of this task. The contractor's use of these facilities must be directly associated with the task accomplishments. The FAA will provide desk space, computer, and phone service for the contractor's use associated with task accomplishment. Tools, Software and COTS vulnerability scanners utilized are currently licensed by ESC. The task shall be performed on site at the following government installation for the FAA ESC:

FAA Mike Monroney Aeronautical Center 6500 S MacArthur Blvd.

Oklahoma City, Oklahoma 73169

9.0 Telework

Approval for teleworking Contractors under this TSOW will be considered on a case-by-case basis by the government. Said approval may be cancelled at the discretion of the government on a case-by-basis. Past approval is not an indication of future approval.

Approved teleworking Contractors would be expected to have reliable high-speed Internet access along with all other appropriate logistical and support features for an appropriate office setting. There will be no direct cost to the government for telework location support office items.

Approved teleworking Contractors may only work from the CONUS, Alaska or Hawaii. Use of third party Virtual Private Networking (VPN) to mask a teleworking Contractors actual remote work site is prohibited.

Downtime on a teleworking Contractor’s end (e.g., power outage, Internet outage or government-issued laptop) is not billable to the government. Physical proximity to

Oklahoma City minimizes downtime as teleworking Contractors encountering issues may immediately go onsite to continue work.

10.0 Hours of Work

Services are to be performed on-site, or via approved telework, Monday through Friday (excluding federal holidays and facility closures) between the operating hours of 0600 to 1800 CT. Contract personnel shall work forty (40) hours each week.

11.0 Security and Privacy

Contractors shall comply with all applicable DOT, FAA, and local directives while performing work under this task.

System Data is considered Sensitive Information and reporting is protected in accordance with OMB guidance.

The contractor may be asked to sign a non-disclosure statement.

The ISSO Support contractors will have a Moderate Risk Level on this contract.

12.0 Standards and References

Documentation will comply with FISMA requirements and DOT, FAA, and NIST standards.