Attach 5-Task 4 - Tech Typist Pool11-22-2022.pdf

Information Technology Support Services (ITSS)

Task Statement of Work

(TSOW 4)

Technical Typist Support

22 November 2022

Enterprise Services Center 6500 South MacArthur Boulevard

Oklahoma City, OK 73125

Statement of Work

Task Reference No.: Task 4

Task Name: Technical Typist Support for all sections within the AMK-230 Cyber Security Services Branch for the Enterprise Services Center (ESC).

Work Originator: All Sections beneath AMK-230, which includes AMK-231 Cybersecurity Support Services Section, AMK-232/234 Cybersecurity Assessment Sections, the AMK-233 Cybersecurity Vulnerability Assessment Section, and any offices that may be created in the future under AMK-230.

Task Type: Labor Hour

Period of Performance: April 1, 2024 – March 31, 2025

1.0 Introduction

1.1 Organization

• Identification Department of Transportation (DOT) Federal Aviation Administration (FAA) Mike Monroney Aeronautical Center (MMAC) Enterprise Services Center (ESC) Information & Digital Services Division (AMK-200) Cyber Security Services Branch (AMK-230)

• FAA Mission

This administration provides for the regulation and promotion of civil aviation to better foster the development and safety and provide for the safe and efficient use of airspace.

2.0 Project Background and Objectives

Enterprise Services Center (ESC):

The Enterprise Services Center (ESC) organization is a U.S. Department of Homeland Security (DHS) accredited shared service provider that delivers Fed-to- Fed cybersecurity services to a broad spectrum of agencies in the U.S. Federal Government. Contract support personnel must be United States Citizens.

3.0 Scope of Work

Technical Typists for this task shall have the appropriate interpersonal skills and English (oral/written/typing) communication skills necessary to interact with Federal and contract employees within the FAA and other Federal agencies.

Contract support shall be proficient in the use of Microsoft Office’s Word and Excel and possess experience utilizing an electronic mail (e-mail) program for correspondence.

4.0 Technical Requirements

Milestones may overlap, run concurrently, and may be tied to advertised project timelines and deadlines. Therefore, priority order and deadline alterations must be discussed with the contractor Task Lead and coordinated with Federal staff on an ongoing basis.

5.0 Tasks that Require Contract Clerical Support include:

5.1 Clerical Reviews:

• The contractor must perform clerical reviews on assigned cybersecurity work products within the defined timelines.

• Reviews will entail comprehensive evaluation of and feedback on spelling/grammar/formatting. Some work products have associated checklists to assist in this endeavor.

o Deliverables:

Assessment Packages:

• Completed Clerical Review Checklist (or equivalent in toolsets) for each project

System Security Plan (SSP) reviews:

• Updated file with tracked changes and comments (per review checklists) Other types of documentation (e.g., Memos, Analyses, Plans, Reports, Waivers):

• As defined in tasking

• Refer to applicable process guides and review checklists made available to Contractor in a centralized ISO Official Documents repository o Timeliness:

Assessment Packages:

• One (1) business day System Security Plan (SSP) reviews:

• Three (3) to five (5) business days; as defined in tasking

(determined by system complexity) Other types of documentation (e.g., Memos, Analyses, Plans, Reports):

• As defined in tasking

• Where appropriate, the Contractor may be required to convert draft documents into standardized/final formats (e.g., converting Microsoft Word files to PDF) o Deliverables:

Finalized documents o Timeliness:

One (1) business day

5.2 Provided by Client (PBC) Population:

• The contractor must populate project artifact placeholders

(Provided by Client; PBC) into online systems, for applicable assessment projects, prior to the start of assessments. The number of applicable assessment projects requiring PBC placeholder creation is on the decline with the increased utilization of FISMA systems for secure file sharing.

o Deliverables:

Refer to Customer/Agency specific guidance and templates.

Create PBC placeholder entries.

Notify the Federal Project Lead upon completion.

As requested by Federal Project Leads, download customer PBC submittals from the customer’s FISMA reporting system.

o Timeliness:

For applicable projects, create the PBC placeholder assignment no later than three (3) weeks prior to the first day of testing.

PBC placeholders may be created well in advance of an upcoming assessment project.

5.3 FISMA Reporting System Data Population/Pulls:

In coordination with designated Federal personnel, the Tech Typists must populate customer FISMA reporting systems (e.g., CSAM, Xacta, Archangel, etc.) with assessment results following approval to do so. As requested, pull download assessment-related documentation from the FISMA reporting systems.

o Deliverables:

Accurately cut-and-pasted assessment content.

o Timeliness:

Complete data population of each package within three (3) business days of request. Inquire with the government of alternative completion timelines if there is a temporary spike in workload.

Requests for data pulls should be completed within one (1) business day.

5.4 Workflow Tracking:

The contractor must log and track activities for workflows associated with:

o Independent Verification and Validation (IV&V) submittals Deliverables:

• Populate IV&V Tracking Log

• If appropriate, pull artifacts for the IV&V from the customer’s FISMA system

• E-Mail notifications to IV&V assignees

• E-Mail notifications and/or status update requests to submittal stakeholders

• Refer to IV&V Closure Validation Process (50421), or equivalent, for applicable process and for specific roles delineation.

Timeliness:

• Within one (1) hour of receipt during normal business hours:

o Update IV&V tracking log o Submit email notification to an available Assessor in the IV&V pool regarding the IV&V assignment and the location of the IV&V artifacts pulled from the customer’s FISMA system.

o Proposed Risk Acceptances (RA), proposed Deadline Extensions (DE), Inventory Change Requests (ICR), software waivers, and System Accreditation Package routing and reporting.

Deliverables:

• Entries made in the appropriate logging tool.

• Status update reports to be delivered weekly and ad hoc as requested.

• E-Mail notifications and/or status update requests to submittal stakeholders

• E-Mail distribution of items requiring stakeholder review or response

Timeliness:

• Entries:

o One (1) business day

• Reports/Notifications:

o On requested frequency (e.g., weekly, monthly, etc.)

5.5 Meeting Requests:

Meeting Invites:

The contractor must create calendar invites and manage meeting reoccurrence (normally 6-10 meetings per month) within the Government-provided e-mail and calendaring system. Ensure invitees are available and that proposed meeting location (when applicable) is unoccupied.

Electronic calendar invites must be sent for each meeting scheduled.

Deliverables:

• Calendar Invites for the meetings with attached Agenda (when provided by Federal employees)

Timeliness:

• Schedule within one (1) business day

Meeting Minutes:

o The contractor must take meeting minutes for meetings as required (normally 6-10 meetings per month).

Minutes are to be archived in the requested format/location and personnel notified of the availability. The Contractor may also be asked to setup meetings for which they will not be in attendance; minutes are not required for these engagements (normally 6-10 meetings per month).

Deliverables:

• Minutes for the meetings (when requested to attend)

• Some Minutes, especially those wherein technical discussion ensued, may be initially submitted to the Federal POC in draft form for review/feedback prior to publishing.

Timeliness:

• One (1) business day following conclusion of the meeting.

5.6 Other Services/Requirements:

The contractor must answer general office phone lines, forward calls and/or take messages as requested. Administrative support personnel must have proficiency in the use of Microsoft Word, Excel, Teams, email and have the appropriate interpersonal skills and English (oral/written/typing) communication skills necessary to interact with Federal employees and occasional Federal customers. Distribute outgoing correspondence within time frames appropriate for priority (e.g., routine – same day, critical/overnight – as identified by requestor).

Meet deadlines for response to ad hoc data calls and reports. Data calls and reports are directly related to information the Tech Typist Pool is already tracking.

6.0 Reporting Requirements

Technical progress review meetings will be conducted between the Government Project Manager, Government Contracting Officer Representatives (COR) and the vendor (contractor) representatives as needed.

7.0 Travel

7.1 Travel and Per Diem

Travel will not be required for this task.

8.0 Government Furnished Services

The FAA will give contractor personnel access to its facilities during normal duty hours during the duration of this task. The contractor's use of these facilities must be directly associated with the task accomplishments. The FAA will provide desk space, computer, and phone service for the contractor's use associated with task accomplishment. Tools and COTS Software are currently licensed by ESC. The task shall be performed on site at the following government installation for the FAA ESC:

FAA Mike Monroney Aeronautical Center 6500 S MacArthur Blvd.

Oklahoma City, Oklahoma 73169

9.0 Telework

Approval for teleworking Contractors under this TSOW will be considered on a case-by-case basis by the government. Said approval may be cancelled at the discretion of the government on a case-by-basis. Past approval is not an indication of future approval.

Approved teleworking Contractors would be expected to have reliable high-speed Internet access along with all other appropriate logistical and support features for an appropriate office setting. There will be no direct cost to the government for telework location support office items.

Approved teleworking Contractors may only work from the CONUS, Alaska or Hawaii.

Use of third party Virtual Private Networking (VPN) to mask a teleworking Contractors actual remote work site is prohibited.

Downtime on a teleworking Contractor’s end (e.g., power outage, Internet outage or government-issued laptop) is not billable to the government. Physical proximity to Oklahoma City minimizes downtime as teleworking Contractors encountering issues may immediately go onsite to continue work.

10.0 Hours of Work

Services are to be performed on-site, or via approved telework, Monday through Friday (excluding federal holidays and facility closures) between the operating hours of 0600 to 1800 CT. Contract personnel shall work forty (40) hours each week.

11.0 Security and Privacy

Contractors shall comply with all applicable DOT, FAA, and local directives while performing work under this task.

System Data is considered Sensitive Information and reporting is protected in accordance with OMB guidance.

The contractor may be asked to sign a non-disclosure statement.

The Tech Typist contractors will have a Low Risk Level on this contract.

12.0 Standards and References

Documentation will comply with commonly accepted professional English writing standards.

Cybersecurity Assessment Group reviews performed under this Task will leverage government-provided Clerical Review Checklists.