Attach 6-Task 5 - Cybersecurity Assessments.pdf

Information Technology Support Services

(ITSS)

Task Performance Work Statement (TPWS 5)

Cybersecurity Assessments

Enterprise Services Center (ESC)

6500 South MacArthur Boulevard

Oklahoma City, OK 73169

22 November 2022

Table of Contents Introduction and Overview

Background

Description of Work

Definitions/Acronyms

Performance Outcome(s)/Deliverable(s)

Reference Documents

TPWS Support Requirements

Place of Performance

Work Schedule (all Cybersecurity Shared Services Branch groups)

Training

Travel

Privacy and Security Requirements

Government Furnished Property

Government Surveillance – Inspection and Acceptance Criteria

Technical Exhibits

Task Performance Work Statement (TPWS) Cybersecurity Assessments

Task Reference: TPWS 5 – Cybersecurity Assessments Type: Firm-Fixed Price

Introduction and Overview The Enterprise Services Center (ESC) is a Federal Shared Service Provider (FSSP) committed to helping customers receive quality products and services in an effort to accomplish their mission objectives.

The ESC Cybersecurity Shared Services Center is a Department of Homeland Security (DHS), Cybersecurity & Infrastructure Security Agency (CISA) designated FSSP for risk management, providing independent and operational security services to assist clients with achieving Federal Information Security Management Act (FISMA) compliance. The ESC Cybersecurity FSSP is also a ISO 9001 and 17020 certified organization. Other services ESC provides to Federal customers include: security, re-authorizations, continuous monitoring assessments, contingency/disaster recovery planning, comprehensive system vulnerability scanning and Information Systems Security Officer (ISSO) services.

The Cybersecurity Assessment Services Group provides independent Cybersecurity Assessments and annual Continuous Monitoring Assessments to Federal agencies.

Background This task must provide personnel to perform cybersecurity assessments and related services for the Cybersecurity Assessment Services Group. The ESC Cybersecurity Assessment Services Group’s work products and processes leverage International Organization for Standardization (ISO 9001:2015 and 17020:2012, or current version) formats, with major processes optimized utilizing Lean Six Sigma principles.

Description of Work Cybersecurity Assessment Services Group

Tasks that Require Security Assessor Support:

The contractor must support Federal cybersecurity assessments using ESC standardized processes, reports and assessment tools. An ESC Assessment Team typically consists of a Federal Project Lead and one or more Contract Assessors that evaluate and test in-scope security controls. ESC expects that Contract Assessor support will be provided for project assignments up to the selected performance Tier.

Assessments must be performed using the guidance available for each Federal agency and within the timelines established in contractual agreements between ESC and the customer.

The government will convey, typically 3+ months in advance, the contract assistance needed on future assessment projects. The Contractor shall provide their Assessor assignments (i.e., names) minimally thirty (30) days in advance of a Project’s Kick- Off so the Government can perform project setup work. Contract Assessor support will be specifically for security control testing, not Reports generation. Reports are generated by the Federal Project Lead. Any deficiencies on contract deliverables noted during the Reports generation will be passed back to the support Contract Assessor for immediate resolution. The government will annotate on scheduling documentation (e.g., Scheduling Dashboard) the specific assistance required. This contract assistance will be identified in whole week intervals.

The contractor must be available to work on their assigned assessment project throughout the assessment Testing. In addition, contract support is expected to perform any re-work identified during the Peer, Clerical, Agency Subject Matter Expert (SME) and Test Director Review phases. Contract deliverables are graded at the Test Director Review phase.

Contract Assessors must have an Associate’s Degree (or higher) in an information technology related field or equivalent experience in the information technology/cybersecurity fields. Contract Assessors must have proficiency in the use of Microsoft Word, Excel, email and have the appropriate interpersonal skills and English (oral/written/typing) communication skills necessary to interact with Federal employees within the FAA and POC’s in other Federal agencies.

Contractors must be U.S. Citizens.

Definitions/Acronyms AMK-230 – Cybersecurity Shared Services Center AMK-232 – Cybersecurity Assessment Services AMK-234 – Cybersecurity Assessment Services Support CMA - Continuous Monitoring Assessment CMIS - Contract Management Information System COTS - Commercial off the shelf

CPARS - Contractor Performance Assessment Reporting System DOT - Department of Transportation ESC - Enterprise Services Center FAA - Federal Aviation Administration FIPS - Federal Information Processing Standards FISMA - Federal Information Security Management/Modernization Act(s) ISO – International Organization for Standardization ISSM - Information System Security Manager ISSO - Information System Security Officer IT - Information Technology MMAC - Mike Monroney Aeronautical Center NIST - National Institute of Standards and Technology PBC - Provided By Client SA - Security Authorizations and Recertifications Information System - Defined by NIST as a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. [Note: Information systems also include specialized systems such as industrial/process controls systems, telephone switching and private branch exchange (PBX) systems, and environmental control systems.]

Performance Outcome(s)/Deliverable(s)

5.1 Cybersecurity Assessment Services Outcomes/Tasks:

Outcome No. 1: Assessor Support on Cybersecurity Assessment Projects

5.1.1 Control Testing and Documentation of Assessment Results.

All assigned security controls must be assessed and the results documented in the ESC assessment tool within established timelines.

• Assessment Process Job Guide (50680)

• Contract Assessors must apply NIST, FIPS, and Agency specific policies, procedures, and guidance to the evaluation process and create system-specific, actionable findings and recommendations as appropriate.

• Contract Assessors must attend all project-related meetings at the Federal Project Lead’s invitation.

• Contract Assessors must report their testing progress to the Federal Project Lead at a minimum of weekly immediately prior to their departure for the weekend at the end of the business week.

Deliverables:

• Control test results documented in ESC’s assessment tool.

5.1.7 Tiers: Assessor Support on Cybersecurity Assessment Projects ( 5.1.1) Tiered Services represent the number of concurrent assessment projects for which Contract Assessor support is requested (e.g., some smaller-scoped projects may not require Contract Assessor support).

• Tier 1: Zero (0) concurrent project assignments

• Tier 2: Up to 6 concurrent project assignments

• Tier 3: Up to 8 concurrent project assignments

• Tier 4: Up to 10 concurrent project assignments

• Tier 5: Up to 18 concurrent project assignments

• Tier 6: Up to 22 concurrent project assignments

• Tier 7: Up to 26 concurrent project assignments

• Tier 8: Up to 30 concurrent project assignments

• Tier 9: Up to 34 concurrent project assignments

• Tier 10: Up to 38 concurrent project assignments

• Add-on (Small): +1 additional concurrent project assignments

• Add-on (Large): +3 additional concurrent project assignments

Project Concurrency example:

Sunday Monday Tuesday Wednesday Thursday Friday Saturday

Assessor 1 Project X

Assessor 2 Project X

Assessor 3 Project Y

Assessor 4 Project Z

In this example, three (3) distinct system projects have control testing occurring during this week. The government has requested Contract Assessor assistance on all three (3) of these projects; however, one of the projects requires two (2) Contract Assessors while the others require only a single Contract Assessor. In total for this example, four (4) concurrent project assessments are present.

The government will request support on a specified number of projects, up to the selected Performance Tier. The contractor will assign their personnel to specific projects, notifying the government of those assignments to facilitate Federal Project Leads integrating the Contract Assessor into project correspondence with ESC’s customers.

Reference Documents

Document No. Description Location

Internal Job Guides Job Guides outline procedures used to produce a standardized product designed to meet the customer satisfaction, ISO standards and compliance with agency regulations.

Shared Drive

DOT Order 1351.37 (current version)

U.S. Department of Transportation Departmental Cybersecurity Policy and Compendium

Shared Drive

NIST SP 800-115 (current version)

Technical Guide to Information Security Testing and Assessment

Current version available online at:

http://csrc.nist.gov/publications

NIST 800-137 (current version)

Information Security Continuous Monitoring for Federal Information Systems and Organizations

Current version available online at:

http://csrc.nist.gov/publications

NIST SP 800-34 (current version)

Contingency Planning Guide for Federal Information Systems

Current version available online at:

Federal Information Security Management Act (FISMA) of 2002 (or updated version)

FISMA assigns specific responsibilities to Federal Agencies, the National Institute of Standards and Technology (NIST) and the Office of Management and Budget (OMB) in order to

Available online http://csrc.nist.gov/publications strengthen the security posture of Federal systems.

Federal Information Security Modernization Act of 2014 (or updated version)

The Federal Information Security Modernization Act of 2014 (FISMA 2014) updates the Federal Government's cybersecurity practices

Available online

OMB Memorandum M-06-16 Protection of Sensitive Agency Information

Available online

Federal Information Processing Standards (FIPS) Publication 199

Standards for Security Categorization of Federal Information and Information Systems

Available online

Federal Information Processing Standards (FIPS) Publication 200

Minimum Security Requirements for Federal Information and Information Systems

Available online

NIST SP 800-53 (current version)

Security and Privacy Controls for Federal Information Systems and Organizations

Current version available online at:

http://csrc.nist.gov/publications

NIST SP 800-53A (current version)

Assessing Security and Privacy Controls in Information Systems and Organizations

Current version available online at:

http://csrc.nist.gov/publications

NIST SP 800-53B (current version)

Control Baselines for Information Systems and Organizations

Current version available online at:

http://csrc.nist.gov/publications

NIST SP 800-37 (current version)

Guide for Applying the Risk Management Framework to Federal Information Systems

Current version available online at:

http://csrc.nist.gov/publications

Assessment Process Job Guide (50680)

Assessment Process Shared Drive

Grading Criteria (5.1.1) Assessment Test Result Standards

Shared Drive http://csrc.nist.gov/publications http://csrc.nist.gov/publications

Office of Management and Budget (OMB) Circular A-

Management of Federal Information Resources

Available online

Contractor Performance Assessment Reporting System

(CPARS)

CPARS hosts a suite of web-enabled applications that are used to document contractor and grantee performance information that is required by Federal Regulations.

Available online https://www.cpars.gov/

TPWS Support Requirements Contractor must provide on-site support, unless the Government directs offsite work due to contingencies (e.g., pandemic, natural disaster, etc.). The contractor will provide a Task Lead or equivalent resource to perform the following functions:

a. Coordinating with the Federal COR on task issues/concerns;

b. Performing work on the task;

c. Providing on-the-job training (OJT) to new contract employees;

d. Managing and assigning work to contract employees;

f. Resolving disciplinary actions with contract employees;

g. Addressing disputes/customer complaints with COR;

h. Ensuring contract employee’s time is properly entered on in government contract labor and time (CMIS) system.

Place of Performance Contract services must be performed at the FAA’s Mike Monroney Aeronautical Center in Oklahoma City, OK. Exceptions may be granted for special circumstances (e.g., pandemic, natural disaster, weather related closures, etc.).

Telework:

Approval for teleworking Contractors under this TSOW will be considered on a case-by-case basis by the government. Said approval may be cancelled at the https://www.cpars.gov/ discretion of the government on a case-by-basis. Past approval is not an indication of future approval.

Approved teleworking Contractors would be expected to have reliable high-speed Internet access along with all other appropriate logistical and support features for an appropriate office setting. There will be no direct cost to the government for telework location support office items.

Approved teleworking Contractors may only work from the Continental United States (CONUS), Alaska or Hawaii. Use of third party Virtual Private Networking (VPN) to mask a teleworking Contractors actual remote work site is prohibited.

Downtime on a teleworking Contractor’s end (e.g., power outage, Internet outage or government-issued laptop) will not extend timelines for delivering control tests results. Physical proximity to Oklahoma City minimizes downtime as teleworking Contractors encountering issues may immediately go onsite to continue work.

Work Schedule (all Cybersecurity Shared Services Branch groups) Work hours must be between 0600 and 1800, U.S. Central time, Monday through Friday, five (5) days a week, with exceptions for Federal holidays and facility closures (unless personnel have been approved to Telework). ESC’s preference is that all contractors are ready to perform work at or before 0800 as a majority of ESC’s customers are located in the Eastern Time zone. Contractors are expected to be available to perform work during the core business hours between 0900 and 1430, with exceptions being made by the Contractor Task Lead, upon coordination with the Federal COR.

Training Reference PWS Section 2.12.

Travel No travel is authorized for this task.

Privacy and Security Requirements Contractors must meet personnel security/suitability sensitivity levels commensurate with their position sensitivity level and are subject to personnel investigation requirements (e.g., FAA Order 1600.1E & 1600.38F). Contractors must be U.S. Citizens. Contractors will be required to sign a Rules of Behavior statement. All data contractors have access to is sensitive and must not be disclosed outside the ESC Cybersecurity Shared Services Center.

Government Furnished Property Reference PWS Section 6.3.

Government Surveillance – Inspection and Acceptance Criteria The Government will evaluate the contractor’s performance on this task in accordance with the Technical Exhibits provided in Section 15.0 below.

The Quality Assurance Surveillance Plan (QASP) focuses on what the Government will do to ensure that the contractor has performed in accordance with the performance standards. It defines how to apply performance standards, the frequency of surveillance, and the minimum acceptable defect rate(s).

Disputes regarding grading must be submitted in writing to the COR within five (5) business days after a grade is issued.

Technical Exhibits Technical Exhibit 1 - Performance Requirements Summary

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Task Deliverable(s) Applicable Standard(s) Acceptable Quality Level(s) (AQL)

TPWS Paragraph 5.1.1

Assess assigned security controls and document the results in the ESC assessment tool within established timelines.

Control Testing must be performed IAW the following standards:

1. NIST Special Publications (800-series).

2. Assessment Process Job Guide (50680)

3. Customer and Agency specific policies, procedures and guides located within an accessible shared drive.

Timeliness:

The Contractor must assign Assessors to projects a minimum of thirty (30) calendar days prior to the beginning of testing.

Assessors must be present for the internal Project Kick-Off with the Test Director and the external Project Kick- Off with the customer, as these set the stage for understanding the scope of testing activities. Assessors must also attend other project-related meetings as scheduled by the Federal Project Lead.

ESC assessment tool populated with the assessment results for each assigned control by COB the last day of assessment testing.

Quality:

Acceptable quality, averaged across all projects for the reporting period, is 95%.

Reference TPWS 5.1.1 Grading Criteria (50668)