Attach 8-Task 6 Cybersecurity Vulnerability Scanning .pdf

Information Technology Support Services (ITSS)

Task Performance Work Statement

(TSOW 6)

Cybersecurity Vulnerability Assessments Section Scanning

Enterprise Services Center 6500 South MacArthur Boulevard

Oklahoma City, OK 73125

22 November 2022

Table of Contents

1.0 Introduction and Overview

2.0 Background

3.0 Description of Work

4.0 Definitions/Acronyms

5.0 Performance Outcome(s)/Deliverable(s)

6.0 Reference Documents

7.0 TPWS Support Requirements

8.0 Place of Performance

9.0 Work Schedule (For all Cybersecurity Services Branch groups) ....................... Error! Bookmark not defined.

10.0 Training

11.0 Travel

12.0 Privacy and Security Requirements

13.0 Government Furnished Property

14.0 Government Surveillance - Inspection and Acceptance Criteria

15.0 Technical Exhibits:

Task Performance Work Statement (TPWS) Cybersecurity Vulnerability Assessments Section Scanning

Task Reference: TPWS 6 – Cybersecurity Vulnerability Assessments Section Scanning (previous contract Task 21) Type: Firm-Fixed Price Work Originator: Cybersecurity Vulnerability Assessments Section (AMK-233) Period of Performance: April 1, 2022 – March 30, 2025

Introduction and Overview The Enterprise Services Center’s (ESC) Cybersecurity Services Branch is a Department of Homeland Security (DHS) Cybersecurity & Infrastructure Security Agency (CISA) vetted Federal Shared Services Provider (FSSP) under the Cyber Quality Services Management Organization (QSMO) program that delivers outsourcing solutions of Cybersecurity Services to a wide variety of clients across various agencies in the U.S. Federal Government.

The Cybersecurity Vulnerability Assessments Section provides vulnerability scanning for operating systems, databases, and web applications along with patch management.

Background

Since ESC’s January 2009 designation by the Office of Management and Budget (OMB) as a Shared Services Center for Information Security Services, requests for service has grown dramatically. Cybersecurity Services Branch security compliance reviews assist Federal agencies in meeting their Federal Information Security Management Act (FISMA) obligations.

Cybersecurity Vulnerability Assessments Section:

The Cybersecurity Vulnerability Assessments Section is divided into specialized teams to support internal and external customers. Each team possesses a different skillset for vulnerability scanning of operating systems, databases and web applications.

The task must provide Compliance and Patch Management Reporting for the Cybersecurity Vulnerability Assessments Section. Additional services may include conducting briefings and presentations, and/or acting as a technical advisor at high-level government meetings.

Description of Work Cybersecurity Vulnerability Assessments Section

Information System Compliance Reports The primary goal of reporting and compliance is to provide information to decision makers to ensure each agency safeguards information systems and networks with appropriate security defenses. The submission of deliverables allows the Authorizing Official (AO) to evaluate the risks of the information system. Each scan requires development of a result report to present findings that are used to assess the health and security posture of the system and to assist in reducing cybersecurity risks.

The contractor must develop and produce system compliance reports for each type of scan that is performed on a system. System compliance reports must be created within two business days from the day the scans have been completed and all scan files have been posted with the contractors being notified of scans’ completion. Contractor may produce up to six compliance reports for each system.

The following must be included in each of the system compliance reports:

a. A Compliance Chart - Compliance tracking involves data generated by vulnerability scans over time. Compliance charts are generated to comply with federal regulations, prioritize patching efforts and track the age of vulnerabilities identified by the different monthly system scans. The 7, 30, 60, and 90 day time limits to mitigate weaknesses are established by the U.S. Department of Transportation (DoT) Departmental Cybersecurity Compendium and FedRamp requirements.

b. Details of identified finding – To assist in the prioritizing of patching or selecting a mitigation path; the details from the particular system scan can provide information about the findings. The detail should include the date of when the findings were first discovered and how many days old the findings are.

The contractor will maintain the Microsoft SQL Server queries to ensure that the data collected for the system compliance reports is valid and accurate. In addition, the contractor must maintain any .NET custom program developed to facilitate the creation of the system compliance reports. The contractor may only be allowed to perform eight (8) modifications a month to the custom program and disease. All modifications must be stored in the code repository and on the local file storage.

When an error is discovered in the standard system reports; the contractor must remediate the error within 40 business hours of receiving the error notification.

Standard System Reports Standard System Reports are produced to establish compliance with federal security regulations, guidelines, laws and agency security requirements. Scan reports are created when the scans have completed or on an as requested basis as a part of the continuous monitoring program and annual security control assessments on the information systems. Reports are broken down by operating systems, databases and web applications. Standard system reports are created for both internal systems and for external system engagements. Standard system reports are include in Vulnerability Assessment packages along with a Scanning Executive Summary.

Internal Standard System Reports Includes:

• Vulnerability Summary Reports per Operating Systems (Linux, Windows, Solaris)

• Vulnerability Summary Reports for Databases

• Vulnerability Summary Reports for each Web Application

External Standard System Reports Include:

• Vulnerability Details and Summary Reports per Operating Systems (Linux, Windows, Solaris)

• Vulnerability Details and Summary Reports for each Database

• Vulnerability Details and Summary Reports for each Web Application

All scan findings are documented and each unique vulnerability is tracked with the Microsoft SQL Server. Reports will rank detected vulnerabilities with a score of critical, high, medium, and low (as supported by the scanning tools) to support prioritization of remediation efforts.

The contractor must produce the standard system reports by developing and maintaining Microsoft SQL Server queries and .NET based custom programs as scanning teams request to summarize verbose findings from scanning tools. When an error is discovered in the standard system reports;

the contractor must remediate the error within 40 business hours of receiving the error notification.

Contractors must produces reports that require vulnerability analysis comments in an editable format such as MS Word document to allow the scanning team engagement members to supply the comments. All final reports are generated in PDF format and sent to the customers by the Government. Raw Reports are available in the following formats: PDF, HTML, CSV, and XML.

Deliverables are provided to the Data Owner or to the appointed recipient who works with the System Owners (SO) to remediate of weaknesses within the established time constraints by the method the data owner has requested.

FedRamp Scanning and Assessment Reports FedRamp provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by the US government. As an accredited FedRamp Third Party Assessment Organizations (3PAOs), we perform the initial and periodic assessments of cloud systems to ensure Cloud Service Provider’s (CSPs) meet FedRamp security requirements. As part of the 3PAO assessment team, we perform the vulnerability scanning services. FedRamp assessments require specific document to be include in the FedRamp assessment package at the time of completion. These templates are the Security Assessment Plan (SAP) and the Security Assessment Report (SAR) which completed jointly between the assessment team and the scanning team. The scanning team in addition to these also provides vulnerability scanning reports (which includes all the reports in the External Standard System Reports).

The contractor must assist in the creation of the Scanning reports. The contractor must validate all data entered into the report prior to providing the reports back to the scanning team selected for the FedRamp assessment. The scanning team will complete the reports with technical comments and other required information unknown to the contractor.

Ad-Hoc Reports, Customized Reports and Presentations Customers may ask for customized reports to further analyze their security position and interpret the data from the raw reports. Ad-Hoc/Custom scanning reports can be created based off of the type. (E.g. Operating Systems, Web Applications, Databases) Compliance or Standard Reports to provide a better comprehensive of the scan data and may vary in complexity depending on customization requested. Additional Graphs, charts, and diagrams to present the scan data and show evidence of patching and improvements are some examples of requests that come from the customer.

The contractor must create customized reports and presentations for customers that request these presentations on a monthly basis. The reports and presentations identify unique vulnerabilities. It is a 90 day comparison and is used to determine progress, historical elements, and show how the controls were managed over time.

The contractor must create customized presentations to support customers and government management. These presentation will include visual representation of overdue vulnerabilities and system’s vulnerability compliance status with the DOT compendium requirements. These presentations may include but are not limited to including: a list of vulnerabilities that have exceeded the mitigation requires from the DOT compendium, a patching metrics, and/or status of scans completed for each system.

In addition, customers may request a one-time report to collect information on a specific vulnerability or issue. These report are normally based off an agency wide data-call to report a specific vulnerability and how many of the vulnerability in question to DHS for high risk vulnerability.

The contractor must develop customized queries to collect and valid system data from regular system scans. The contractor must build a report from the collect data to be sent back to the customer making the request.

Education and Experience Requirements Contract support should have proficiency in the use of Microsoft Office products and e-mail processing. Contract support should possess a Bachelor’s Degree in an information technology related field or experience in information technology or information security field. Contract support should have basic knowledge with Microsoft SQL Server development and development work with .NET languages like Visual Basics and C#. Contract support should have the appropriate interpersonal skills and English (oral/written/typing) communication skills necessary to interact with Federal employees within the FAA and other Federal agencies.

Definitions/Acronyms

AMK-230 – Cybersecurity Services Branch AMK-232 – Cybersecurity Assessment Section AMK-233 - Cybersecurity Vulnerability Assessments Section AMK-234 - Cybersecurity Assessment Services Support Section CMA - Continuous Monitoring Assessments CMIS – Contract Management Information System COTS - Commercial off the shelf CPARS - Contractor Performance Assessment Reporting System CSMC - Cyber Security Management Center DOT - Department of Transportation ESC - Enterprise Services Center ES3 - External IS3 Website FAA - Federal Aviation Administration FIPS - Federal Information Processing Standards FISMA - Federal Information Security Management Act (2002) IS3 –Information System Security Services Website (Intranet) ISO – International Organization for Standardization ISSM - Information System Security Manager ISSO - Information System Security Officer IT - Information Technology MMAC - Mike Monroney Aeronautical Center) NIST - National Institute of Standards and Technology PBC - Provided By Client (PBC) tracker repository PL – Project Lead OIT - Office of Information Technology SA - System Administrator SA - Security Authorizations and Recertification’s SBCC - Security Baseline Configuration Checklists SO - System Owner SP - Special Publications (NIST) Information System - define by NIST as a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. [Note: Information systems also include specialized systems such as industrial/process controls systems, telephone switching and private branch exchange (PBX) systems, and environmental control systems.] Custom Program Modifications – are changes that add additional user interface functionality or a change to SQL query’s to where original output data is including different/excluding data or creating new SQL queries for new reports.

Administrative Changes – are changes that does not affect data being reported or modifying the users interface.

Examples of administrative changes are like changing a database name, migrating scan data from one database to another database, or updating a query to pull correct data.

Performance Outcome(s)/Deliverable(s)

Cyber Security Vulnerability Assessments Section Outcomes/Tasks:

Outcome No. 1: Provide Compliance and Patch Reporting Services

Information system scanning reports involves developing monthly scanning reports to establish and track the age of scanning findings identified during monthly system scans and provide crisp and clean views of the scanning findings that can be easily understood by the information systems’ technical staff. System Owners are required by federal guidelines, established by the U.S. Department of Transportation Departmental Cybersecurity Compendium and FedRamp requirements, to patch and remediate identified vulnerabilities within a specified time frame based on the ranking category of critical, high, medium, and low. Any item not patched and remediated within the specified time frames is considered past due and will be identified in a system compliance report. Plan of Action and Milestones (POA&Ms) will be created and tracked for overdue vulnerabilities until the requirements are met and the POA&M is closed. Activities seek to improve the federal government’s security posture and promote a healthy, secure, and resilient IT infrastructure by proactively identifying and reporting on vulnerabilities and configurations issues present on federal hosts before those vulnerabilities can be exploited.

Task 1: Information System Compliance Reports Scan findings from operating system, database, web application, and configuration baselines are tracked on a monthly or bi-weekly or weekly basis using the current reporting tools. Scan data for each tool is imported and maintained as needed. System compliance reports are generated monthly from the in-house solutions. After scan findings are imported, using the in-house reporting tools, the system compliance report created. At established or ad hoc times the system compliance report is generated and provided to ISSO’s, ISSM, SO’s, Assessors, and Management. Reports are generated to show findings that are past due. POA&Ms are created in the designated repository system on all past due findings. As changes to the status occur, the POA&M is updated and logged. When the requirements have been met for closure, the POA&M is closed in the system repository.

a. Deliverable(s): Contractor must produce system compliance reports (to include, but not exclusive of, past due items and scan data monitoring) for each scan type.

Task 2: Internal System Standard Reports Scan data from operating system, database, and web application are imported on a monthly or bi-weekly or weekly basis using the current reporting tools. Scan data for each tool is imported and maintained as needed.

After the scan data is imported, using the in-house reporting tools, the summary reports of the standard system report grouping are created. Standard system reports are generated at least monthly from the in-house solutions. Standard system reports may include reports will be created per established requirements in the system agreement.

a. Deliverable(s):

1. Summary Reports per Operating System Grouping (Linux, Windows, Solaris)

2. Summary Report for System Databases

3. Summary Report for each Web Application

Task 2: External System Standard Reports and FedRamp Reports

Scan data from an operating system, database, and web application are imported during the established engagement with the external information system/FedRamp system using the current reporting tools. Scan data for each tool is imported and maintained as needed. After the scan data is imported, using the in-house reporting tools, the summary and detail reports of the standard system report grouping are created. Standard system reports will be created per established requirements in the system agreement. Standard system reports will be delivered back to the scanning team that provided the raw scanning data for them to review and completed as necessary.

b. Deliverable(s):

4. Scan reports per Operating System Grouping (Linux, Windows, Solaris)

5. Scan reports for each Database

6. Scan reports for each Web Application

Tiers: Cyber Security Vulnerability Assessments Section Tiered Services are monthly estimates that represent the number of systems and reports that will have monthly reports generated for.

Tier 1: Zero Systems for Compliance Reports with Zero Standard System Reports, FedRamp Reports, and up to 0 Ad-Hoc Reports per Month Tier 2: Up to 12 Systems for Compliance Reports with a 130 Standard System Reports, FedRamp Reports, and Ad-Hoc Reports per Month Tier 3: Up to 24 Systems for Compliance Reports with a 250 Standard System Reports, FedRamp Reports, and Ad-Hoc Reports per Month Tier 4: Up to 36 Systems for Compliance Reports with a 370 Standard System Reports, FedRamp Reports, and Ad-Hoc Reports per Month Tier 5: Up to 48 Systems for Compliance Reports with a 490 Standard System Reports, FedRamp Reports, and Ad-Hoc Reports per Month Tier 6: Up to 60 Systems for Compliance Reports with a 610 Standard System Reports, FedRamp Reports, and Ad-Hoc Reports per Month Tier 7: Up to 72 Systems for Compliance Reports with a, 730 Standard System Reports, FedRamp Reports, and Ad-Hoc Reports per Month Add-on (Small): 12 Additional Systems for Compliance Reports with a 120 Additional Standard System Reports, FedRamp Reports, and Ad-Hoc Reports per Month Add-on (Large): 36 Additional Systems for Compliance Reports with a 360 Additional Standard System Reports, FedRamp Reports, and Ad-Hoc Reports per Month

Reference Documents Document No. Description Distribution

Internal Job Guides Job Guides outline scan functions and configuration settings used to produce a standardized product designed to meet the customer satisfaction, ISO standards and compliance with agency regulations.

Available at time of award

U.S. Department of Transportation Departmental Cybersecurity Compendium

Available at time of award

NIST 800-137 Information Security Continuous Monitoring for Federal Information Systems and Organizations

Available online http://csrc.nist.gov/publications

NIST SP 800-34 Contingency Planning Guide for Federal Information Systems

Federal Information Security Management Act (FISMA) of 2002 (or updated version)

FISMA assigns specific responsibilities to Federal Agencies, the National Institute of Standards and Technology (NIST) and the Office of Management and Budget (OMB) in order to strengthen information security systems.

Available online

Federal Information Security Modernization Act of 2014 (or updated version)

Available online

OMB Memorandum M-06-16 Protection of Sensitive Agency Information

Available online

Federal Information Processing Standards (FIPS) Publication 199

Standards for Security Categorization of Federal Information and Information Systems

Document No. Description Distribution

Federal Information Processing Standards (FIPS) Publication 200

Minimum Security Requirements for Federal Information and Information Systems

Available online

NIST SP 800-53 (current version) Security and Privacy Controls for Federal Information Systems and Organizations

Available online http://csrc.nist.gov/publications

NIST SP 800-53A (current version)

Assessing Security and Privacy Controls in Federal Information Systems and Organizations - Building Effective Assessment Plans

Available online http://csrc.nist.gov/publications

NIST SP 800-37 (current version) Guide for Applying the Risk Management Framework to Federal Information Systems

Available online http://csrc.nist.gov/publications

AMKWI-230-50001 Assessment Process (current version)

ISO Work Instruction – Assessment Process

Available when needed

Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources

Available online

Contractor Performance Assessment Reporting System

CPARS)

CPARS hosts a suite of web-enabled applications that are used to document contractor and grantee performance information that is required by Federal Regulations.

Available online https://www.cpars.gov/

FedRamp Assessment Documents FedRamp standardizes the Federal Government’s requirements and approach to security assessment, authorization, and monitoring of cloud products and services.

Available online https://www.fedramp.gov/templates/

TPWS Support Requirements Contractor must provide on-site (task lead or contract resource) for the following functions to include:

a. Coordinating with the COR on task issues/concerns;

b. Performing work on the task;

c. Providing OJT to new contract employees;

d. Managing and assigning work to contract employees;

http://csrc.nist.gov/publications http://csrc.nist.gov/publications http://csrc.nist.gov/publications https://www.cpars.gov/ https://www.fedramp.gov/templates/

e. Responsible for quality assurance and monitoring

f. Resolve discipline actions with the contractor’s employees;

g. Address disputes/customer complaints with COR;

h. Ensuring contract employee’s time is properly entered on the government contract labor and time (CMIS) intranet web site.

Place of Performance Contract services must be performed at the FAA’s Mike Monroney Aeronautical Center in Oklahoma City, OK.

Hours of Work Services are to be performed on-site, or via approved telework, Monday through Friday (excluding federal holidays and facility closures) between the operating hours of 0600 to 1800 CT. Contract personnel shall work forty (40) hours each week.

Telework Approval for teleworking Contractors under this Task will be considered on a case-by-case basis by the government. Said approval may be cancelled at the discretion of the government on a case-by-basis. Past approval is not an indication of future approval.

Approved teleworking Contractors would be expected to have reliable high-speed Internet access along with all other appropriate logistical and support features for an appropriate office setting. There will be no direct cost to the government for telework location support office items.

Approved teleworking Contractors may only work from the CONUS, Alaska or Hawaii. Use of third party Virtual Private Networking (VPN) to mask a teleworking Contractors actual remote work site is prohibited.

Downtime on a teleworking Contractor’s end (e.g., power outage, Internet outage or government-issued laptop) is not billable to the government. Physical proximity to Oklahoma City minimizes downtime as teleworking Contractors encountering issues may immediately go onsite to continue work.

Training Reference PWS Section 2.12.

Travel No travel is authorized for this task.

Privacy and Security Requirements Contractors must meet personnel security/suitability sensitivity levels commensurate with their position sensitivity level and are subject to personnel investigation requirements (e.g., FAA Order 1600.1E & 1600.73).

Contractors will be required to sign a Rules of Behavior statement pertaining to system administrator role.

Content of all data the contractor works with and results are assumed to be privacy data and will be held confidential

Government Furnished Property Reference PWS Section 6.3

Government Surveillance - Inspection and Acceptance Criteria The Government will evaluate the contractor’s performance on this task in accordance with the Technical Exhibits provided in Section 15.0 below.

The Quality Assurance Surveillance Plan (QASP) must focus on what the Government will do to ensure that the contractor has performed in accordance with the performance standards. It defines how to apply performance standards, the frequency of surveillance, and the minimum acceptable defect rate(s).

Technical Exhibits:

Technical Exhibit 1 - Performance Requirements Summary

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Task Deliverable(s) Applicable Standard(s) Acceptable Quality Level(s)

TPWS Paragraph 5.1 The contractor must perform compliance tracking and reporting of scan findings from monthly vulnerability, database, web application, and configuration baselines.

The AMKJG-230-50455 - Compendium Compliance Report Job Guide

Provide at time of award.

98% compliance. Reports are delivered on a monthly basis with updated and accurate data.