Attachment_1_Statement_of_Work.docx

07/16/2024 Statement of Work Cybersecurity Services Program Support

General Information Title of Project Cybersecurity Services Program (CSS) Statement of Need and Purpose The National Center for Advancing Translational Sciences (NCATS) Information Technology Resources Branch (ITRB) Cybersecurity Services (CSS) Division requires dedicated cybersecurity services to apply information security, privacy, and risk management measures to safeguard the confidentiality, integrity, and availability of the scientific systems and collaborative platforms that make up the NCATS virtual research organization as well as for the Center’s general IT environment.

The contractor will provide full-time support through a small cadre of individuals under a fixed-price contract. The individuals working under this contract are expected to have deep individual cybersecurity expertise. Discrete tasks (for example, completion of an authorization to operate (ATO) package) will be performed through fixed-price or time-and-materials contract structured to meet those needs (e.g. for a period of weeks or months, part-time, on-site/off-site, by subcontract, joint venture, etc.). The contractor will provide advice to the CSS division chief regarding the most advantageous and cost-effective approaches to accomplish the tasks in this Statement of Work (SOW).

These support services will primarily consist of direct support to the CSS Division on a fixed-price basis, with the contract to provide for full-time level of effort that will address the contract management and program management tasks described below.

The contract will provide full-time support that will address the contract management and program management tasks described below.

Background Information and Objective

The mission of NCATS is to catalyze the generation of innovative methods and technologies that will enhance the development, testing, and implementation of diagnostics and therapeutics across a wide range of human diseases and conditions. NCATS is at the forefront of automated biomedical experimentation, replacing hours of time-consuming basic laboratory work with systems and robots capable of conducting experiments with a fraction of the resources. This technology can both cut costs and increase productivity, which acts as a multiplier effect on research efficiency and raw output.

Physical and Information Landscape

In the administration of these programs, NCATS utilizes many assets, including buildings, facilities, communications equipment, computer systems, employees, contractors, public trust, and information. A loss to any one of these assets could affect the goals or the quality of support necessary from NCATS to its various customers and stakeholders. Additionally, NCATS collects, uses, and stores information that falls into the categories of privacy data, Protected Health Information (PHI), Personally Identifiable Information (PII), proprietary data, procurement data, inter-agency data, and privileged system information. Access to these types of information is subject to the Privacy Act of 1974 (as amended), the Computer Security Act of 1987 (as amended), and the Federal Information Security Management Act (FISMA) of 2002, as well as many important rules, regulations, policies, and guidelines promulgated by HHS, the Office of Management and Budget (OMB), and the National Institute of Standards and Technology (NIST). As a result, NCATS has a legal and practical responsibility to maintain the confidentiality, integrity, and availability of this information.

Policy and Regulatory Landscape

Under the NCATS Cybersecurity Services Program (CSS) and supported by the NIH Office of the Chief Information Officer (OCIO) staff, the NCATS CIO is responsible for applying prudent and effective information security, privacy and risk management measures. This will safeguard the NCATS staff, patients, research, grants and financial data, computers, networks, and other IT resources that are vital to the daily functioning and mission of NCATS. Under this program, the NCATS CIO seeks to comply with the Federal Information Security Modernization Act of 2014 (FISMA 2014), widely accepted information security best practices, and many other laws, policies, standards, mandates and initiatives as put forth by the U.S. Congress and implemented by the Department of Health and Human Services (HHS), the Department of Homeland Security (DHS), OMB, NIST, the General Accounting Office (GAO), and the White House. Also, under this program, the NCATS CIO provides information security and privacy incident response, security operations support, security policy and oversight, program and project management, security awareness and training, and other cyber and information security services to the NCATS programs and affiliates.

Though automated systems reduce the need for human labor, the systems and labs are not entirely self-sufficient. This contract seeks to augment the workforce responsible for the day-to-day operation of robotics and systems, as well as the infrastructure necessary to achieve top quality results.

Organizational Structure

To safeguard the confidentiality, integrity, and availability of its information and information systems effectively, NCATS has established a center wide Cybersecurity Services Program (CSS). Within this program it has two subcategories – the Information Security and Privacy Group (ISPG) and the NCATS Cybersecurity Integration Center (NCIC).

The Information Security and Privacy Group, charged with protecting NCATS data, provides leadership to NCATS and its programs in managing information security and privacy risks appropriate for evolving cyber threats. ISPG executes this vision utilizing an innovative approach to provide optimal visibility, situational awareness, resilience and incident response readiness across all NCATS systems.

The NCIC is crafted to particularly identify, detect, protect, prevent, respond and recover from any cybersecurity threat. The CSS Security and Privacy program is responsible for defining policy, providing security and privacy services, leading compliance and oversight of the program, asset & inventory management, training & awareness, and audits & assessments.

NCATS CSS will partner and support the NCATS community, culture, and mission in partnership with relevant stakeholders, including intramural and extramural principal investigators and research staff; patients, physicians, nurses, and other caregivers; NCATS senior management and administrative staff; and NCATS IC CIO, Information System Security Officers (ISSOs), and security team members.

CSS would work in close collaboration with contractor support to provide subject matter expertise and thought leadership. CSS would also take ownership of responsible work, manage quality, and provide the government with deliverables that are finished products ready to be delivered to senior management or CSS customers across the agency. “Finished Products” are concise, relevant, well-formed and professional in appearance with content checked for accuracy and adherence to objectives through a contractor-managed quality control process.

The NCATS CSS Program is seeking to further its goal to support the unique NCATS biomedical research enterprise and safeguard its diverse Hybrid IT (both cloud and on-premises) resources that NCATS relies on each day to fulfill its mission. The program is committed to balancing mission needs and risk; reducing NCATS high risk areas; improving protections for data, infrastructure and staff; and working to increase visibility into IT assets, operations, threats and risks. These goals will be achieved via NCATS-specific initiatives and federal-wide directives and compliance requirements to promote IT management best practices of the full life-cycle of NCATS IT investments, including configuration and patch management, system administration, and change and operations management. These activities will also be accomplished via implementation of DHS Continuous Diagnostic and Mitigation (CDM) guidance and technologies and other NCATS, NIH and HHS information security projects intended to protect and serve the NCATS mission, patients and staff.

The requirements placed upon the NCATS CSS Program to protect NCATS against cybersecurity threats, including the need to quickly modernize the NCATS information security infrastructure and improve capabilities, have dramatically increased.The Cybersecurity Services (CSS) division is the counterpart to the Information Technology Support Services division, which provides direct general IT and scientific computing support.

The following provides the organizational structure with associated services:

Programmatic Support

The contractor managing CSS will also be responsible for providing its services to NCATS programs such as the Rare Disease Clinical Research Network (RDCRN) and the Clinical Translational Science Awards (CTSA) Program Network.

RDCRN

The RDCRN is intended to advance the diagnosis, management, and treatment of rare diseases with a focus on clinical trial readiness. Each RDCRN member will promote highly collaborative, multi-site, patient-centric, translational and clinical research with the intent of addressing unmet clinical trial readiness needs. NCATS provides access and expertise in provisioning, managing, and securing cloud services to RDCRN. NCATS currently has access to services from major cloud providers for commercial and government cloud environments.

CTSA

The CTSA Program supports a national network of medical research institutions — called hubs ― that work together to improve the translational research process to get more treatments to more patients more quickly. The hubs collaborate locally and regionally to catalyze innovation in training, research tools and processes. To facilitate this work NCATS has begun to work on the iCollaborate Initiative which is a cloud-based infrastructure with four primary goals:

1. Promote Collaborative Team Science

· Investigators/institutions work together to solve healthcare challenges

2. Shared Resources

· Scientific Material produced by the CTSA will be available to the entire CTSA Program

3. Economies of Scale

· Implement cloud-based computing to standardize network while minimizing duplicative investments

4. Security Services

· Provide consolidated capabilities that replace or augment existing technology to improve security

All these goals are imperative to the success of the initiative but are dependent on the foundation and operation of a secure cloud environment.

ASPIRE

The same goals can also be applied towards the ASPIRE program defined as A Specialized Platform for Innovative Research Exploration. The intent of this program is to generate a next generation life sciences laboratory that is collaborative in nature; meaning automated platforms available across multiple facilities can be utilized by researchers in a collaborative way to help develop new therapies. This will also require a secure cloud-based environment where researchers from around the country can freely and securely share data and initiate new experiments to be run. It is important to stress that point; the collaborative cloud platform can be used to initiate an automated process at a physical location that may be different from the location of the researcher. This requires a very difficult balancing act between being open and accessible yet at the same time secure and protected.

Statement of Work Specific Requirements

The contractor shall provide all services and qualified personnel, not otherwise provided by the Government, necessary to perform the following tasks:

Contract Management

The contractor shall prepare a management plan describing the technical approach, organizational resources, and management controls to be employed to meet the cost, performance, and schedule requirements throughout contract execution. The proposed management plan shall be submitted with the written technical proposal. At the time of award, the Government may recommend changes to the management plan which will be negotiated and made final within fifteen days of contract award.

Contract-Level Program Management

The contractor shall provide the technical and functional activities at the contract level needed for program management. This shall include productivity and management methods such as project management, task level quality assurance, work breakdown structures, onsite and offsite staff supervision, documentation quality reviews, responsive hiring, and maintenance of staff technical skills. The contractor shall also provide the centralized administrative, clerical, documentation and other related functions appropriate to this level.

Experience and Functional Responsibility

This contract provides direct support to the chief of the CSS Division of ITRB in the execution of the tasks executed by the ISPG and NCIC as described below. The individuals working under this contract are expected to have deep individual cybersecurity expertise.

The contractor will provide full-time support through a fixed-price contract. Discrete tasks (for example, completion of an ATO package) will be performed through fixed-price contract structured to meet those needs. The contractor will provide advice to the CSS division chief regarding the most advantageous and cost-effective approaches to accomplish the tasks in this SOW.

Information Security and Privacy Group (ISPG) Task 1: Information Security and Privacy Policy Support

Develop and provide information security and privacy support to NCATS employees and contractors to apply on specific business needs, technical situations and policy requirements.

A. Provide guidance and determine the impact of new technology or policy (e.g., CDM technologies, anomaly-based tools, virtual and cloud environments, etc.) on the NCATS information security and privacy program;

B. Provide expert analysis and document preparation for various analytical efforts focused on processes and procedures;

C. Review various draft documents and provide timely feedback to NCATS employees and contractors;

D. Develop and implement information security and privacy program strategic and tactical goals and objectives, in addition to outreach and communication plans;

E. Assist with transforming the organization and governance structure to support NCATS information security and privacy initiatives;

F. Draft, review, update, and maintain information security policies, procedures, guidelines, tools, directives, templates, and materials to ensure all documentation reflects and incorporates the most recent version of all NCATS information security and privacy program documentation;

G. Develop an Information Security library/website for NCATS that will provide IC employees and contractors with a virtual library of applicable security and privacy policies, procedures, guidelines, tools, directives, and templates;

H. Provide information support for NCATS employees and contractors to obtain assistance with questions/issues concerning NCATS information security and privacy standards, policies, procedures, Assessment and Authorization (A&A) artifacts, and any other security-related deliverables NCATS requires for systems and applications as documented and required on the NCATS Information Security Website.

I. Provide surge capability when required by COR

Deliverable(s): Submit a written proposal for NCATS COR approval that addresses requirements outlined in section 2.2.1 Task1: Information Security & Privacy Support: Information Security website that hosts library of security policies, procedures, guidelines, tools, templates, etc. for NCATS employees and contractors.

Task 2: Information Security and Privacy Technical Services

Task 2a - Assessment and Authorization (A&A) Support

A. Provide overall subject matter expertise to the Information Security Assessment and Authorization (A&A) program. Provide specific guidance and technical expertise in the form of standards, policies, procedures, and oversight for the NCATS A&A program;

B. Create and/or review and analyze all Authorization to Operate (ATO) artifacts for accuracy and completeness in support of ATO requests;

C. Conduct audits of Plan of Actions and Milestones (POA&M) for completeness and compliance;

D. Develop and support the Ongoing Authorization (OA) / Continuous Monitoring process.

E. Catalog system security authorization documentations for each Program system or release. Update the Business Impact Analysis (BIA), System Security Plan (SSP), IT Contingency Plan (CP), Contingency Plan Test (CP Test), Configuration Management Plan (CMP), Incident Response Plan (IRP), Incident Response Plan Test (IRP Test), and Plan of Actions and Milestones (POAMs). Identify and remediate any gaps in existing documentation.

Deliverable(s): Submit required documents listed in 2.2.2.1 Task 2a in support of Assessment & Authorization engagements.

Task 2b – Privacy and Security Engineering Services

Provide expertise in specific security or security-related engineering and privacy topics, which may include, but is not limited to, the following types of activities:

A. Provide expertise in specific security or security-related engineering topics and privacy engineering.

B. Prepare situational awareness briefings regarding information security policy and industry trends for NCATS senior management;

C. Develop alternatives of system designs and/or architectures which consider trade-offs between security requirements, functional/operational requirements, cost and compliance;

D. Determine the impact of new or changing applicable federal policy changes or revised legislation and regulations (OMB, HIPAA, FISMA, FISCAM, FedRAMP, FITARA, etc.);

E. Conduct research and present analyses to evaluate and/or determine emerging industry technology trends, government agency best practices, and security issues;

F. Ensure security and privacy is an integral part of all phases of the System Development Life Cycle (SDLC);

G. Provide vulnerability management technical support services.

Deliverable(s): Executive Briefings: Support as requested the development and/or delivery of content related to contractor's tasks in support of a range of NCATS executive briefings, boards as requested by COR. Content for such briefing support may include but is not limited to strategic plans & proposals, status reports, performance metrics, business cases, etc.

Task 3: Information Security and Privacy Training Services

Develop and maintain a comprehensive information security and privacy awareness and training program which will include, but is not limited to, providing support in the following areas:

A. Assess and provide recommendations of additional training beyond the existing training program and materials to meet security and compliance requirements as well as recent industry trends;

B. Develop, deliver and maintain outreach and marketing strategy for security and privacy;

C. Enhance, document, administer, and deliver a comprehensive program to measure and improve the information security and privacy awareness and vigilance of all NCATS system users and administrators, including those with significant security responsibilities.

D. Develop a comprehensive Information Security & Privacy role-based training program including training material (in various media formats including but not limited to online, e-learning, video, etc.) for NCATS staff and its partners.

D. Propose metrics for COR approval that demonstrates improvements required in item ‘C”.

Deliverable(s): Submit a written proposal for NCATS COR approval for training of information security & privacy program and material that meets federal security compliance standards and industry trends.

Submit a written proposal for NCATS approval for an outreach and promotion strategy for security and privacy awareness training.

Task 4: Audit Management and Support Provide audit management support for involvement in the development and maintenance of an Audit and Risk Management program and to provide support to include, but is not limited to, the following areas:

A. Support audit engagements in research, information gathering , and submission of written responses and audit artifacts;

B. Manage each audit engagement in collaboration with all stakeholders;

C. Maintain a list of findings and support the remediation efforts D. Assist with managing and maintaining visibility of plans of action and milestones (POA&M) through closure to improve levels of acceptable risk.

Deliverable(s): Provide written status report on the findings from audit engagements and POAM activities.

Task 5: Security Operations Support Provide comprehensive operational cyber security situational awareness and response readiness by performing cybersecurity monitoring and advanced analytics and to provide support to include, but is not limited to, the following areas:

A. Monitor, defend and protect perimeter interface for malicious network traffic;

B. Performing advanced network analysis of egress and ingress traffic;

C. Monitor, defend and protect hosts and applications within each FISMA boundary for malicious activity or activity that could indicate lateral movement within the environment;

D. Monitor security events, correlate information from cloud and on-premises data center feeds and NCATS functional areas to identify incidents, issues, threats, and vulnerabilities.

Deliverable(s): Standard Operating Procedures (SOPs) and notification, escalation, and summary reports, Service Desk Tickets, Incident Response Reports, Federal requirements, and Agency requirements and guidelines.

Ad-hoc reports on any event or incident to the NCATS ISSO, ITRB leads and/or COR. Reports can include, but not limited to, reviews, findings and recommendations; cyber security metrics and trending data.

NCATS Cybersecurity Integration Center (NCIC) Task 1: Security Engineering

Provide security engineering which implements, optimizes, and administers innovative security solutions that reduce IC risk by providing increased visibility and response readiness across the enterprise. This includes the following:

Deliverable(s): Document proposed plan including secure system architecture plan and design solutions within the FISMA boundary for NCATS’ review & approval.

Comprehensive documented description of the secure system configuration and implementation of design and/or solutions that are consistent with Federal, NIST 800-53 & other Special Publications and NCATS architecture guidelines.

Task 2: Penetration Testing

Provide penetration testing services by coordinating and conducting all Agency penetration testing on systems operated by and on behalf of NCATS. Document a test plan and methodology and utilize a variety of NCATS approved tools to conduct vulnerability assessments and penetration tests for all NCATS FedRAMP cloud and on-prem systems.

Deliverable(s): Documented test plan and methodology utilizing a variety of NCATS approved tools to conduct vulnerability assessments and penetration tests for all NCATS FedRAMP cloud and on-premises systems.

Rules of Engagement (ROE) letter and approval by COR & NCATS ISSO of plan activities and the finding and recommended remediation reports.

Task 3: Forensics, Malware Analysis, and Advanced Hunting

Provide forensics and malware analysis for network, system and media digital forensics, advanced threat hunting, and malware analysis capabilities in a hybrid cloud environment. Utilize industry standard techniques, tools and procedures, to perform network and media digital forensics, incident response, malware analysis, advanced threat hunting across the Enterprise.

Deliverable(s): Reports on any event or incident analyses to the COR and Government Leads (CSS Lead and ISSO). Report should include a detailed diagram from the origin of the incident, activities conducted including but not limited to, comprehensive forensic findings, results of all analyses and remedial recommendations

Task 4: Compliance Monitoring

Provide information security compliance monitoring activities to promote ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions and to address assessment and analysis of security control effectiveness.

Deliverable(s): Centralized repository of documented report of the lifecycle of incident from its origination to closure.

Task 5: Incident Management

Provide incident management services which includes a variety of critical functions related to situational awareness, incident and vulnerability management, coordination, collaboration, and security oversight for the Enterprise. The service ensures that each of the individual incident response teams and associated stakeholders are provided with timely relevant information to allow for the most effective response activities possible. The NCIC team serves as the central coordinating and communications component for security efforts coordination, incident and vulnerability management, for the teams supporting NCATS FISMA systems. The services include, but are not limited to, providing support in the following areas:

Deliverable(s): Document, update or revise an Incident Response Plan (IRP) to include short and long-term goals for improving incident response program based on guidance from the NIH Incident Response Plan and NIST 800-61 Rev 2. IRP should define and report metrics for measuring the incident response capability.

Document incident analysis reports of event(s) to the COR and ISSO. Reports should include but is not limited to comprehensive findings, other results of the analysis and remedial recommendations.

Task 6: Cyber Threat Intelligence and Information Sharing

The Threat Management Program ensures an optimal Agency security posture by identifying ongoing, immediate, and emerging threats to the organization, including threat actors, attack vectors, and breach scenarios. Proactive threat management informs stakeholders, improves situational awareness, highlights high-risk configuration vulnerabilities, facilitates rapid response, supplies relevant security material, and helps quantify organizational security risk.

Deliverable(s): Written communication that provides up-to-date information about cyberthreat of high-impact activities affecting NCATS systems. Information should include but is not limited to alerts of current security issues, automated scans of vulnerabilities and potential exploits.

Task 7: Secure Application Development Service

Provide software assurance and best practices in the system development life-cycle (SDLC) of agile application development environment that incorporates NIST 800-64 and 800-53 r4 security controls required for Federal IT systems. The software assurance process should apply the required security controls within the SDLC with a thorough understanding of the information security, threats, vulnerabilities, adverse impacts and risk to critical mission/business functions and provide foundation for the successful development, implementation and operations of information systems.

Deliverable(s): Documented Software Assurance (SwA) Guideline best practices.

Documented Application Code Analysis and Remediation Report.

Document alignment, gap analysis and update System Development Life Cycle (SDLC) procedures to include the security risk management process in the SDLC activities.

Other deliverables:

Project Plan - schedule and requirement Requirement - defined requirement from stakeholder Design & Prototyping - architecture design document Development - testable and functional solution Testing - integration & performance testing Deployment – management process/SOPs Operation and Maintenance – Documented SOPs, Tools, configuration management, etc. For the O&M of applications

Additional Deliverable Task 1: Bi-Weekly Status Reporting Requirements Upon the commencement of this contract, the Contractor shall support bi-weekly Status Meetings and/or Deliverable Review Meetings by preparing and delivering Meeting Agendas, Meeting Minutes, Presentation Materials, and an Action Item List for each Status Meetings and/or Deliverable Review Meetings.

• Activities performed on each task since the last bi-weekly meeting

• Current status of each deliverable, including a discussion of those deliverables that are delayed, behind schedule, or late

• Activities by each task/sub-task anticipated for the following 4 weeks

• Meetings attended by Contractor staff since the last bi-weekly meeting

• Risks by deliverable for those identified as behind schedule or delayed with mitigations

• Issues by deliverable for those identified as late with corrective action plan and impact to each project and project dependencies

• Current metrics and statistics for monitoring activities, including a discussion of new security incidents for each week, updates of old security incidents by status

Task 1: Monthly Status Reporting Requirements Upon award and commencement of this contract, the Contractor shall provide a Monthly Status Report to the COR including any risk/issues in the format specified by the COR. The Monthly Status Report shall be accompanied by an updated TO Project Plan

• A section describing the technical tasks and sub-tasks detailing work accomplished, milestones achieved, deliverables submitted, the status of tasks, and plans for the next monthly reporting period.

• A section detailing Government actions needed such as Government furnished equipment, information, or support.

• Events or circumstances that may impact contractor's ability to meet obligations

• An updateable, all-encompassing list of deliverables and formal reviews and approvals

Additional Requirements Task 1: Reports The following administrative reporting requirements shall be submitted in accordance with the terms and conditions (as outlined in the base contract).

1. Reporting of Financial Conflict of Interest (FCOI).

2. Information and Security and Physical Access Reporting Requirements:

a. IT Security Plan

b. Roster of Employees Requiring Suitability Investigations

c. Contractor Non-Disclosure Agreement

d. Security Awareness, Privacy, Counterintelligence, Emergency Preparedness and Records Training

e. Rules of Behavior

f. Incident Response

g. Sanitization

h. Notification of Employee Departure

i. Employee Separation Checklist

3. Invention Reporting Requirements:

a. Annual Utilization Report (required if the TO period of performance exceeds one year)

b. Final Invention Statement

4. Subcontract Reporting Requirements (applicable only to other than small businesses):

a. Individual Subcontract Report.

b. Summary Subcontract Report.

5. Service Contract Reporting Requirements for Indefinite-Delivery Contracts.

6. Transition Plan

7. Summary of Salient Results Task 2: Contract Report and Delivery Schedule Satisfactory performance of the TO shall be deemed to occur upon performance of the work described in the TO award, and upon delivery and acceptance by the Contracting Officer, or duly authorized representative, the below listed deliverables. The deliverables shall be delivered F.o.b. Destination as set forth in FAR Clause 52.247-35, F.o.b. DESTINATION, WITHIN CONSIGNESES PREMISES (APRIL 1984).

Administrative Reporting Requirements

Note:

· CO: Contracting Officer

· COR: Contracting Officer’s Representative

· IRT: Incident Response Team, irt@nih.gov ISSO: Information Systems Security Officer, Nam Ngo, nam.ngo@nih.gov, 301-827-0967

Government Responsibilities

NIH will provide the work space, utilities, workstations, chairs, tables, phones and service, computers and setup/maintenance, fax machines, copiers, printers, NIH standard applications & software for computers, office/career center furniture, LAN, Internet access, and electronic mail service necessary to perform the requirements of the contract. This provided office space will be available when the contractor is on site but will not be dedicated when the contractor is not at the site. The vendor may use NIH mail services to the extent possible for mail related to the services of this contract. Parking will be available for on-site personnel only.

The Government will provide the Contractor with access to all information required to successfully perform the work requirements specified in this SOW.

The Government will allow the Contractor's employees free access to the premises and facilities at all reasonable hours within prescribed NIH Security procedures and guidelines.

Other Considerations Travel

Individuals may be required to travel for specific contract requirements. Possible travel could involve conference or meeting attendance, visiting overseas collaborators to assist with data collection, etc. The contractor will be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. All travel requires Government approval/authorization and notification to the appropriate personnel.

Transition In / Transition Out

The Contractor shall perform transition services necessary to ensure an effective transition-in and transition-out of contractor support and continued operations, as well as an orderly transition period without any interruption or loss of proficiency of services. Transition services shall include the involvement of all contractor personnel on a limited or part-time basis for the transition periods outlined below.

Key Personnel

Information Security and Privacy Group (ISPG) Lead Requirements:

1. 10 or more years or more of experience in information technology security with 5 years or more in cybersecurity directly supporting a Federal Agency

1. Experience managing personnel

1. Experience leading/providing executive-level briefings

Preferences:

1. Bachelor of Science in Computer Science or Information Technology

1. Certification as either Certified Information Privacy Professional (CIPP) or Certified Information Privacy Manager (CIPM) or equivalent

NCATS CYBERSECURITY INTEGRATION CENTER (NCIC) Lead

Requirements:

1. 10 or more years or more of experience in information technology security with 5 years or more in cybersecurity directly supporting a Federal Agency

1. Experience managing personnel

1. Experience leading/providing executive-level briefings

Preferences:

1. Bachelor of Science in Computer Science or Information Technology

1. Certification as either Certified Information Systems Security Professional (CISSP) or equivalent

Personnel Security Background checks, etc.

Management

1. Unless authorized in writing by the Contracting Officer, the costs for overtime shall be unallowable as direct costs.

2. The COR will have the authority to approve or deny proposed individual’s participating under this contract. Prior to assigning an individual to fill a labor category, the Contractor shall provide the COR with the proposed individual’s resume and an explanation of how the proposed individual’s skills, experience, and credentials meet or exceed the requirements of the labor category. The COR will then either approve or deny that individual’s participation under the contract.

3. Contractor employees performing services under this contract will be controlled, directed and supervised at all times by management personnel of the contractor. Contractor employees will perform independent of and without the supervision of any Government official. Actions of contractor employees may not be interpreted or implemented in any manner that results in any contractor employee creating or modifying Federal policy, obligating appropriated funds of the U.S. Government, overseeing the work of Federal employees, providing direct personal services to any Federal employee or otherwise violating the prohibitions set forth in Parts 7.5 and 37.1 of the Federal Acquisition Regulation (FAR). The Government will control access to the facility and will perform the inspection and acceptance of the completed work.

image1.png image2.png