Attachment A - QASP Cybersecurity.pdf

Attachment A – Quality Assurance Surveillance Plan

CYBERSECURITY SUPPORT SERVICES - Quality Assurance Surveillance Plan (QASP)

Exhibit A - CISO & COR Support Task Area

Task Area Performance Standard

Acceptable Quality Level (AQL)

Method of Surveillance

Incentive/ Disincentive

Required/ Optional

Monthly Contract Status Report (Section 3.1.1 - Program Management Support)

Contractor shall provide accurate and complete monthly program status report.

Report must contain required data and address significant issues & findings as of the time of each update.

Contractor shall ensure accurate and complete information, free from major grammatical errors; delivered to the COR by 5pm ET on the 10 business days after the end of the reported month 95% of the time.

100% Inspection

Incentive:

Consistently meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

Key Personnel Availability (Section 3.1.1 - Program Management Support)

Contractor shall ensure key program positions are appropriately backfilled to minimize the impact of program vacancies.

Contractor shall ensure for key personnel who leave the program outside of the contractor’s control (e.g., resignations), the Contractor shall provide a qualified replacement candidate resume within 15 business days of departure. Contractor will ensure key positions are filled within 30 business days from date of CFPB Personnel Security approval 95% of the time.

meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

Acceptable Quality Level (AQL)

Method of Surveillance

Incentive/ Disincentive

Required/ Optional

Semi-Annual Cybersecurity Strategic Planning Report (Section 3.1.2 - Strategic Cybersecurity Planning Support)

Contractor shall provide a detailed and succinct report describing potential opportunities the Bureau could leverage to improve Cyber defenses, manage strategic cyber risks, and optimize associated budget expenditures.

Report must contain required data and address emerging challenges in Government and the Financial Sector as of the time of each update.

Contractor shall ensure accurate and complete information, free from major grammatical errors; delivered to the COR semi-annually by 5pm ET on the date defined by COR or designee 95% of the time. (Typically, December and June).

meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

Recommended Objectives and Key Results (OKRs) (Section 3.1.2 - Strategic

Planning Support) propose OKRs that accurately measure performance of the Information Technology program as related to Cybersecurity.

Contractor shall provide actionable Cybersecurity objectives align with the CFPB’s strategic vision, free from major grammatical errors;

delivered quarterly to the COR or designee by 5pm ET on the date defined by COR or designee 95% of the time.

meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Acceptable Quality Level (AQL)

Method of Surveillance

Incentive/ Disincentive

Required/ Optional

Recommended Cybersecurity Metrics (Section

3.1.2 - Strategic Cybersecurity Planning Support)

The proposed metrics shall include a description, a formula or calculation for deriving each metric, a viable data source, frequency of measurement, and challenges associated with achieving each metric.

Contractor shall provide viable metrics that address all elements of the performance standard and align with CFPB’s Cybersecurity objectives, free from major grammatical errors; delivered to the COR or designee by 5pm ET on the date defined by COR or designee 95% of the time.

meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

Cybersecurity Executive Status Report (Section

3.1.3 - CISO

Support)

The Contractor shall collaborate with cybersecurity teams to provide Cybersecurity Executive Status Reporting.

Contractor shall ensure accurate and complete information, free from major grammatical errors; delivered as required by the CISO or COR 95% of the time.

Incentive: Consistently meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Optional

Acceptable Quality Level (AQL)

Method of Surveillance

Incentive/ Disincentive

Required/ Optional

Cybersecurity Executive Briefings (Section

3.1.3 - CISO

Support)

The Contractor shall collaborate with cybersecurity teams to provide Cybersecurity Executive Briefings.

Contractor shall ensure accurate and complete information, free from major grammatical errors; delivered as required by the CISO or COR 95% of the time.

meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Optional

Exhibit B - Cyber Program Management Task Area (QASP)

Acceptable Quality Level (AQL)

Method of Surveillance

Incentive/ Disincentive

Required/ Optional

Cybersecurity Meeting Minutes (Section 3.2 - Cybersecurity Program Management Support)

Contractor shall provide accurate, complete, and properly formatted documents to be delivered to the COR or designee.

Contractor shall ensure accurate and complete documentation/ information and is free from major grammatical and formatting errors.

Contractor shall deliver to COR or designee within one business day of meeting and stored in a centralized location 95% of the time.

Periodic favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

Cybersecurity Communications (Section 3.2 - Cybersecurity Program Management Support)

Contractor shall provide accurate, complete, and properly formatted in support of Cyber Program Management, Cyber workforce development, Cybersecurity audits, cybersecurity supply chain risk management, Cybersecurity policy to be

Contractor shall ensure accurate and complete information, free from major grammatical and formatting errors

Contractor shall develop relevant communications as defined in communication plan or as directed by CPM Director or designee if not favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Acceptable Quality Level (AQL)

Method of Surveillance

Incentive/ Disincentive

Required/ Optional delivered to the COR or designee.

defined 95% of the time.

Cybersecurity Communication Plan (Section 3.2.1 - Cybersecurity Project Management Support)

Contractor shall provide accurate, complete, and properly formatted plan in support of Cyber Program Management, Cyber workforce development, Cybersecurity audits, cybersecurity supply chain risk management, Cybersecurity policy to be delivered to the COR or designee.

ensure accurate and complete information, free from major grammatical and formatting errors

Contractor shall develop a plan that includes all known communications for all Cyber Program Management, Cyber workforce development, Cybersecurity audits, cybersecurity supply chain risk management, Cybersecurity policy activities to be delivered to COR or designee the second week of the every fiscal year (October) 95% of the time.

favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

CIO Cybersecurity Scorecard (Section 3.2.1

- Cybersecurity Project Management Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the

Contractor shall ensure accurate and complete documentation/ information in response to the data favorable comments may be documented on Past Performance Disincentive: If

Acceptable Quality Level (AQL)

Method of Surveillance

Incentive/ Disincentive

Required/ Optional

COR or designee. call and is free from major grammatical and formatting errors.

Contractor shall deliver to COR or designee on the last business day of every month 95% of the time.

Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Executive Order Status Reports (Section 3.2.1 - Cybersecurity Project Management Support)

Contractor shall provide accurate, complete, and properly formatted documents in support of Executive Order status reporting to be delivered to the COR or designee.

Contractor shall ensure accurate and complete documentation/ information and is free from major grammatical and formatting errors.

Contractor shall deliver to COR or designee by 4pm ET on the day of the Executive Order Meeting every week 95% of the time.

favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

Cybersecurity Status Reports (Section 3.2.1 - Cybersecurity Project Management Support)

Contractor shall provide accurate, complete, and properly formatted information to be delivered to the COR or designee.

Contractor shall ensure accurate and complete documentation/ information and is free from major grammatical and formatting errors favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, Acceptable Quality Level (AQL)

Method of Surveillance

Incentive/ Disincentive

Required/ Optional prior to status reporting meeting.

Contractor shall deliver to COR or designee daily in applicable task tracking application 95% of the time.

unfavorable comments may be documented on past performance.

Cybersecurity Metric Reports (Section 3.2.1 - Cybersecurity Project Management Support)

Contractor shall provide accurate, complete, and properly formatted documents to be delivered to the COR or designee.

Contractor shall ensure accurate and complete documentation/ information and is free from major grammatical and formatting errors.

Contractor shall deliver to COR or designee daily, weekly, monthly, or quarterly as defined by the CPM Director or designee 95% of the time.

favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

Cybersecurity Project Dashboards and Briefs (Section 3.2.1 - Cybersecurity Project Management Support)

Contractor shall provide accurate, complete, and properly formatted documents status reporting to be delivered to the COR or designee.

Contractor shall ensure accurate and complete documentation/ information and is free from major grammatical and formatting errors.

favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments

Acceptable Quality Level (AQL)

Method of Surveillance

Incentive/ Disincentive

Required/ Optional

Contractor shall deliver to COR or designee at least 2 business day before the due date as defined by the data call body, CPM Director, or designee 95% of the time.

may be documented on

CPM Project Management Standard Operating Procedures (Section 3.2.1 - Cybersecurity Project Management Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee in support project management activities.

Contractor shall ensure accurate and complete documentation/ information that reflects current project management processes and is free from major grammatical and formatting errors.

Contractor shall ensure documents are maintained as current. Contractor shall make updates no later than 5 business days as a change occurs and delivered to COR or designee for review.

favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

OMB, CISA, and other Data Call Responses (Section 3.2.1 - Cybersecurity Project Management Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee.

Contractor shall ensure accurate and complete documentation/ information in response to the data call and is free from major grammatical and formatting errors.

Contractor shall deliver to COR or designee for review at least 3 business favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on day before the submission to the data call body 95% of the time.

Cybersecurity Document Management Schedule (Section 3.2.3 - Cybersecurity Policy, Directive, Process, Procedure and Communication Development Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee.

Contractor shall ensure accurate and complete information, free from major grammatical and formatting errors.

Contractor shall develop a cybersecurity document management schedule which accurately reflects the documents to be updated and applicable timelines to account for organization requirements and approval process.

Contractor shall deliver the project schedule on the second week of the fiscal year (October) each year to COR or designee 95% of the time.

100% Inspection favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

Cybersecurity Document

Contractor shall provide accurate, Contractor shall

Management Tracker (Section 3.2.3 - Cybersecurity Policy, Directive, Process, Procedure and Communication Development Support) complete, and properly formatted documents delivered to the COR or designee.

complete information, free from major grammatical and formatting errors.

Contractor shall ensure tracker(s) reflects dates in Cybersecurity document management schedule and are updated at least monthly in the applicable application.

Contractor shall deliver to COR or designee for review on the last business day each month 95% of the time.

favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Cybersecurity Policies, Directives, Processes, Procedures, and Communications (Section 3.2.3 - Cybersecurity Policy, Directive, Process, Procedure and Communication Development Support)

Contractor shall provide accurate, complete, validated, and properly formatted documents delivered to the COR or designee.

Contractor shall develop applicable documentation in no more than 10 business days and shall deliver according to project schedule to the CPM Director or designee.

Contractor shall ensure each cybersecurity favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on document is accurate, complete information, free from major grammatical and formatting errors, and requires no more than 2 internal reviews from the CPM Director or designee.

Contractor shall present/brief subject experts on expectations and timelines outlines in schedule to facilitate comments and feedback.

Contractor shall ensure data is validated by subject experts and adjudicated within 5 business days from receipt of experts and delivered to COR or designee for review. The Contractor’s quality assurance review must be completed within 2 business days of the Governments draft approval deliver and maintain records of comment and adjudications from subject expert reviews. Contractor shall ensure records are maintained current and delivered to COR or designee for review.

Contractor shall ensure these timelines are met no less than 95% of the time.

CPM Policy Management Standard Operating Procedures (Section 3.2.3 - Cybersecurity Policy, Directive, Process, Procedure and Communication Development Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee in support policy management activities.

Contractor shall ensure accurate and complete documentation/ information that reflects current policy management processes and is free from major grammatical and formatting errors.

Contractor shall ensure documents are maintained as current. Contractor shall make updates no later than 5 favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on business days as a change occurs and delivered to COR or designee for review 95% of the time.

Cybersecurity Policy Briefs and Presentations (Section

3.2.3 - Cybersecurity Policy, Directive, Process, Procedure and Communication Development Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee

Contractor shall ensure accurate and complete information, free from major grammatical and formatting errors.

Contractor shall deliver according to project schedule or as directed by CPM Director or designee if not defined 95% of the time.

favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Audit Responses (Section 3.2.5 - Cybersecurity Audit and Compliance Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee.

Contractor shall ensure accurate and complete information, free from major grammatical and formatting errors.

Contractor shall request responses from stakeholders, validate responses, and submit to oversight body daily during the audit.

Contractor shall address ad-hoc audit request as defined by oversight body.

Contractor shall deliver to CPM Director or designee for review 95% of favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

Corrective Action Plans (CAPs) (Section 3.2.5 - Cybersecurity Audit and Compliance Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee.

Contractor shall ensure each CAP must document the current state of remediation as of the time of each update and be free from major grammatical and formatting errors.

favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on deliver the original CAP within 2 weeks of final report from oversight body and delivered to COR or designee 1 business day before due date.

The Contractor shall ensure CAPs are updated monthly and delivered to the COR or designee for review 95% of the time.

Notice of Findings and Recommendations (NOFRs) (Section 3.2.5

- Cybersecurity Audit and Compliance Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee.

Each NOFR must document the current state of remediation as of the time of each update and be free from major grammatical and formatting errors.

Contractor shall deliver the original NOFR within 2 weeks of final report from oversight body and delivered to COR or designee 1 business day before due date. The Contractor shall ensure CAPs are updated quarterly and delivered to the favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

COR or designee for review 95% of the time.

Audit Activities Trackers (Section 3.2.5 - Cybersecurity Audit and Compliance Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee.

Contractor shall ensure accurate and complete information, free from major grammatical and formatting errors.

Contractor shall ensure tracker(s) are maintaining current and updated daily during the audit 95% of the time.

favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

FISMA Reporting (Section 3.2.5 - Cybersecurity Audit and Compliance Support)

Contractor shall provide accurate and complete input to CyberScope reports to the CISO or designee for review.

Contractor shall ensure accurate and complete information, free from major grammatical and formatting errors.

Contractor shall develop project schedule that accounts for the quarterly due date defined by oversight body and CFPB approval process.

Contractor shall provide approved FISMA reporting favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on documentation to the COR or designee for submission as defined by the project schedule on or before the due date defined by oversight body 95% of the time.

Audit Analysis and Summaries (Section

3.2.5 - Cybersecurity Audit and Compliance Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee.

Contractor shall ensure accurate and complete information, free from major grammatical and formatting errors.

Contractor shall deliver as directed by CPM Director or designee 95% of the favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

CPM Audit Management Standard Operating Procedures (Section 3.2.5 - Cybersecurity Audit and Compliance Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee in support CPM audit management activities.

Contractor shall ensure accurate and complete documentation/ information that reflects current CPM audit management processes and is free from major grammatical and formatting errors.

Contractor shall ensure documents are maintained as favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on current. Contractor shall make updates no later than 5 business days as a change occurs and delivered to COR or designee for review 95% of the time.

Audit Report Responses (Section 3.2.7 - Technology & Innovation Audit and Compliance Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee.

Contractor shall ensure accurate and complete information, free from major grammatical and formatting errors.

Responses must fully document the status all requests.

Contractor shall deliver according to timeline of oversight body (typically <4 business days) 95% of the time.

favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

Corrective Action Plans (CAPs), Notice of Findings & Recommendations (NOFRs) and Updates (Section 3.2.7 - Technology & Innovation Audit and Compliance Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee.

Contractor shall ensure each CAP or NOFR must document the current state of remediation as of the time of each update and be free from major grammatical and formatting errors.

favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on deliver the original CAP/NOFR within 2 weeks of final report from oversight body and updated quarterly as defined by the oversight body to the COR or designee

Audit Activities Trackers (Section 3.2.7 - Technology & Innovation Audit and Compliance Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee.

Contractor shall ensure accurate and complete information, free from major grammatical and formatting errors.

Contractor shall ensure tracker(s) is maintained current and updated daily during the audit favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

Audit After Action Review (AAR) Summaries (Section

3.2.7 - Technology & Innovation Audit and Compliance Support)

Contractor shall provide accurate, complete, and properly formatted documents advise the T&I Leadership that delivered to the COR or designee.

Contractor shall ensure accurate and complete information, free from major grammatical and formatting errors.

Contractor shall deliver to COR or designee as directed favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

Governance, Risk, and Compliance Committee Report (Section 3.2.7 - Technology & Innovation Audit and Compliance Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee.

Contractor shall ensure accurate and complete information, free from major grammatical and formatting errors.

Report must fully document the status monthly 95% of the favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

T&I Audit Management Standard Operating Procedures (Section 3.2.7 - Technology & Innovation Audit and Compliance Support)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee in support T&I audit management activities.

Contractor shall ensure accurate and complete documentation/ information that reflects current T&I audit management processes and is free from major grammatical and formatting errors.

Contractor shall ensure documents are maintained as current. Contractor shall make updates no later than 5 business days as a change occurs and delivered to COR or designee for review 95% of the time.

favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Workforce Development Presentations and Materials (Section 3.2.9 - Cybersecurity Workforce Development)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee in support of phishing exercises, cybersecurity awareness events, general user cyber awareness training and specialized role based cyber training.

Contractor shall ensure accurate and complete information, free from major grammatical and formatting errors.

Contract shall deliver to the COR or designee as defined by CPM Director or designee or upon receipt of new federal requirements favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Development Metrics and Status Reports (Section 3.2.9 - Cybersecurity Workforce Development)

Contractor shall provide accurate, complete, and properly formatted documents to be

Contractor shall ensure accurate, relevant, current, and complete information, free from major grammatical and formatting errors.

Contractor shall report metrics according to the following schedule and deliver to the COR or designee:

• Phishing – daily during exercise.

• Mandatory Compliance

Training – weekly, daily 2 weeks before campaign closure

• Compliance Tracking/Blocking – Weekly

• Role-based training -weekly

As Director by CPM Director or designee if not defined 95% of the favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Cybersecurity Tips of the Week (Section 3.2.9 - Cybersecurity Workforce Development)

Contractor shall provide accurate, complete, and properly formatted documentation/ti ps and post them to applicable media to be ensure accurate, relevant, current, and complete information, free from major grammatical and formatting errors.

Contactor shall develop content based on current events and relevant cybersecurity activities and submit to COR or designee for review.

Contractor shall post approved tips to applicable media at least twice weekly favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Development Programs Customer Feedback and Skills Gap Surveys (Section 3.2.9 - Cybersecurity Workforce Development)

Contractor shall provide accurate, complete, and properly formatted survey in support of cybersecurity workforce activities to be ensure accurate, relevant, current, and complete information, free from major grammatical and formatting errors.

Contractor shall develop project schedule to develop and seek approval from governing body to launch survey.

Contractor shall launch and deliver reporting to COR or designee post training sessions or end of training campaigns 95% of favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Mandatory Compliance Training Campaigns (Section 3.2.9 - Cybersecurity Workforce Development)

Contractor shall provide relevant, complete, and properly configured campaigns and applicable reports in support of annual Cybersecurity mandatory compliance training to be delivered to the COR or designee.

Contractor shall select, launch, and monitor mandatory compliance training campaigns annually to be delivered to the COR or designee.

Contractor shall deliver new hire training campaign 2 month before the beginning of the fiscal year (October) to COR or designee for review.

Contractor shall deliver mandatory compliance training campaign one week before Mandatory Compliance Training Period as defined by the Office of Human Capital to COR or designee for review.

All other campaigns should be delivered as defined by COR or designee 95% of favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Cybersecurity Role- Based Training Fiscal Year Strategy (Section

3.2.9 - Cybersecurity Workforce Development)

Contractor shall provide accurate, complete, and properly formatted documents in support of annual Cybersecurity role-based training to be complete information, free from major grammatical and formatting errors.

Contractor shall deliver project strategy/schedule annually to be delivered to COR or designee 3 months before Cybersecurity role-based training launch, which is defined by COR or designee (2nd quarter of the fiscal year) favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Based Training Curriculum and Population Mapping Plan (Section 3.2.9 - Cybersecurity Workforce Development)

Contractor shall provide accurate, complete, and properly formatted documents in support of annual role-based training curriculum identification and population mapping be complete information, free from major grammatical and formatting errors.

Contractor shall identify applicable curriculum to be delivered to workforce for Cybersecurity role-based training and map each appliable user to work roles based on federal guidance.

Contractor shall deliver according to project strategy/schedule favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Based Training Knowledge and Skills Gap Survey Briefing (Section 3.2.9 - Cybersecurity Workforce Development)

Contractor shall provide accurate, complete, and properly formatted documents in support of annual skills gap survey be delivered to the COR or designee.

complete information, free from major grammatical and formatting errors.

Contractor shall analyze result and deliver briefing to COR or designee within 2 weeks of survey closure 95% of the time.

favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Required

Cybersecurity Phishing Campaigns (Section

3.2.9 - Cybersecurity Workforce Development)

Contractor shall provide relevant, complete, and properly configured campaigns and applicable reports in support of Cybersecurity phishing to be design, launch, and monitor phishing campaigns monthly favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

CyberStar Results Dashboards (Section

3.2.9 - Cybersecurity Workforce Development)

Contractor shall provide accurate, complete, and properly formatted documents in support of CyberStar Results to be delivered to complete information, free from major grammatical and formatting errors.

Contractor shall calculate results and deliver applicable documentation to COR or designee within 2 weeks of phishing campaign completion 95% of favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Cybersecurity Wiki Pages (Section 3.2.9 - Cybersecurity Workforce Development)

Contractor shall provide accurate, complete, and properly formatted documents on the Cybersecurity managed wiki pages delivered to COR or designee.

Contractor shall ensure accurate and complete, relevant, documentation/ information and is free from major grammatical and formatting errors.

Contractor shall update CPM wiki pages at least monthly and Cybersecurity wiki pages quarterly.

Contractor shall deliver to COR or designee for validation 95% of favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Awareness Month (Section 3.2.9 - Cybersecurity Workforce Development)

Contractor shall provide accurate, complete, and properly formatted documentation and plan and facilitate, host, present, applicable activities in support of Cybersecurity Awareness month occurring October each year to be delivered to complete documentation/infor mation, free from major grammatical and formatting errors.

Contractor shall deliver a Cybersecurity Awareness Month plan to the COR or designee 3 months prior to October 1st of each year 95% of the time.

Contractor shall ensure the Cybersecurity Awareness Month activities are delivered per the timelines approved in the

A M h favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

New Hire Orientation Brief (Section 3.2.9 - Cybersecurity Workforce Development)

Contractor shall provide accurate, complete, and properly formatted documents in support of new hire cybersecurity awareness training.

Contractor shall present/brief the materials at scheduled orientation sessions.

Contractor shall ensure accurate and complete information, free from major grammatical and formatting errors;

delivery according to schedule defined by the Office of Human Capital (estimated bi-weekly) 95% of the time.

favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

CPM Workforce Development Standard Operating Procedures (Section 3.2.9 - Cybersecurity Workforce Development)

Contractor shall provide accurate, complete, and properly formatted documents delivered to the COR or designee in support of phishing exercises, cybersecurity awareness events, general user cyber awareness training and specialized role based cyber training.

Contractor shall ensure accurate and complete documentation/ information that reflects current workforces’ development processes and is free from major grammatical and formatting errors.

Contractor shall ensure documents are maintained as current. Contractor shall make updates no later than 5 business days as a change occurs and delivered to COR or designee for review 95% of the time.

favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Cybersecurity Events and Conferences (Section 3.2.9 - Cybersecurity Workforce Development)

Contractor shall provide accurate, complete, and properly formatted documents and host/facilitate cybersecurity events and conferences as defined by the COR or designee.

Contractor shall ensure accurate and complete, relevant, documentation/ information and is free from major grammatical and formatting errors.

Contractor shall ensure the coordination of an event to include logistics, facilitation, and agenda.

Contractor shall coordinate Cybersecurity ALL hands to be delivered to the COR or designee quarterly.

Contractor shall deliver all other events and conference as defined by CPM Director or designee favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on

Exhibit C - Safeguards & Risk Management Task Area QASP

Acceptable Quality Level (AQL)

Method of Surveillance

Incentive/ Disincentive

SRM

Documentation and Deliverables (Applies to all written deliverables under Subtask 3.3 unless otherwise defined in this

QASP)

Contractor shall provide accurate and complete documents delivered to the COR or designee on the agreed-upon delivery date

Accurate and complete information, free from major grammatical errors;

delivery according to project schedule.

Periodic Inspection meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Security Implementation Plan (SIP) Quality and Timeliness (Section 3.3.1.1 - Assessment & Authorization Support)

Contractor shall provide accurate and complete input to the SIP and delivered to the COR or designee on the agreed-upon delivery date.

Timeliness:

Meets: ≤ due date + 1 day Unsatisfactory: ≥ due date + 1 day

Quality:

Submitted using the approved SIP template. Accurate and complete information addressing critical security controls pertinent to application or system are fully addressed and free from spelling and major grammatical errors.

Periodic Inspection Incentive: Consistently meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Acceptable Quality Level (AQL)

Method of Surveillance

Incentive/ Disincentive

POA&M

Metrics and Reports (Section 3.3.1.2 - Plan of Action and Milestones Support )

Contractor will fully document POA&Ms, track their progress, and follow up with System Owners to facilitate resolution

100% of POA&Ms are properly documented and updated monthly.

Periodic Inspection Incentive: Consistently meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Security Controls Assessment Quality (Applies to all deliverables under Section 3.3.2.2 - Assessment & Authorization Support )

Contractor shall provide the Authorizing Official (AO) with a succinct description of key findings resulting from the security test effort.

No more than three

(3) SCA Reports per quarter will be returned for rework due to inaccuracies or incompleteness.

comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Ongoing Assessment Coverage (Section 3.3.3 - Continuous Control Effectiveness Monitoring Support)

Ongoing Assessments are performed to ensure that the assessment of the security controls in the last system Security Authorization is still valid

Each system will undergo a review of 33.3% of all security controls annually with a 100% review over a three-year period.

comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments

Acceptable Quality Level (AQL)

Method of Surveillance

Incentive/ Disincentive

GRC Support Documentation & Deliverables (Section 3.3.4 - Cybersecurity Governance, Risk, and Compliance Support)

Contractor shall provide accurate and complete documents delivered to the COR or designee on the agreed-upon delivery date

Accurate and complete information, free from major grammatical errors;

delivery according to comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments

Exhibit D - Security Architecture and Engineering Task Area QASP

Standard Acceptable Quality Level (AQL) Method of

Surveillance Incentive/

Disincentive

SAE

Documentation and Deliverables (Applies to all written deliverables under Subtask 3.4 unless otherwise defined in this QASP)

Contractor shall provide accurate and complete documents delivered to the COR or designee on the agreed-upon delivery date.

Timeliness:

Meets: ≤ due date + 1 day Unsatisfactory: ≥ due date + 1 day

Quality:

Address all required elements and reflects technical depth and competency, free from spelling and grammatical errors

Periodic Inspection

Incentive:

Consistently meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive:

If Contractor does not consistently meet AQL, unfavorable comments may be documented on past

Surveillance Incentive/

Disincentive Architecture Reviews (Section 3.4.1 - Security Architecture Support)

Contractor shall provide accurate and complete architecture reviews based on CFPB security architecture and industry best practices. Reviews shall be provided either in verbal or written communication, pending on the method requested by the COR or the designee based on the agreed-upon delivery date.

Accurate and complete information, free from major grammatical errors; delivery according to agreed to schedule.

Periodic Inspection

Incentive:

Consistently meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive:

If Contractor does not consistently meet AQL, unfavorable comments may be documented

Surveillance Incentive/

Disincentive Change Request and Design Reviews (Section 3.4.1 - Security Architecture Support)

Contractor shall provide accurate and complete documents delivered to the COR or designee on the agreed-upon delivery date.

Reviews shall be provided and must address significant issues, findings and recommendations.

Timeliness:

Meets: ≤ due date + 1 day Unsatisfactory: ≥ due date + 1 day

Quality:

Technical review complete, addresses technical elements and relevant issues or concerns identified meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive:

If Contractor does not consistently meet AQL, unfavorable comments may be documented

Surveillance Incentive/

Disincentive Security Configuration Baseline Quality & Timeliness (Section 3.4.3 - Security Baseline Development)

Contractor shall provide accurate and complete documents delivered to the COR or designee on the agreed-upon delivery date.

Timeliness:

Meets: ≤ due date + 1 day Unsatisfactory: ≥ due date + 1 day

Quality:

Accurate and complete information, free from spelling and major grammatical errors

Periodic Inspection

Incentive:

Consistently meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive:

If Contractor does not consistently meet AQL, unfavorable comments may be documented

Surveillance Incentive/

Disincentive Information Technology Contingency Plan (ITCP) Documentation & Deliverables (Section 3.4.5 - Information Technology Contingency Planning )

Contractor shall provide accurate and complete ITCP documentation delivered to the COR or designee on the agreed-upon delivery date.

Timeliness:

Meets: ≤ due date + 1 day Unsatisfactory: ≥ due date + 1 day

Quality:

Accurate and complete information, free from spelling and major grammatical errors.

Annual Inspection

Incentive:

Consistently meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive:

If Contractor does not consistently meet AQL, unfavorable comments may be documented

Surveillance Incentive/

Disincentive ITCP Training Documentation & Deliverables (Section 3.4.5.1 - ITCP Training)

100% training is provided to all new users that have a role with supporting the ITCP. A minimum of two (2) refresher training is provided monthly. Schedule of training is based on schedule approved by the COR or designee.

Timeliness:

Meets: ≤ due date + 1 day Unsatisfactory: ≥ due date + 1 day

Quality:

Accurate and complete information, free from spelling and major grammatical errors.

Annual Inspection

Incentive:

Consistently meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive:

If Contractor does not consistently meet AQL, unfavorable comments may be documented

Surveillance Incentive/

Disincentive ITCP Testing Documentation & Deliverables (Section 3.4.5.2 - ITCP Testing)

100% Testing and Exercises for each system contained in the ITCP Annex is performed annually.

For each system, ITCP Testing and Exercises include:

(1) ITCP Exercise Plan and Schedule including test objectives, success criteria, roles, responsibilities, scenarios, scripts, procedures, and timelines; (2) ITCP Test Report Results.

Timeliness:

Meets: ≤ due date + 1 day Unsatisfactory: ≥ due date + 1 day

Quality:

Accurate and complete information, free from spelling and major grammatical errors.

Annual Inspection

Incentive:

Consistently meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive:

If Contractor does not consistently meet AQL, unfavorable comments may be documented

Exhibit E - Cybersecurity Operations Task Area QASP

Acceptable Quality Level

(AQL)

Method of Surveillance

Incentive/ Disincentive

CyberOps Documentation & Deliverables (Applies to all written deliverables under Subtask 3.5 unless otherwise defined in this QASP)

Contractor shall provide accurate, complete, and properly formatted work products delivered to the COR or designee on the agreed-upon delivery date

Accurate and complete information, free from major grammatical and formatting errors; delivery according to comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Responses to Data Calls (Section 3.5.1 - Cybersecurity Operations Project Manager) and (Section 3.5.2 - CSIRT Task Lead)

Contractors shall collaborate with Government personnel to provide responses that contain required data defined within the call.

Data calls will receive a response on or before the due date.

90% of data call responses will be delivered on time. The remaining 10% must be addressed by a Government-approved exception for delay and data must be provided by an agreed-upon alternate date.

comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Cyber Incident Tracking Tickets (Section 3.5.3.1 - Computer Security Incident Response Team Support)

Contractor shall ensure ticket information is made current as updates are received and/or discovered; Tickets must contain all required data fields.

90% of tickets should be of sufficient accuracy and completeness so that rework is not required.

comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past

Acceptable Quality Level

(AQL)

Method of Surveillance

Incentive/ Disincentive

Incident Reports Timeliness & Quality (Section 3.5.3.1 - Computer Security Incident Response Team Support))

Contractor shall ensure reports are consistent with the requirements of relevant NIST Special Publications and Federal Incident Reporting Guidelines

Incident data is accurately recorded and complete; all reportable incidents requiring US-CERT/NCCIC notification are communicated within one hour.

comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Threat Indicator List Timeliness & Quality (Section 3.5.3.2 - Cyber Threat Intelligence Support)

Contractor shall process indicators for blocks, watchlist addition, or other applicable defensive capabilities within agreed-upon delivery dates and times

Indicator data is accurate and applied to blocklist and/or watchlist processes at least weekly.

Random Sampling Inspection

Incentive: Consistently meets/exceeds AQL, favorable comments may be documented on Past Performance Disincentive: If Contractor does not consistently meet AQL, unfavorable comments may be documented on past performance.

Availability of On Demand Advanced Incident Response Services (Section 3.5.4.1 - Advanced Incident Response Support )

The contractor shall make appropriate on demand staff available within one business day from the time of written direction is given by the CISO or COR of an…