Sources Sought Notice Request No. 75F40126Q00333

Attachment – Draft SOW

Food and Drug Administration (FDA) Cybersecurity Program

DRAFT

NEXUS

NextGen Cyber Engineering, Operations AI, and Unified Services

Blanket Purchase Agreement (BPA) Statement of Work (SOW)

1 EXECUTIVE SUMMARY

1.1 Background

1.2 Objective

2 CYBERSECURITY ENGINEERING AND OPERATIONS REQUIREMENTS

2.1 Cybersecurity Engineering and Platform Modernization

2.2 Cybersecurity Program Modernization and Workforce Support

2.3 Secure Cloud Connectivity and the Trusted Internet Connection (TIC) Engineering (Multi- Cloud)

2.4 Enterprise Cybersecurity Platform Infrastructure Support

2.5 Cyber AI Defense and Counterintelligence Cyber Recon Hunt

2.6 Vulnerability and Threat Management

3 CYBERSECURITY OPERATIONS AND THREAT MANAGEMENT REQUIREMENTS

3.1 Endpoint Security

3.2 Network Security

3.3 Application and Workload Security

3.4 Data and Information Protection

3.5 Cybersecurity Operations (Security Operations Center (SOC) / Network Operations Center (NOC) – 24x7x365 Monitoring and Response

3.6 Core SOC/NOC Monitoring and Operational Requirements

3.6.1 Enterprise Network & Infrastructure Monitoring

3.6.2 Platform, Application, and Service Monitoring

3.6.3 Security Monitoring & Threat Detection

3.6.4 Incident Response & Reporting

3.6.5 Operational Coordination & Situational Awareness

3.6.6 Specialized Monitoring Capabilities

3.6.7 Automation, Orchestration, and Zero Trust Enablement

3.6.8 Zero Trust Architecture and Governance

3.6.9 Cybersecurity Documentation and Continuity Support

3.6.10 Digital Forensics Support

3.6.11 Foreign Travel Security Support

3.7 ICAM Overview

3.8 ICAM Task Areas

3.9 ICAM Operations

3.10 ICAM Engineering Services

3.11 ICAM Engineering and Operations Requirements

3.12 ICAM Engineering, Integration, and Technical Services

3.13 Security, Compliance, and Continuous Monitoring

4 ARTIFICIAL INTELLIGENCE AND AUTOMATION REQUIREMENTS

5 POST QUANTUM CRYPTOGRAPHY (PQC)

6 ZERO TRUST IDENTITY HUB

7 APPENDIX A: CYBERSECURITY CAPABILITIES INVENTORY (CONFIDENTIAL)

9 APPENDIX C: OTHER CONTRACT LANGUAGE

10 PLACE OF PERFORMANCE

7.1 10.1 Performance Locations

11 SECTION 508 STANDARDS, GFE, AND SECURITY CLEARANCE

7.2 11.1 Government Furnished Equipment (GFE)/Government Furnished Information (GFI)

7.3 11.2 Contractor Personnel Security Clearance Standards and Residency Requirements

7.4 11.3 Clauses

12 SECURITY AND PRIVACY REQUIREMENTS

7.5 12.1 Security Requirements

7.6 12.2 Training Requirements

7.7 12.3 Rules of Behavior

1 EXECUTIVE SUMMARY

1.1 Background

Cybersecurity is a top priority at the U.S. Food and Drug Administration (FDA), and we take seriously our responsibility to protect industry and public health information in today’s environment of increased cybersecurity risks. Our Cybersecurity, Counterintelligence, and Insider Threat Program is comprised of highly skilled cyber professionals actively identifying and thwarting cyber threats, vulnerabilities, and risks to FDA’s IT infrastructure encompassing over 21,000 end users, 4 prominent public-facing applications, and 413 production/pre-production systems and applications. The FDA Office of Digital Transformation (ODT) recognizes the risks associated with operating a global information technology enterprise in support of our public health mission. Over the past decade, our FDA Cybersecurity, Counterintelligence, and Insider Threat Program has evolved from a program under congressional scrutiny to an award-winning organization at the forefront of federal healthcare cybersecurity.

FDA is a prime and persistent target for cybercrime and economic espionage due to trillions of dollars of value in industry trade secrets, company confidential, and other commercial and intellectual property within our IT enterprise. Nation state actors, such as Russia, China, and Iran, along with trusted insiders and transnational criminal organizations are continuously developing advanced technical capabilities to thwart FDA’s cyber defenses and those of partner agencies via third party contractors, as evidenced by the massive SolarWinds hack, the ransomware attack on a third party hired by the Centers for Medicare and Medicaid Services (CMS) that resulted in the loss of PII of over 2.8 million individuals, and the zero-day exploit targeting two HHS contractors at the Center for Disease Control and Prevention (CDC) and the National Institutes of Health (NIH) that resulted in the loss of PII for over 1.88 million individuals. Additionally, we have witnessed significant increases in ransomware and other cyberattacks within the healthcare sector, to include hospitals, pharmacies, and health care providers. The threats, vulnerabilities, and risks to our critical assets remain high and pose significant risk to our FDA public health mission and reputation as a world health leader, as well as to U.S. National and Economic Security.

In January 2022, the FDA Cybersecurity program established the “FDA Zero Trust Cybersecurity Network Defense Implementation Plan” to transform the program toward Zero-Trust principles. Zero Trust is a cybersecurity paradigm shift focused on asset protection and the premise that trust is never granted implicitly but must be continually evaluated. Zero Trust architecture is an end-to-end approach to enterprise resource and data security that encompasses identity and access management, operations, endpoints, hosting environments, and the interconnecting infrastructure. Traditionally, an agency’s cybersecurity construct focuses on perimeter defense and authorized users are given access to a broad collection of resources once inside the internal network, whereas Zero Trust is a new framework designed to meet the security considerations of our hyper-connected digital world as perimeters have essentially dissolved for most modern enterprises. The FDA has implemented a mature, successful cybersecurity program aligned with the federal Cybersecurity Framework and a focus on cyber capabilities, compliance, and workforce development. Success is defined by a commitment to excellence and the ability to provide strategic communications that support the FDA’s public health mission.

1.2 Objective

The objective of this Blanket Purchase Agreement (BPA) is to establish a consolidated, enterprise-wide acquisition vehicle to deliver integrated Cybersecurity Engineering, Cybersecurity Operations and Threat

Management, Identity, Credential, and Access Management (ICAM), Artificial Intelligence and Automation-Enabled Capabilities, and Post Quantum Cryptography (PQC) capabilities in support of the U.S. Food and Drug Administration (FDA). This BPA enables a scalable, agile, and mission-aligned framework to rapidly acquire and deploy advanced, AI-enabled cybersecurity services, intelligent automation tools, and adaptive solutions necessary to protect FDA’s confidentiality, integrity, and availability of data and critical information systems.

This effort unifies three interdependent cybersecurity domains into a single strategic vehicle, strengthening FDA’s ability to implement a proactive, defense-in-depth security posture across a complex, distributed, and high-value enterprise environment. The BPA is designed to enhance operational efficiency, improve security integration, and accelerate the adoption of modern technologies, including machine learning (ML), predictive analytics, autonomous response capabilities, and intelligent process automation, to address evolving cyber threats. The BPA further promotes continuous optimization through AI-enabled decision support, orchestration, and real-time threat correlation, enabling faster, data-driven responses and reduced reliance on manual intervention.

FDA operates at the intersection of public health, national security, and economic stability, overseeing products that account for approximately 20 percent of the U.S. economy. FDA systems store and process highly sensitive information, including proprietary industry data, confidential regulatory information, clinical and scientific research data, and critical public health and safety information. Given the sensitivity and strategic value of these systems, FDA is a high-value target for nation-state actors, cybercriminal organizations, and insider threats. A successful cyber incident could significantly disrupt regulatory operations, compromise data integrity, impact public health decision-making, and erode public trust.

Through this BPA, the Contractor shall provide integrated, intelligent, and automation-driven end-to-end cybersecurity support services, including the application of AI-enabled analytics, automated workflows, and self-optimizing security capabilities across the following areas

Enterprise Cybersecurity Strategy and Modernization Planning Cybersecurity Engineering and Platform Modernization Cybersecurity Operations and Threat Management Services Identity, Credential, and Access Management (ICAM) Services Artificial Intelligence and Automation Enablement Post Quantum Cryptography (PQC)

In summary, this BPA seeks to systematically reduce and ultimately eliminate manual processes, transition toward autonomous cybersecurity operations, and significantly increase mission output through the strategic application of Artificial Intelligence (AI), intelligent automation, and advanced analytics. The BPA positions FDA to evolve into a data-driven, AI-enabled cybersecurity enterprise capable of anticipating, detecting, and responding to threats with speed, precision, and minimal human intervention.

2 CYBERSECURITY ENGINEERING AND OPERATIONS REQUIREMENTS

2.1 Cybersecurity Engineering and Platform Modernization

The Contractor shall provide centralized enterprise cybersecurity engineering, integration, and modernization support to design, implement, and sustain FDA’s Cybersecurity Platform (CSP) and associated security capabilities across on-premises and cloud environments.

The Contractor shall:

Framework Alignment and Architecture

Align all engineering activities to applicable Federal cybersecurity standards and guidance, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), CISA Zero Trust Maturity Model, and other relevant OMB and DHS directives, while leveraging Artificial Intelligence (AI)-enabled compliance monitoring, automated control validation, and continuous authorization (cATO) capabilities to ensure ongoing alignment and rapid adaptation to evolving federal requirements.

Support the design, integration, and evolution of a scalable, resilient, and interoperable cybersecurity architecture aligned to a defense-in-depth strategy, AI-driven architecture optimization, intelligent workload distribution, automated resilience testing, and predictive risk modeling to enhance system performance, security posture, and operational agility.

Platform Engineering and Integration

Provide engineering, administration, and sustainment support for the FDA Cybersecurity

Platform, including Security Information and Event Management (SIEM) and associated tools, AI-enhanced analytics, automated system tuning, and self-optimizing platform capabilities to improve performance, reduce manual intervention, and enable real-time threat visibility.

Design, develop, integrate, and configure new and existing data connections, pipelines, and interfaces across enterprise security systems and environments, incorporating intelligent automation, machine learning (ML)-assisted data mapping, and adaptive integration frameworks to accelerate deployment and improve data accuracy and consistency.

Implement and manage data ingestion, normalization, and transformation processes, including Extract, Transform, and Load (ETL) capabilities, to ensure efficient and reliable data flow, leveraging AI-driven data enrichment, automated anomaly detection, and dynamic data quality validation to enhance data integrity and usability.

Enable interoperability, data exchange, and application program interface (API) connectivity between CSP and enterprise systems, including but not limited to endpoint protection, network security tools, cloud security platforms, vulnerability management systems, identity services, case management systems, and governance/risk/compliance platforms, through the use of automation-first integration patterns, AI-enabled orchestration, and intelligent API management to support seamless, secure, and scalable enterprise-wide connectivity.

Advanced Cloud and Network Security Engineering

Provide engineering support for cloud and hybrid environments, including Infrastructure-as-a-

Service (IaaS), Platform-as-a-Service (PaaS), Software-as-a-Service (SaaS), and Secure Access Service Edge (SASE) security solutions, leveraging AI-driven cloud security posture management

(CSPM), automated configuration enforcement, and continuous monitoring capabilities to ensure secure, scalable, and resilient environments.

Support secure architecture and implementation of Software Defined Networking (SDN), Software Defined Wide Area Networking (SD-WAN), and Zero Trust capabilities, incorporating intelligent traffic analysis, AI-enabled policy enforcement, and automated segmentation to dynamically adapt to evolving threat conditions.

Provide integration and engineering support across major cloud and security service providers (e.g., AWS, Azure, Google Cloud Platform, and other enterprise security solutions as required), utilizing automation-first integration, AI-assisted configuration management, and cross-platform orchestration to ensure seamless interoperability and optimized performance.

Implement, document, and manage secure data ingestion priorities and schedules in accordance with National Archives and Records Administration (NARA) and Federal logging and data requirements (e.g., OMB M-21-31), leveraging automated data lifecycle management, AI-driven prioritization, and real-time compliance validation to ensure accuracy, completeness, and audit readiness.

Tune and optimize platform performance, including log ingestion, storage utilization, and query efficiency to improve operational effectiveness and cost efficiency, through AI-enabled performance analytics, automated resource scaling, and predictive capacity planning to reduce latency and maximize system throughput.

Provide AI-enabled cybersecurity capabilities and secure cloud engineering support, incorporating machine learning (ML)-driven threat detection, automated remediation workflows, and intelligent orchestration, to enhance FDA’s cybersecurity posture within cloud environments (e.g., Google Cloud Platform (GCP), AWS).

Integrate artificial intelligence and machine learning capabilities into FDA’s cybersecurity ecosystem to enhance real-time threat detection, advanced analytics, and autonomous response, proactive, and predictive defense mechanisms.

Develop and refine AI models using cybersecurity data to support anomaly detection, behavioral analytics, and predictive threat identification, leveraging continuous learning, model retraining, and automated data enrichment pipelines to improve accuracy and reduce false positives.

Implement secure AI development practices aligned with Federal guidance, including transparency, accountability, and automated risk mitigation controls, ensuring responsible and secure adoption of AI technologies.

Establish performance metrics to measure effectiveness of AI-driven cybersecurity capabilities, utilize automated performance monitoring, AI model evaluation frameworks, and continuous optimization feedback loops to drive measurable improvements.

Design, implement, and enhance secure cloud architectures aligned with Zero Trust principles and Federal cybersecurity requirements that reduce latency and increase speed to the Cloud, incorporating AI-driven architecture optimization, intelligent routing, and automated infrastructure provisioning (Infrastructure-as-Code).

Engineer and sustain TIC 3.0 and FedRAMP compliant connectivity solutions within Cloud environments, leveraging automated compliance validation, continuous monitoring, and AI-assisted security control enforcement to maintain accreditation and operational readiness.

Configure and manage cloud-native services, including networking, identity, and security controls, utilizing automation, policy-as-code, and AI-enabled configuration management to ensure consistency, scalability, and rapid deployment.

Support secure integration of third-party platforms and SaaS providers within the cloud environment through automated onboarding, AI-driven risk assessment, and continuous security validation, ensuring secure and efficient expansion of the FDA cybersecurity ecosystem.

Testing, Documentation, and Operations Conduct system and integration testing to validate security, performance, and compliance, utilizing automated testing frameworks, AI-driven test case generation, continuous validation pipelines, and predictive defect analysis to improve coverage, reduce manual testing effort, and accelerate deployment timelines.

Develop and maintain technical documentation, including architecture diagrams, runbooks, and operational procedures, leveraging automated documentation generation, AI-assisted knowledge management, and dynamic documentation updates to ensure accuracy, consistency, and real-time relevance

Provide ongoing operational support, monitoring, and issue resolutions in coordination with FDA stakeholders, incorporating AI-enabled monitoring, automated incident detection and response, self-healing capabilities, and intelligent ticketing workflows to minimize downtime and improve service delivery.

Threat Intelligence and Analytics Enablement

Develop, enhance, and maintain dashboards, visualizations, and analytic capabilities to support threat intelligence, monitoring, and decision-making, utilizing AI-driven data visualization, real-time analytics, and automated insight generation to enable faster, data-informed decisions.

Enable advanced analytics capabilities through integration of emerging technologies, including artificial intelligence and automation, where applicable, leveraging machine learning (ML), behavioral analytics, and predictive modeling to proactively identify threats and trends across the enterprise.

Develop sensors with automated alerts and triggers from a variety of cyber defense tools (e.g., intrusion detection, firewalls, network traffic logs) to maintain comprehensive enterprise-side visibility, incorporating AI-based anomaly detection, automated correlation, and intelligent alert prioritization to reduce false positives and improve response efficiency.

Infrastructure and Connectivity Support

Support secure connectivity and data flow between FDA environments, including data centers, cloud environments, and external partner systems, utilizing automated network orchestration, AI-driven traffic analysis, and intelligent routing optimization to ensure secure, reliable, and high-performance connectivity.

Secure data in transit and at rest using Federal Information Processing Standard (FIPS) 140-2 encryption and NIST approved cryptographic modules, incorporating automated encryption management, AI-assisted key lifecycle management, and continuous compliance monitoring to maintain data protection and regulatory alignment.

Provide engineering support to integrate and enhance capabilities aligned with DHS Continuous Diagnostics and Mitigation (CDM) and HHS cybersecurity initiatives, leveraging AI-enabled continuous diagnostics, automated vulnerability identification, and real-time risk scoring to strengthen enterprise-wide cybersecurity posture and accelerate remediation efforts.

Specialized Security Support

Provide engineering expertise to support specialized environments, including digital forensics and insider threat platforms, ensuring appropriate access controls and data protection, while incorporating automated monitoring and AI-assisted analysis to enhance investigative capabilities and reduce manual effort.

Ensure the data in digital forensic systems are legally admissible in a court of law, by following rigorous standards of security, integrity, and chain of custody, supported by automated audit logging and integrity validation mechanisms.

Change Request

Adhere to FDA IT Change Management process to submit standard or emergency change requests (CR) as necessary, that will modify software, infrastructure, security controls, and AI systems, leveraging automation and workflow orchestration tools to improve speed, traceability, and approval efficiency.

Documentation and Knowledge Transfer

Develop, maintain, and update engineering documentation, including system diagrams, target state diagrams, standard operating procedures, and configuration guides, utilizing automated documentation tools and centralized knowledge repositories to ensure accuracy and accessibility.

Provide structured knowledge transfer and training to Government personnel to ensure continuity of operations and capability maturity, incorporating AI-enabled training support and interactive learning platforms where appropriate.

Operational Support and Reporting

Provide support for planned and unplanned outages, including root cause analysis and development of After-Action Reports (AARs), leveraging automated monitoring, AI-assisted diagnostics, and predictive analytics to accelerate resolution and reduce recurrence.

Coordinate with vendors and service providers, including facilitating system health checks and performance reviews as required, supported by automated reporting and performance analytics.

Develop lessons learned to include root cause analysis, identification of control failures, and proposed corrective action, utilizing data-driven insights and trend analysis to support continuous improvement.

Modernization and Transformation

Develop and execute modernization strategies to enhance cybersecurity capabilities, including migration of legacy systems to cloud-native architectures, incorporating automation, infrastructure-as-code, and AI-informed decision-making to accelerate transformation efforts.

Develop comprehensive transition and implementation plans for major platform changes (e.g., SIEM migration), including assessment of current state, dependency mapping, phased implementation, risk mitigation, and continuity of operations, supported by automated planning tools and predictive risk analysis.

Identify and implement cost optimization opportunities, including reduction of infrastructure overhead, improved licensing strategies, and increased automation, leveraging AI-driven cost analytics and resource optimization techniques to maximize efficiency.

2.2 Cybersecurity Program Modernization and Workforce Support

The Contractor shall provide strategic and operational support to enhance FDA’s cybersecurity program, workforce, and governance framework, leveraging data-driven analysis, automation, and AI-enabled insights to improve operational maturity and mission effectiveness.

The Contractor shall:

Assess and recommend improvements to cybersecurity roles, responsibilities, and organizational structure aligned with the NIST Cybersecurity Framework (CSF) and Federal workforce guidance, utilizing workforce analytics and capability gap assessments.

Evaluate mission priorities and recommend process improvements to enhance program efficiency, effectiveness, and alignment with FDA cybersecurity objectives, incorporating automation and process optimization strategies to reduce manual effort and improve performance.

Develop and enhance workforce development strategies, including training, recruitment, and retention programs aligned to critical cybersecurity skillsets, leveraging data-informed workforce planning and emerging technology readiness assessments.

Support the development and delivery of employee engagement, technical training, and leadership development initiatives, incorporating AI-enabled learning platforms and role-based training approaches where appropriate.

Develop and maintain executive-level dashboards and reporting capabilities to support decision-making and program oversight.

Provide quarterly updates to cybersecurity portfolio documentation and facilitate executive review sessions.

Ensure annual and continuous training to contract staff on cybersecurity, Zero Trust, Artificial Intelligence (AI), including cyber job specialty areas in the NIST Workforce Framework for Cybersecurity and National Initiative for Cybersecurity Education (NICE).

2.3 Secure Cloud Connectivity and the Trusted Internet Connection (TIC) Engineering (Multi- Cloud)

The Contractor shall provide engineering, integration, and operational support to implement and enhance secure cloud connectivity solutions aligned with TIC 3.0 requirements:

Design, engineer, integrate, and sustain TIC Policy Enforcement Point (PEP) capabilities across FDA cloud environments (e.g., AWS, Google Cloud Platform, and other authorized environments), utilizing automated policy enforcement and AI-assisted traffic inspection to enhance visibility and control.

Ensure compliance with DHS TIC 3.0, FISMA, FedRAMP, and other applicable Federal cybersecurity requirements, through automated compliance validation, continuous monitoring, and AI-enabled control assessment.

Support secure cloud-to-cloud, SaaS, PaaS, and SASE connectivity through implementation of network security, segmentation, micro-segmentation and boundary protection services.

Configure and manage cloud networking components, including virtual networks, endpoints, load balancers, and secure connectivity services, leveraging infrastructure-as-code, automated provisioning, and AI-assisted configuration management to ensure consistency and scalability.

Support firewall engineering and operations, including configuration, patching, rule management, and optimization.

Provide cloud architecture guidance for secure multi-account/multi-project environments, including identity, access control, and network segmentation strategies. supported by AI-informed design recommendations and automated governance controls. Support migration planning and execution from legacy TIC architectures to TIC 3.0-aligned solutions leveraging automated migration tooling and predictive risk analysis to minimize disruption and accelerate transition.

Provide testing, validation, and documentation, including test plans, architecture diagrams, and operational runbooks, utilizing automated testing frameworks and AI-assisted documentation generation to improve accuracy and efficiency.

Deliver ongoing operational support for TIC services, including troubleshooting, monitoring, and integration with enterprise security capabilities, incorporating AI-enabled monitoring, automated incident response, and self-healing network capabilities to enhance reliability and performance.

2.4 Enterprise Cybersecurity Platform Infrastructure Support

The Contractor shall provide specialized engineering and sustainment support for critical cybersecurity infrastructure and platforms, leveraging automation and AI-assisted diagnostics to improve resiliency and response times.

Provide rapid-response engineering support for critical cybersecurity infrastructure failures, including coordination with vendors and OEM-certified resources, utilizing automated alerting, AI-driven root cause analysis, and intelligent incident triage to accelerate resolution. Support the recovery and restoration of cybersecurity platforms and supporting infrastructure to ensure minimal operational disruption, incorporating automated recovery procedures where feasible.

Maintain and enhance infrastructure supporting SIEM, forensic environments, vulnerability management systems, network security devices, and enterprise monitoring capabilities, leveraging AI-enabled performance monitoring and automated system optimization to ensure stability and scalability.

Support integration with DHS Continuous Diagnostics and Mitigation (CDM) and other Federal cybersecurity initiatives, utilizing automated data integration and AI-assisted risk analysis to strengthen enterprise-wide visibility and compliance.

2.5 Cyber AI Defense and Counterintelligence Cyber Recon Hunt

The Contractor shall provide advanced threat hunting and intelligence capabilities to proactively identify, analyze, and mitigate sophisticated cyber threats across the FDA enterprise

Threat Hunt Operations

Leverage structured frameworks (e.g., MITRE ATT&CK) of adversary tactics, techniques, and procedures (TTPs) to model attacker behavior, improve threat detection, and strengthen overall cybersecurity posture.

Leverage AI capabilities as a force multiplier to search for hidden threats across FDA networks, environments, and devices to detect unknown attack patterns.

Employ AI for pattern recognition to correlate signals and detect anomalous behavior across various data sources.

Use AI in Threat Hunt operations to provide meaningful insights, improve the speed of reviews, reduce false positive, and gain deeper insights of potential attack chains.

Conduct tactical, operational, and strategic cyber threat hunting activities across FDA networks, systems, and data environments.

Identify indicators of compromise, anomalous behavior, and advanced persistent threat activity beyond traditional monitoring capabilities.

Investigate threat intelligence alerts based on known malware signatures and definitive Indicators of Attack (IOAs).

Collaborate with cybersecurity operations, incident response, advanced forensics, counterintelligence, and insider threat teams to coordinate response actions.

Provide proactive Cybersecurity, Reconnaissance, and Threat Hunting support to FDA Office of Information Security (OIS).

Implement AI-assisted and autonomous threat hunting, reducing reliance on manual analyst-driven investigations.

Leverage generative AI to produce threat intelligence summaries, reports, and executive briefings.

Enable continuous, automated hypothesis generation for threat hunting based on evolving attack patterns.

Integrate real-time adaptive detection models that evolve without manual rule creation.

Threat Intelligence and Analysis

Research, analyze, and produce actionable intelligence on emerging threats, threat actors, and attack methodologies.

Maintain enterprise situational awareness of global cyber threats and their potential impact to FDA systems and mission.

Recommend intelligence-driven defensive strategies and improvements to FDA’s cybersecurity posture.

Respond to detected and reported cybersecurity threats per industry standards and Federal security mandates, in accordance with FDA’s internal cybersecurity policies, and under FDA Office of Information Security (OIS) oversight and approval.

Leverage AI to ingest and aggregate significant volumes of data from different sources including logs, open-source intelligence (OSINT), dark web forums, social media.

Reporting and Communications

Develop and maintain dashboards and reports supporting cyber hunt operations and global threat awareness.

Provide real-time notification of validated threat activity in accordance with defined Service Level Agreements (SLAs).

Deliver recurring intelligence reports and executive-level briefings to FDA leadership.

2.6 Vulnerability and Threat Management

The Contractor shall enhance FDA’s cybersecurity posture through continuous vulnerability identification, tracking, remediation, and reporting.

Implement and maintain enterprise AI-driven vulnerability tracking and risk management capabilities to identify missing patches, software updates, system misconfigurations, and unauthorized software.

Develop and manage a vulnerability risk register, including tracking of remediation status, trends, and risk prioritization.

Implement vulnerability and threat management capabilities to detect and mitigate adversarial AI threats (e.g., AI-generated phishing, deepfakes, automated vulnerability exploitation).

Incorporate AI automated vulnerability scanning to analyze data from enterprise security tools and identify systemic risks, recurring issues, and high-risk assets.

Establish and manage a closed-loop vulnerability management process, including identification, remediation, validation, and reporting.

Leverage AI capabilities to perform routine automated vulnerability scans on systems, to improve accuracy and reduce manual effort.

Monitor vulnerability and threat management intelligence feeds and Common Vulnerability Exposure (CVE) advisory boards and the NIST National Vulnerability Database. Coordinate with the coordination center, system owners, ISSOs, and risk managers to validate remediation actions and ensure compliance.

Provide recommendations to improve vulnerability management processes and reduce enterprise risk exposure.

Automation and SOAR Integration

Expand and enhance Security Orchestration, Automation, and Response (SOAR) capabilities across the cybersecurity ecosystem.

Develop and refine automated workflows and playbooks to improve incident response efficiency.

Integrate SOAR with SIEM and other enterprise tools to reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).

Incorporate AI-enabled automation to support advanced threat detection and response.

Establish metrics and reporting to measure effectiveness of automation capabilities.

Enable automated remediation workflows, including patching, configuration changes, and compensating controls Deploy continuous attack surface discovery using AI and external reconnaissance tools.

3 CYBERSECURITY OPERATIONS AND THREAT MANAGEMENT

REQUIREMENTS

Cybersecurity Operations are essential to protecting FDA’s enterprise systems, infrastructure, and data in a dynamic and evolving threat environment. Operating across a hybrid ecosystem of on-premises and cloud environments, the FDA requires integrated, 24x7x365 cybersecurity capabilities aligned with Federal mandates, including Zero Trust Architecture, Continuous Diagnostics and Mitigation (CDM), NIST Cybersecurity Framework, and NIST standards. These operations ensure continuous visibility, threat detection, incident response, and resilience across all cybersecurity domains, leveraging AI-driven analytics, automated monitoring, and real-time threat intelligence to enhance situational awareness and response speed.

This BPA supports enterprise Cybersecurity Operations services encompassing endpoint protection, network defense, vulnerability management, and Security Operations Center (SOC) and Network Operations Center (NOC) monitoring. The contractor will operate and enhance security tools such as End Point Detection and Response (EDR,), Intrusion Detection System (IDS), Intrusion Prevention System (IPS), firewalls, and Security Information and Event Management (SIEM) platforms to detect and respond to threats in real time, while leveraging automation, orchestration, machine learning (ML) and proactive threat hunting to strengthen the FDA’s security posture.

Cybersecurity Operations will also ensure compliance with federal incident reporting requirements and support governance through continuous monitoring, audit readiness, and alignment with FDA Zero Trust objectives, incorporating automated compliance validation and AI-assisted reporting to improve accuracy and timeliness, while delivering a resilient and adaptive cybersecurity capability that safeguards mission-critical operations.

The contractor shall provide comprehensive Identity, Credential, and Access Management (ICAM) services to support the FDA’s Zero Trust Architecture, ensuring secure, policy-based access to enterprise systems, applications, and data across hybrid environments, utilizing adaptive authentication, behavioral analytics, and automated identity governance to enhance access control and reduce risk.

3.1 Endpoint Security

The Contractor shall provide management, administration, operations, maintenance, monitoring, and support for endpoint security services across the FDA enterprise in accordance with federal cybersecurity requirements and FDA security policies. This includes, but is not limited to, servers, workstations, desktops, laptops, tablets, smartphones, Internet of Things (IoT) devices, and research and scientific equipment.

The Contractor shall:

Manage and operate AI-powered Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) services, such as CrowdStrike or FDA-approved equivalent solutions, to help monitor, detect, investigate, and respond to cybersecurity threats on FDA endpoints.

Leverage AI endpoint security solutions to collect and analyze telemetry data (e.g., registry modifications, memory operations, execution events, and generate actionable intelligence.

Manage and operate Full Disk Encryption (FDE) solutions, such as BitLocker (Windows) or FDA-approved equivalent solutions, across all supported endpoint assets.

Provide endpoint anti-malware and anti-virus services to detect, prevent, and respond to malicious activity.

Implement the Security Technical Implementation Guides (STIGs), a comprehensive and mandatory configuration standard designed by the U.S. Department of Defense Information Systems Agency (DISA), to harden systems, reduce the attack surface, improve compliance verification, and ensure consistent security configurations across the environment.

Enforce security configurations via Group Policy and Mobile Device Management (MDM).

Provide host-based firewall services for endpoints to enforce FDA-approved security policies and protect devices from unauthorized access.

Provide Attack Surface Management (ASM), also referred to as Threat and Vulnerability

Management (TVM), services to identify, assess, classify, prioritize, report, and support remediation of vulnerabilities affecting identity, devices, networks, cloud environments, applications, and data.

Ensure vulnerabilities are addressed and corrected in accordance with FDA-approved service level agreements (SLAs), risk priorities, and remediation timelines.

Leverage systems to identify agency assets (e.g., servers, workstations, printers, smart phones, tablets, etc.), while conducting routine inventory data calls to track resources.

3.2 Network Security

The Contractor shall provide 24x7x365 operations, administration, monitoring, maintenance, and support for network security services across FDA data center, field, and cloud environments in accordance with applicable federal cybersecurity requirements, Government mandates, FDA policies, and industry standards, including but not limited to the Department of Homeland Security Continuous Diagnostics and Mitigation (CDM) Program, FDA’s Zero Trust Maturity Model, and applicable NIST, ISO, and OMB guidance, leveraging AI-driven monitoring, automated threat detection and response, and continuous analytics to enhance visibility, reduce manual intervention, and improve operational effectiveness.

Install, operate, maintain, administer, manage, patch, upgrade, and support FDA network security services and infrastructure in on-premises and cloud environments, including:

Firewalls (e.g., Next-Generation, Web Application, etc.)

Intrusion Detection Systems (IDS) Intrusion Prevention Systems (IPS) Web-filtering and proxy services User and server proxies Policy Enforcement Points (PePs)

Leverage AI-Powered traffic pattern analysis mechanisms to establish baselines for normal traffic flow and enable rapid detection of network cybersecurity attacks (e.g., DDoS).

Protect mission-critical resources from unauthorized access by establishing network access controls, regulating data and network traffic, segmenting applications and workloads, and implementing end-to-end encryption.

Leverage Software Defined Network (SDN) technology to implement micro-segmentation by application profiles and data flow patterns, while ensuring authentication and connectivity for services.

Incorporate AI-driven safety protocols to block suspicious IPs and trigger alerts without human intervention.

Participate in daily and weekly Change Control Board (CCB) activities and review firewall, proxy, IDS/IPS, and other network security change requests, leveraging automated change tracking and AI-assisted impact analysis.

Provide technical analysis and recommendations to FDA Office of Information Security (OIS) regarding firewall rules, network security changes, access requirements, and implementation approaches, utilizing AI-driven risk assessment and data-informed decision support.

Create, test, validate, track, and implement internal and external network security rules and configurations based on approved business, user, and system requirements.

Provide technical assistance to customers in identifying required ports, protocols, and connectivity requirements for new or modified network security rule requests, supported by automated rule validation and recommendation tools.

Troubleshoot and resolve network security service issues, including those related to firewall changes, proxy services, IDS/IPS configurations, and other security implementations, leveraging AI-assisted diagnostics and automated alerting to accelerate resolution.

Analyze and resolve conflicts associated with the addition, deletion, or modification of network security rules and services, utilizing automated conflict detection and optimization capabilities.

Retrieve, process, track, and respond to network security and firewall-related requests submitted through FDA’s ticketing system, currently ServiceNow, or through FDA OIS-directed tasking, incorporating automated workflows and intelligent ticket prioritization

Coordinate deployment, replacement, and troubleshooting of network security and firewall equipment in FDA field locations outside the Metropolitan Area Network (MAN), including coordination with FDA International and Regional Services personnel and vendors, as appropriate, supported by automated deployment tracking and remote diagnostics.

Ensure appropriate replication, consistency, and synchronization of network security policies and rule sets between internal environments and external cloud or hosted contractor environments, including Amazon Web Services (AWS), Microsoft Azure, and other FDA-approved platforms, leveraging automated configuration management and continuous validation.

Develop, maintain, and update network security documentation, including Standard Operating Procedures (SOPs), installation guides, architecture documentation, and Concepts of Operations (CONOPS), utilizing automated documentation tools and centralized knowledge management.

Review and coordinate network security designs and rule changes with FDA stakeholders to ensure security, effectiveness, and operational alignment, supported by AI-assisted design analysis and validation.

Provide technology refresh, patching, maintenance, and administration for firewall, and related network security infrastructure and services, leveraging automated patch management and AI-driven lifecycle optimization.

All firewalls, IDS/IPS, proxy, and border security services shall remain subject to FDA OIS oversight and approval. The Contractor shall provide first-line technical evaluation and recommendations for firewall and network security change requests; however, final oversight and approval authority shall remain with FDA OIS federal personnel prior to implementation. All changes to border firewall policies shall be performed during approved after-hours maintenance windows to minimize operational disruption to internet services.

3.3 Application and Workload Security

The Contractor shall support the security of applications, platforms, and workloads across FDA environments by implementing and maintaining controls consistent with federal cybersecurity policy, Executive Orders, FDA policy, and secure software development practices.

The Contractor shall:

Ensured applications, services, platforms, and workloads are configured in accordance with applicable federal policies, Executive Orders, and the FDA Information Security and Privacy Policy (IS2P).

Implement and maintain automated mechanisms and security tooling to assess, monitor, and report on the security posture of applications and workloads such as: (1) microservices, (2) Virtual Machines (VMs), (3) containers, (4) functions, and (5) supporting services. Support the identification, assessment, and remediation of application and workload security weaknesses, misconfigurations, and vulnerabilities. Promote continuous improvement of application and workload security through automation, standardized baselines, and security control validation.

Conduct an inventory of applications and workloads to prioritize cybersecurity protection requirements for high value and critical assets.

Implement process isolation and micro segmentation with Continuous Integration/Continuous Deployment (CI/CD) best practices throughout the development process to prevent lateral movement.

Ensure continuous monitoring and ongoing authorizations of the health, status, and operability of deployed applications and workloads, while logging and tracking suspicious activity.

Secure Application Program Interfaces (APIs) by implementing authentication, authorization, and encryption mechanisms.

3.4 Data and Information Protection

The Contractor shall support FDA data protection capabilities and services to safeguard enterprise and user data from unauthorized access, disclosure, modification, loss, misuse, or destruction in accordance with federal mandates and FDA policies.

Support continuous monitoring, Data Loss Prevention (DLP), reporting, and improvement of endpoint security posture across the enterprise.

Provide operational support for FDA-furnished cybersecurity tools and services used to protect data, including DLP capabilities and associated backup and restore support.

Implement mechanisms to protect sensitive data, personally identifiable information (PII), personal health information (PHI), regulatory information, trade secrets, and confidential commercial information.

Apply cybersecurity controls and protective measures in accordance with federal mandates and HHS and FDA internal and external policies to protect enterprise and user data.

Support monitoring, reporting, and response activities associated with unauthorized access attempts, improper data usage, data exfiltration risks, and other data protection events.

Assist in maintaining data protection configurations, operational procedures, and supporting documentation necessary to sustain secure and compliant data handling practices across the enterprise.

Meet FDA compliance data security and privacy protection requirements and standards.

3.5 Cybersecurity Operations (Security Operations Center (SOC) / Network Operations Center (NOC) – 24x7x365 Monitoring and Response

The Contractor shall provide fully integrated, 24x7x365 Network Operations Center (NOC) and Security Operations Center (SOC) services to ensure the continuous availability, performance, and security of FDA enterprise systems, networks, applications, and data. These services shall deliver real-time monitoring, detection, analysis, escalation, and response capabilities across all environments, including on premise, cloud, and hybrid infrastructures. The Contractor shall employ advanced monitoring, analytics, and automation capabilities to proactively identify performance degradation, security threats, and anomalous activity, ensuring rapid containment and remediation in alignment with HHS, DHS, and FDA cybersecurity policies, including Zero Trust architecture principles.

All operations shall support mission continuity, protect sensitive data, and maintain compliance with federal incident reporting requirements, leveraging automated reporting and AI-assisted compliance validation to improve accuracy and timeliness. The Contractor shall transition SOC/NOC operations toward a semi-autonomous and autonomous security operations model over the BPA lifecycle. The implementation of AI-driven alert triage, enrichment, and prioritization, reducing analyst workload is paramount.

The Contractor shall automate Tier 1 and Tier 2 SOC functions, including:

Alert validation (leveraging AI-assisted correlation and automated rule execution) Initial investigation (utilizing automated playbooks and AI-supported analysis) Data enrichment (through automated data aggregation and contextual intelligence feeds)

The Contractor shall also implement natural language interfaces (e.g., LLM-driven copilots) to support analyst decision-making and accelerate investigations and continuously reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) through intelligent automation, predictive analytics, and continuous optimization.

3.6 Core SOC/NOC Monitoring and Operational Requirements

3.6.1 Enterprise Network & Infrastructure Monitoring

The Contractor shall:

Provide continuous monitoring of all network components, interfaces, and services to ensure availability, detect latency, and identify performance degradation or outages; escalate and report deviations to the FDA Watch Officer, leveraging AI-driven monitoring, automated alerting, and predictive analytics to proactively identify issues.

Setup emergency bridges to coordinate action across teams and share situational updates in real time regarding critical security incidents (e.g., ransomware, outage, etc.), major outages, and service disruptions, supported by automated incident coordination and real-time collaboration tools.

Monitor voice, video, and data (VV&D) services for outages, interruptions, and performance degradation, utilizing automated performance monitoring and AI-assisted anomaly detection.

Monitor remote access environments (e.g., VPN, SASE) to ensure secure and reliable connectivity and prevent unauthorized access, incorporating behavioral analytics and automated access monitoring.

Monitor routing and switching infrastructure for anomalies such as routing loops, packet loss, excessive bandwidth utilization, and resource constraints (CPU/memory), leveraging AI-based anomaly detection and automated diagnostics.

Track network bandwidth utilization and traffic patterns, identify high-usage “top talkers,” and enforce threshold-based alerting, utilizing automated…