Attachment_F_FISMA_Task_Order_Performance_Work_Statement.pdf
PDF 223 KB Posted
- Attached to
- Risk Management IDIQ
- Solicitation number
- 140R8123R0003
About this file
This performance work statement outlines requirements for contractor services to assist the Bureau of Reclamation's Risk Management Services Division in maintaining Federal Information Security Modernization Act compliance. The contractor will perform ongoing monitoring of Reclamation information systems within the Xacta 360 governance, risk, and compliance software for documentation compliance. Additional tasks include providing expertise to staff on developing system security plans within Xacta 360, performing user administration duties, and preparing training materials. The contractor must have expert experience with Xacta 360 and be knowledgeable in FISMA compliance activities such as security control assessments, plans of action and milestones, and training requirements. The contractor must submit weekly status reports and knowledge transfer documentation to the contracting officer's representative.
View the file
Other files
Show all 18
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
140R8123R0003 Attachment F: FISMA Task Order Performance Work Statement 04/07/2023
1. SCOPE
OBJECTIVE -The objective of this contract is to acquire contractor services to assist the United States Bureau of Reclamation Risk Management Services Division (RMSD) in implementing and maintaining compliance with Federal Information Security Modernization Act (FISMA) requirements for all information system security boundaries within the Xacta 360 Governance, Risk, and Compliance (GRC) software tool.
2. BACKGROUND
The RMSD is responsible for implementing and maintaining compliance with Federal cybersecurity and related privacy requirements. The RMSD leads the Reclamation FISMA Compliance Program which manages all activities associated with the National Institutes of Science and Technology (NIST) Risk Management Framework (RMF). Reclamation requires contractor services to support FISMA compliance activities, including the monitoring and tracking compliance of information system statuses, Plan of Actions and Milestones (POA&Ms) management, aiding with security control implementation, and recommending process improvements within Xacta 360. The bureau has approximately sixty-eight information systems accounted for within Xacta 360, all being low or moderate security categorizations. All systems currently follow NIST SP 800-53 rev. 4 requirements (Rev. 5 TBD) and the NIST RMF, and most have static point-in-time authorizations while implementing continuous monitoring activities, working toward obtaining ongoing authorizations. Information System documentation, POA&Ms, and Risk Acceptances are maintained in Xacta 360. The place of performance for this task order will be remote. Access to the Denver Federal Center in Denver, CO may be available in coordination with the COR. Reclamation employees that support this system are located in Denver.
3. REFERENCES
An understanding of the following list of documents is required in the performance of this contract:
• NIST SP 800- 18, Guide for Developing Security Plans for Federal Information Systems https://doi.org/10.6028/NIST.SP.800-18r1
• NIST SP 800-30, Guide for Conducting Risk Assessments https://doi.org/10.6028/NIST.SP.800-30r1
• NIST SP 800-34, Contingency Planning Guide for Federal Information Systems https://doi.org/10.6028/NIST.SP.800-34r1
• NIST SP 800-37, Risk Management Framework for Information Systems and Organizations: A Security Life Cycle Approach for Security and Privacy https://doi.org/10.6028/NIST.SP.800-37r2
• NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View https://doi.org/10.6028/NIST.SP.800-39
• NIST SP 800-53A, Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans https://doi.org/10.6028/NIST.SP.800-53Ar4
04/07/2023
• NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations https://doi.org/10.6028/NIST.SP.800-53r4
• NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories https://doi.org/10.6028/NIST.SP.800-60v1r1
• NIST FIPS 199, Standards for Security Categorization of Federal Information and Information Systems https://doi.org/10.6028/NIST.FIPS.199
4. TASKS
The project will be evaluated for completeness of tasks and objectives weekly. Tasks will be provided to the contractor from the Contracting Officer Representative (COR) on a weekly basis, in accordance with the terms of the contract.
4.1. Contractor shall perform ongoing monitoring of Reclamation information system projects within Xacta 360 for compliance with FISMA requirements and provide timely detection, identification, and reporting of non-compliance issues, such as; quarterly POA&M maintenance status, annual Internal Control Review (ICR) progress, Authorization to Operate (ATO) status, and other FISMA related requirements.
4.2. Contractor shall provide expertise, guidance and assistance to Reclamation Enterprise and regional cybersecurity staff on developing and improving the system projects or “packages” within Xacta 360 for their information systems, to include all required System Security and Privacy Plan (SSPP) elements in support of Reclamation’s continuous monitoring program.
4.3. Contractor shall perform user management within Xacta 360, to include activities such as assigning project access, user roles, reactivating locked accounts, and removing project access when uses are terminated or transferred.
4.4. Contractor shall prepare Xacta 360 briefing materials, such as user guides and Standard Operating Procedures (SOPs) to support Reclamation cybersecurity staff in completing their assigned tasks within Xacta 360.
5. PERFORMANCE REQUIREMENTS SUMMARY
Task No.
Task Description
Performance
Indicator
Performance
Standard
Minimum Acceptable Quality
Level
4.1 Perform ongoing monitoring of
Reclamation information systems within Xacta 360 for compliance with required FISMA documentation to provide timely detection, identification and reporting of non-compliance issues.
100% on time delivery of high-quality products
Product delivery compliant with agreed upon delivery schedules and product requirements.
Minimum acceptable quality level= 90%. Failure to perform within the minimum level could result in contract price reduction or other action.
04/07/2023
4.2 Provide expertise, guidance, and
assistance to Reclamation staff on developing and improving system projects within Xacta 360.
100% on time delivery of high-quality products
Product delivery compliant with agreed upon delivery schedules and product requirements.
Services may be delivered late no more than 10% of the time.
Failure to perform within the 10% could result in contract price reduction or other action.
4.3 Perform user management
administration within Xacta 360.
100% on time delivery of high-quality products
Product delivery compliant with agreed upon delivery schedules and product requirements.
Services may be delivered late no more than 10% of the time.
Failure to perform within the 10% could result in contract price reduction or other action.
4.4 Prepare briefing materials to
support Reclamation cybersecurity staff in completing assigned tasks within Xacta 360.
100% on time delivery of high-quality products
Product delivery compliant with agreed upon delivery schedules and product requirements.
Services may be delivered late no more than 10% of the time.
Failure to perform within the 10% could result in contract price reduction or other action.
6. DATA AND REPORTS
Item No.
(associated with Task)
Description
Content
Format
Medium
Delivery
All The COR will define the requirements for assigned products upon task assignment.
Content requirements will be directed by the COR upon task assignment.
Format to be agreed upon by COR and Project Manager upon task Assignment.
Electronic format Deliver to
COR
All Weekly status reports Content requirements will be agreed upon by Contractor and
COR.
Contractor's choice
Electronic format for all reports and any presentation materials - MS Word document for reports, Presentation material format can be determined by Contractor.
Deliver to
COR
04/07/2023
All Knowledge Transfer Defined in paragraph 8.3, “Knowledge Transfer”.
Contractor’s Choice
Electronic Format Deliver to
COR
All Staff Replacement Plan
Defined in paragraph 8.4, “Staff Replacement Plan”.
Contractor’s Choice
Electronic Format Deliver to
COR
7. PERSONNEL QUALIFICATIONS
Individuals will be required to obtain a Public Trust Clearance.
7.1. Expert level experience as both a “User” and an “Administrator” within Xacta 360, or an equivalent level of expertise within another GRC tool (such as eMASS, Archer, CSAM, etc.), to include, but not limited to; assigning user roles, creating information system profiles, completing information system profiles, creating and managing POA&Ms, assessing security controls, crafting implementation statements, and completion of all other aspects of the RMF process within the tool.
7.2. Experience with FISMA compliance-related activities to include system security plans, contingency plans, incident response plans, configuration management plans, security control requirements and assessments, POA&Ms, and training requirements.
7.3. Experience in technical writing in support of providing users guidance on how to navigate and use information systems, applications, or other similar tools.
8. DELIVERABLES
The contractor shall submit the following reports in accordance with paragraph 6.0, "DATA AND
REPORTS".
8.1. Electronic copies of document deliverables shall be delivered to the COR using Microsoft Office (e.g., Microsoft (MS) Word, MS Excel, MS PowerPoint, MS Project, or MS Visio), or .pdf for graphics unless otherwise specified at the task level by the COR. A shared environment or SharePoint site will be used to store documentation per the government instructions. Electronic submissions shall be made via email, unless otherwise agreed by the COR. Reclamation shall have ten (10) business
04/07/2023 days to review each document and provide feedback and comments if necessary. The Contractor shall have five (5) business days to incorporate any comments. A final review shall be conducted with the COR. The COR's concurrence and approval of the draft and final documents shall constitute acceptance by Reclamation.
8.2. Contractor shall furnish electronic weekly status reports to the COR that include the results and/or progress of tasks for government review and performance metric review.
8.3. Knowledge Transfer
Contractor shall provide a strategy to the government on their method to ensure that contract staff has sufficient knowledge to perform all development, operation, and maintenance activities identified by the Government in a backup role or become the primary leader in the event of staff transitioning out of company.
A quarterly updated report shall be provided to the government containing at a minimum the following information:
o Task or Application o From: Name | Contractor o To: Name | Contracting Officer Representative o Date o Percent transition progress
8.4. Staff Replacement Plan
Contractor staff replacement must meet the experience level of individuals selected for the initial award of this task order.
9. GOVERNMENT FURNISHED EQUIPMENT
The government will furnish the staff with a computer; on site staff will also be furnished with a monitor, mouse, and keyboard.
File details come from the government source that posted it. Updated .