Attachment P5_ Sample Task 2 Cyber.docx

Sample Task 2: Cybersecurity Support

a. Background – NAWCAD Security Department provides cybersecurity support to assigned NAVAIR Program Offices to provide cybersecurity guidance to Program Management regarding Acquisition security requirements and management of all cybersecurity requirements for the Program, including all assigned personnel, throughout the life cycle of the weapons system. The contractor is responsible for providing expertise in managing the detailed process tasks associated with implementing appropriate cybersecurity policies, programs and processes which reduce risk and support an uncompromised asset delivered to the fleet.

b. Program Manager Aircraft’s (PMA) 288 has managed the Navy’s F-55 Aircraft for the past 25 years. The ACAT 1D F-55 Program Of Record (POR) was established as a joint project with the Air Force and there are several Foreign Military Sales cases that have been established through both services. Because it was fully Operational prior to the inception of the Cybersecurity Risk Management Framework (RMF), no formal cybersecurity accreditation for F-55 was established. The Navy is planning to end it’s involvement with the F-55 Aircraft within the next fiscal year and transition to a new weapons system, which is currently being developed by an industry partner. The new ACAT 1D weapons system, titled F-56, will meet all previous mission requirements of the F-55 as well as introduce several new capabilities, which will provide a technological advantage over our adversaries. These new capabilities have been identified as a priority for the warfighter through an Urgent Operational Need (UON). The Milestone decision authority has just approved the F-56 weapons systems to enter at the Pre-milestone B phase of the Acquisition process with Milestone B review set for April 2021. The F-55 Aircraft will remain as a POR for the Air Force and will continue to be supported by both services for all FMS customers.

c. PMA288 has never had dedicated cybersecurity support in the form of an Information System Security Engineer (ISSE), Information System Security Officer (ISSO), Information Security Manager (ISSM) or a trained CSS cybersecurity analysts to manage all cybersecurity requirements. Overall program cybersecurity risk has been measured and found to be at a very high level. No cybersecurity documentation exists for the F-55 Weapons system. The F-56 Weapons system is a classified connected system and the initial system categorization is HHH (Confidentiality, Integrity and Availability). There is no cybersecurity accreditation package in work and no other formal cybersecurity documentation, metrics or processes have been established. PMA288 and their Prime Contractor are negotiating a mod to the contract to add cybersecurity requirements for cyber-accreditation for the F-56 weapons system. No cybersecurity processes have been initiated for the F-56 weapons system at this time.

The offeror shall develop an approach and plan that outlines how the offeror would manage the overall cybersecurity requirements for the Program Office. The plan shall include all cybersecurity requirements for both Programs of record weapons systems (F-55/F-56) and the implementation of sound cybersecurity practices to include regular reoccurring scans and patches to effectively mitigate current and future cybersecurity risks.

The offeror’s approach and plan shall specifically address the following areas:

1) Describe the current and potential cybersecurity risks that must be accounted for to achieve a full accreditation to include sustainment .

2) Develop a holistic, fundamental plan to address the implementation of an effective cybersecurity program for PMA288 that encompasses all areas deficient in the above scenario.

3) Describe actions that can mitigate the identified risk(s), or changes in current processes/metrics that show how current risk is mitigated and could mitigate identified risks in the future.

4) Describe the required Acquisition cybersecurity documentation that must be addressed for both, the Navy sunset of the F-55 and the establishment of the F-56 POR.

5) Describe critical outside dependencies that can influence the offeror’s ability to successfully complete the plan, and how to manage them if possible.

6) What type of resources are anticipated to support your plan and how would they be utilized?

7) Describe how you would maintain this level of cybersecurity posture.