Attch 1 - PWS Cyclops Sources Sought.pdf

PERFORMANCE WORK STATEMENT (PWS)

CYBERSECURTY COUNTER INSIDER THREAT OPERATIONS (CInT Ops) SUPPORT

Contents 1 Description of Services and Scope of Work

2 CInT Ops Task Order Objectives

3 Scope of Work and Task Description

3.1 Task 1: CINT Ops – PMO Support

3.1.1 Task 1 Sub-Task 1: Orientation Briefing and Ongoing Staffing

3.1.2 Task 1 Sub-Task 2: Ramp-Up Knowledge Transfer

3.1.3 Task 1 Sub-Task 3: Period of Performance Summary Report

3.1.4 Task 1 Sub-Task 4: Transition to Support (T2S)

3.1.5 Task 1 Sub-Task 5: Contract Related Project Management Tasks

3.1.6 Task 1 Sub-Task 6: Program Management Support to CInT Ops Management

3.2 Task 2: CInT Ops – Analytics, Monitoring, and Incident Management

3.2.1 Task 2 Sub-Task 1: Perform Full-Spectrum User Behavior Analytics Operational

Intelligence Services

3.2.2 Task 2 Sub Task 2: Perform Risk Model and Data Analytics

3.2.3 Task 2 Sub-Task 3: Indicator and Use Case Management

3.2.4 Task 2 Sub-Task 4: Data Management and Data Analytics

3.2.5 Task 2 Sub-Task 5: CInT Incident Response and Management

3.2.6 Task 2 Sub-Task 6: CInT and Audit Monitoring and Event/Incident Analysis

3.3 Task 3: HVA

3.4 Cybersecurity Support – Security Audit Monitoring Operations

3.5 Task 4: (Surge Optional): CInT Ops Operational and Program Support

4 Deliverables

4.1 Task 1: CInT Ops – PMO Support Deliverables

4.2 Task 2: CInT Ops – Analytics, Monitoring, and Incident Management Deliverables

4.3 Task 3: HVA Deliverables

4.4 Task 4: (Surge Optional) CInT Ops Operational and Program Support

4.5 High Level Project Schedule

4.6 Ship To

5 Delivery

5.1 Quality Assurance for Delivery Submission

5.2 Place of Performance

6 Labor Categories and Descriptions

6.1 Labor Categories

7 Period of Performance and Contract Type

7.1 Period of Performance

7.2 Contract Type

8 Personnel Requirement and Key Personnel

8.1 SKILLS REQURIEMENTS

9 Government-Furnished Property (GFP)

9.1 Government-Furnished Information

9.2 Travel

9.3 Operating Hours, Government Closures

10 Contractor Reports

11 Security

11.1 Disclosure Awareness Training

11.2 Non-Disclosure Agreement

11.3 Security Documentation/Forms (Documents will be provided, as applicable, by COR Upon

Award) 35

12 Appendix

1 Description of Services and Scope of Work

The Internal Revenue Service (IRS), Information Technology (IT) Cybersecurity organization implemented critical Counter Insider Threat (CInT) capabilities to mitigate serious risks to the IRS. Recent trends in Counter Insider Threat analytics, cyber related fraud, and the misuse of government systems has presented a unique threat to taxpayer information safeguarded by IRS systems, applications, and databases.

Counter Insider Threat Operations (CInT Ops) addresses the serious risks posed by those who have been granted access to IT systems where resides sensitive taxpayer information and supporting IT financial systems. In recent years, cases of high-profile breaches of sensitive information have come to national attention with international implications. Their actions, whether intentional or unintentional, have caused serious damage through the unauthorized release of sensitive information. For the IRS, the compromise of sensitive taxpayer information would result in serious damage to the agency's image, reputation, and ability to perform its mission.

The National Insider Threat Task Force (NITTF) is charged under Executive Order (EO) 13587 with reviewing and, when appropriate, adding to or modifying the Minimum Standards and guidance in coordination with the executive branch departments and agencies (D/As) subject to the EO. The Minimum Standards provide the basic elements necessary to establish a fully functional insider threat program (InTP) and thereby serve as milestones in the InTP maturity process. In response to this threat, the Department of Treasury established the Insider Threat program on August 9, 2013, with Treasury Order (TO) 105-20. This was in response to Executive Order 13587, Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information.

The Department of Treasury subsequently issued the Insider Threat Program Strategy, FY 2016 - 2019.

In addition, Cybersecurity’s mission is to ensure IRS compliance with federal statutory, legislative, and regulatory requirements governing confidentiality, integrity and availability of IRS electronic systems, services, and data. Cybersecurity manages the IRS IT Security Program in accordance with the Federal Information Security Management Act (FISMA) in tracking compliance, continuously monitoring risk, providing remediation recommendations and more. The Federal High Value Asset (HVA) initiative was established to identify, assess, and secure the Chief Financial Officers (CFO) Act and Non-CFO-Act agencies’ most critical information systems. In 2018, the Office of Management and Budget (OMB) released Memorandum (M) 19-03 to provide guidance on the enhancement of the HVA Program and providing agencies the following guidance allowing greater flexibility in the identification and designation of their most critical assets. The Cybersecurity and Infrastructure Security Agency (CISA) was established with the mission to “lead the National effort to understand and manage cyber and physical risk to our critical infrastructure.” A component of that mission is to ensure appropriate protections and controls are implemented to secure the Nation’s most critical assets. CISA has conducted over 50 assessments on HVAs and gained key insights into the cybersecurity posture of the Federal HVA Enterprise (FHE). These assessments have generated key insight and lessons learned to provide the IRS with crucial guidance on HVA security and continuous monitoring procedures. Department of Homeland Security’s, Binding Operational Directive 18-02, has been performing HVA assessments, which include Risk and Vulnerability Assessments (RVAs) and Security Architecture Reviews (SARs) on Agency HVA systems across the Federal Government’s High Value Asset enterprise. As required by BOD 16-01, agencies developed remediation plans specifying the timelines and mitigation actions necessary to address certain vulnerabilities. TIGTA Planned Corrective Actions (PCA) 4-2-1 and 5-2-1 focus on Mainframe platforms, which most IRS HVAs are hosted on, and related applications for continuous monitoring and validation of human and non-human (entity/service) accounts to ensure the named account is provisioned with proper authorization/documentation and assigned the appropriate role-based access (RBAC) on the target system/application. As there is currently no automated means to interface with Business Entitlement Access Request System (BEARS) (or equivalent enterprise access authorization data authority), the RBAC Matrix (spreadsheet maintained by User Admin Group) and RACF database (containing the defined security groups and accounts), the current remediation efforts are complex, manual, voluminous, unscalable, and prone to inaccuracy by human processing.

IT Cybersecurity is currently in receipt of 11 additional directives released by Office of Management and Budget (OMB), National Institute of Standards and Technology (NIST), and Department of Homeland Security (DHS)/ Cybersecurity and Infrastructure Security Agency (CISA) subsequent to Executive Order #14028 Improving the Nation’s Cybersecurity. Each of these federal mandates were released post-award and contain direct tasking to IRS IT Cybersecurity; OMB M-22-09 (26JAN2022) Subject (Moving the U.S.

Government Toward Zero Trust (ZT) Cybersecurity Principles) which specifically contains six major ZT architecture implementation requirements to be completed no later than FY24. As defined by M-22-09, ZT is a new approach to security which provides a defensible architecture for this new environment. The foundational tenet of the Zero Trust Model is that no actor, system, network, or service operating outside or within the security perimeter is trusted. Government agencies are required to verify anything and everything attempting to establish access. This is a dramatic paradigm shift in philosophy of how we secure our infrastructure, networks, and data, from verify once at the perimeter to continual verification of each user, device, application, and transaction.

2 CInT Ops Task Order Objectives

The IRS has implemented significant enhancements to its CInT Ops programs. This task order will continue those programmatic successes and ensure the protection of IRS protected information throughout the enterprise.

This task order is intended to provide technical cybersecurity CInT monitoring, analysis, and response activities for the IRS. The IRS is a large federal government agency that supports 80,000 employees with varying levels of access to information technology resources and a vast portfolio of applications, systems, and databases that must be monitored to ensure those access levels are being used as intended/defined by their role as well as guidance/policy governing acceptable behavior.

The contractor will leverage large-scale governmental experience in CInT Ops to successfully:

• CInT Ops Program Management Office (PMO) Support:

o Provide direct support to CInT PMO through conducting and assisting the management of various tasks and projects including reviews, assessments, gap analyses. These activities will support the development of strategic and tactical plans in order to meet and implement various CInT related cybersecurity and privacy regulations, legislations, mandates, and directives protecting the government’s information assets.

o Advocate constructive improvements to the agency’s policies, governance, and infrastructure (i.e., agency’s User Behavior Analytics Ecosystem) to enhance the agency’s User Behavior Analytics posture.

o Provide documentation and analysis in support of legal analytics and incident response processes.

• CInT Ops Monitoring, Analytics, and Incident Management:

o Employ advanced techniques to develop, enhance, and perform CInT and User Entity

Behavior Analytics (UEBA) monitoring, analytics, and incident response related and activities from across a wide range of essential IRS IT systems.

o Assist with performing innovative and advanced User Behavior Analytics data analytics (e.g., machine learning) on vast stores of near real time and archived transactional data sets from across a wide range of IT systems (e.g., mainframe, servers, and network devices).

o Develop custom, complex User Behavior Analytics Use Cases, cross- organizational reporting, and risk metrics to identify and predict malicious activity.

o Identify previously undetected anomalous patterns, trends, and events that lead to the discovery of User Behavior Analytics activity supported with the associated corrective actions.

• HVA Monitoring and Reporting:

o Provide HVA assessment and 24x7 continuous monitoring of IRS HVA systems.

o Contractors supporting HVA will need a T5 Clearance

The objectives above, supported by all the tasks and work activities defined in this PWS, will provide the IRS Cybersecurity organization with the following basic services to address the following FISMA requirements:

• Deterrence – Identifying trends in user behavior contributing to User Behavior Analytics events.

• Detection – Detecting, responding, and reporting User Behavior Analytics events.

• Mitigation – Reducing the impact of User Behavior Analytics events.

As with all federal government contracts, work products and deliverables produced from this contract belongs to the IRS IT Cybersecurity Counter-Insider Threat Operations.

3 Scope of Work and Task Description This contract is a performance based, Firm Fixed Price (FFP) contract type.

Task Summary Table:

Task # Title Contract Type

001 Task 1 – Program Management Support FFP

002 Task 2 – Analytics, Monitoring, and Incident Management FFP

003 Task 3 – High Value Asset (HVA) Support FFP

004 Task 4 – (Surge Optional): CInT Ops Operational and Program

Support

LH

The scope of work performed by the contractor, as reflected in this PWS, are designed to prevent/deter, detect, and support response activities to CInT Ops events and incidents targeting the IRS assets and resources.

Generally, all work formed as part of this contract shall:

• Follow IRS Enterprise Life Cycle (ELC) and Investment Decision Management (IDM) processes.

• Produce Work Products/Deliverables that conform to, and integrate with, existing IRS standards and guidelines.

• Conform to all IRS security, disclosure, and other policies.

Please also note:

• Tasks may vary from month to month.

• Contractor shall be familiar with Federal policies, program standards and guidelines

3.1 Task 1: CINT Ops – PMO Support

This task provides project management support oversight and subject matter expertise to ensure that all contractor resources are effectively contributing to the desired programmatic outcomes. This task leverages the designated resources identified by labor category and skillset requirements, to compile the deliverables listed below and provide overall support for the delivery of the CInT Ops program.

3.1.1 Task 1 Sub-Task 1: Orientation Briefing and Ongoing Staffing

Description: Within 5 days of task order award, the contractor shall conduct an orientation briefing for the government.

The government does not desire an elaborate orientation briefing nor does it expect the contractor to expend significant resources in preparation for this briefing. Rather, the intent of the briefing is to initiate the communication process between the government and contractor by introducing key task order participants, explaining their roles, reviewing communication ground rules, and assuring a common understanding of task order requirements and objectives.

The orientation briefing shall be held at the government's facility and both parties shall mutually agree upon the date and time.

The contractor’s Orientation Briefing shall include a Staffing Plan to demonstrate how they will ramp up staffing to immediately begin supporting the work described in the PWS at Task Order award and how they will accomplish the process to ensure all proposed staff achieves Final Staff-Like Access approval within no more than 45 days of award. The IRS clearance process is expected to require 30-45 days from the accurate submission of the required background investigation documents and completion of other requirements (e.g., timely fingerprinting) by the contractor. Due to this process, partial billing of LH work efforts described above, will occur for any contractor personnel not cleared by the IRS to work on the contract as required by IRS policy.

The COR designation will be identified by the CO’s written designation memo. The CO will identify the COR via e-mail to the contractor.

As staffing changes through the life of the contract, the Contractor shall provide updates to the Staffing Plan and brief the government accordingly. Partial billing of LH work efforts described above, will occur for any contractor personnel not cleared by the IRS to work on the contract as required by IRS policy.

Desired Outcome: The completion of this briefing shall result in the following:

• The contractor and government personnel who will perform work under this task order will be introduced.

• The government will show the applicable facilities to the contractor if the contractor will be performing work on the government's site.

• The government may provide any GFP to the contractor.

• Identify issues concerning the contractor’s request for clearances for its personnel will be discussed to plan for resolution.

• The contractor will present its plan to accomplish the work under this PWS.

• The contractor will provide the accounting period end dates to be used for the term of this task order.

3.1.2 Task 1 Sub-Task 2: Ramp-Up Knowledge Transfer

This task includes meeting with the IRS Subject Matter Experts frequently to gather any tacit knowledge related to the Core Systems, Compliance Document Matching and Solutions Engineering/Enterprise Services tasks or programs in development. The government estimates this task will take approximately four to six months to complete after the Task Order is awarded.

The contractor will appoint a knowledge transfer manager to oversee the transfer of knowledge and ensure all areas are accounted for. If desired, this can be the Project Manager (PM) or Project Scheduler.

Prior to the transfer of knowledge, the contractor shall develop a draft Knowledge Transfer Plan (KTP) and present it to the government within the first 15 business days after award (See Section Error!

Reference source not found.).

The government will have 10 business days to review the draft KTP plan and provide comments to the contractor. Government and contractor representatives will then meet to discuss the comments after which the contractor will incorporate the agreed-upon changes and deliver a final KTP within five working days of the government’s feedback.

The contractor will meet with the IRS bi-weekly (twice a month) to discuss the progress of the knowledge transfer. The contractor will present an updated MS Project Schedule and discuss any risks or concerns.

Desired Outcome: The contractor provides a Knowledge Transfer Plan that is accepted by the government and successfully completes knowledge transfer in accordance with the plan.

3.1.3 Task 1 Sub-Task 3: Period of Performance Summary Report

Description: Provide a summary of work performed, including a list of deliverables, at the end of each Base and Optional Period of Performance.

The government also reserves the right to request this report at any point during the performance of the order at the discretion of the Contracting Officer. This ad hoc report, if desired, will only be requested once during the life of the task order and is in addition to the regularly scheduled Period of Performance Summary report.

Desired Outcome: The contractor will provide the Period of Performance Summary Report.

3.1.4 Task 1 Sub-Task 4: Transition to Support (T2S)

Description: The transition to support process will include, but not be limited, to the following:

• Knowledge transfer of technical skills and lessons learned to IRS staff upon completion of deliverables and work products.

• Operations and maintenance processes and procedures.

• Transfer of complete documentation for all delivered functionalities. Deliverables will be in softcopy and hardcopy format and will become the sole property of the federal government.

The format of deliverables will be provided in a format which will allow the government to modify and update when/if necessary.

• Knowledge transfer of configurable data including usernames and passwords and application settings.

• Transfer of knowledge timeframe will be identified by the government (90 to 180 days ext.).

Desired Outcome: The contractor will transition support to the government prior to the completion of the contract.

3.1.5 Task 1 Sub-Task 5: Contract Related Project Management Tasks

This task relates to project management tasks and projects related to contract management of all associated CInT Ops tasks including but not limited to:

• Onboarding and Contract Initiation: Activities and tasks including orientation briefing, ramp-up and knowledge acquisition and transfer.

• Project and Program Management Activities Related to the Contract: Overall management of contract including personnel and resource management to perform and maintain contract.

• Performance Tracking, Documentation, and Reporting Related to the Contract: Period of performance summary report, and other documents as needed and requested by the government.

3.1.6 Task 1 Sub-Task 6: Program Management Support to CInT Ops

Management

This task relates to project management tasks and projects related to providing direct subject matter expertise, guidance, and oversight as reflected in the following descriptions of work efforts. The contractor will provide program management with the requested deliverables and services, collaborate across the IRS, and participate in the development of analytic strategies to achieve identified objectives.

They will coordinate with IRS Cyber Operations personnel to ensure that the CInT Ops program objectives are aligned with the direction of this task order by routinely reporting progress against established project schedules and performance requirements.

• Project and Program Management Activities Related in Support of CInT Ops: Provide direct support to major projects and program areas related to CInT Ops. (e.g., Support may be provided to specific areas within CInT Ops including CInT Ops Program Management Office (PMO); CInT Ops Monitoring, Analytics, Compliance & Audit Management, Incident Management; HVA Monitoring and Reporting.)

• Performance Tracking, Documentation, and Reporting in Support of CInT Ops: Support development of documentation and tracking of documentation for CInT Ops. (e.g., CONOPS, desk guides, Standard Operating Procedures (SOPs), white papers, technical papers, assessments, gap analysis, and training plans etc.)

• Provides review, development, edit, and maintain CInT Ops technical documents, including SOPs, SOP template(s), desk guide(s), white papers, risk response, Memorandum of Understanding (MOU), Service Agreements, presentations, special reports, and other project deliverables to meet contract requirements.

Desired Outcome:

• The contractor will assist with the development of analytic strategies to support User Behavior Analytics mission and consistently provide assurance to designated IRS personnel that task objectives and performance requirements are being achieved and schedules are being met.

• Support CInT Ops program areas responding to TIGTA and other audits through gathering narratives and evidence

• Write, edit, and maintain CInT Program area technical documents, including SOPs, SOP Catalog, SOP template(s), desk guides, white papers, risk response, MOUs, Service Agreements, and presentations, functional descriptions, system specifications, guidelines, special reports, and other project deliverables to meet contract requirements.

3.2 Task 2: CInT Ops – Analytics, Monitoring, and Incident Management

This task provides the specialized, technical expertise to implement the User Behavior Analytics Detection program to protect the IRS from potential intentional/unintentional behaviors that increase risk to IRS protected systems and protected data/information. This includes complex analytics methods to assess big data platforms across a wide range of IT systems (e.g., mainframe, servers, and network devices) on government networks on both structured and unstructured data sets to produce analytic views of correlated activities. This includes development of custom use cases and indicators and predicting previously undetected anomalous or malicious activity. The following represent tasks, with the understanding that the contractor is responsible for the outcome of the User Behavior Analytics Detection during the contract and as such will implement the requisite analytic methods to effectively detect anomalous activity with timely alerts provided to IRS management.

3.2.1 Task 2 Sub-Task 1: Perform Full-Spectrum User Behavior Analytics

Operational Intelligence Services

Description: The contractor will conduct Predictive Analytics: Conduct complex analytics on large transactional data sets from various operating systems such as mainframes, servers, desktops, databases. and network devices to identify anomalous patterns in activity and build and refine predictive models to classify and/or identify anomalous transactions.

Desired Outcomes:

• Assist with the Identification anomalous behavior indicative of User Behavior Analytics activity through innovative complex deep data analysis on large transactional data sets containing near real time and archived log data from a broad range of IT systems and applications.

• Assist with the development and refining of predictive and forensic analytics capability to prevent, detect, and mitigate the User Behavior Analytics risk both real and potential.

3.2.2 Task 2 Sub Task 2: Perform Risk Model and Data Analytics

Description: The contractor will support performing data analysis of data sets by Senior Subject Matter Experts (SMEs), such as Data Scientists among others, to identify new use case patterns of behavior and potential attack vectors as input into the predictive analytics, as well as deep analysis of potential anomalous activity isolated by the predictive analysis. Some of these may require employing machine learning and big data analytics and other data mining techniques.

Desired Outcome: User Behavior Analytics behavioral analysis reports, both orally and in writing, that are appropriately formatted to communicate to a wide range of audiences (technical and managerial) clearly and effectively.

3.2.3 Task 2 Sub-Task 3: Indicator and Use Case Management

Analysts will support CInT Ops indicator and use case development and management through incorporating Primary Risk Indicators (PRIs) as prioritized by the IRS Insider Threat Working Group (InT WG). Through examining, researching, and analyzing incident trends and emerging threats, analysts will work in conjunction with other CInT Ops teams to propose and develop, test, and implement new indicators and use cases.

Provide behavioral sciences Subject Matter Expertise (SME) to incorporate personal and environmental factors in threat identification, assessment and response used to assist with the development of PRIs and use cases.

Provide SPLUNK User Behavior Analytics (UBA) expertise to assist with the development and deployment of uses cases. Assist CInT Analytics with the determination of the value of the use cases

Desired Outcome: Augment CInT Analytics Team with appropriate expertise and experience in the development of PRIs and use cases.

3.2.4 Task 2 Sub-Task 4: Data Management and Data Analytics

The team will manage data sources used in CInT Ops through entire lifecycle of operations. Team will support tasks and projects including but not limited to:

• Determine and implement strategy for managing the architecture, tools, and analytical platform as needed.

• Support the development of requirements for data acquisition, and acquire and maintain new data sources in support of CInT Ops.

• Support the enhancement and execution of CInT data and PRI integration roadmap for acquiring, integrating, and maintaining data sources.

• Support the research, development, implementation, and maintenance/tuning/enhancement of data analysis and anomaly detection methodologies. Commercial-off-the shelf (COTS) products will be used when feasible. Government-off-the shelf (GOTS) may be used to augment COTS products.

• Support the development and maintenance of data management related documentation for data access (e.g., SOPs, desk guides, System of Records Notice (SORN), Privacy Civil Liberties Impact Assessment (PCLIA), and Computer Matching Agreement (CMA)).

• Provide programming language expertise to include but not limited to R, Python, and etc.

Desired Outcome: Augment CInT Analytics Team’s data management effort with appropriate expertise and experience.

3.2.5 Task 2 Sub-Task 5: CInT Incident Response and Management

Contractor will support the anomalous referral stage of case management through approved processes and capabilities to ensure integrity and effectiveness of the InT inquiry and response processes. This may involve conducting reviews of active and aging open tickets and events, maintaining and executing the Incident Response Plan (IRP) and Escalation and Resolution Playbook to coordinate incident escalation to cross-functional stakeholders, incident referral tracking, and incident closure remediation.

Contractor will help define, develop, and implement CInT program-wide performance measures, displaying CInT statistics and metrics to analyze trends in cross-functional data and monitor potential anomalous user activities.

Contractor will provide the technical and management support, through detection, documenting, and presentation of identified threats and malicious activity to ensure coordination of these activities through the appropriate adjudication processes. The contractor leverages knowledge and past experience in coordinating and supporting law enforcement and investigative organizations in the successful disciplinary and/or prosecutorial outcomes stemming from the contractor’s identified threats.

Provide advisory input support for IRS Ecosystems (software and hardware) integration, data, governance and analytics incorporating enterprise-wide collaboration to strengthen User Behavior Analytics processes.

The contractor will recommend, contribute, and collaborate in the development, update, and implementation of CInT Ops team Standard Operating Procedures (SOP), desk guides, and such other documentation to improve team effectiveness and efficiency.

Contractor will utilize established SQL server and database to continue the development and maintenance of cyber automated performance measures and data visualizations for CInT Ops. Utilize use of a relational database structure to provide near-real time reporting and visualization of CInT Ops tracking of CInT incident response activities and performance metrics.

Desired Outcome:

• Augment the CInT Ops monitoring and incident management activities with appropriate expertise and experience.

• Provide the necessary support to effectuate disciplinary or prosecutorial actions for identified threats, misuse, or fraud throughout the adjudication processes.

• Support IRS Ecosystems (software and hardware) integration, data, governance and analytics incorporating enterprise-wide collaboration to strengthen CInT Ops processes.

3.2.6 Task 2 Sub-Task 6: CInT and Audit Monitoring and Event/Incident

Analysis

The team will execute automated UBA cases and conduct analysis of anomalous results. The team will execute and monitor new UEBA (User & Entity Behavior Analytics) solutions from future deployed modernization predictive analytics capabilities. Identify and deconflict incidents with partner SOC section and/or the InT Analyst Hub.

Contract will support prioritization and coordination of CInT automated or scheduled processes for regular and timely receipt and integration of information from all relevant Insider Threat Workgroup (InT WG) stakeholders. Establishes automated procedures to receive notification with predictable frequency of information relevant to insider threat from other IRS partner data holders.

Contractor will provide application and platform audit analysis and reporting of IT systems in support of Federal Information Security Management Act (FISMA) compliance. Focuses on event log monitoring and analysis and to ensure all operational IRS applications, platforms, and systems are being used as intended. Identify and deconflict with partner SOC sections for event that are not.

Desired Outcome: Augment compliance and audit monitoring program of the CInT Ops.

3.3 Task 3: HVA

The scope of this HVA Risk Assessment and Continuous Monitoring services is to provide Project Management, Enterprise Testing Support, and Cybersecurity support to address findings from the CISA SAR, published on November 4, 2020. Contract will provide consolidated services and activity to meet legislative requirements and to be in line with the wider industry standard. The contractor will provide IRS Cybersecurity with the necessary support to achieve and enforce compliance across agency information systems. Providing the capability to have “Enforcement”, once gaps are identified and closed creates a powerful way to improve Governance, Risk and Compliance. The continuous monitoring approach to security and compliance enforcement meets the strict requirements of efficiency while satisfying the operational demands of the ever- changing cyber workspace. To further this goal the IRS has issued IRM 10.8.33 to create a correlation between the IBM Mainframe Roles to a corresponding IRS Role defined either within IRM 10.8.33 or IRM 10.8.2. Contractor will support the IRS’ objective towards the IRS continuous monitoring capabilities to increase the likelihood of malicious system events being detected and remediated within a cyber-relevant time frame to decrease the likelihood of a breach exposing hundreds of millions of IRS Personally Identifiable Information (PII) records. The current continuous monitoring capability for the HVAs capture most log events but lack a comprehensive view of the logs and have gaps in log collection. Within the IRS information security infrastructure, operational logging is conducted on a 24x7 basis. However, CISA determined that IRS operational logging has not been configured to identify or prioritize HVA information. Furthermore, at the time of the CISA report there was no dashboard with HVA-specific data available to the HVA leadership for situational awareness. The contractor will assist the agency with addressing CISA findings to implement continuous monitoring, which shall include the collection and analysis of security-relevant network-device-generated data, system logs, and application logs. This data should be centrally aggregated in an enterprise-level security information and event management (SIEM) solution, the Security Operations Center (SOC) Splunk instance. The HVA system owners should coordinate with the SOC to develop event tagging and prioritization to ensure that alerts from the HVAs are acted upon in cyber-relevant time.

There are 6 Moderate risk category recommendations and 1 major recommendation for HVA assessment and monitoring as follows:

1. Boundary Protection

2. Continuous Monitoring

3. Data Security

4. Auditing and Logging - Applicable Systems

5. Identity and Access Management

6. Resiliency Testing

7. Defense in Depth

Additionally, there are a specific list of HVAs determined by Treasury that IRS maintains and updates periodically. The audit and logging findings from the CISA SAR determined the IRS does not capture sufficient security-relevant logs and events which increases the likelihood that adverse events will not be detected or acted upon in a cyber-relevant timeframe. CISA recommends reviewing current sources that feed the SIEM and working toward collaboration with the SOC to provide a continuous monitoring capability. The IRS must ensure the required security data results can be refreshed to achieve the desired visibility for security monitoring of the HVA and include a requirement for monitoring capabilities to each component of the HVAs in all future upgrades. This could include embedded agents, audit logging, or any other solution to provide a near-real-time ability to monitor security status. The IRS must develop a relationship with and share monitoring data with the SOC to provide additional monitoring function for the HVAs and for department-wide situational awareness in near-real time. The IRS must work with Treasury Continuous Diagnostics and Monitoring (CDM) program representatives to help use CDM capabilities to increase integration and collaboration with the SOC’s and Treasury’s continuous monitoring objectives.

The objective of this task is to address findings from the CISA SAR, published on November 4, 2020. The report captured technical and risk-based observations and recommendations for systems at the IRS.

Areas of primary concern which apply to HVA continuous monitoring are identified in the table below:

Table 1: HVA Overlay Controls Breakdown

Specific Control

Description HVA Control Description Compliance

AU-2 AUDIT EVENTS

Item D: Audit successful and failed logons (OS and data repositories); successful and failed computer account activities (OS and data repositories); successful and failed account and user management activities (OS and data repositories); unsuccessful attempts to access databases; enterprise-synchronized date, time, and time zone for each event; source IP, port, and protocol;

destination IP, port, and protocol; etc.

AU-6

AUDIT REVIEW,

ANALYSIS, AND

REPORTING

Given the sensitivity of the information and systems, the analysis of the logs and events are performed more frequently and with more rigor than for non- HVA systems. Reporting of potential incidents complies with US-CERT requirements.

AU-6

AUDIT REVIEW,

ANALYSIS, AND

REPORTING

Item A: Review, analyze, and alert on system audit records in real time for indications of inappropriate, unusual activity (i.e., concurrent logons), breaches, or threats.

AU-6

AUDIT REVIEW,

ANALYSIS, AND

REPORTING

Item B: Report incidents and findings in accordance with US-CERT reporting time frames and requirements.

AU-6(3)

AUDIT REVIEW,

ANALYSIS, AND

REPORTING |

CORRELATE AUDIT

REPOSITORIES

Manage enterprise risk by correlating audit logs and events from all organizational systems to form a single risk view of the enterprise. Audit data collected at the system level (Tier 3) shall be aggregated with audit data from other systems to form a system-level enterprise view of audit records. Audit information must be protected at a level congruent with the highest level of information it contains (AU-9).

AU-6(4)

AUDIT REVIEW,

ANALYSIS, AND

REPORTING | CENTRAL

REVIEW AND ANALYSIS

Organizations provide capabilities that allow central review and analysis of audit records and events for all components.

Specific Control

Description HVA Control Description Compliance

AU-16

CROSS-

ORGANIZATIONAL

AUDITING

Organizations require that the contractor or external hosting entity comply with federal and agency audit requirements in the external environments. The external system provides non-repudiation for non- public user access to HVA information for accountability.

CA-7(3)

CONTINUOUS

MONITORING | TREND

ANALYSES

Organizations examine, correlate, and analyze current threat information sources, emerging vulnerabilities and exploits, latest social engineering tactics, intrusion detection events, and auditor reports and adjust the frequency and types of continuous monitoring activities accordingly to be performed against the systems and environment.

PL-8

INFORMATION SECURITY

ARCHITECTURE

In accordance with OMB M-17-09, organizations ensure strict access control implementation, multifactor authentication, vulnerability scanning, increased monitoring and analysis of events, network segmentation, boundary protections, and incident response testing.

The HVA security architecture is designed and implemented in a layered approach based on risk assessment of threats to components and data, information flow, user access, insider threats, operational behaviors, and mission-critical services.

Detailed data flows of information within the HVA are developed and prioritized; rules and policies are created where segmentation and layers of isolation are identified. Devices that do not require direct access by HVA users are located behind boundary protection devices with strict access control, filtering, and monitoring. Access lists use deny-by-default, permit-by-exception policy both inbound and outbound. Egress rules block all access except required services. Block all unnecessary traffic to the Internet. Security and administrative services and functions are isolated onto their own networks with strict access control.

Implement access control lists to limit traffic between security, admin, and production networks. Traffic entering and leaving the HVA accreditation boundary is encrypted in accordance with the risk analysis of the information being transmitted. Device services and applications are bound only to the appropriate interface/network required for it to function.

SI-4 SYSTEM MONITORING

Organizations monitor the environment for both internal and external threats leveraging monitoring information from the boundary devices, isolation devices, workstation and server devices, and intrusion/prevention devices. The HVA environment

Description HVA Control Description Compliance is monitored for anomalous traffic, exfiltration, and indicators of insider threat. For example, a user who is copying extraordinarily large amounts of information as compared to other users are identified and reviewed.

SI-4(1)

SYSTEM MONITORING |

SYSTEM-WIDE

INTRUSION DETECTION

SYSTEM

Organizations implement HVA environment-wide intrusion detection/prevention tools and solutions for all capable devices.

Host- based intrusion/prevention solutions report centrally to be used for monitoring of anomalous traffic, exfiltration, and indicators of insider threat.

SI-4(10)

SYSTEM MONITORING |

VISIBILITY OF

ENCRYPTED

COMMUNICATIONS

Organizations balance the need for encrypted traffic verses inspection of the traffic. Organizations determine the best approach to mitigating the risks associated with encrypted traffic.

Examples include but are not limited to the following: Choose to limit encrypted traffic to only authorized encrypted connections and locations; decrypt and inspect encrypted traffic entering and leaving the environment from unknown or public sources or destinations to determine the appropriateness of use; unencrypt inbound traffic at known locations so it can be inspected; and block all outbound unauthorized encrypted traffic.

SI-4(11)

SYSTEM MONITORING |

ANALYZE

COMMUNICATIONS

TRAFFIC ANOMALIES

Organizations monitor outbound and inbound traffic at the authorization boundary as well as strategic points inside the environment, such as boundary protection devices isolating the tiers (enclaves), to detect for anomalies, malicious traffic, or threats.

SI-4(13)

SYSTEM MONITORING |

ANALYZE TRAFFIC AND

EVENT PATTERNS

Analyze communications traffic and event patterns for the system at the authorization boundary and at access control points inside the environment, such as boundary protection devices isolated in the tiers (enclaves), to establish regular traffic patterns and actions. Continue to monitor traffic in these same locations and use the baselines as a comparison to detect unusual traffic and to configure detection monitoring tools with these baseline characteristics to alert on threshold values.

SI-4(16)

SYSTEM MONITORING |

CORRELATE

MONITORING

INFORMATION

Organizations correlate monitoring information from enterprise monitoring tools and mechanisms such as, but not limited to, antivirus monitoring, intrusion detection system, intrusion prevention system, and logging. Organizations must protect this information at an appropriate level congruent with the highest level of information contained within.

Description HVA Control Description Compliance

SI-4(18)

SYSTEM MONITORING

|ANALYZE TRAFFIC AND

COVERT EXFILTRATION

Monitor and inspect outbound communications traffic at the HVA authorization boundary and at strategic locations inside the boundary to detect covert exfiltration of information.

SI-4(20)

SYSTEM MONITORING

|PRIVILEGED USERS

Organizations implement additional monitoring of privileged user account actions based on established policies. Organizations determine what additional monitoring attributes for privileged accounts are implemented based on risk assessment and potential impact to the environment, i.e., successful process execution, successful resource access, etc.

SI-4(22)

SYSTEM MONITORING

|UNAUTHORIZED

NETWORK SERVICES

Organizations define authorized network services and implement solutions to detect unauthorized network services on the network and create alerts when detected. Examples include but are not limited to peer-to-peer communications and Internet relay chat.

SI-4(23)

SYSTEM MONITORING

|HOST-BASED DEVICES

Implement individual host-based monitoring tools and solutions on capable devices within the HVA accreditation boundary.

PL-10 BASELINE SELECTION

At a minimum all HVA systems start with at least the Moderate baseline from NIST SP 800-53 R5. All HVA overlay controls must be applied as specified and are not tailored. Organizations leverage FIPS 199 system categorization to select and tailor the initial baseline controls for HVAs from NIST SP800-53 R5 (Moderate or High baselines only). All HVA systems also receive the controls in the HVA Overlay. Based on a risk assessment and the types of information stored/transmitted/processed by the HVA, additional overlays may be necessary and other controls tailored in or out in accordance with the NIST Risk Management Framework.

3.4 Cybersecurity Support – Security Audit Monitoring Operations

The contractor shall provide Cybersecurity Support in assessing and establishing a framework for Security Audit (Continuous) Monitoring Operations. The Monitoring and Analysis support shall participate in a variety of Information System Security (ISS) activities including monitoring of HVA systems status; escalating and reporting potential user-related incidents; creating and updating incident cases and tickets; risk assessment analysis for Privilege Access Management (PAM) for elevated, global, privileged users and users with access to sensitive data sources such as FTI/PII/SBU systems. Privileged User Management Access System (PUMAS) uses CyberArk Privileged Account Security (“PAS”) solution which is a core component of CDM Phase 2 and provides managed privileged / elevated access to servers, and Just in Time (JIT) access to mainframes, network devices, and HVAs using privileged accounts. PAS provides audit trails, which consist of logs and optionally session recordings of all administrator actions which take place on the managed servers and devices to ensure higher levels of security and audit ability of all administrative actions which require elevated privileges. They enable users to be able to access these critical components in a safe and secure method with extensive auditing, session recording and policy-based controls.

BEARS provides full lifecycle management of the digital identity of an individual and of all the roles, resources and entitlements granted or removed. The contractor will provide monitoring of BEARS and other Identity Access Management (IAM) capabilities to assess the repository of user identity data, automated fulfillment of resource provisioning and de-provisioning workflows, and a request/ approval mechanism to facilitate user self-service for application/ resource access. The contractor will establish monitoring operations of full logging and auditing capabilities from IAM and PAM capabilities. The Security Audit Monitoring and Analysis support group shall provide 24x7x365 monitoring and analysis support of all IRS HVA security feeds. The contractor shall assist in the investigation and positively identify anomalous events that are detected by security devices or reported to the SOC from external entities, IRS components, system administrators, and the user community, via security monitoring platform and tools, incoming phone calls, and emails. The Security Audit Monitoring and Analysis support group may also be required to participate in assembling, evaluating, installing, and maintaining various intrusion detection sensors and associated software applications. The Contractor shall provide informal investigation, review, and recommendation documentation as necessary. Deliverables for Monitoring and Analysis Support include daily summary informal reports based on security event analysis.

The contractor shall work with the IRS Cybersecurity Operations team, and/or any other pertinent parties (to include external vendors) at any IRS location to recover from any incident. In this role, the contractor shall have hands-on involvement in gathering artifacts or recovering systems. It is expected that any incident requiring a response team to be deployed shall be able to deploy within 48 hours of notification. On rare instances where it is not possible to deploy, support will usually be done via phone and email, or, in rarer cases, remote system access. In all cases, this work shall be done in coordination with external service providers, IRS system owners, system administrators, and Information System Security Officers (ISSOs), as appropriate. The contractor shall also maintain a set of Government furnished portable vulnerability assessment, digital media analysis, and malware analysis tools to support deployment missions, to be used for critical incident response efforts and in response to high priority initiatives determined by IRS leadership. Deliverables for Incident Assessment and Response Support include an Incident Assessment and Response Report.

Representative activities include but are not limited to:

• Review deliverables created by the User Activity Monitoring and Security Audit Monitoring teams leveraging a deep understanding of security and privacy principles and solutions.

• Confirm the accuracy of anomalous activity and incident management statistics.

• Document HVA Incident risk mitigation strategies and alternative solutions for security and Counter-Insider Threat (CINT) risk areas.

• Support resolution of identified defects within PUMAS and BEARS capabilities through analyses, presentations, and coordination meetings.

• Establish and maintain an internal CINT risk register to track potential security and privacy weaknesses.

• Provide continuous monitoring assessment and validation of Security Audit Monitoring operations where output is specified, developed and tested to meet and demonstrate compliance with security and CINT requirements.

• Identify and recommend options for modifying approaches to achieving and maintaining security compliance to support program delivery strategies that seek to achieve more rapid, frequent, and continuous delivery of IT systems and services.

Desired Outcome: Effective and timely mitigation strategies for security and privacy risks. The program security and privacy team inputs are efficiently and effectively incorporated into program processes and solutions. Programs are continuously aware of; and responsive to, both known and emerging security and privacy impacts and risks. Additionally, governance documents including desk guides and SOPs for knowledge retention and transfer will be produced and maintained.

3.5 Task 4: (Surge Optional): CInT Ops Operational and Program Support

Description: This task…