B Sources Sought Notice 75N95023R00028-SBSS.pdf

SAM.gov

SOURCES SOUGHT NOTICE

1. Notice Number: 75N95023R00028-SBSS

2. Title: Cybersecurity Services Program (CSS)

3. Classification Code: DJ01 - IT and Telecom - Security And Compliance

Support Services (Labor)

4. NAICS Code: 541519 - Other Computer Related Services

5. Size Standard: $34M

6. Description:

This is a Small Business Sources Sought notice. This is NOT a solicitation for proposals, proposal abstracts, or quotations.

The purpose of this notice is to obtain information regarding: (1) the availability and capability of qualified small business sources; (2) whether they are small businesses; HUBZone small businesses; service-disabled, veteran-owned small businesses; 8(a) small businesses; veteran-owned small businesses; woman-owned small businesses; or small disadvantaged businesses; (3) their size classification relative to the North American Industry Classification System (NAICS) code for the proposed acquisition; and (4) availability of domestic sources manufactured in the United States in sufficient and reasonably available commercial quantities and of a satisfactory quality.

Your responses to the information requested will assist the Government in determining the appropriate acquisition method, including whether a set-aside is possible. An organization that is not considered a small business under the applicable NAICS code may submit a response to this notice.

This notice is issued to help determine the availability of qualified companies technically capable of meeting the Government requirement and to determine the method of acquisition. It is not to be construed as a commitment by the Government to issue a solicitation or ultimately award a contract. Responses will not be considered as proposals or quotes. No award will be made as a result of this notice. The Government will NOT be responsible for any costs incurred by the respondents to this notice. This notice is strictly for research and information purposes only.

Background: The mission of NCATS is to catalyze the generation of innovative methods and technologies that will enhance the development, testing, and implementation of diagnostics and therapeutics across a wide range of human diseases and conditions. NCATS is at the forefront of automated biomedical experimentation, replacing hours of time-consuming basic laboratory work with systems and robots capable of conducting experiments with a fraction of the resources. This technology can both cut costs and increase productivity, which acts as a multiplier effect on research efficiency and raw output.

In the administration of these programs, NCATS utilizes many assets, including buildings, facilities, communications equipment, computer systems, employees, contractors, public trust, and information. A loss to any one of these assets could affect the goals or the quality of support necessary from NCATS to its various customers and stakeholders. Additionally, NCATS collects, uses, and stores information that falls into the categories of privacy data, Protected Health Information (PHI), Personally Identifiable Information (PII), proprietary data, procurement data, inter-agency data, and privileged system information. Access to these types of information is subject to the Privacy Act of 1974 (as amended), the Computer Security Act of 1987 (as amended), and the Federal Information Security Management Act (FISMA) of 2002, as well as many important rules, regulations, policies, and guidelines promulgated by HHS, the Office of Management and Budget (OMB), and the National Institute of Standards and Technology (NIST). As a result, NCATS has a legal and practical responsibility to maintain the confidentiality, integrity, and availability of this information.

Under the NCATS Cybersecurity Services Program (CSS) and supported by the NIH Office of the Chief Information Officer (OCIO) staff, the NCATS CIO is responsible for applying prudent and effective information security, privacy and risk management measures. This will safeguard the NCATS staff, patients, research, grants and financial data, computers, networks, and other IT resources that are vital to the daily functioning and mission of NCATS. Under this program, the NCATS CIO seeks to comply with the Federal Information Security Modernization Act of 2014 (FISMA 2014), widely accepted information security best practices, and many other laws, policies, standards, mandates and initiatives as put forth by the U.S. Congress and implemented by the Department of Health and Human Services (HHS), the Department of Homeland Security (DHS), OMB, NIST, the General Accounting Office (GAO), and the White House. Also, under this program, the NCATS CIO provides information security and privacy incident response, security operations support, security policy and oversight, program and project management, security awareness and training, and other cyber and information security services to the NCATS programs and affiliates.

Though automated systems reduce the need for human labor, the systems and labs are not entirely self-sufficient. This contract seeks to augment the workforce responsible for the day-to-day operation of robotics and systems, as well as the infrastructure necessary to achieve top quality results.

Purpose and Objectives: The purpose of this requirement is to provide the National Center for Advancing Translational Sciences (NCATS) Information Technology Resources Branch (ITRB) Cybersecurity Services (CSS) Division with day-to-day support services. The contractor will provide full-time support through a small cadre of individuals under a fixed-price task order. The individuals working under this contract are expected to have deep individual cybersecurity expertise. Discrete tasks (for example, completion of an authorization to operate (ATO) package) will be performed through fixed-price or time-and-materials task orders structured to meet those needs (e.g. for a period of weeks or months, part-time, on-site/off-site, by subcontract, joint venture, etc.).

The contractor will provide advice to the CSS division chief regarding the most advantageous and cost-effective approaches to accomplish the tasks in this Statement of Work (SOW). These support services will primarily consist of direct support to the CSS Division on a fixed-price basis, with the first task order to provide for full-time level of effort that will address the contract management and program management tasks described below. Additional task orders may be issued on a fixed-price level of effort, fixed price completion, time-and-materials, or labor hours basis. The first task order will be awarded concurrently with the award of the parent IDIQ, and will provide for full-time support that will address the contract management and program management tasks).

Project requirements:

The complete description of each the project requirements is provided in the attached Draft Statement of Work.

• Experience and Functional Responsibility Capable of providing direct support to the chief of the CSS Division of ITRB in the execution of the tasks executed by the ISPG and NCIC. The contractor performing the services are expected to have deep individual cybersecurity expertise with a full-time support through a small cadre of individuals.

• Information Security and Privacy Policy Support Capable of providing information security and privacy support to NCATS employees and contractors to apply on specific business needs, technical situations and policy requirements.

• Information Security and Privacy Technical Services Capable of providing overall subject matter expertise to the Information Security Assessment and Authorization (A&A) program. Provide specific guidance and technical expertise in the form of standards, policies, procedures, and oversight for the NCATS A&A program as well as providing expertise in specific security or security-related engineering and privacy topics

• Information Security and Privacy Training Services

Capable of developing and maintaining a comprehensive information security and privacy awareness and training program.

• Audit Management and Support Capable of providing audit management support for involvement in the development and maintenance of an Audit and Risk Management program and to provide support

• Security Operations Support Capable of providing comprehensive operational cyber security situational awareness and response readiness by performing cybersecurity monitoring and advanced analytics and to provide support

• Security Engineering Capable of providing security engineering which implements, optimizes, and administers innovative security solutions that reduce IC risk by providing increased visibility and response readiness across the enterprise

• Penetration Testing Capable of providing penetration testing services by coordinating and conducting all Agency penetration testing on systems operated by and on behalf of NCATS.

Document a test plan and methodology and utilize a variety of NCATS approved tools to conduct vulnerability assessments and penetration tests for all NCATS FedRAMP cloud and on-prem systems.

• Forensics, Malware Analysis, and Advanced Hunting Capable of providing forensics and malware analysis for network, system and media digital forensics, advanced threat hunting, and malware analysis capabilities in a hybrid cloud environment. Utilize industry standard techniques, tools and procedures, to perform network and media digital forensics, incident response, malware analysis, advanced threat hunting across the Enterprise.

• Compliance Monitoring Capable of providing information security compliance monitoring activities to promote ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions and to address assessment and analysis of security control effectiveness

• Incident Management Capable of providing incident management services which includes a variety of critical functions related to situational awareness, incident and vulnerability management, coordination, collaboration, and security oversight for the

Enterprise. The service ensures that each of the individual incident response teams and associated stakeholders are provided with timely relevant information to allow for the most effective response activities possible.

• Cyber Threat Intelligence and Information Sharing The Threat Management Program ensures an optimal Agency security posture by identifying ongoing, immediate, and emerging threats to the organization, including threat actors, attack vectors, and breach scenarios. The vendor shall be Capable of providing proactive threat management informs stakeholders, improves situational awareness, highlights high-risk configuration vulnerabilities, facilitates rapid response, supplies relevant security material, and helps quantify organizational security risk

• Secure Application Development Service Capable of providing software assurance and best practices in the system development life-cycle (SDLC) of agile application development environment that incorporates NIST 800-64 and 800-53 r4 security controls required for Federal IT systems.

Anticipated period of performance: This is expected to be a one-year contract with two option years.

Other important considerations: It is incredibly important for respondents to recognize that the government is looking for a comprehensive security strategy that accounts for the complexity and diversity of the entire NCATS scientific and IT portfolio, not simply a piecemeal approach on a case-by-case basis.

Capability statement /information sought.

Companies that believe they possess the capabilities to provide the required services should submit documentation of their ability to meet each of the project requirements to the Contracting Officer. The capability statement must specifically address each of the project requirements separately, as per the ATTACHED DRAFT STATEMENT OF WORK, as well as the ATTACHED TECHNICAL CAPABILITIES QUESTIONNAIRE.

Additionally, the capability statement should include 1) the total number of employees, 2) the professional qualifications of personnel as it relates to the requirements outlined, 3) any contractor GSA Schedule contracts and/or other government-wide acquisition contracts (GWACs), such as NITAAC, by which all the requirements may be met, if applicable, and 4) any other information considered relevant to this program. Capability statements must also include the Company Name, Unique Entity ID from SAM.gov, Physical Address, and Point of Contact Information. The response must include the respondents’ technical and administrative points of contact, including names, titles, addresses, telephone and fax numbers, and e-mail addresses.

Interested companies are required to identify their type of business, applicable North American Industry Classification System (NAICS) Code, and size standards in accordance with the Small Business Administration. The government requests that no proprietary or confidential business data be submitted in a response to this notice.

However, responses that indicate the information therein is proprietary will be properly safeguarded for Government use only. Capability statements must include the name and telephone number of a point of contact having authority and knowledge to discuss responses with Government representatives. Capability statements in response to this market survey that do not provide sufficient information for evaluation will be considered non-responsive. When submitting this information, please reference the solicitation notice number.

One (1) copy of the response is required and must be in Microsoft Word or Adobe PDF format using 11-point or 12-point font, 8-1/2” x 11” paper size, with 1” top, bottom, left and right margins, and with single or double spacing.

The information submitted must be in and outline format that addresses each of the elements of the project requirement and in the capability statement /information sought paragraphs stated herein. A cover page and an executive summary may be included but is not required.

The response is limited to ten (10) page limit. The 10-page limit does not include the cover page, executive summary, or references, if requested.

All responses to this notice must be submitted electronically to the Contract Specialist and Contracting Officer. Facsimile responses are NOT accepted.

The response must be submitted to the Contract Specialist, Renato Gomes, at e-mail address renato.gomes@nih.gov

The response must be received on or before March 20, 2023, 9am, Eastern Time.

“Disclaimer and Important Notes: This notice does not obligate the Government to award a contract or otherwise pay for the information provided in response. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the organization’s qualifications to perform the work.

Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. After a review of the responses received, a presolicitation synopsis and solicitation may be published in www.sam.gov. However, responses to this notice will not be considered adequate responses to a solicitation.

mailto:renato.gomes@nih.gov

Confidentiality: No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).”

DRAFT 3/6/2023

Statement of Work Cybersecurity Services Program Support

1 General Information

1.1 Title of Project

1.2 Statement of Need and Purpose

1.3 Background Information and Objective

1.3.1 Physical and Information Landscape

1.3.2 Policy and Regulatory Landscape

1.3.3 Organizational Structure

1.3.4 Programmatic Support

2 Statement of Work

2.1 Specific Requirements

2.1.1 Contract Management

2.1.2 Contract-Level Program Management

2.1.3 Experience and Functional Responsibility

2.2 Information Security and Privacy Group (ISPG)

2.2.1 Task 1: Information Security and Privacy Policy Support

2.2.2 Task 2: Information Security and Privacy Technical Services

2.2.3 Task 3: Information Security and Privacy Training Services

2.2.4 Task 4: Audit Management and Support

2.2.5 Task 5: Security Operations Support

2.3 NCATS Cybersecurity Integration Center (NCIC)

2.3.1 Task 1: Security Engineering

2.3.2 Task 2: Penetration Testing

2.3.3 Task 3: Forensics, Malware Analysis, and Advanced Hunting

2.3.4 Task 4: Compliance Monitoring

2.3.5 Task 5: Incident Management

2.3.6 Task 6: Cyber Threat Intelligence and Information Sharing

2.3.7 Task 7: Secure Application Development Service

3 Additional Deliverable

3.1 Task 1: Bi-Weekly Status Reporting Requirements

3.2 Task 1: Monthly Status Reporting Requirements

4 Additional Requirements

4.1 Task 1: Reports

4.2 Task 2: Task Order Report and Delivery Schedule

4.3 Government Responsibilities

4.4 Other Considerations

4.4.1 Travel

4.4.2 Transition In / Transition Out

4.4.3 Key Personnel

4.4.4 Personnel Security

4.4.5 Management

1 General Information

1.1 Title of Project

Cybersecurity Services Program (CSS)

1.2 Statement of Need and Purpose

The purpose of this requirement is to provide the National Center for Advancing Translational Sciences (NCATS) Information Technology Resources Branch (ITRB) Cybersecurity Services (CSS) Division with day-to-day support services.

The contractor will provide full-time support through a small cadre of individuals under a fixed-price task order. The individuals working under this contract are expected to have deep individual cybersecurity expertise. Discrete tasks (for example, completion of an authorization to operate (ATO) package) will be performed through fixed-price or time-and-materials task orders structured to meet those needs (e.g. for a period of weeks or months, part-time, on-site/off-site, by subcontract, joint venture, etc.). The contractor will provide advice to the CSS division chief regarding the most advantageous and cost-effective approaches to accomplish the tasks in this Statement of Work (SOW).

These support services will primarily consist of direct support to the CSS Division on a fixed-price basis, with the first task order to provide for full-time level of effort that will address the contract management and program management tasks described below. Additional task orders may be issued on a fixed-price level of effort, fixed price completion, time-and-materials, or labor hours basis.

The first task order will be awarded concurrently with the award of the parent IDIQ, and will provide for full-time support that will address the contract management and program management tasks described below.

1.3 Background Information and Objective

The mission of NCATS is to catalyze the generation of innovative methods and technologies that will enhance the development, testing, and implementation of diagnostics and therapeutics across a wide range of human diseases and conditions. NCATS is at the forefront of automated biomedical experimentation, replacing hours of time-consuming basic laboratory work with systems and robots capable of conducting experiments with a fraction of the resources. This technology can both cut costs and increase productivity, which acts as a multiplier effect on research efficiency and raw output.

1.3.1 Physical and Information Landscape

In the administration of these programs, NCATS utilizes many assets, including buildings, facilities, communications equipment, computer systems, employees, contractors, public trust, and information. A loss to any one of these assets could affect the goals or the quality of support necessary from NCATS to its various customers and stakeholders. Additionally, NCATS collects, uses, and stores information that falls into the categories of privacy data, Protected Health Information (PHI), Personally Identifiable Information (PII), proprietary data, procurement data, inter-agency data, and privileged system information. Access to these types of information is subject to the Privacy Act of 1974 (as amended), the Computer Security Act of 1987 (as amended), and the Federal Information Security Management Act (FISMA) of 2002, as well as many important rules, regulations, policies, and guidelines promulgated by HHS, the Office of Management and Budget (OMB), and the National Institute of Standards and Technology (NIST). As a result, NCATS has a legal and practical responsibility to maintain the confidentiality, integrity, and availability of this information.

1.3.2 Policy and Regulatory Landscape

Under the NCATS Cybersecurity Services Program (CSS) and supported by the NIH Office of the Chief Information Officer (OCIO) staff, the NCATS CIO is responsible for applying prudent and effective information security, privacy and risk management measures. This will safeguard the NCATS staff, patients, research, grants and financial data, computers, networks, and other IT resources that are vital to the daily functioning and mission of NCATS. Under this program, the NCATS CIO seeks to comply with the Federal Information Security Modernization Act of 2014 (FISMA 2014), widely accepted information security best practices, and many other laws, policies, standards, mandates and initiatives as put forth by the U.S. Congress and implemented by the Department of Health and Human Services (HHS), the Department of Homeland Security (DHS), OMB, NIST, the General Accounting Office (GAO), and the White House. Also, under this program, the NCATS CIO provides information security and privacy incident response, security operations support, security policy and oversight, program and project management, security awareness and training, and other cyber and information security services to the NCATS programs and affiliates.

Though automated systems reduce the need for human labor, the systems and labs are not entirely self-sufficient. This contract seeks to augment the workforce responsible for the day-to-day operation of robotics and systems, as well as the infrastructure necessary to achieve top quality results.

1.3.3 Organizational Structure

To safeguard the confidentiality, integrity, and availability of its information and information systems effectively, NCATS has established a center wide Cybersecurity Services Program (CSS). Within this program it has two subcategories – the Information Security and Privacy Group (ISPG) and the NCATS Cybersecurity Integration Center (NCIC).

The Information Security and Privacy Group, charged with protecting NCATS data, provides leadership to NCATS and its programs in managing information security and privacy risks appropriate for evolving cyber threats. ISPG executes this vision utilizing an innovative approach to provide optimal visibility, situational awareness, resilience and incident response readiness across all NCATS systems.

The NCIC is crafted to particularly identify, detect, protect, prevent, respond and recover from any cybersecurity threat. The CSS Security and Privacy program is responsible for defining policy, providing security and privacy services, leading compliance and oversight of the program, asset & inventory management, training & awareness, and audits & assessments.

NCATS CSS will partner and support the NCATS community, culture, and mission in partnership with relevant stakeholders, including intramural and extramural principal investigators and research staff; patients, physicians, nurses, and other caregivers; NCATS senior management and administrative staff; and NCATS IC CIO, Information System Security Officers (ISSOs), and security team members.

CSS would work in close collaboration with contractor support to provide subject matter expertise and thought leadership. CSS would also take ownership of responsible work, manage quality, and provide the government with deliverables that are finished products ready to be delivered to senior management or CSS customers across the agency.

“Finished Products” are concise, relevant, well-formed and professional in appearance with content checked for accuracy and adherence to objectives through a contractor-managed quality control process.

The NCATS CSS Program is seeking to further its goal to support the unique NCATS biomedical research enterprise and safeguard its diverse Hybrid IT (both cloud and on-premises) resources that NCATS relies on each day to fulfill its mission. The program is committed to balancing mission needs and risk; reducing NCATS high risk areas; improving protections for data, infrastructure and staff; and working to increase visibility into IT assets, operations, threats and risks. These goals will be achieved via NCATS-specific initiatives and federal-wide directives and compliance requirements to promote IT management best practices of the full life-cycle of NCATS IT investments, including configuration and patch management, system administration, and change and operations management. These activities will also be accomplished via implementation of DHS Continuous Diagnostic and Mitigation (CDM) guidance and technologies and other NCATS, NIH and HHS information security projects intended to protect and serve the NCATS mission, patients and staff.

The requirements placed upon the NCATS CSS Program to protect NCATS against cybersecurity threats, including the need to quickly modernize the NCATS information security infrastructure and improve capabilities, have dramatically increased.

The Cybersecurity Services (CSS) division is the counterpart to the Information Technology Support Services division, which provides direct general IT and scientific computing support.

The following provides the organizational structure with associated services:

1.3.4 Programmatic Support

The contractor managing CSS will also be responsible for providing its services to NCATS programs such as the Rare Disease Clinical Research Network (RDCRN) and the Clinical Translational Science Awards (CTSA) Program Network.

1.3.4.1 RDCRN

The RDCRN is intended to advance the diagnosis, management, and treatment of rare diseases with a focus on clinical trial readiness. Each RDCRN member will promote highly collaborative, multi-site, patient-centric, translational and clinical research with the intent of addressing unmet clinical trial readiness needs. NCATS provides access and expertise in provisioning, managing, and securing cloud services to RDCRN. NCATS currently has access to services from major cloud providers for commercial and government cloud environments.

1.3.4.2 CTSA

The CTSA Program supports a national network of medical research institutions — called hubs ― that work together to improve the translational research process to get more treatments to more patients more quickly. The hubs collaborate locally and regionally to catalyze innovation in training, research tools and processes. To facilitate this work NCATS has begun to work on the iCollaborate Initiative which is a cloud-based infrastructure with four primary goals:

1. Promote Collaborative Team Science

• Investigators/institutions work together to solve healthcare challenges

2. Shared Resources

• Scientific Material produced by the CTSA will be available to the entire CTSA

Program

3. Economies of Scale

• Implement cloud-based computing to standardize network while minimizing duplicative investments

4. Security Services

• Provide consolidated capabilities that replace or augment existing technology to improve security

All these goals are imperative to the success of the initiative but are dependent on the foundation and operation of a secure cloud environment.

1.3.4.3 ASPIRE

The same goals can also be applied towards the ASPIRE program defined as A Specialized Platform for Innovative Research Exploration. The intent of this program is to generate a next generation life sciences laboratory that is collaborative in nature; meaning automated platforms available across multiple facilities can be utilized by researchers in a collaborative way to help develop new therapies. This will also require a secure cloud-based environment where researchers from around the country can freely and securely share data and initiate new experiments to be run. It is important to stress that point; the collaborative cloud platform can be used to initiate an automated process at a physical location that may be different from the location of the researcher. This requires a very difficult balancing act between being open and accessible yet at the same time secure and protected.

2 Statement of Work

2.1 Specific Requirements

The contractor shall provide all services and qualified personnel, not otherwise provided by the Government, necessary to perform the following tasks:

2.1.1 Contract Management

The contractor shall prepare a management plan describing the technical approach, organizational resources, and management controls to be employed to meet the cost, performance, and schedule requirements throughout contract execution. The proposed management plan shall be submitted with the written technical proposal. At the time of award, the Government may recommend changes to the management plan which will be negotiated and made final within fifteen days of contract award.

2.1.2 Contract-Level Program Management

The contractor shall provide the technical and functional activities at the contract level needed for program management. This shall include productivity and management methods such as project management, task level quality assurance, work breakdown structures, onsite and offsite staff supervision, documentation quality reviews, responsive hiring, and maintenance of staff technical skills. The contractor shall also provide the centralized administrative, clerical, documentation and other related functions appropriate to this level.

2.1.3 Experience and Functional Responsibility

This contract provides direct support to the chief of the CSS Division of ITRB in the execution of the tasks executed by the ISPG and NCIC as described below. The individuals working under this contract are expected to have deep individual cybersecurity expertise.

The contractor will provide full-time support through a small cadre of individuals under a fixed-price task order. Discrete tasks (for example, completion of an ATO package) will be performed through fixed-price, time-and-materials, or labor-hours task orders structured to meet those needs (e.g. for a period of weeks or months, part-time, on-site/off-site, by subcontract, joint venture, etc.). The contractor will provide advice to the CSS division chief regarding the most advantageous and cost-effective approaches to accomplish the tasks in this SOW.

2.2 Information Security and Privacy Group (ISPG)

2.2.1 Task 1: Information Security and Privacy Policy Support

Develop and provide information security and privacy support to NCATS employees and contractors to apply on specific business needs, technical situations and policy requirements.

A. Provide guidance and determine the impact of new technology or policy (e.g., CDM technologies, anomaly-based tools, virtual and cloud environments, etc.) on the NCATS information security and privacy program;

B. Provide expert analysis and document preparation for various analytical efforts focused on processes and procedures;

C. Review various draft documents and provide timely feedback to NCATS employees and contractors;

D. Develop and implement information security and privacy program strategic and tactical goals and objectives, in addition to outreach and communication plans;

E. Assist with transforming the organization and governance structure to support NCATS information security and privacy initiatives;

F. Draft, review, update, and maintain information security policies, procedures, guidelines, tools, directives, templates, and materials to ensure all documentation reflects and incorporates the most recent version of all NCATS information security and privacy program documentation;

G. Develop an Information Security library/website for NCATS that will provide IC employees and contractors with a virtual library of applicable security and privacy policies, procedures, guidelines, tools, directives, and templates;

H. Provide information support for NCATS employees and contractors to obtain assistance with questions/issues concerning NCATS information security and privacy standards, policies, procedures, Assessment and Authorization (A&A) artifacts, and any other security-related deliverables NCATS requires for systems and applications as documented and required on the NCATS Information Security Website.

I. Provide surge capability when required by COR

Deliverable(s): Submit a written proposal for NCATS COR approval that addresses requirements outlined in section 2.2.1 Task1: Information Security & Privacy Support:

Information Security website that hosts library of security policies, procedures, guidelines, tools, templates, etc. for NCATS employees and contractors.

2.2.2 Task 2: Information Security and Privacy Technical Services

2.2.2.1 Task 2a - Assessment and Authorization (A&A) Support

A. Provide overall subject matter expertise to the Information Security Assessment and Authorization (A&A) program. Provide specific guidance and technical expertise in the form of standards, policies, procedures, and oversight for the NCATS A&A program;

B. Create and/or review and analyze all Authorization to Operate (ATO) artifacts for accuracy and completeness in support of ATO requests;

C. Conduct audits of Plan of Actions and Milestones (POA&M) for completeness and compliance;

D. Develop and support the Ongoing Authorization (OA) / Continuous Monitoring process.

E. Catalog system security authorization documentations for each Program system or release. Update the Business Impact Analysis (BIA), System Security Plan (SSP), IT Contingency Plan (CP), Contingency Plan Test (CP Test), Configuration Management Plan (CMP), Incident Response Plan (IRP), Incident Response Plan Test (IRP Test), and Plan of Actions and Milestones (POAMs). Identify and remediate any gaps in existing documentation.

Deliverable(s): Submit required documents listed in 2.2.2.1 Task 2a in support of Assessment & Authorization engagements.

2.2.2.2 Task 2b – Privacy and Security Engineering Services

Provide expertise in specific security or security-related engineering and privacy topics, which may include, but is not limited to, the following types of activities:

A. Provide expertise in specific security or security-related engineering topics and privacy engineering.

B. Prepare situational awareness briefings regarding information security policy and industry trends for NCATS senior management;

C. Develop alternatives of system designs and/or architectures which consider trade-offs between security requirements, functional/operational requirements, cost and compliance;

D. Determine the impact of new or changing applicable federal policy changes or revised legislation and regulations (OMB, HIPAA, FISMA, FISCAM, FedRAMP, FITARA, etc.);

E. Conduct research and present analyses to evaluate and/or determine emerging industry technology trends, government agency best practices, and security issues;

F. Ensure security and privacy is an integral part of all phases of the System Development Life Cycle (SDLC);

G. Provide vulnerability management technical support services.

Deliverable(s): Executive Briefings: Support as requested the development and/or delivery of content related to contractor's tasks in support of a range of NCATS executive briefings, boards as requested by COR. Content for such briefing support may include but is not limited to strategic plans & proposals, status reports, performance metrics, business cases, etc.

2.2.3 Task 3: Information Security and Privacy Training Services

Develop and maintain a comprehensive information security and privacy awareness and training program which will include, but is not limited to, providing support in the following areas:

A. Assess and provide recommendations of additional training beyond the existing training program and materials to meet security and compliance requirements as well as recent industry trends;

B. Develop, deliver and maintain outreach and marketing strategy for security and privacy;

C. Enhance, document, administer, and deliver a comprehensive program to measure and improve the information security and privacy awareness and vigilance of all NCATS system users and administrators, including those with significant security responsibilities.

D. Develop a comprehensive Information Security & Privacy role-based training program including training material (in various media formats including but not limited to online, e-learning, video, etc.) for NCATS staff and its partners.

D. Propose metrics for COR approval that demonstrates improvements required in item ‘C”.

Deliverable(s): Submit a written proposal for NCATS COR approval for training of information security & privacy program and material that meets federal security compliance standards and industry trends.

Submit a written proposal for NCATS approval for an outreach and promotion strategy for security and privacy awareness training.

2.2.4 Task 4: Audit Management and Support

Provide audit management support for involvement in the development and maintenance of an Audit and Risk Management program and to provide support to include, but is not limited to, the following areas:

A. Support audit engagements in research, information gathering , and submission of written responses and audit artifacts;

B. Manage each audit engagement in collaboration with all stakeholders;

C. Maintain a list of findings and support the remediation efforts D. Assist with managing and maintaining visibility of plans of action and milestones

(POA&M) through closure to improve levels of acceptable risk.

Deliverable(s): Provide written status report on the findings from audit engagements and POAM activities.

2.2.5 Task 5: Security Operations Support

Provide comprehensive operational cyber security situational awareness and response readiness by performing cybersecurity monitoring and advanced analytics and to provide support to include, but is not limited to, the following areas:

A. Monitor, defend and protect perimeter interface for malicious network traffic;

B. Performing advanced network analysis of egress and ingress traffic;

C. Monitor, defend and protect hosts and applications within each FISMA boundary for malicious activity or activity that could indicate lateral movement within the environment;

D. Monitor security events, correlate information from cloud and on-premises data center feeds and NCATS functional areas to identify incidents, issues, threats, and vulnerabilities.

Deliverable(s): Standard Operating Procedures (SOPs) and notification, escalation, and summary reports, Service Desk Tickets, Incident Response Reports, Federal requirements, and Agency requirements and guidelines.

Ad-hoc reports on any event or incident to the NCATS ISSO, ITRB leads and/or COR.

Reports can include, but not limited to, reviews, findings and recommendations; cyber security metrics and trending data.

2.3 NCATS Cybersecurity Integration Center (NCIC)

2.3.1 Task 1: Security Engineering

Provide security engineering which implements, optimizes, and administers innovative security solutions that reduce IC risk by providing increased visibility and response readiness across the enterprise. This includes the following:

A. Ensure security system architecture and engineering is built into the solution/design as part of the SDLC and solutions implementation;

B. Support NCATS security operations center (SOC) operations and the tools that are used by the various subordinate SOCs;

C. Develop and maintain advanced protection of NCATS core systems and infrastructure as well as protecting and updating key applications;

D. Provide oversight and leadership into the use of current and future security tools used to additionally secure NCATS and its systems as a whole;

E. Bridge security gaps and enhance tool interoperability through development and implementation of open source toolkit;

F. Research, develop, administer and actively tune security implementation for the

NCATS enterprise that provides visibility, situational awareness, active defense, and response readiness;

G. Develop enterprise security engineering plan;

H. Develop and maintain an enterprise security architecture.

I. Provide surge capability when required by COR

Deliverable(s): Document proposed plan including secure system architecture plan and design solutions within the FISMA boundary for NCATS’ review & approval.

Comprehensive documented description of the secure system configuration and implementation of design and/or solutions that are consistent with Federal, NIST 800-53 & other Special Publications and NCATS architecture guidelines.

2.3.2 Task 2: Penetration Testing

Provide penetration testing services by coordinating and conducting all Agency penetration testing on systems operated by and on behalf of NCATS. Document a test plan and methodology and utilize a variety of NCATS approved tools to conduct vulnerability assessments and penetration tests for all NCATS FedRAMP cloud and on-prem systems.

A. Identify security deficiencies and determine the efficacy of security controls design and implementation;

B. Advise and deploy countermeasures to mitigate threats;

C. Provide a basis for evaluating the effectiveness of proposed or implemented security measures;

D. Provide vulnerability to exploit mapping;

E. Integrate penetration testing activities with other testing efforts.

Deliverable(s): Documented test plan and methodology utilizing a variety of NCATS approved tools to conduct vulnerability assessments and penetration tests for all NCATS FedRAMP cloud and on-premises systems.

Rules of Engagement (ROE) letter and approval by COR & NCATS ISSO of plan activities and the finding and recommended remediation reports.

2.3.3 Task 3: Forensics, Malware Analysis, and Advanced Hunting

Provide forensics and malware analysis for network, system and media digital forensics, advanced threat hunting, and malware analysis capabilities in a hybrid cloud environment. Utilize industry standard techniques, tools and procedures, to perform network and media digital forensics, incident response, malware analysis, advanced threat hunting across the Enterprise.

Deliverable(s): Reports on any event or incident analyses to the COR and Government Leads (CSS Lead and ISSO). Report should include a detailed diagram from the origin of the incident, activities conducted including but not limited to, comprehensive forensic findings, results of all analyses and remedial recommendations

2.3.4 Task 4: Compliance Monitoring

Provide information security compliance monitoring activities to promote ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions and to address assessment and analysis of security control effectiveness.

Deliverable(s): Centralized repository of documented report of the lifecycle of incident from its origination to closure.

2.3.5 Task 5: Incident Management

Provide incident management services which includes a variety of critical functions related to situational awareness, incident and vulnerability management, coordination, collaboration, and security oversight for the Enterprise. The service ensures that each of the individual incident response teams and associated stakeholders are provided with timely relevant information to allow for the most effective response activities possible.

The NCIC team serves as the central coordinating and communications component for security efforts coordination, incident and vulnerability management, for the teams supporting NCATS FISMA systems. The services include, but are not limited to, providing support in the following areas:

A. Provide NCATS leadership and appropriate stakeholders with comprehensive situational awareness regarding the status of all security related incidents and activities relating to all NCATS Hybrid IT Infrastructure;

B. Conducts and coordinates data calls out to federal and contractor staff who own or operate NCATS FISMA systems;

C. Provide centralized oversight for all NCATS security functions D. Provide security and privacy expertise to assist with research and responding to privacy incidents, regardless of how the incident is reported.

E. Conduct initial triage, containment, categorization, and escalation for suspicious events and incidents;

F. Provide compromise response activities as necessary as well as any lessons learned and recommendations for improvement of our security posture if necessary.

Deliverable(s): Document, update or revise an Incident Response Plan (IRP) to include short and long-term goals for improving incident response program based on guidance from the NIH Incident Response Plan and NIST 800-61 Rev 2. IRP should define and report metrics for measuring the incident response capability.

Document incident analysis reports of event(s) to the COR and ISSO. Reports should include but is not limited to comprehensive findings, other results of the analysis and remedial recommendations.

2.3.6 Task 6: Cyber Threat Intelligence and Information Sharing

The Threat Management Program ensures an optimal Agency security posture by identifying ongoing, immediate, and emerging threats to the organization, including threat actors, attack vectors, and breach scenarios. Proactive threat management informs stakeholders, improves situational awareness, highlights high-risk configuration vulnerabilities, facilitates rapid response, supplies relevant security material, and helps quantify organizational security risk.

A. Provide timely alerts and information about current security issues, vulnerabilities and exploits B. Engage team cross-team communication, coordination and collaboration about cyber threats to ensure effective execution of threat management and IT operational task

C. Exchange information and provide detail documentation

Deliverable(s): Written communication that provides up-to-date information about cyberthreat of high-impact activities affecting NCATS systems. Information should include but is not limited to alerts of current security issues, automated scans of vulnerabilities and potential exploits.

2.3.7 Task 7: Secure Application Development Service

Provide software assurance and best practices in the system development life-cycle (SDLC) of agile application development environment that incorporates NIST 800-64 and 800-53 r4 security controls required for Federal IT systems. The software assurance process should apply the required security controls within the SDLC with a thorough understanding of the information security, threats, vulnerabilities, adverse impacts and risk to critical mission/business functions and provide foundation for the successful development, implementation and operations of information systems.

A. Develop and provide functional software assurance evaluation process that incorporates SDLC in accordance with NIST 800-64 applies to development, implementation and maintenance of application development.

B. Apply application security engineering principles in an agile SDLC application development environment during the design, coding and testing of application components that incorporates security testing/evaluation required to be implemented at all post-design phases of SDLC process.

C. Conduct Application Vulnerability Scanning and Analysis and recommend necessary remediation of security deficiencies including but not limited to products and technology used.

D. Prepare, revise, update and maintain documented software assurance processes and that include but not limited the following: Stakeholder Need and Requirement Definition, System Requirement & Specifications, Architecture Definition, System Analysis and Verification, Implementation/Operation/Maintenance & User Documentation

Deliverable(s): Documented Software Assurance (SwA) Guideline best practices.

Documented Application Code Analysis and Remediation Report.

Document alignment, gap analysis and update System Development Life Cycle (SDLC) procedures to include the security risk management process in the SDLC activities.

Other deliverables:

Project Plan - schedule and requirement Requirement - defined requirement from stakeholder Design & Prototyping - architecture design document Development - testable and functional solution Testing - integration & performance testing Deployment – management process/SOPs Operation and Maintenance – Documented SOPs, Tools, configuration management, etc. For the O&M of applications

3 Additional Deliverable

3.1 Task 1: Bi-Weekly Status Reporting Requirements

Upon the commencement of each task order, the Contractor shall support bi-weekly Status Meetings and/or Deliverable Review Meetings by preparing and delivering Meeting Agendas, Meeting Minutes, Presentation Materials, and an Action Item List for each Status Meetings and/or Deliverable Review Meetings.

• Activities performed on each task since the last bi-weekly meeting

• Current status of each deliverable, including a discussion of those deliverables that are delayed, behind schedule, or late

• Activities by each task/sub-task anticipated for the following 4 weeks

• Meetings attended by Contractor staff since the last bi-weekly meeting

• Risks by deliverable for those identified as behind schedule or delayed with mitigations

• Issues by deliverable for those identified as late with corrective action plan and impact to each project and project dependencies

• Current metrics and statistics for monitoring activities, including a discussion of new security incidents for each week, updates of old security incidents by status

3.2 Task 1: Monthly Status Reporting Requirements

Upon award and commencement of each task order, the Contractor…