CB18-RFP0008amend002_Cyber_Security_Monitoring.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NO.

3. EFFECTIVE DATE

05/11/2018

4. REQUISITION/PURCHASE REQ. NO.

CB2018-0143

5. PROJECT NO. (If applicable)

AOCBOCODE

Acquisitions Office Congressional Budget Office FHOB 2nd & D Streets, SW Acquisitions@cbo.gov Washington, DC 20515

6. ISSUED BY CODE7. ADMINISTERED BY (If other than Item 6)

9A. AMENDMENT OF SOLICITATION NO.

CB18-RFP0008

CODE FACILITY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, country, state and ZIP Code) (X)

X 9B. DATED (SEE ITEM 11)

04/25/2018

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 11)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X XThe above numbered solicitation is amended as set forth in item 14. The hour and date specified for receipt of Offers is extended, is not extended, Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods: (a) By completing items 8 and 15, and returning __1__copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment your desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return _______ copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Project Title: Cyber Security Monitoring Services

Purpose of Amendment: This amendment (1) incorporates the answers to questions from offerors; and (2) revises pages from the solicitation. See the pages attached to this amendment for Q&A document and the solicitation revisions.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

(Signature of person authorized to sign)

15B. CONTRACTOR/OFFEROR 15C. DATE SIGNED

By (Signature of Contracting Officer)

16B. UNITED STATES OF AMERICA 16C. DATE SIGNED

NSN 7540-01-152-8070

Previous edition unusable

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA FAR (48 CFR) 53.243

Document Number: CB18-RFP0008 Page 1 of 14

Questions and Answers for Cyber Security Monitoring Services Solicitation No. CB18-RFP0008

May 11, 2018

Question 1: I am writing to request clarification / confirmation regarding the facility clearance requirements, which seemingly contradict one another. A company cannot hold or process an employee’s Top Secret clearance with a facility clearance of the same level (TS).

Answer: We have revised the solicitation to remove the Top Secret key personnel and facility clearance requirements. (See RFP §3, SOW ¶4)

Question 2: How many IP address will require auditing and monitoring?

Answer: Approximately 900. Total number is not expected to exceed 1,370 through the duration of the contract.

Question 3: Can ACAS and SCAP Compliance Checker (SCC) be used for network vulnerability scanning? If not, what tools are required?

Answer: CBO will provide the vulnerability scanning tools. Offerors should be familiar with

Tenable products.

Question 4: Can you provide a historical hour breakdown of labor, or equivalent data, to assist in scoping the labor effort?

Answer: This contract has historically been a fixed-price effort, so we have no data on previous contractor effort. Additionally, the scope of this RFP is somewhat expanded compared to the previous contract scope.

Question 5: Can you provide a breakdown of the number of onsite personnel and remote personnel required? Also, can you specify the role of the on-site personnel?

Answer: No security monitoring personnel are required to be onsite at CBO. This is a service/solution engagement with no onsite personnel required. Contractor personnel are only expected to come to CBO for meetings and system health checks. Contractor personnel shall perform the monitoring services from the Contractor’s facility.

Question 6: Do personnel that do not require a TS clearance require a SECRET clearance or

Public Trust?

Answer: We have revised the solicitation to remove the Top Secret key personnel requirement. In addition, we clarified that all personnel must obtain a favorable FBI criminal check. (See RFP §3, SOW ¶4(c))

Question 7: Is there a CDRL or other deliverable list?

Answer: There is no list of deliverables in the solicitation. Offerors should include in their proposal the deliverables they expect to provide under the contract, based on the SOW requirements and their experience.

Question 8: Can you disclose if this scope is currently being performed by a contractor? If not, it is currently being performed by the Government?

Answer: Similar services are currently being performed by TruShield Security Solutions, Inc. under Contract No. CB17-C0171.

Amendment No. 002 to Solicitation No. CB18-RFP0008 Page 2 Questions and Answers

Question 9: Is there a page count limitation for the technical volume response?

Answer: No, there is no page count limitation on the proposal.

Question 10: Is there a limit on the number of past performance citations?

Answer: No, there is no limit on the number of past performance items. The RFP asks that offerors “[p]rovide a list of all companies/agencies for whom the offeror recently … performed contracts that are similar in scope and magnitude to the work required under this solicitation.” (Ref. RFP §4, ¶4(4)(a))

Question 11: Can the Government provide a two-week extension to the proposal due date?

Answer: Due to schedule constraints, we cannot grant a two-week extension. However, we did grant a 1-week extension to the proposal due date. See Amendment No. 001 issued on May 10, 2018 for the new proposal due date.

Question 12: Please provide the amount of data (in GB) that all existing CBO log sources comprise on a daily, weekly, or monthly basis. This information is necessary for SIEM pricing.

Answer: CBO can provide this information to the Contractor after award. Additionally, the vendor will not be purchasing the SIEM. Regardless of the type selected (managed, co-managed, or fully managed), CBO will purchase the SIEM.

Question 13: How many unique users does CBO have?

Answer: See SOW ¶1: “IRM supports a staff of 245 employees …”

Question 14: How many externally-facing websites/web applications does CBO maintain?

Answer: Relevant to this solicitation, there are two in AWS that are externally-facing.

None are located onsite. The CBO.gov public website is hosted externally by a third party so it is not included in this requirement.

Question 15: How many network segments are there?

Answer: There are 4 segments (Inside, Outside, DMZ) and roughly 20 VLANS.

Question 16: What is the bandwidth for each TIC/Internet circuit? What is the average utilization for each?

Answer: Currently, CBO’s bandwidth is 100MBps. We will have the ability to move to 1GB in the future as we use more cloud options.

Question 17: How many Events per second do the Tipping Point IPS see on average?

Answer: On average, Tipping Point sees about 45 Inspection events every 15 minutes.

Question 18: Will the CBO consider extending the proposal due date to one week?

Answer: See answer to Question 11.

Question 19: Please disclose incumbent(s) for the previous contract.

Answer: See answer to Question 8.

Question 20: Is there an approved list of software?

Answer: No, it is the Contractor’s responsibility to determine the particular tools and technology they need to support the requirements under the contract.

Amendment No. 002 to Solicitation No. CB18-RFP0008 Page 3

Question 21: Will this need to cover assessments for all departments of IAM, DLP, Cyber tools for risk management of Agriculture, Budget, CBO Operations, Climate and Environment, Defense and National Security, Disaster Preparation and Relief, Dynamic Analysis, Economy, Education, Employment and Labor Markets, Energy and Natural Resources, Finances, Health Care, Homeland Security, Housing, Immigration, Income Distribution, Infrastructure and Transportation, Mandates, Poverty and Income Security, Retirement, Science and Research and Development, Social Security, State and Local Governments, Taxes, and Veteran?

Answer: CBO is a small agency with 245 staff. All divisions are included in this requirement and all divisions are covered by the same security policies and tools.

Question 22: Please provide inventory comprising the NOC and SOC.

Answer: This information is included in Appendix A (the document sent separately to requestors that submit the NDA at Attachment 3 of the solicitation).

Question 23: Please confirm the FTE’s supporting this opportunity will be responsible for monitoring endpoints such as desktops, networks and servers.

Answer: Yes.

Question 24: Please confirm tools currently in use within the SOC.

Answer: See answer to Question 22.

Question 25: Please confirm the number of users, end points, assets that are on the enterprise managed service contract agreement. What is the current list of GSP boundary for all assets in scope? Can we review the current SSP?

Answer: The number of users is 245 (see SOW ¶1). Endpoints, assets, and nodes together total around 900. Our demarcation point is from the Internet/Border router down to the endpoint.

Question 26: Is there a ticketing system in place today? If so, what is it?

Answer: CBO uses the system provided by the incumbent contractor and an internal helpdesk system from Absolute/Heat.

Question 27: If no ticketing system is in place today, are the vendors responsibility to provide one?

Answer: Yes, the Contractor shall provide a system for submitting trouble tickets. (See

RFP §3, SOW ¶3(8)a)

Question 28: What SIEM are you currently using?

Answer: CBO will provide this information to the Contractor after award. Familiarity with

Splunk is a plus.

Question 29: Does the government expect the remote monitoring/traffic to occur on an unclassified or classified facility?

Answer: We have revised the solicitation to remove the facility clearance requirement and replaced it with a description of the required facility characteristics. (See RFP §3, SOW ¶4)

Amendment No. 002 to Solicitation No. CB18-RFP0008 Page 4

Question 30: Is this being released on a GSA schedule? If so, what SIN?

Answer: This solicitation is not being competed under a specific GSA Schedule; the clause at CBO 201-01 (Alternate I) that references the GS Schedule is included in the event an offeror chooses to propose under their GS Schedule contract.

Question 31: The offeror assumes the “teams” referenced in this requirements are the shifts to cover the 24/7 requirement. Please confirm.

Answer: We have revised the solicitation to remove the Top Secret key personnel requirement. (See RFP §3, SOW ¶4)

Question 32: Are Incidents resolved by CBO government personnel only? What specific assistance is required by the contractor with respect to making recommendations for remediation?

Answer: CBO may ask for remediation suggestions but the Contractor is not expected to implement any remediation.

Question 33: What is the SLA for immediate response by impact/priority level?

Answer: See the tables below.

Incident Urgency Categorization Category Description

High (H) • The damage caused by the Incident increases rapidly.

• Work that cannot be completed by staff is highly time sensitive.

• A minor Incident can be prevented from becoming a major

Incident by acting immediately.

• Several users with VIP status are affected.

Medium (M) • The damage caused by the Incident increases considerably over time.

• A single user with VIP status is affected.

Low (L) • The damage caused by the Incident only marginally increases over time.

• Work that cannot be completed by staff is not time sensitive.

Priority Matrix Impact

H M L

Urgency

H 1 2 3

M 2 3 4

L 3 4 5

Amendment No. 002 to Solicitation No. CB18-RFP0008 Page 5

Priority Code Description Target Response Time Target Resolution Time

1 Critical Immediate 1 Hour

2 High 10 Minutes 4 Hours

3 Medium 1 Hour 8 Hours

4 Low 4 Hours 24 Hours

5 Very low 1 Day 1 Week

Question 34: Can the government please provide a listing of SLAs for this effort?

Answer: See answer to Question 33.

Question 35: What is the solution(s) being used today for vulnerability scans? Will the contractor receive the rules for vulnerability scans from the government? In other words, is the contractor operating and reporting the tool that is configured by the government or is the contractor responsible for configuring and optimizing the government owned scanning solution?

Answer: The scanning solution is Nessus. CBO will provide a ROE (Rules of Engagement) for vulnerability scanning to the Contractor after award.

Question 36: What is CBO’s internal helpdesk system being used today?

Answer: See answer to Question 26.

Question 37: Is there a page limit for the Technical Offer?

Answer: See answer to Question 9.

Question 38: What SIEM is CBO using today?

Answer: See answer to Question 28.

Question 39: What volume of logs or messages per second have you encountered for the last six months (by month)?

Answer: CBO can provide this information to the Contractor after award.

Question 40: Can CBO provide historical Security Incident ticket volumes by day for the past six months? Please include priority level/severity level for Incidents as well.

Answer: CBO does not have this information but we do archive IR incidents. CBO will provide this information to the Contractor after award.

Question 41: Does CBO require a person with TS at all times, all shifts?

Answer: See answer to Question 31.

Question 42: Are there any planned infrastructure changes during the life of the contract?

Answer: CBO recently refreshed the network and security and is moving to a new data center so we do not foresee any major infrastructure changes in the near future.

However, there is always the potential for some change due to growth or if we identify the need to procure a new security tool as technology evolves.

Amendment No. 002 to Solicitation No. CB18-RFP0008 Page 6

Question 43: Is there a minimum number Incident Response hours to be quoted?

Answer: We have not specified Incident Response hours; offerors should determine how they will adhere to CBO’s Incident guidelines, which will be provided to the Contractor after award.

Question 44: Minimum 365 days of log retention is mentioned, is there any reason to expect that more than 365 will be required?

Answer: There is a possibility that we would need access to the log data beyond 365 days. For instance, there could be a discovery situation and we may need to go back further than one year. That is why the SOW says “minimum” because, although it may not be likely or very frequent that we would want to go back further, in the event it does occur it gives us the ability and visibility we would need.

Question 45: In the RFP is mentions "Periodically assessing system health against threats" could you define periodically?

Answer: We have clarified the solicitation to define periodically as not less than quarterly.

(See RFP §3, SOW ¶2)

Question 46: What software is CBO currently using as their existing scanning solution?

Answer: See answer to Question 3.

Amendment No. 002 to Solicitation No. CB18-RFP0008 Page 3 of 38

Part 2 – Contract Clauses

The following clause applies to Open Market orders:

1A. CBO 201-01 Terms and Conditions Limited (May 2003) This contract expressly limits acceptance to terms and conditions stated herein. Any additional or different terms and conditions proposed by the Contractor are rejected unless expressly agreed to by the Congressional Budget Office (CBO) in writing. If the Contractor commences shipment or performance pursuant to this contract, then the Contractor shall be deemed to have agreed to and accepted this contract in its entirety, including its terms and conditions as set forth herein.

The following clause applies to GSA Schedule orders:

1B. CBO 201-01 Terms and Conditions Limited (May 2003) Alternate I (July 2004) The instant action is subject to the terms and conditions under the GS Schedule number referenced in Block 2 of the award form, as supplemented by the following terms. If any of the terms or conditions in the GS Contract and this supplement are inconsistent, the terms and conditions of the GS Schedule shall govern, unless otherwise agreed between the parties.

2. CBO 201-02 Endorsements/News Releases/Advertising (May 2003) The Contractor agrees not to refer to this contract or CBO, in advertising, promotional or any other materials, in such a manner as to state or imply that the products or services provided are endorsed or preferred by CBO or are considered by CBO to be superior to other products or services. No news release, press conference, or advertisement pertaining to this contract will be distributed or broadcast without prior written approval by CBO.

3. CBO 203-170 Contractor Employee Whistleblower Rights (Dec 2014) The Contractor shall not require any employees or contractors of the Contractor seeking to report fraud, waste, or abuse to sign internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or contactors from lawfully reporting such waste, fraud, or abuse to a designated investigative or law enforcement representative of a Federal department or agency authorized to receive such information.

4. CBO 209-01 Key Personnel (March 2018)

(a) The following individuals are is considered to be essential to the successful performance of the work hereunder:

(1) Project Manager

(2) Employee with TS level clearance

The Contractor agrees that these key personnel may not be removed from the contract work or replaced without compliance with paragraphs (b) and (c) of this clause.

(b) If one or more of the key personnel, for whatever reason, becomes, or is expected to become, unavailable for work under this contract for a continuous period exceeding 30 work days, or is expected to devote substantially less effort to the work than indicated in the proposal or initially anticipated, the Contractor shall immediately notify the Contracting Officer and shall, subject to the concurrence of the Contracting Officer, promptly replace the personnel with personnel of at least substantially equal ability and qualifications.

(c) Each request for approval of substitutions must be in writing and contain a detailed explanation of the circumstances necessitating the proposed substitutions. The request must also contain a complete resumé for the proposed substitute and other information requested or needed by the Contracting Officer to evaluate the proposed substitution. The Contracting Officer and the COR shall evaluate the Contractor’s request and the Contracting Officer shall promptly notify the Contractor of his or her decision in writing.

(d) If the Contracting Officer determines that suitable and timely replacement of key personnel who have been reassigned, terminated, or have otherwise become unavailable for the contract work is not reasonably forthcoming, or that the resultant reduction of productive effort would be so substantial as to impair the successful completion of the contract or the service order, the contract may be terminated by the Contracting Officer for default or for the convenience of the government, as appropriate. If the Contracting Officer finds the Contractor at fault for the condition, the contract price or fixed fee may be equitably adjusted downward to compensate the government for any resultant delay, loss, or damage.

5. CBO 211-101 Performance Period – Base Contract and Options (Feb 2007) The overall performance period of this contract consists of the following time periods:

Amendment No. 002 to Solicitation No. CB18-RFP0008 Page 15 of 38

Document No. 1: Statement of Work Cyber Security Monitoring

1. Agency Background The Congressional Budget Office (CBO) is a small legislative branch agency that provides economic and budgetary analysis to the U.S. Congress to aid in policy decisions. The agency’s research, analysis, and reports include baseline and long term budget projections, formal and information cost estimates on pending legislature, scorekeeping reports, and an analysis of the President’s budget.

CBO’s Information Resource Management (IRM) unit has oversight of all the agency’s information technology operations and is responsible for implementing and maintaining all IT infrastructure, systems, and operations. IRM supports a staff of 245 employees providing services, devices, and systems that include helpdesk, applications, desktops, printers, network, Wi-Fi, telework, cybersecurity, mobile devices, disaster recovery, backup, email, data storage, and Internet connectivity.

CBO’s IT infrastructure is currently distributed across two physical facilities and two cloud environments: the agency’s Ford House Office Building (FHOB) headquarters in Washington, DC; an off-site datacenter; and the cloud with deployments in both Amazon Web Service (AWS) and Microsoft’s Azure cloud platforms. The agency is currently redesigning its infrastructure to accommodate a third facility that will serve as a failover or backup datacenter. A variety of devices, systems, and applications comprises the agency’s IT infrastructure. They include routers, switches, wireless controllers, access points, load balancers, hyper-converged compute and storage systems, firewalls, domain controllers, virtual and stand-alone servers, databases, Netflow monitoring devices, web filtering devices, malware and threat analysis systems, enterprise backup systems, mobile device monitoring systems, intrusion detection and prevention systems, remote access systems, desktop backup systems, identity and access management systems, video-on-demand systems, IP Address management systems, SaaS/PaaS/IaaS deployments, Helpdesk systems, document management systems, email systems, load balancing devices, and power management systems. Appendix A includes a full list of devices, make, type, systems, and quantities that require monitoring. (Note: Vendors must contact CBO’s Acquisitions Office and sign an NDA for access to Appendix A. See paragraph 9 of this SOW.)

2. Objectives CBO has established requirements for a Contractor to provide cybersecurity monitoring of the agency’s infrastructure, applications, and cloud deployments in the form of externally managed security, threat detection, and threat response services. The agency’s limited IT staff and increasing cyber threats are the key factors leading the agency to pursue external monitoring services. CBO’s requirements are derived from its objectives to improve the agency’s cybersecurity posture by improving its ability to detect and respond to cyber threats, secure assets and devices, and streamline threat alerting and notification. The agency has determined that these objectives can only be attained by leveraging outside professional outside services in cybersecurity monitoring.

The Contractor shall provide a 24/365 remote cybersecurity monitoring service to achieve these objectives. Features of this service must include:

• Collecting and analyzing data from various assets, systems, and CBO’s computing environment;

• Monitoring the network and devices for potential threats;

• Monitoring CBO’s cloud infrastructure;

• Periodically assessing system health against cyber threats (at least on a quarterly basis);

• Providing timely alert notifications and response support;

• Providing on-demand reporting on the status of CBO security posture; and

• Cooperating in security assessment efforts conducted by third parties.

3. Scope of Work The Contractor shall provide all management, supervision, labor, subcontractors, materials, supplies and equipment, and shall plan, schedule, coordinate, and assure effective completion of all services described herein. The Contractor shall provide the following services atfor the FHOB and both offsite datacenter locations:

1) Data Collection and Analysis

a. Support one or all of the following log management solutions:

i. Co-Managed security information and event management (SIEM) on-premise

Amendment No. 002 to Solicitation No. CB18-RFP0008 Page 16 of 38

ii. Co-Managed SIEM hosted

iii. Fully Managed SIEM on-premise

iv. Fully Managed SIEM hosted

b. Collect log data from endpoints and systems including security controls, wireless infrastructure, network infrastructure, cloud infrastructure, IDS/IPS, identity management systems, database systems, vulnerability reports, and other assets to be specified.

c. Provide real-time analysis event correlation between log data sources.

d. Provide precise and real-time log analysis for threat detection.

e. Provide and disclose sources of threat intelligence feeds used as indicators of compromise (IOC).

f. Provide technical support during CBO’s IT security incident investigation and response activities.

g. Ensure that all CBO log data is store within the United States.

h. Provide CBO with either of the following access to historical log data:

i. Occasionally and on request (in a Fully Managed SIEM provider scenario).

ii. On-demand for CBO staff search and extraction (in a Co-Managed SIEM provider scenario).

i. Contractor is required to retain log records for a minimum of 90 days for real-time access and a minimum of 1 years for archival access.

2) Threat Monitoring and Detection

a. Provide 24/365 security monitoring and incident response capabilities for CBO’s information technology environment.

b. Provide 24/365 monitoring of security controls, wireless infrastructure, network infrastructure, cloud infrastructure, IDS/IPS, identity management systems, database systems, vulnerability reports, and other assets to be specified.

c. Establish a baseline network egress and ingress traffic profile of CBO’s environment and regularly update this profile as needed in coordination with CBO.

d. Monitor and report on the health of critical security devices such as firewalls, IDS, IPS, web proxies, and other cyber security devices.

e. Provide ability to detect custom or targeted attacks directed at CBO’s environment.

f. Provide first step remediation guidance as an incident response service by assisting CBO in validating, investigating scope and severity, and making recommendations for remediation of high and critical severity categorized threat incidents.

3) Cloud Monitoring

a. Provide real-time, 24/365, monitoring and incident response for CBO IaaS, PaaS, and SaaS systems in

AWS and Microsoft Azure cloud environments.

b. Provide security and traffic baseline for cloud environments.

c. Provide incident response assistance for cloud environments.

4) Threat Alerting and Notification

a. Provide real-time automated alerting of security incidents or system health incidents for on premise and cloud based systems.

b. Provide immediate and timely alerting of incidents that have high impact and high urgency based on CBO incident management policy.

c. Provide daily alerting and informational security notifications via email, text, and/or phone contact to specified CBO personnel or group of personnel based on asset ownership, role, and need-to-know status.

d. Provide immediate, hourly, and daily alerting and notification depending on threat category and severity.

e. Include actionable remediation advice in alerts.

f. Provide ability to contact CBO staff after hours and provide support with investigation and remediation of critical security incidents.

g. Provisions allowing CBO to alert the Contractor about a potential security incident.

5) Portal Access & Reporting

a. Provide a secure portal accessible via a browser or app by designated CBO staff.

b. Provide daily reports via portal and email summarizing security status of environment, security advisories, and specific security metrics that provide insight into CBO’s current security posture.

c. Provide ability to generate standard and custom reports and dashboard view regarding CBO security posture.

d. Lead a monthly management-level briefing on-site or via conference call to discuss current CBO security posture, recommendation for improvements, and service performance based on established Service Level Agreement (SLA).

Amendment No. 002 to Solicitation No. CB18-RFP0008 Page 17 of 38

6) Vulnerability Scanning

a. Perform credentialed network vulnerability scanning of all CBO IP-based assets using CBO’s existing scanning solution.

b. Deliver vulnerability scan results data to CBO for integration into internal reporting systems.

c. Report on findings identified during vulnerability scan and produce a Security Assessment Report (SAR).

7) Continuing Risk Assessment Coordination

a. Allow CBO to periodically audit the Contractor’s security service capabilities using a third party resource.

b. Allow CBO to periodically visit the Contractor’s primary monitoring facilities to evaluate capabilities and personnel (see clause CBO 246-04, Inspection of Services – Fixed-Price).

8) Incident Management and Response

a. Provide a system for creating security related trouble tickets either by phone or through an online customer ticketing system.

b. Integrated alerting with CBO’s internal helpdesk system.

c. Provide a designated point of contact for support and other issues.

d. Immediately inform CBO of unplanned service outages and provide at least 5 days prior notice of scheduled outages.

4. Key Personnel and Facility Requirements

(a) The Contractor’s security operations center shall be staffed and operational 24 hours a day, 365 days year with staffing sufficient to service client needs during those times.

(b) The contractor’s security operations center facilities and all personnel involved shall be located within the United States. Additionally, no agency data shall be accessible by Contractor employees who are located outside the U.S., nor shall any agency data be transmitted outside the U.S.

(c) All Contractor staff who will have consistent access to CBO systems and data shall complete a non-disclosure agreement prior to commencing work under this contract and obtain a favorable FBI criminal check. Contractor staff are required to be fingerprinted at the U.S. Capitol Police headquarters in Washington, DC. Contractor staff shall also hold the determined clearance level, if applicable, for any data to which they will have logical or physical access. The Contractor shall provide the necessary information to CBO’s Security Officer after contract award to verify the clearance levels and coordinate fingerprinting. (See clause CBO 239-01, Security for Confidential Information)

(d) It is preferred, but not required, that the Contractor have a Facility Security Clearance (FSC) at the Confidential or Secret level either through the Department of Defense or other government agency, or be in the process of obtaining a FSC. The Contractor’s Managed Security Service facility shall have the following characteristics and capabilities:

(i) Two-tier level of security between the front door and the SOC itself.

(ii) Log of every person who enters and leaves the SOC on a daily basis.

(iii) A penetration test of the systems is conducted at least once a year. The Contractor shall notify CBO each time the testing has been completed.

(e) The Contractor shall have at least one analyst on each team who is cleared at the Top Secret (TS) level who is at the Managed Security Service provider site and is available to CBO. VPN staff do not need TS clearance. The Contractor shall provide required information to CBO’s Security Officer after contract award to verify the TS clearance. Any changes to TS-cleared personnel shall be communicated to the Contracting Officer and the Security Officer immediately to conduct the verification process for replacement personnel.

5. Security and Identification of Employees All necessary security measures required by this contract shall be subject to the approval of the Contracting Officer. The Contractor shall be responsible for initiating necessary measures to ensure that its employees comply with all established security rules and regulations, including but not restricted to the following:

(1) Work areas: All areas where work is required under this contract are designated as work areas. Unless specifically authorized, Contractor personnel shall be restricted to these areas. It shall be the Contractor’s responsibility to ensure by appropriate and effective means that its personnel remain in these areas while on site.

Amendment No. 002 to Solicitation No. CB18-RFP0008 Page 18 of 38

(2) Restricted areas: Personnel will not be permitted to enter established or designated restricted areas unless so authorized by the Contracting Officer. Such entry shall be in accordance with and subject to the security regulations established in the area. It shall be the Contractor’s responsibility to insure by appropriate and effective means that its personnel shall not enter these areas unless authorized as set forth above.

(3) Identification of Contractor employees: The Government will issue all Contractor personnel who will require continued access to secured areas of the Ford House Office Building an identification badge with the employee’s photograph and clearly identifying the employee as a contractor. Such identification shall be required for all employees on site and shall be worn at all times. Contractor employees must receive a favorable FBI fingerprint report from the U.S.

Capitol Police prior to being issued an ID badge.

(41) Employee Log: The Contractor shall maintain a daily shift log of all employees who are monitoring CBO’s systems, to include the name of the specific personnel and the time of day they came on and off duty. This log information will be retained for one (1) year and shall be made available delivered to CBO daily and upon request.

6. Place of Performance The majority of the work required under this contract shall be performed at the Contractor’s Managed Security Service facility. Allny meetings or on-site work on this project such as system health checks will be conducted at the following location:

Congressional Budget Office Ford House Office Building 2nd and D Streets, SW Washington, DC 20515

The Ford House Office Building is across the street from the Federal Center SW metro station, which is on the Blue, Orange and Silver lines. All persons entering the Ford House Office Building pass through magnetometer screening devices. In addition, all hand-carried items are screened by x-ray devices prior to entry into the building.

7. Work Schedule TheAny requested on-site services shall be completed at the CBO premises during normal business hours (8:30 am to 5:00 pm, Monday-Friday).

8. Government-Furnished Property The following Government facilities, equipment, materials, and services will be available to the Contractor for use in the performance of any on-site work under these specifications:

(1) CBO will provide office space for the Contractor personnel, including limited access to the CBO network, email, and the Internet.

(2) Identification badges. The Contractor will be supplied identification badges for all employees performing work on-site on a continuous basis (see paragraph 5 of this SOW).

(2) CBO will purchase the SIEM to be used by the Contractor, regardless of whether it is managed, co-managed, or fully managed.

The Contractor shall provide their own computer equipment, software, and other related technology.

9. Confidentiality and Pre-certification

(a) Companies preparing an offer will require additional technical information in order to fully understand the requirements. Such information is both confidential and sensitive. Therefore, any company intending to submit an offer shall sign and return a confidentiality agreement (see Attachment 3). Details will then be provided by email to the individual companies upon request. A list of all CBO cyber-related products and priorities will be provided to the successful Contractor after contract award.

(b) Detailed technical information regarding the internal operations of CBO’s cyber security program are both confidential and sensitive. Data and software provided to the Contractor under this contract must remain confidential and must not be used for any purpose other than the development and completion of this project. Data, software, hardware, design, and work products produced by the Contractor under this contract shall remain the property of CBO. The

Amendment No. 002 to Solicitation No. CB18-RFP0008 Page 19 of 38

Contractor will be required to sign a non-disclosure agreement prior to starting performance of the contract (see clause CBO 239-01, Security for Confidential Information). All information provided shall remain the property of CBO and may not be shared or disseminated without expressed written consent.

Amendment No. 002 to Solicitation No. CB18-RFP0008 Page 36 of 38

(a) Service Methodology and Management

(i) Include a description of the procedures used to secure the monitoring systems, including the last time the systems were scanned and penetration tested.

(b) Event Monitoring/Logging/Device Management Capabilities

(2) Factor 2 - Managerial Approach to Customer Service: This factor addresses the offeror’s proposed overall approach to the customer service aspects required by this solicitation, including but not limited to:

(a) Customer Portal and Reporting Resources (Ref. SOW ¶3.5)

(b) Customer Support (Tiers, Locations, Capabilities)

(3) Factor 3 – Qualifications and Staffing: The offeror must describe the experience and qualifications of its proposed personnel. The offeror must demonstrate that it has sufficient and qualified staff available to perform the work required.

(a) Provide résumés of key personnel (see clause CBO 209-01, Key Personnel) proposed to perform the work with information summarizing their experience, including:

(i) professional accomplishments/certifications; and

(ii) education.

(b) Identify training and continuous learning requirements for staff, especially in staying current with cybersecurity issues and risks.

(4) Factor 4 – Offeror’s Past Performance. The offeror shall provide information that demonstrates the offeror’s past performance. CBO reserves the right to use any source of information available on the offeror’s past performance to either evaluate past performance or verify information provided by the offeror.

(a) Provide a list of all companies/agencies for whom the offeror recently (completed within the last five years or ongoing) performed contracts that are similar in scope and magnitude to the work required under this solicitation.

(1) The offer shall list contact information (name and telephone number, at a minimum) of all references provided, with a short description of the reference project.

(2) CBO may use other references/information to verify past performance.

(3) The offeror may provide awards, letters or other documentation as it relates to their Past

Performance.

(4) Corporate and/or government references are equally acceptable for past performance.

5. CBO 212-101 Instructions for Preparing the Pricing Offer Section Price proposals submitted in response to this solicitation shall contain the following information in the order cited to facilitate evaluation by the Congressional Budget Office:

(a) Pricing shall be entered by each offeror on the Schedule page for each line item which shall represent the firm fixed price for performing the scope of services required by this solicitation. Offerors are hereby notified that even if cost or pricing data are not initially requested in this solicitation, the Contracting Officer reserves the right to request such data if they are later found necessary.

(b) The Price Proposal will be submitted with the required documents in the following order:

(1) A completed copy of Standard Form 1449, “Solicitation/Contract/Order for Commercial Items” from Part 1 (signature required in Block 30a).

(2) A fully completed “Continuation Sheet” at page 2 of the solicitation, with prices entered for all Schedule line items.

(3) A completed copy of the document entitled “Offeror Representations and Certifications for CBO Contracts” located at Document No. 4.

6. CBO 212-02 Evaluation—Commercial Items (Jan 1999)

(a) CBO will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the government, price and other factors considered. The following factors and weights will be used to evaluate offers: