Attachment 1 CircPWS 072910.pdf

OFFICE OF THE

COMPTROLLER OF THE

CURRENCY

ATTACHMENT 1 - PERFORMANCE

WORK STATEMENT

COMPUTER INCIDENT RESPONSE

AND SECURITY SERVICES

July 29, 2010

CircPWS072910.doc Page 2

TABLE OF CONTENTS

1. PURPOSE

2. INTRODUCTION

2.1. Organization Background

2.2. OCC Corporate Objectives

2.3. Information Technology Services (ITS)

2.4. Technical Infrastructure (TI)

2.5. Information Risk Management (IRM)

3. PROCUREMENT OBJECTIVES

3.1. Ensure a Secure Operational Cyber Environment

3.2. Maintain Mission Critical Cyber Defenses

3.3. Advance the OCC’s Cyber Situational Awareness and Intelligence Analysis Capabilities

3.4. Mature and Evolve the OCC’s Capability to Assess and Secure its IT Assets

4. SCOPE OF WORK

4.1. General

5. SPECIFIC TASKS

5.1. Information Incident Response

5.2. Security Services

5.3. Database Reporting

5.4. Access Management – Optional Task

5.5. Situational Awareness – Optional Task

6. CONSTRAINTS

6.1. Operational Controls

6.2. Program Management

6.3. Personnel Management

6.4. Quality Assurance Plan……………………………………………………………………….…..12

7. GOVERNMENT FURNISHED EQUIPMENT

8. GOVERNMENT FURNISHED INFORMATION

9. HOURS OF OPERATION

10. PLACE OF PERFORMANCE

11. TRAVEL

12. SECTION 508 COMPLIANCE..................................................13Error! Bookmark not defined.

TECHNICAL EXHIBIT 1: Performance Requirements Summary TECHNICAL EXHIBIT 2: Workload Estimates TECHNICAL EXHIBIT 3: Contract Deliverables TECHNICAL EXHIBIT 4: Applicable Documents TECHNICAL EXHIBIT 5: OCC’s CALM Database Application TECHNICAL EXHIBIT 6: Current IRM Tools and Techniques TECHNICAL EXHIBIT 7: Access Management Reporting Solution Requirements

CircPWS072910.doc Page 3

Performance Work Statement

1. PURPOSE

The Office of the Comptroller of the Currency (OCC) seeks an experienced industry partner to provide Computer Incident Response and Security Services in support of its critically important IT assets and infrastructure.

2. INTRODUCTION

In support of its mission to ensure a safe, sound, and competitive banking system, the OCC employs a range of sophisticated applications, business systems, and databases. Deployed assets range from mainframe applications to enterprise services including Web content management, document management, records management, knowledge management, identity management, notification services, data management and analytics, and enterprise-wide security operations.

To enable its business units to easily, independently access, and use these information assets, the OCC provides a secure, high-availability data delivery platform that offers the technical infrastructure and services required to process, share, and secure the large volume of highly sensitive data used by the OCC workforce. The OCC is entrusted with, and requires access to, a great deal of sensitive personal and organizational information in the course of its examinations.

Its regulatory responsibilities demand high standards for safeguarding the confidentiality, integrity and availability of this data. The challenge is to provide consistent delivery of the highest levels of performance, availability, and reliability for mission critical systems while at the same time safeguarding OCC information and systems through sound technical and operational controls.

The OCC challenge is growing on a number of fronts. The threat landscape continues to shift from easy-to-detect attacks to sophisticated and targeted attacks. Hackers and other players with malicious intent target OCC users with a blend of advanced software and social engineering.

Highly sophisticated SPAM-based social engineering attacks target users’ fears and anxieties around such topical issues as swine flu, the state of the economy, environmental disasters, and other topics that can ensnare the uninformed. The rise of Botnet technology, which can evade traditional anti-virus systems, and the use of malware to infiltrate users’ computers make situational awareness critical to a layered security architecture.

The OCC relies significantly on its Internet presence. More and more applications are being built (and reengineered) with the Internet in mind. At the same time, the OCC recognizes that no area of security is growing faster than attacks against applications. In response, the OCC is adapting its traditional defense techniques and approaches to include more focus on the application layer, requiring detailed security reviews of applications to ensure that high-risk vulnerabilities are removed prior to putting an application into production.

CircPWS072910.doc Page 4

2.1. Organization Background

The Treasury Department is the executive agency responsible for promoting economic prosperity and ensuring the financial security of the United States. The Treasury is organized into departmental offices and operating bureaus. The bureaus carry out specific missions. A primary mission operation is the corporate governance of financial institutions.

As a Treasury bureau, the OCC charters, regulates, and supervises national banks to ensure a safe, sound, and competitive banking system that supports both the citizens and the economy of the United States. Currently, the OCC supervises approximately 1,648 institutions with national bank charters and 50 federal branches of foreign banks in the United States.

The OCC has a mobile and geographically dispersed workforce of approximately 3,000 employees in locations throughout the United States, including its headquarters in Washington, D.C., a data center in Landover, Maryland, and four district offices in Chicago, Dallas, Denver, and New York. The Office of the Ombudsman is located in Houston. The OCC also operates approximately one hundred field offices and satellite locations in cities throughout the United States, resident examiner teams in the largest banking companies, and an examining office in London, England.

The Landover Data Center facility was established and became fully operational in September 1986. Its core services include blade server and virtualization technology and continued support for legacy mainframe and Wintel services; enterprise telecommunication voice, data, and video services; disaster recovery; operations control; desktop engineering; infrastructure acquisition support; e-Mail and Blackberry Enterprise Service (BES) operations; and security services.

2.2. OCC Corporate Objectives

The OCC’s activities are predicated on four objectives that support its mission to ensure a stable and competitive national banking system. The four objectives are:

• To ensure the safety and soundness of the national banking system;

• To foster competition by allowing banks to offer new products and services;

• To improve the efficiency and effectiveness of OCC supervision, including reducing regulatory burden; and,

• To ensure fair and equal access to financial services for all Americans.

Additional information regarding OCC’s mission, business objectives, and other product information can be attained at www.occ.gov.

CircPWS072910.doc Page 5

2.3. Information Technology Services (ITS)

Information Technology Services (ITS) provides the electronic infrastructure and applications that support the OCC’s mission and business objectives. ITS is comprised of the following organizational areas: 1) Business Services Delivery; 2) Executive Assistant to the CIO; 3) Technical Infrastructure; 4) Information Systems; and, 5) Information Risk Management.

2.4. Technical Infrastructure (TI)

The Technical Infrastructure department (TI) of ITS operates and maintains the OCC Data Center and a distributed technical infrastructure supporting the highly mobile and geographically dispersed workforce.

2.5. Information Risk Management (IRM)

The Information Risk Management (IRM) division’s activities protect OCC information resources in a manner that is commensurate with the risk and magnitude of harm that could result from the loss, misuse, or unauthorized access to, or modification of, said resources.

3. PROCUREMENT OBJECTIVES

As a direct result of Contract performance, the OCC shall achieve the following outcomes:

3.1. Ensure a Secure Operational Cyber Environment

Provide assurance that all solutions, services, and products provide appropriate safeguards for the confidentiality, integrity, and availability of OCC information and resources and are in full compliance with all applicable Federal regulations and statutes governing information technology, privacy, and security.

3.2. Maintain Mission Critical Cyber Defenses

Detect the presence of known or suspected cyber threats within the OCC enterprise infrastructure. Ensure effective incident management, intrusion prevention, and virus protection.

Provide timely reporting on the status of mission critical defenses.

3.3. Advance the OCC’s Cyber Situational Awareness and Intelligence Analysis

Capabilities Provide timely, actionable information concerning current global cyber security issues, vulnerabilities, attack methods, and exploits. Enhance OCC information security intelligence and provide a proactive operational response capability.

CircPWS072910.doc Page 6

3.4. Mature and Evolve the OCC’s Capability to Assess and Secure its IT Assets Continuously improve the OCC’s defensive posture. Apply industry-leading methods and tools for threat and technology assessments, incident detection and response, and virus protection.

4. SCOPE OF WORK

4.1. General

The Contractor shall furnish to the Government all necessary labor, services (non-personal), and materials (except as specified by the Government) required to accomplish the efforts as specifically set forth in this Performance Work Statement. The Contractor shall perform all tasks under the technical direction of the project Contracting Officer’s Technical Representative (COTR). The Contractor shall interface with and coordinate with other members of the Information Technology Services (ITS) office, which is comprised of OCC employees and other Contractor personnel.

The work consists of recurring activities in areas such as computer incident response, security services (such as vulnerability assessment, penetration testing, security site reviews, software testing, reporting, and forensics), and situational awareness. Services provided shall be fully compliant with the Federal Information Security Management Act of 2002 (FISMA), OMB Circular A-130 Appendix II, FIPS requirements, NIST Guidelines, and other applicable policies, regulations and statutes.

The OCC is using a performance-based strategy for conducting work and procuring the specified services. Outcome-oriented goals and objectives are specified for the CIRC program, with quantitative business and technical metrics derived from these objectives. Qualitative measures provide a balance against quantitative measures when assessing the Contractor’s performance.

Metrics are used to determine whether OCC objectives are being achieved, to assess the Contractor’s performance, to monitor trends in contractual work, and to facilitate oversight.

Technical Exhibit (TE) 1 of this PWS provides the performance metrics that the OCC recognizes as pertinent to this contract, identifies what will be measured to assess program and Contractor performance, and traces performance to IRM objectives. The metrics do not include specific target values to be obtained or baseline values from which improvements can be measured.

Offerors shall propose target values and expected improvement percentages appropriate for each metric in their Technical Approaches. Recommended surveillance methods shall be included where appropriate. The Contractor shall recommend specific target values to IRM within 120 days of contract commencement and, upon IRM approval, shall incorporate them into its quality control plan and processes.

TE 2 presents the OCC’s best estimate of expected workload using data available at the time this PWS was developed. The figures presented in TE 2 are estimates only, based on the most current information available, and not necessarily projections of total workload. They are provided as reasonable estimates or as examples (not inclusive) of past workload and factors that

CircPWS072910.doc Page 7 demonstrate the type and/or extent of effort that can reasonably be expected. The Contractor is advised that the estimated value of each workload factor is not a guarantee of future workload.

TE 3 contains the list of significant Contract deliverables. TE 4 presents the pertinent security-related documents. As with the workload factors in TE2, the Contractor is advised that these are representative samples whose contents and requirements may change during the Contract’s period of performance.

5. SPECIFIC TASKS

5.1. Information Incident Response

The OCC’s computer incident response capability must provide rapid response in the event of a security incident. Damage must be assessed and contained quickly; customer data protected; the root cause found; and, an accurate record of events and losses generated. It is a high-profile responsibility, since it puts IRM in direct contact with customers and involves the cooperation of several different work areas. Intrusion detection, virus protection, and other investigative responsibilities, such as forensics, data analysis, customer follow up, and briefings are all essential elements of securing the OCC enterprise-computing environment.

The Contractor shall staff and conduct a computer incident response program that complies with NIST guidelines, OCC policy and Treasury information security policy. Current OCC-supported tools and processes are identified in TE 6. Representative activities shall include:

• Manage and operate the OCC’s audit logging infrastructure. Capture all security events in real-time across OCC domain controllers, databases, and application servers. Perform log analysis and report on suspicious activity for privileged users. Retain audit data according to OCC policies. Continually monitor all automated logging processes.

• Detect the presence of cyber threats within the OCC enterprise infrastructure within 15 minutes of occurrence.

• Respond to security events and incidents, such as lost data, potential virus infections and intrusion alerts within 30 minutes of receipt of event/incident notification. Provide incident response and remediation support leading to threat/vulnerability mitigation and incident resolution. Provide incident management services including collaboration with and reporting to OCC business units and customers and IRM, TI, and ITS staffs and contractors.

• Manage and operate the OCC’s client-side security infrastructure. Scan workstations, servers and infrastructure devices, providing results of the scans with an analysis of the findings. Test and perform updates to the client firewall policies, antivirus signatures and spam updates.

• Manage and operate OCC’s intrusion detection and prevention system: Monitor alert services; update and enforce policies designed to minimize the impact of threats, both known and unknown.

CircPWS072910.doc Page 8

• Test and perform updates, patches, and other changes to supported security tools (reference TE 6) in adherence with the OCC’s change management and configuration management policies.

• Perform forensic analysis on OCC infrastructure components, report findings and make recommendations for remediation.

• Follow chain-of-custody best practices in accordance with OCC policies and procedures.

• Independently verify and validate that patches have been deployed and are working as intended.

• Ensure lessons learned from incidents are collected in a timely manner and are incorporated into operating procedures and disseminated to IRM in the form of reports, briefings, and presentations, as required.

• Manage the OCC lost and stolen IT asset and information process. For lost/stolen incidents that potentially contain OCC information, open a ticket with Treasury in less than one hour.

• Train IRM staff in the event of significant updates to supported tools and technologies.

• Conduct and report on an annual Incident Response test exercise;

• Provide off-hour point of contact for information security incidents and respond to inquiries from IRM, the Treasury Computer Security Incident Response Center and US CERT to ensure the security of OCC networks and information.

• Provide and utilize non-OCC, out-of-band network connectivity to inspect, test, and scan OCC network assists for security vulnerability.

5.2. Security Services

Information confidentiality, privacy, integrity, and availability are crucial in meeting the requirements of the OCC workforce, customers, and stakeholders. The OCC’s security services capability must protect OCC IT assets and data and prevent their unauthorized use, denial, or destruction.

The Contractor shall provide security services that comply with NIST guidelines, OCC policy and Treasury information security policy. Representative activities shall include:

• Manage and operate the OCC’s vulnerability assessment and management platform.

Conduct penetration testing of the OCC’s internal and external networks and monitor vulnerabilities on the OCC network. The OCC currently employs the tools and processes listed in TE 6 for this purpose.

• Validate and verify appropriate closure of audit and review findings related to network security that can be tracked in the OCC Plan of Actions and Milestones.

• Carry out site visits to OCC offices or OCC service providers to ensure the effectiveness of management, operational and technical safeguards used to protect the confidentiality, integrity and availability of OCC data and systems.

• Conduct threat assessments, security evaluations and vulnerability assessments. Report on the results to IRM and other OCC technical and program staff.

CircPWS072910.doc Page 9

• Provide support to OCC’s desktop engineering, server, and network teams to deploy, audit, and secure configurations for workstations, servers, and network equipment.

• Conduct formal reviews annually to identify gaps in OCC information security programs related to safeguarding sensitive data, including privacy and personally identifiable information. Provide gap analysis & assessment reports outlining the results of the formal reviews.

• Conduct regular reviews to ensure accurate and effective use of information security technologies, such as Intrusion Detection and Prevention Systems, firewalls, email, antivirus, and proxy devices used to safeguard OCC workstations, servers, systems, data and networks.

• Review and evaluate the specifications and capabilities of new or improved technologies that could impact the OCC’s security posture and provide recommendations regarding the integration of these technologies into the OCC environment.

• Provide expert opinion on the security tools, techniques, and operational effectiveness employed by OCC business partners (e.g. banks and/or Vendors).

• Provide expert opinion on the feasibility and impact of planned cyber security policy and/or procedures on OCC mission critical defenses.

• Provide feedback to IRM on the impact and risk of new Requests for Change (RFCs).

• Attend working groups such as: Engineering Review Group (ERG), Enterprise

Configuration Control Board (ECCB), Security Engineering Operations Group (SEOG), and other meetings requiring CIRC/Security Services participation. Assist IRM in preparation of analysis or recommendations for these meetings.

• Conduct vulnerability scans to support FISMA requirements for new systems, and annual assessments and re-certifications for existing FISMA systems.

• Monitor the Treasury Computer Security Incident Response Center and US CERT for technical security alerts and bulletins.

• Proactively research, analyze and report on trends in certain activities, vulnerabilities, reported attack methods and known exploits that could impact OCC networks and information assets.

• Promote security awareness to the OCC community by maintaining and updating information on the OCC Intranet.

• Generate reports and briefings for management and technical staff on the results of CIRC activities and Security Services testing.

• Provide expert opinion on current audit logging strategy for all OCC systems and assist with and execute as needed improvements to current strategy.

5.3. Database Reporting

The OCC employs a custom-developed, Oracle-based audit logging and information security database named “CALM” to provide an in-depth perspective on the changing threat landscape and to support IRM incident management processes. CALM collects data from servers and system logs of VPN gateways, proxy, the central IPS, wireless access points and firewalls and serves as the foundation of the OCC’s security intelligence capability. Scheduled and ad hoc reports are routinely generated to support intrusion detection and prevention activities, as well as

CircPWS072910.doc Page 10 anomaly discovery and investigation. Additional information about the existing CALM system is provided in TE 5.

The Contractor shall provide scheduled and ad hoc database reporting services to enable IRM to easily access and use CALM-stored information to support data analysis, decision making, and information presentation needs out of the current Oracle-based system (known as CALM), which is in the process of being transitioned to Microsoft SQL Server 2008 by the end of calendar year 2010.

NOTE: The following tasks are designated as optional tasks to be executed at the discretion of the OCC.

5.4. Access Management – Optional Task

The Contractor shall provide a process or solution on system and network user accounts and passwords related to the age of passwords, the current status of privileged user accounts, user accounts in Active Directory group policy, and audit-related activities. The Contractor’s solution shall include reporting formats and frequencies to accomplish this task. This solution shall provide a full accounting of all user accounts and passwords, including service accounts as well as non-Active Directory related IDs associated with mainframe systems (2 systems) and mission-related applications (approximately 15). A listing of anticipated reporting solution requirements is provided in TE 7.

5.5. Situational Awareness – Optional Task

Situational awareness refers to the capability to maintain a constant vigil over important information, understand the relationship among the various pieces of information monitored, and project this understanding into the near future to make critical decisions. Situational awareness includes being observant of one’s surroundings and identifying potential threats and dangerous situations and taking proper steps to safeguard oneself, the OCC, and the data and systems we are entrusted with.

Situational Awareness is not a system, a network, or an application; rather it is a set of processes to be adopted and employed by anyone entrusted with access to OCC information. A well functioning situational awareness process is composed of practices that focus on the human factor- such as training, briefings, correlation between security systems and the threats they protect OCC from-in such a manner as to make informed decisions, act in a timely manner, and ultimately ensure operational safety. Failures to maintain situational awareness can lead to inadequate decision making and ultimately to realized threats against the confidentiality, integrity and availability of OCC information and systems.

The Contractor’s solution may leverage, but is not limited to, the OCC’s existing systems and resources used to collect threats, vulnerabilities, operational statistics, trends, alerts, and other risk-based information from disparate sources (including logging), in order to process the data according to OCC priorities, and report the information in an easy-to-understand manner. The Contractor’s proposed solution shall address the process for implementing and managing the solution with the necessary supporting incident management and analytical expertise to enable

CircPWS072910.doc Page 11

IRM to meet its situational awareness objectives in an agile and cost-effective manner.

The Contractor’s solution shall demonstrate the process and approach for meeting the following functional requirements:

• Promote enhanced analysis and decision-making by allowing the user to drill down from high-level, summarized charts and displays to the underlying detailed source data and systems.

• Provide current reporting of the global emerging cyber threat assessment and industry-proven defenses to enhance OCC information security intelligence and proactive operational response capability.

• Establish a key risk indicator program that communicates operational, compliance and technical risk to all levels of OCC management.

• Provide timely problem analysis to detect and disseminate emerging trends and relationships among seemingly discrete events to enhance OCC information security intelligence and proactive operational response capability.

• Leverage the OCC's situational awareness capability to enhance the OCC's training and awareness program.

• Utilize the alerts, briefings & recommendations from the situational awareness capability to enhance OCC policy.

6. CONSTRAINTS

6.1. Operational Controls

The Contractor shall adhere to the following controls:

• Any activities that may degrade the performance of network environments, operating systems, databases and applications must be performed outside of normal business hours.

• All products and deliverables must be provided in a format supported by the OCC’s available tools to support future updates unless otherwise agreed to by the COTR and

CO.

6.2. Program Management

OCC requires a Program Manager for this contract who has operational and administrative authority for all persons under this contract. Moreover, the Contractor Program Manager is the single corporate liaison for all contract issues. Subcontract relationships shall not be visible to OCC in management, administration, or operations.

6.3. Personnel Management

Key personnel shall be identified. At a minimum, the Contractor Project Manager and the Senior Security Engineer shall be key personnel. OCC requires 30-day notification of loss of key personnel and concurrent approval of proposed replacement.

CircPWS072910.doc Page 12

The Contractor shall provide notification to the COTR and CO of personnel adds, losses, assignment, and assignment changes within 24 hours of their occurrence. Prior approval of OCC is not required except in the case of Key Personnel.

In light of the specialization and high level of expertise of services typically required, the OCC is looking for Offerors to demonstrate the ability to attract, develop, motivate, organize, and retain the talent needed over the course of the contract. Offerors shall ensure that their proposed staff has the latest training on security technologies deployed at OCC and cited in TE 6.

6.4. Quality Assurance Plan (QAP)

The Contractor shall submit a QAP covering all tasks required for this contract as part of their technical response. The QAP shall promote excellence in all functional areas of the contract. The specifics of the plan may be changed periodically through mutual agreement to establish parameters that are fair and optimally helpful to the objectives of the contract.

The QAP shall include the following minimum elements:

• The Contractor shall establish for each work requirement a minimum, but sufficient, set of specific, time-bound, and objective quality measurements;

• The Contractor shall establish, for each measurement, the person responsible for that measurement process, the process to acquire the measure, the frequency of the measurement, the format for recording the measure, the frequency for reporting the measure, the means and format of communicating the measures, and the identity of the recipients of the communication.

7. GOVERNMENT FURNISHED EQUIPMENT

The Government will provide the hardware and software needed to perform the tasks described in Section 4 as well as any hardware or software requiring technical analysis, evaluation, verification, or study in support of this contract. The OCC currently utilizes, and will provide the Contractor access to the software listed in TE 6. The OCC will also provide the Contractor Project Manager with Government-owned Blackberries as needed to facilitate communications with the Information Risk Management division.

8. GOVERNMENT FURNISHED INFORMATION

Government provided information may take the form of policies, standards, guidelines, technical data, specifications, or other applicable documents. The safeguarding and disposition of this information shall be in accordance with agency regulations and/or the direction of the Contracting Officer. The Contractor shall protect from unauthorized disclosure any materials or information made available by the Government, or that the Contractor has access to by virtue of the provisions of this contract, that are not intended for public disclosure.

CircPWS072910.doc Page 13

9. HOURS OF OPERATION

Core Service Hours under this contract are between the hours of 6:30am and 12:00am (midnight) Eastern Standard Time, Monday through Friday, excluding Federal holidays. At least one Contractor staff member shall be on-site at all times from 6:30am to 6:00pm; at least one Contractor staff member shall be immediately available on-call between the hours of 6:00pm and 12:00am EST; one Contractor staff member shall be located at the Network Operations Center during Core Service Hours. The Contractor shall have one staff member on-call outside of Core Service Hours.

Note: Internal scans are conducted against servers after normal business hours and workstations during the business day. Web application scans are scheduled on weekends. External scans last approximately 5 days and extend over weekend hours.

10. PLACE OF PERFORMANCE

Activities under this contract will be primarily performed on-site at OCC locations in the Washington, DC Metro Area.

11. TRAVEL

There will be a requirement for travel outside the Washington, DC metropolitan area during the performance of this contract. It is anticipated that there will be up to twelve (12) trips to outlying District and Field Offices or OCC service provider sites each year of this contract.

12. SECTION 508 COMPLIANCE

The Contractor shall ensure all documents delivered are in electronic format and formatted to comply with accessibility requirements of Section 508 of the Rehabilitation Act of 1973, as amended. Specifically, all delivered documents, reports, plans, etc. shall adhere to Web-based Intranet and Internet standards as defined in 36 CFR 1194.22 and fully meet the Functional Performance Criteria of 36 CFR 1194.31 as all deliverables shall be suitable for publishing, sharing or storage on the OCC Intranet.

The Contractor shall ensure all expert advice, guidance and consultation provided under this statement of work for proposed solutions or IT investments include research on the level of accessibility by following the applicable technical standards 36 CFR 1194.21-26, the Functional Performance Criteria of 36 CFR 1194.31, and the Information, Documentation and Support services of 36 CFR 1194.41.

TECHNICAL EXHIBIT 1: Performance Requirements Summary

The absence of any contract requirement from the PRS shall not detract from its enforceability or limit the rights or remedies of the Government under any other provision of the contract, including the clauses entitled “Inspection of Services” and “Default.”

The PRS Headings are defined as Follows:

Performance Objective/Task – Lists the OCC objective or task requirement linked to the measured metric or performance standard.

Metric/Performance Standard – Lists how complete, how timely, or at what level of quality each specific service shall be performed. Specified as a target value.

Acceptable Quality Level – Lists the maximum absolute number or percentage of deviation from standard performance that may occur before the Government will declare the service unacceptable.

Surveillance Method – Lists the surveillance methods the Government will use to evaluate the Contractor’s performance in meeting the contract requirements.

The Contractor shall propose the Metric/Performance Standards, Acceptable Quality Levels, and Surveillance Method as appropriate for each Performance Objective.

Performance Objective

Metric / Performance Standard AQL Surveillance Method

Detect the presence of cyber threats within the OCC enterprise infrastructure.

Mean time to Incident Discovery (MTID):

Incidents shall be discovered and the OCC alerted within 15 minutes of occurrence.

Damage is assessed and contained quickly and customer data is protected.

Mean Time from Discovery to Containment (MTDC): Incidents shall be contained within x hours of occurrence.

Root cause is found, vulnerabilities are mitigated, and an accurate record of events and losses is generated

Mean time to Incident Recovery (MTIR):

CIRC must recover from an incident within x hours.

Mobile laptops operate with the latest virus definitions, signature files and spam updates at all times.

Number of mobile laptops with the latest Virus Definitions: Clients are using the latest antivirus signatures and spam updates offered at the date of connection.

IT security protection systems function properly and protect OCC systems and data from malicious activity 24x7x365.

Mean time to mitigate vulnerabilities (MTTMV): Policies designed to minimize the impact of threats are updated and enforced within x hours. Secure configurations for workstations, servers, and network equipment are deployed and audited within y hours/days.

Deployed internal controls effectively detect incidents at the outer layer.

% of Incidents Detected by Internal Controls (PIDIC): Incidents detected by Internal Controls are at x% or higher.

The OCC’s defensive posture continuously improves. Industry-leading risk assessments are performed for all applications and systems.

Risk Assessment Coverage: X % of all applications/systems has undergone an assessment of the risk at hand.

Selected Metric Descriptions and Related Notes These metrics come from the CIS security metrics guide and are organized by layers of the Defense in Depth Model.

Internal Perimeter:

This perimeter includes the metrics that are closest to the end user itself. Monitoring tools are SAV and firewall

1) Mean time to incident discovery (MTID)

a. Measured in hours, it indicates how quickly an incident is discovered and vetted to the OCC

b. (Date of discovery – date of occurrence)/Count

c. Includes incidents coming from the end user – and alerts from SAV/SEP

2) Mean time from discovery to containment (MTDC)

a. Measurement from the time an incident is discovered to when it is contained

b. Measured as an average since some incidents can be more difficult to contain than others

c. (Date of containment-Date of discovery)/number of incidents

3) Mean time to Incident Recovery (MTIR)

a. Measures the effectiveness of the CIRC to recover from security incidents

b. Measured in hours per incident – (i.e.: CIRC must recover from an incident within x hours)

c. (Date of recovery – date of occurrence)/incident counts

4) Number of mobile laptops with the latest Virus Definitions

a. Measures the availability and effectiveness of OCC client SAV system

b. Number of clients who have connected to the OCC on x time/number of users who are successfully using the latest definition offered at the date of connection

Server & Application Perimeter:

This perimeter deals with the vulnerabilities on servers and applications

1) Mean time to mitigate vulnerabilities (MTTMV)

a. Rather than simply detecting vulnerabilities, the CIRC should determine vulnerabilities and provide assistance bringing these vulnerabilities to full mitigation

b. Remediation paths should be determined by working with various parties of the OCC

c. Formulize a standard way to detect, and mitigate known vulnerabilities for the OCC

d. Measured in hours – internal vulnerabilities measured in weeks

e. (Date of mitigation – date of detection)/count

Network Perimeter This perimeter deals with outer layer defense – IPS/IDS

1) Percentage of Incidents Detected by Internal Controls (PIDIC)

a. Ratio of the incidents detected by the OCC’s security controls and the total number of incidents identified

b. For example, incidents detected by Internal Controls must be at 90% or higher

Outside Threats Concerns outside threat awareness of Vulnerabilities and Exploits and how they could impact the OCC’s business

1) Risk Assessment Coverage

a. Risk management ratio: What is the percentage of applications/systems that have undergone an assessment of the risk at hand?

b. (Number of applications that have undergone a risk assessment/count)*100

c. The metric requires an understanding of outside threats to accurately measure this number

TECHNICAL EXHIBIT 2: Workload Estimates

The estimated number of devices to be monitored is presented in Table 1. The values are based on the number of devices monitored in FY 2009. Representative activities are presented in Table

2. Estimates for Oracle Database operations and maintenance support are presented in Table 3.

The values are based on the FY 2009 level of effort.

Table 1: Estimated Annual Workload - By Devices Monitored

Device Type Workload

FISMA systems in inventory 18

NetIntercept Devices 6

MacAfee IPS/IDS devices 9

Qualys appliances 7

Client workstations/laptops 4340

Servers 635

Table 2: Estimated Workload – Activities

Workload Factor Workload

Internal Scans 36,410 scans completed between April and October 2009

Web application scans 64 scans completed between April and October 2009

External device scans 187 scans completed between April and October 2009.

Malicious Activity Detected and Blocked

60,536 alerts between April and October 2009

Malware Detected and Blocked

Between January and October 2009:

256 Proxy; 1724 Email; 34,743 Client (including 32,166 instances on a single OCC machine)

Email received/blocked/sent without issue

FY08: 10,091,118 blocked/ 16,217,139 not blocked; FY09:

4,721,401 blocked /12,810,814 Not blocked

Site visits to OCC offices or OCC service providers per year

Meetings attended per year 240

Note: Internal scans are conducted against servers after business hours and workstations during the business day. Web application scans are scheduled on weekends. External scans last approximately 5 days and extend over weekend hours.

Table 3: Estimated Annual Workload – Oracle Database

Workload Factor Workload Notes

Oracle Databases 2

Events in audit logging database 2.5 billion (monthly)

Collected from servers and system logs of VPN Gateways, BlueCoat Proxy, the central IPS, wireless access points and firewalls

Note: The current database is over 2 TB in size and 85 million rows of data are inserted every day. The OCC expects data input to increase tenfold over the next 12 months.

TECHNICAL EXHIBIT 3: Contract Deliverables

The Contractor shall ensure that all deliverables are clear, concise, technically accurate, well organized, properly referenced, and complete by the appropriate due dates. Deliverables shall be in accordance with OCC Standard Operating Procedures (the OCC Computer Security Incident Response Capability Program and Operations Guide).

Deliverable Due Date

Weekly Status Report Weekly on Monday for the Previous Period Running Sunday to Saturday

Monthly Report Monthly, Five (5) Business Days After Month’s End

Scheduled and Ad Hoc Reports As Required by COTR Updates to the OCC Computer Security Incident Response Capability Program and Operations Guide

10 days After a Significant Change in Pertinent Activities

Weekly Status Report: The Contractor shall report on the status of work products, ongoing assessments and investigations, significant issues and trends, scans, and other indicators of contract activities. These reports shall be submitted to the COTR and CO.

Monthly Report: Provided in Microsoft Word, monthly reports shall contain summaries of all routine activities and special projects completed for the preceding month and describe activities for the month ahead. In addition, monthly reports shall clearly show how the Contractor’s performance for the past month measures against the performance parameters established in TE

1. The reports shall present objective and empirical data collected throughout the performance periods. The reports shall clearly articulate how the various performance results were calculated and tallied to indicate the level of compliance with the stated metric/performance standard.

Monthly reports shall also contain an asset inventory accounting for government-issued equipment and software. These reports shall be submitted to the COTR and CO.

Ad Hoc Reports: Ad hoc reports shall present information about security events and the status of the OCC network. This reporting shall include, but not be limited to, statistics and analysis of attempted attacks on the OCC network, number of emails received/blocked, lost or stolen assets, unauthorized software, virus detection and prevention, account management, to include aging, and password policy compliance.

Security Services / Incident Response Procedures Manual: The procedures manual shall be updated to ensure that all activities are consistent with published government guidance and allow periodic review by IRM.

TECHNICAL EXHIBIT 4: Applicable Documents

Federal Laws

• Computer Fraud & Abuse Act (as amended 1994 and 1996), P.L. 99-474 [18 USC 1030] (http://www4.law.cornell.edu/uscode/18/1001.html)

• Computer Security Act of 1987, P.L. 100-235 (http://www.ciao.gov/resource/computer_security_act_of_1987printer.html)

• Freedom of Information Act of 1966 [5 USC 552] as amended by P.L. 104-231 (1996) (http://www.usdoj.gov/oip/foia_updates/Vol_XVII_4/page2.htm)

• Federal Information Security Management Act (FISMA) of 2002, Title III of the E- Government Act of 2002, P.L. 107-347 (http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=107_cong_public_laws&docid=f:publ347.107.pdf)

• Health Insurance Portability and Accountability Act of 1996 (HIPAA), P.L. 104-191 (http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=104_cong_public_laws&docid=f:publ191.104.pdf)

• Privacy Act of 1974, P.L. 93-579 [5 USC 552a] (http://www4.law.cornell.edu/uscode/5/552a.html)

• Paperwork Reduction Act of 1995, P.L. 104-13 [44 USC 35] (http://www4.law.cornell.edu/uscode/44/3501.html)

• Clinger-Cohen Act of 1996 (formerly known as the Information Technology Management Reform Act of 1995), P.L. 104-106 [40 USC 1401] (http://wwwoirm.nih.gov/itmra/itmra96.html)

OMB

• OMB Circular A-130, “Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources,” December 24, 1985 (http://www.whitehouse.gov/omb/circulars/a130/a130appendix_iii.html)

• Note to CIO Council, Guidance to Assist Agencies with Certification and Accreditation Efforts, July 3, 2003 (http://csrc.nist.gov/policies/WhatAgencycandonow-OMB-memo.pdf)

Federal Information Processing Standards (FIPS)

With the passage of the Federal Information Security Management Act (FISMA) of 2002, there is no longer a statutory provision to allow for agencies to waive mandatory Federal Information Processing Standards (FIPS). The waiver provision had been included in the Computer Security Act of 1987; however, FISMA supersedes that Act. Therefore, the references to the "waiver process" contained in many of the FIPS listed below are no longer operative.

Note, however, that not all FIPS are mandatory; consult the applicability section of each FIPS for details. FIPS do not apply to national security systems (as defined in

FISMA).

• FIPS PUB 102 Guideline for Computer Security Certification & Accreditation, September 1983 (1st of 7 parts http://csrc.nist.gov/publications/fips/fips102/f102a.pdf) (2nd of 7 parts http://csrc.nist.gov/publications/fips/fips102/f102b.pdf) (3rd of 7 parts http://csrc.nist.gov/publications/fips/fips102/f102c.pdf) (4th of 7 parts http://csrc.nist.gov/publications/fips/fips102/f102d.pdf) (5th of 7 parts http://csrc.nist.gov/publications/fips/fips102/f102e.pdf) (6th of 7 parts http://csrc.nist.gov/publications/fips/fips102/f102f.pdf) (7th of 7 parts http://csrc.nist.gov/publications/fips/fips102/f102g.pdf)

• FIPS PUB 199 Standards for Security Categorization of Federal Information and Information Systems, December 2003 (http://csrc.nist.gov/publications/drafts/draft-fips-pub-199.pdf)

• FIPS PUB 140-2 Security Requirements for Cryptographic Modules, December 2002 http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf

• Link to other FIPS Publications (http://csrc.nist.gov/publications/fips/)

NIST Special Publications

• SP 800-12, An Introduction to Computer Security: The NIST Handbook, October 1995 (http://csrc.nist.gov/publications/nistpubs/800-12/ – goes to page with several download options)

• SP 800-16, Information Technology Security Training Requirements: A Role- and Performance-Based Model, April 1998 (http://csrc.nist.gov/publications/nistpubs/800- 16/800-16.pdf)

• SP 800-18, Guide for Developing Security Plans for Information Technology Systems, December 1998 (http://csrc.nist.gov/publications/nistpubs/800-18/Planguide.PDF)

• SP 800-30, Risk Management Guide for Information Technology Systems, October 2001 (http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf)

• SP 800-34, Contingency Planning Guide for Information Technology Systems, June 2002 (http://csrc.nist.gov/publications/nistpubs/800-34/sp800-34.pdf)

• SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems, June 2003 (http://csrc.nist.gov/publications/drafts/sp800-37-Draftver2.pdf)

• SP 800-39, Managing Risk from Information Systems, April 2008 (http://csrc.nist.gov/publications/drafts/800-39/SP800-39-spd-sz.pdf)

• SP 800-47, Security Guide for Interconnecting Information Technology Systems, September 2002 (http://csrc.nist.gov/publications/nistpubs/800-47/sp800-47.pdf)

• SP 800-53, Recommended Security Controls for Federal Information Systems, October 2003 (http://csrc.nist.gov/publications/drafts/draft-SP800-53.pdf)

• SP 800-60, Volume I: Guide for Mapping Types of Information and Information Systems to Security Categories, Version 1.0 Initial Public Draft, December 2003 (http://csrc.nist.gov/publications/drafts/draft-sp800-60V1.pdf)

• SP 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Version 1.0 Initial Public Draft, December 2003 (http://csrc.nist.gov/publications/drafts/draft-sp800-60V2.pdf)

• Link to other NIST Special Publications (http://csrc.nist.gov/publications/nistpubs/index.html)

• NIST C&A Website – (http://csrc.nist.gov/sec-cert/)

• NIST Best Practices Website (links to documents other agencies have done in a variety of topic areas including C&A) – (http://csrc.nist.gov/fasp/)

Department of the Treasury

• Treasury Directive Publication (TD P) 25-04, Privacy Act Handbook.

• Treasury Directive Publication (TD P) 28-01, Preparation and Review of Regulations.

• Treasury Directive Publication (TD P) 25-06, The Treasury Data Integrity Board.

• Treasury Directive Publication (TD P) 85-01, Treasury Information Technology Security

Program

• Treasury Directive Publication (TD P) 15-03, Department of the Treasury Intelligence

Information System Security Policy Manual

• Treasury Directive Publication (TD P) 71-10 and TD 71-10, Department of the Treasury

Security Manual

• Treasury Directive (TD) 12-60, Delegations for Telecommunications and Information

Systems Security

• Treasury Directive (TD) 85-09, Responsibilities for Telecommunications and Information

Systems Security

• Treasury Directive (TD P 15-71), Department of the Treasury Security Manual

Office of the Comptroller of the Currency

• The OCC Information Security Program: Policies, Standards, and Required Controls (retired)

• OCC Master Security Control Catalog, Version 1.1

• PPM-4000-1 http://occnet.occ/examinerlibrary/ppm/ppm-4000-1.pdf

• PPMS http://occnet.occ/examinerlibrary/ppm.html

• PPM 4000-1, Information Security Policy

• DB2 Standards, Doc ID: 5.1.3

• Data Warehouse Data Naming Standards and Guidelines Doc ID: 5.4.1

• Data Management, Doc ID: 5.3

• Creating Data Element Definition Guidelines, Doc ID: 5.3.2.2

• Standard Relational Database Naming Conventions, Doc ID: 5.3.5

• Naming Techniques for Mainframe Programming, Doc ID: 4.3.1.1

• Mainframe Configuration Management, Doc ID: 4.5

• Application System/Subject Database Identifiers, Doc ID: 4.3.1.2

TECHNICAL EXHIBIT 5: OCC’s CALM Database Application

The OCC maintains an internal application for data log aggregation and analysis for information security event monitoring. The application was built using Oracle Application Express (APEX) operating on Oracle 11g Standard Edition in standalone mode.

The application is used to review information security-related data from a variety of syslog sources (e.g., firewalls), other commercial off the shelf software suites (via ODBC), and connect (as read-only or to create Materialized Views) to other, non-Oracle database instances (e.g., Microsoft SQL). The primary role of the application is to analyze data for the purposes of intrusion detection and prevention, as well as anomaly discovery and investigation purposes.

Data parsing is performed using triggers to format and normalize the data after which it’s inserted into tables. The majority of data (~ 95 percent) does not change once it is put into the tables.

The current database is over 1TB in size and 30 million rows of data are inserted every day. The OCC expects data input to increase ten fold over the next 12 months. This database will be migrated to Microsoft SQL Server 2008.

TECHNICAL EXHIBIT 6: Current IRM Tools and Techniques

Security Tools Access Data Forensic Toolkit 2.0 Acronis True Image Corporate Workstation 9.1 AppDetective Core Impact Custom script to gather computer volatile data Cyfin Reporter Subscription including monitoring software, subscription of daily updates to Wavecrest List EnCase Event Archiver Enterprise; Dorian Platinum Support Service; UltraAdmin Support Included GFI LANguard Network Security Scanner 8.0 Guardium Hyena IBM RATL…