CSS_Attachment_2_Task_Order_SOW.pdf

NCATS Cybersecurity Services Program Support Task Order No. [TBD] Statement of Work

Base Period of Performance: 09/19/2024 to 10/18/2024 (1 month) Option Period of Performance: 10/19/2024 to 10/18/2025 (12 months)

Option to Extend Services: 10/19/2025 to 04/18/2026 (6 months)

General Requirement

In accordance with the parent contract Statement of Work, the Contractor shall provide dedicated cybersecurity services to apply information security, privacy, and risk management measures to safeguard the confidentiality, integrity, and availability of the scientific systems and collaborative platforms that make up the NCATS virtual research organization as well as for the Center’s general IT environment.

The services and capabilities supported by CSS include the facilitation and development plans, implementation, the operational support that enhances the security of NCATS Computational Environments, and the NIH & Federal information security compliance requirements.

Specific Task Areas

1. Program Management & Reporting

Prepare overall project plan for task order (including subtasks). All reporting requirements and deliverables are to follow an agreed-upon format by CSS Federal management.

• Prioritize tasks based on the highest risk and benefits to NCATS

• Develop (Electronic/Digital) Dashboards that provide meaningful information and performance indicators of the security landscape of NCAT IT environments

• Enhance reporting requirement to include comprehensive information on security postures of NCATS IT environment

2. Day-to-Day Support

The Contractor shall provide day-to-day support for the Cybersecurity Services Division of NCATS Information Technology Resource Branch (ITRB) as described in the parent contract Statement of Work.

3. Management of Information Technology Security Resources

The Contractor shall provide management support of IT security resources, including but not limited to Splunk Enterprise Security. Conduct events monitoring and management, performance monitoring, and analysis of applications, systems, and computational infrastructure assets. The contractor services shall include but are not limited to monitoring established thresholds and responding to and communicating warnings and alerts to stakeholders.

• Standardize security capabilities for logging, monitoring, auditing, and reporting of

NCATS IT environments

• Evaluate pre-built frameworks, workflows, and dashboards to gain full visibility into NCATS IT environments in support of analytics-driven security decisions

• Leverage Splunk Enterprise Security capabilities and available management tools to provide visibility and insight into information technology activities that could present operations, security, and business risk to the NCATS IT network environment.

4. Vulnerability Management & Incident Response Support

The Contractor shall provide security-level expertise in transforming NCATS vulnerability management and incident response support. Enhance and operate the recommended Threat and Vulnerability Management (TV&M) Plan. Augment TV&M support to include the use of automated management tools for evaluation, detections, compliance/non-compliance, impact, prioritize remediation, and reporting.

The contractor shall lead the incident response management (IRM) of cybersecurity incidents impacting NCATS information technology systems across its hybrid environments.

• Enhance vulnerability management processes and procedures to resolve the deficiencies in the accuracy of data captured and reported in both NIH enterprise and NCATS end-point solutions

• Verify and validate the accuracy of various NIH & NCATS end-point solutions

• Support and assistance in configuring/re-configuring & Optimizing end-point solutions

• Perform vulnerability scans of NCATS IT assets based on NCATS/NIH policy & procedures

• Conduct risk analysis of identified vulnerabilities in support of remediation priority levels

• Coordinate with other ITRB teams to confirm accuracy, drive remediation of vulnerabilities, and ensure compliance of IT assets across NCATS networks

• Develop vulnerability and remediation progress reports as a component of the Program

Management & Reporting suite of deliverables & reports

• Establish capabilities for collecting digital evidence and other data for forensics analysis

• Identify, define, and share with the responsible NCATS IT teams the requirements to respond to cybersecurity incidents

• Develop a Forensics tool kit to enhance incident response support of NCATS on-prem and cloud IT environments.

• Ensure Cybersecurity Support Services (NCATS CSS) personnel are trained to support cybersecurity incidents response management.

5. Security & Cloud Engineering Support

The Contractor shall provide advanced cybersecurity engineering support that enhances the security of NCATS IT & Scientific networks (NCATS Computational Environment) and safeguard its infrastructure components, including computers, software, and data.

Cybersecurity services should include security technical assessment, security architecture development, security engineering, recommendations of alternative products and design, security compliance, and other NIH/HHS relevant policies as appropriate throughout the design, engineering, development, installation, and operating process to ensure proper security controls are in place and operated as expected.

• Review the architectures, segmentations, tools utilized, and security controls selection of

NCATS IT environments

• Determine and recommend security & operation measures that should be in place during development and before the production status of systems and IT environments

• Conduct research on emerging technologies

• Provide product review, technical guidance, and security-related implementation recommendations for products, systems, applications, and cloud solutions, including IaaS and SaaS

• Provide guidance on bringing the NCATS Cloud environment in compliance with NCATS, NIH & the NIST RMF, including but not limited to risk assessment, system-secured baseline configurations, and standards, scans, patch & vulnerability management, log collection, etc.

• Implement security tools across NCATS networks environments to enhance security operations & management

• Identify capabilities lacking in the NCATS security program and determine additional tools and solutions needed to support the Cyber Security Framework and augment the security posture of NCATS IT environments.

• Collaborate with other ITRB Teams to address resolutions of vulnerabilities and compliance deficiencies

• Provide guidance, recommendations, and support to NCATS ITRB teams in reviewing processes and procedures requiring security input

• Assess the Cloud environments to ensure that the architecture complies with the applicable requirements of NIH & Federal IT systems

• Identify gaps in the security of the architecture, management, and operations of the cloud environments

• Provide recommendations that support the establishment of secure cloud environments, infrastructure, platforms, and software services (IaaS, PaaS & SaaS)

• Recommend solutions, processes, and procedures that improve the overall security posture of the NCATS hybrid IT environment & meet the Federal & NIH compliance requirements

6. General Technical Security Services

Provide general technical security support, including but not limited to expert guidance that augments IT risk management and supports the continuous improvement of the security posture of NCATS IT & Computational environments as determined.

• Develop recommendations, guidance, and standards for NCATS Information Technology

Environments

• Provide training on operation security processes and procedures

• Assist NCATS in establishing an automated inventory process of the lifecycle of HW and SW asset management

• Update and develop checklist and start-up kits for compliance requirements, including but not limited to secured baselines of federal & NIH-approved technologies (firewall, routers & switches, servers, databases, etc.)

• Continue to enhance the CSS intranet page with security & privacy related information and content

• Guidance, recommendation, and procedures regarding sharing of IT-related information/data to external sources

• Perform other IT security-related tasks as defined by NCATS management

7. Information Security & Privacy Support

The Contractor shall support the growing need for several NCATS research programs and the IT and computational systems that host sensitive and PII data types that are subject to the Privacy Rule and Paperwork Reduction Act. Provide information security and privacy support to NCATS employees and contractors that are applicable to specific business needs, technical situations, and policy requirements

• Conduct Privacy Impact Assessment & Third-Party Web Applications (PIA/TPWA) of NCATS systems and third-party web applications

• Recommend, develop, implement, and support a risk-based evaluation process & procedure to assist NCATS Senior management decision-making regarding the use of third-party web applications

• Assist privacy coordinator in all activities involving privacy incidents/breaches, website maintenance of privacy policies, FISMA data call, fostering privacy policy and procedure, and advise staff on privacy issues

• Support the development of applicable security and privacy procedures, guidelines, documents, startup kits, workflow, and templates to assist NCATS staff and contractors in navigating through the Federal requirements

• Maintain and update security and privacy documents to reflect changes that comply to

NIST 800-53 rev 5 and meet NIH requirements

8. Assessment Readiness & Authorization Support of NCATS Systems

The Contractor shall provide NIH and NCATS security compliance readiness and remediation support for NCATS assigned systems, which may include but are not limited to following technical, operational, and management duties outlined in the NIST 800-53 Special Publication Security and Privacy Controls for Information Systems and Organizations.

• As required for Federal IT systems, conduct pre-assessments of security controls (i.e.

planning, review, analysis, and recommendations) as required to prepare NCATS systems for federal compliance requirements.

• Continue enhancement of ATO guidance documentation as needed

• Provide support during and after independent assessment activities of NCATS systems o Perform post-independent assessment tasks o Conduct and support Continuous Monitoring of POAM items through the remediation/mitigation processes, updates, and close-out

• Support system authorization activities involving sponsorship of FedRAMP agency authorization

9. Independent Assessment & Authorization of NCATS Information Technology Systems

The Contractor shall conduct an independent security assessment in support of the Authorization to Operate (ATO) of designated NCATS information systems. Assessments are to comply with the NIST Risk Management Framework (RMF) for Information Systems as documented in NIST 800-37, Federal, HHS, NIH, and NCATS requirements. All assessments must be documented and evidenced, and the results shall be recorded in the designated NIH Security Authorization system. The independent assessor shall use the NIH-provided templates, and activities from the task should be a delivery of a complete ATO package for the IT system.

Perform Readiness Review

• Provide independent assessment through validation of a system’s compliance with the security controls as defined within the SSP

• Utilize the System Security Plan (SSP) as a guide for implementing the controls. The independent assessor shall identify inconsistencies or errors within the SSP.

• Identify and report these errors/inconsistencies to the System Owner, who will work with the Information System Security Officer (ISSO), & the NCAT Cybersecurity Lead (CSS Lead) to update the SSP.

Develop a Security Assessment Plan

• The independent assessor shall create a Security Assessment Plan (SAP) based on NIST 800-53A Rev. 4 utilizing the NIH SAP template or available the NIST version provided by NCATS

• Revise the NIH template to define the boundaries of the system, outline the testing methodologies, describe samplings if appropriate, and provide a general guide to the system.

The deliverable of this activity is the SAP and should be submitted to the System Owner ISSO & CSS Lead for review and approval.

Perform the Security Control Assessment

The independent assessor shall perform the Security Control Assessment (SCA) by testing and evaluating the management, operational, and technical security controls consistent with NIST SP 800-53A to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome for meeting the security requirements for the system. Evidence collection is required for each test objective for compliant or non-compliant controls by the Contractor that performs the independent assessment. Evidence shall be specific in nature, support the assessment conducted, and be uploaded to the control within the data repository.

Evidence shall include, but is not limited to:

• Document interviews (with interviewee name, title, and interview date included). This shall be used in combination with technical and documented evidence.

• Documents including policies, procedures, Standard Operating Procedures (SOPs), guidelines, and others that support the implementation of controls.

• Screenshots, digital and photographic evidence depicting the examination of system configurations and performance of security testing.

The deliverable of this activity includes the Security Control Assessment (SCA) and the Plan of Action & Milestones (POA&Ms)

Develop Security Assessment Report (SAR)

The independent assessor prepares the SAR within the data repository documenting the issues, findings, and recommendations identified during the SCA. The SAR can only be generated when all assessment information is entered into the data repository and draft POA&Ms have been created for all findings. Risk must be determined for findings and an overall system or application risk and included in the authorization package.

The SAR must document all findings from the security assessment that are not fully satisfied, with vulnerabilities, threats, an in-place controls discussion, likelihood, impact, risk discussion/rating, and recommendations for correcting deficiencies in security controls.

The deliverables of this activity include Security Assessment Report (SAR) & a complete ATO Package of the IT systems.

TASK ORDER DELIVERABLES

Project Plan of Task Order

• Project Plan of major tasks with projected timelines

• Bi-monthly and Monthly Reports

• Semi-annual Reports

Management of Information Technology Security Resources

• Status reports, challenges & milestone

• Customized correlation searches, alerts, reports, and dashboards that fit NCATS-specific needs

Vulnerability Management & Incident Response Support

• Digital Forensic Tool Kit and defined processes for Incident Response

Security Engineering

• Deliverables to be determined based on the scope and specific engineering requirements defined for the IT Cloud or On-Premises environments

Assessment Readiness & Authorization Support of NCATS Systems

• The FIPS-199 System Categorization

• The Approved Privacy Impact Assessment

• The HHS E-Authentication Risk Assessment and Selection of E-Authentication

Assurance Levels template is completed, up-to-date, and is signed

• System Security Plan (SSP),

• Memorandums of Understandings (MOUs) or Interconnection System Agreements

(ISAs), (when applicable)

• The Business Impact Analysis

• The Contingency Plan

• The Contingency Plan Test and after-action report

• The Configuration Management Plan

• The Incident Response Plan

• The Incident Response Plan Test and after-action report

Independent Assessment & Authorization of NCATS Information Technology Systems

• Security Assessment Plan

• Security Control Assessment

• Plan Of Action & Milestone (findings capture & documented in the designated NIH

GRC Tool)

• Security Assessment Report

• Complete ATO Package

Information Security and Privacy Support

• Security and Privacy startup kits, workflows, and templates

• Profile a guidance/template for NCATS management in their decision-making on the use of third-party web applications as needed

Specific Task Areas