DRAFT Statement of Work NetworkScanningTool.pdf

DEPARTMENT OF HOMELAND SECURITY (DHS)

Science & Technology Directorate (S&T)

STATEMENT OF WORK (SOW)

Portable Network Scanning Tool

1.0 BACKGROUND

The Federal Protective Service (FPS), a component of the Department of Homeland Security (DHS), is responsible for safeguarding more than 8,500 non-military federal facilities and approximately 1.4 million people who work in, visit, or conduct business at those locations.

Within FPS, the Cyber-Physical Division (CPD) conducts cybersecurity assessments of facility operations, safety, and security systems. These assessments are critical for identifying vulnerabilities and ensuring the secure design, deployment, and operation of systems supporting federal facilities.

FPS Cyber-Physical Division currently performs over 50 cybersecurity assessments annually using traditional information technology (IT) tools. However, these tools are not optimized for the unique environments FPS encounters, particularly locally connected systems such as heating, ventilation, and air conditioning (HVAC), lighting, video surveillance, and access control, which are often not monitored by a Security Operations Center (SOC) or DHS IT personnel. The lack of a consolidated, portable, agentless network scanning tool creates persistent blind spots in FPS’s ability to manage cyber risk across its portfolio.

Recent gap analyses and need assessments have highlighted the importance of developing a portable network scanning tool tailored to FPS operational requirements. The tool must enable comprehensive discovery and inventory of IT, Internet of Things (IoT), and Operational Technology (OT) assets, perform vulnerability and configuration assessments in environments without centralized monitoring, and generate structured outputs compatible with FPS’s existing inventory and reporting tools. The project will also address the need for interoperability with legacy systems, unique asset tracking, and compliance with government travel and operational constraints.

The Department of Homeland Security Science & Technology Directorate Homeland Security Advanced Research Projects Agency (HSARPA) is leading the development of this tool, with FPS as the component customer and eventual recipient. The Contractor will design, develop, test, and deliver the tool, with oversight and project management provided by DHS S&T HSARPA.

2.0 SCOPE

The Contractor shall design, develop, test, and deliver a consolidated, portable, agentless network scanning tool for use by FPS. The tool will support real-time discovery and inventory of information technology (IT), Internet of Things (IoT), and Operational Technology (OT) assets, vulnerability and configuration assessments, and integration with FPS’s existing inventory and reporting systems. The project will also include the development of a user interface, documentation, and training materials, as well as validation and testing in operational file://hqnas/SHARED/G-A/G-ACS/CAAT%20Team/TOOLBOX/SCOPE%20PARAGRAPHS.doc environments. The total project cost is $2,000,000.00, and the period of performance is twelve

(12) months from the date of award.

Technical Requirements A. Portability and Durability

1. The scanning tool must be transportable by a single person and small enough to meet the size and weight restrictions of carry-on and checked airline baggage (less than 50 pounds for checked luggage).

2. The tool and its accessories must fit inside a normal-sized vehicle and allow a single individual to transport the entire system without requiring assistance.

3. The equipment must be resilient against typical challenges faced during travel and on-site use, including adverse weather conditions and accidental impacts (e.g., dropping on hard surfaces).

4. Protective cases, if needed, must be small and light enough to be checked as standard baggage and moved easily by one person.

B. Operational and Logistical

1. The device should not require complex setup procedures or extensive equipment, as it will be deployed in dynamic and fast-moving field environments.

2. The tool must comply with government travel regulations, including size and weight limits for checked luggage.

3. The tool must be agentless, meaning it must perform network discovery and assessment with no software agents installed on the target endpoints.

C. Functional and Use Case

1. Comprehensive discovery and inventory of IT, IoT, and OT assets, including building automation, security, and life safety systems.

2. Capture device attributes (type, vendor, model, firmware/software version, interfaces, logical/physical location).

3. Support creation and maintenance of validated, facility-specific asset inventories.

4. Identify known vulnerabilities, weak configurations, and exposed services across

IT and OT/IoT assets.

5. Characterize network paths and connectivity between systems, including external connectivity.

6. Operate in environments without centralized logging, monitoring, or Security

Operations Center (SOC) integration.

7. Function effectively in fragmented, nonstandard, and minimally documented networks.

8. Accommodate building-specific architectures and vendor ecosystems.

9. Operate with minimal dependencies on enterprise infrastructure.

D. Interoperability and Asset Tracking

1. Seamless integration with FPS legacy and external tracking systems.

2. Support mapping legacy tracking numbers to a new, unique identifier scheme that avoids double-counting and misattribution.

3. Support sharing of asset and vulnerability information with DHS and interagency partners.

E. Reporting and Output

Produce structured outputs compatible with FPS’s inventory management and reporting processes.

F. Artificial Intelligence (AI) and Data Collection Lifecycle

1. Evaluate and document the permissible use of artificial intelligence (AI) and agentless data collection mechanisms within FPS operational and compliance frameworks.

2. Ensure the tool meets FPS lifecycle requirements, including compliance with data collection and ingestion restrictions.

G. User Interface and Reporting

1. Develop a graphical user interface (GUI) to facilitate setup, execution, and reporting.

2. Support design optimizations and allow for queueing system submission.

3. Produce scanning reports capturing assets and vulnerabilities within federal facilities.

4. Support integration of inventory management solutions, compliance with federal directives, and timely reporting of risks and remediations.

H. Testing and Validation

1. Conduct comprehensive testing and validation of the tool, including durability, usability, and interoperability assessments.

2. Validate the tool’s performance against empirical data and operational requirements.

I. Documentation and Training

1. Produce user guides, training materials, and operational documentation to support end-users in deploying and utilizing the scanning tool.

3.0 SPECIFIC REQUIREMENTS/TASKS

3.1 Task One: Project Management

The Contractor shall provide program management support for the entirety of this effort, including:

• Conducting monthly status meetings with DHS S&T HSARPA and FPS to review progress, findings, and project updates.

• Submitting monthly status reports summarizing work performed, financial status, travel, and issues requiring sponsor attention.

• Preparing and delivering a final technical report summarizing all interim findings and research outcomes.

3.2 Task Two: Requirements Definition and Use Case Analysis

The Contractor shall refine and document operational requirements and prioritized use cases for the scanning tool, focusing on portability, durability, transportability, and integration with FPS workflows.

• Deliverable: Requirements and Use Case Analysis Report.

3.3 Task Three: Design and Development of Portable Network Scanning Tool The Contractor shall design and develop the scanning tool, ensuring compliance with size, weight, and durability constraints suitable for government travel and field operations. The tool must be agentless and capable of operating in environments with minimal or no enterprise infrastructure.

• Deliverable: Design and Development Report.

3.4 Task Four: Interoperability and Asset Tracking Integration The Contractor shall implement mechanisms for seamless integration with FPS legacy and external tracking systems, including unique identifier assignment and mapping of disparate data schemas.

• Deliverable: Interoperability Integration Report.

3.5 Task Five: Artificial Intelligence (AI) and Data Collection Lifecycle Compliance The Contractor shall evaluate and document the permissible use of artificial intelligence (AI) and agentless data collection mechanisms within FPS operational and compliance frameworks, and ensure the tool meets FPS lifecycle requirements.

• Deliverable: AI and Data Collection Compliance Report.

3.6 Task Six: Testing, Validation, and User Interface Development The Contractor shall conduct comprehensive testing and validation of the tool, including durability, usability, and interoperability assessments. A graphical user interface (GUI) shall be developed to facilitate setup, execution, and reporting.

• Deliverable: Testing, Validation, and GUI Development Report.

3.7 Task Seven: Documentation and Training Materials

The Contractor shall produce user guides, training materials, and operational documentation to support end-users in deploying and utilizing the scanning tool.

• Deliverable: Manuals and Training Documentation.

4.0 OTHER APPLICABLE CONDITIONS

4.1 SECURITY

4.1.1 Access to Sensitive or Classified Information

Contractor access to sensitive or classified information is not required under this SOW.

DHS has and will exercise full control over granting, denying, withholding, or terminating unescorted Government facility and/or sensitive Government information access for contractor employees, based upon the results of a background investigation. DHS may, as it deems appropriate, authorize and make a favorable Entry Of Duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the contactor to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full employment contractor fitness (suitability) authorization will follow as a result thereof. The granting of a favorable EOD decision or a full contractor fitness (suitability) authorization determination shall in no way prevent, preclude or bar the withdrawal or termination of any such access by DHS, at any time during the term of the award. No employee of the contractor shall be allowed unescorted access to a Government facility, access to any sensitive information or access to DHS IT Systems without a favorable EOD decision or contractor fitness (suitability) determination by the DHS Office of Security. Contract employees assigned to the award not needing access to sensitive DHS information or recurring access to DHS facilities will not be subject to security contractor fitness (suitability) screening. Contract employees waiting for an EOD decision may not begin work on the award. Limited access to Government buildings is allowable prior to the EOD decision if the contractor is escorted by a Government employee. This limited access is to allow contractors to attend briefings, nonrecurring meetings and begin transition work.

4.2 PERIOD OF PERFORMANCE

The period of performance for this contract is twelve (12) months from the date of award.

4.3 TRAVEL

Occasional travel, including international travel, shall be required in the performance of tasks listed in this SOW. All travel, Domestic and International, requires approval of the DHS S&T Project Manager and S&T COR in advance. A DHS S&T Foreign Travel Report is required 30 days in advance of the travel. A trip report is required within 30 days after completion of domestic and international travel (template provided at Kick-Off meeting). All travel associated with the execution of the tasks indicated in this Statement of Work will be reimbursed in accordance with the limits set forth in the Federal Travel Regulations, provided the contractor provides appropriate supporting documentation.

4.4 INTELLECTUAL PROPERTY

The contractor, its partner institutions, and subcontractors make no claim of proprietary rights in pre-existing data and computer software that shall be developed and delivered under this contract award.

4.5 SEVERABILITY

DHS has determined this requirement is non-severable.

4.6 GOVERNMENT FURNISHED AND CONTRACTOR ACQUIRED PROPERTY

The contractor shall be accountable to DHS for personal property (1) provided by DHS as Government Furnished Equipment (GFE); or (2) that is Contractor Acquired Property (CAP) acquired with DHS funds where (a) the CAP has an acquisition cost of $5000 or more or (b) where the CAP is sensitive assets of any value, defined as laptops, cameras, Ironkeys, and any other property that may have retainable storage memory (template provided at Kick-Off meeting).

The contractor shall provide a listing with photographs of all GFE and CAP to the DHS Contracting Officer annually on the anniversary date of the contract.

Ninety (90) days prior to the completion of work and acceptance of all deliverables under the contract, the contractor shall provide the DHS Contracting Officer the final and complete listing of all GFE and CAP charged to the contract with an acquisition cost of $5000 or more or sensitive assets.

The DHS Contracting Officer shall provide the contractor with instructions for disposition of all GFP and CAP and provide any additional funds to enable that disposition, as necessary.

5.0 PROJECT TIMELINE AND DELIVERABLES

5.1 Project Timeline

5.2 Project Deliverables

Design and Development Report The Design and Development Report will outline the architecture, engineering approach, and prototype specifications for the portable, agentless network scanning tool. It will describe the tool’s physical attributes, software capabilities, and integration points with FPS inventory and reporting systems. The report will address durability, transportability, and user interface requirements, ensuring the tool meets government travel and field deployment standards. It will also include risk assessments and mitigation strategies for operational environments. This deliverable will demonstrate the Contractor’s progress toward a functional and compliant solution.

Integration Report The Integration Report will document the process and results of connecting the scanning tool with FPS legacy and external asset tracking systems. It will describe the methods used to map disparate data schemas and assign unique identifiers to prevent asset duplication. The report will include test cases, validation results, and any challenges encountered during integration. It will also outline procedures for maintaining compatibility with evolving FPS systems and standards.

This deliverable will ensure seamless interoperability and accurate asset management across FPS’s operational landscape.

Compliance Report The Compliance Report will evaluate the scanning tool’s adherence to FPS lifecycle requirements, including permissible use of artificial intelligence (AI) and agentless data collection mechanisms. It will review the tool’s data handling, ingestion, and reporting processes against FPS operational and regulatory standards. The report will document any restrictions, exceptions, or recommendations for future compliance. It will also include feedback from FPS stakeholders and technical reviewers. This deliverable will confirm that the tool operates within approved guidelines and supports FPS’s mission-critical activities.

Validation and GUI Report The Validation and Graphical User Interface (GUI) Report will present the results of comprehensive testing and usability assessments for the scanning tool. It will describe the tool’s performance in operational environments, including durability, interoperability, and user experience. The report will detail the features and functionality of the GUI, ensuring ease of setup, execution, and reporting for FPS personnel. It will include feedback from pilot deployments and recommendations for enhancements. This deliverable will demonstrate the tool’s readiness for field use and its alignment with FPS operational requirements.

Manuals and Training Materials The Manuals and Training Materials deliverable will provide comprehensive user guides, operational documentation, and training resources for FPS personnel. It will cover setup, deployment, troubleshooting, and best practices for using the scanning tool in diverse environments. The materials will include step-by-step instructions, real-world examples, and guidance on integrating scan results with FPS inventory systems. They will be designed to support both new and experienced users, ensuring effective adoption and sustained operational capability. This deliverable will empower FPS staff to maximize the tool’s value and maintain cybersecurity across federal facilities.

Portable Network Scanning Tool The portable FPS Network Scanning Tool deliverable will provide a compact, agentless device purpose-built for conducting cybersecurity assessments in federal facilities. It will enable FPS personnel to discover, inventory, and assess vulnerabilities in information technology (IT), Internet of Things (IoT), and Operational Technology (OT) assets without requiring software installation on target endpoints. The tool will feature a durable design and intuitive graphical user interface, supporting reliable operation in dynamic field environments and compliance with government travel requirements. It will generate structured, actionable reports that integrate seamlessly with FPS inventory and risk management systems, ensuring accurate asset tracking and timely vulnerability mitigation. This deliverable will equip FPS staff with a resilient and efficient solution for proactively safeguarding the cyber-physical security of federal infrastructure.

5.3 Key Milestones and Deliverables

Program Element / Project Task

Key Milestones and Deliverables

Due Date or Completion Date

Project Management Kickoff meeting One month after award Monthly status reports 15th of each month Quarterly review materials Quarterly Final technical report 30 days before contract end Requirements Definition Requirements Analysis Report 2 months after award

Program Element / Project Task

Key Milestones and Deliverables

Due Date or Completion Date

Tool Design & Development Design and Development Report 4 months after award Interoperability Integration Integration Report 6 months after award AI/Data Compliance Compliance Report 8 months after award Testing & GUI Development Validation and GUI Report 10 months after award Documentation & Training Manuals and Training Materials 11 months after award

6.0 TERMS AND ACRONYMS

Acronym / Term Definition

5G Fifth-Generation technology standard for cellular networks ACA After Contract Award BAP Binary Analysis Platform CAP Contractor Acquired Property COR Contracting Officer’s Representative CWE Common Weakness Enumeration DHS Department of Homeland Security EOD Entry on Duty EMP Electromagnetic Pulse EPRI Electrical Power Research Institute GFE Government Furnished Equipment GMD Geomagnetic Disturbance GUI Graphical User Interface

HEMP High-altitude EMP IBIS I/O Buffer Information Specifications ICS Industrial Control Systems ITV Implement, Test, and Validate LIM Latency Insertion Method

LRBAA Long Range Broad Agency Announcement MS Microsoft PoP Period of Performance PLC Programmable Logic Controller

RLGC Resistance, induction, conductance, and capacitance per meter of a transmission line

S&T Science and Technology Directorate SETA Systems Engineering and Technical Assistance SDLC Software Development Life Cycle SNL Sandia National Laboratories SOW Statement of Work TQI Total Quality Index TVS Transient Voltage Suppressors

7.0 Points of Contact

Department of Homeland Security Science & Technology Directorate, Homeland Security Advanced Research Projects Agency (HSARPA)

DHS S&T Project Manager

TBD

Department of Homeland Security Science and Technology Directorate Homeland Security Advanced Research Projects Agency Telephone: TBD Email: TBD

DHS S&T Technical Manager/SME

TBD

Department of Homeland Security Science and Technology Directorate Homeland Security Advanced Research Projects Agency Telephone: TBD Email: TBD

DHS S&T Contracting Officer’s Representative (COR)

Department of Homeland Security Science and Technology Directorate Homeland Security Advanced Research Projects Agency Telephone: TBD Email: TBD

DHS S&T Financial Analyst

Department of Homeland Security Science and Technology Directorate Homeland Security Advanced Research Projects Agency Washington, DC 20528 Phone: TBD Email: TBD

DHS S&T Invoicing

DHS ICE

Burlington Finance Center PO Box 1000 Attn: S&T Division Williston, VT 05495-1000 mailto:benson.macon@hq.dhs.gov mailto:gabriel.martinez@hq.dhs.gov mailto:cynard.holland@hq.dhs.gov

Email: InvoiceSAT.Consolidation@ice.dhs.gov

Contractor Points of Contact:

Technical Lead Organization: [Contractor Name] Sub-organization: [Contractor Sub-organization] Telephone: [Contractor Telephone] Email: [Contractor Email]

Administrative Lead Organization: [Contractor Name] Sub-organization: [Contractor Sub-organization] Telephone: [Contractor Telephone] Email: [Contractor Email] mailto:InvoiceSAT.Consolidation@ice.dhs.gov