DTFACT-16-R-00004-0005.pdf

DTFACT-16-R-00004 Amendment 0005

PART I - SECTION A

GENERAL INFORMATION

A.1 CONTRACTOR PERSONNEL

The Federal Aviation Administration (FAA) may utilize contractor support for this source evaluation.

Contractor employees may be advisors to the evaluation teams, assist in meeting with Offerors, and review price proposals. These individuals will sign Non-Disclosure Agreements and Conflict of Interest statements for this procurement. While these contractors support the evaluation process, the exclusive responsibility for source selection decision remains with the FAA.

A.2 GOVERNMENT POINTS OF CONTACT

Contracting Officer:

FAA William J. Hughes Technical Center (WJHTC) Attn: Lori Bishop, AAQ-640 Atlantic City International Airport, NJ 08405 Phone: (609) 485-4742 Email: lori.bishop@faa.gov

Supervisory Contracting Officer (if above CO is unavailable):

FAA William J. Hughes Technical Center (WJHTC) Attn: Debra Stuart, AAQ-640 Atlantic City International Airport, NJ 08405 Phone: (609) 485-5360 Email: debra.stuart@faa.gov

PART I - SECTION B

SUPPLIES/SERVICES & PRICE/COST

B.1 IDENTIFICATION OF SUPPLIES/SERVICES

This procurement is for support services to assist the FAA Security Operations Center (SOC) Management and the Department of Transportation (DOT)/FAA in maintaining the current 24 hours a day, seven days a week, 365 days per year operations center to protect the DOT/FAA information technology infrastructure. The Contractor must support all SOC activities. The Contractor must be able to support these activities during periods of Continuity of Operations exercises. That is, if it becomes necessary to temporarily relocate to a selected alternate site for emergency or test scenarios, the Contractor must be able to support, and extend normal SOC operations to that remote location. The support services shall be in accordance with the Statement of Work provided in Part I - Section C.

The North American Industry Classification System (NAICS) code for this procurement is 541513 (Computer Facilities Management Services) and the size standard is $27.5 million.

An Indefinite Delivery/Indefinite Quantity (IDIQ) time and materials labor hour type contract will be awarded with a five (5) year performance period. The contractor must provide the services necessary to accomplish the tasks described in Part I – Section C of this contract as authorized by the Contracting Officer (CO) through the issuance of task order(s). The CO is the only person authorized to issue orders under this IDIQ contract.

All terms and conditions contained in this document will be applicable to all orders issued.

B.2 MINIMUM ORDERING OBLIGATION AND MAXIMUM CEILING

The minimum ordering obligation under this contract is $10,000.00 and this amount will be obligated on Task Order No. 0001. The Government has no obligation to order additional services or issue additional orders to the Contractor beyond the minimum ordering obligation specified.

The total not-to-exceed (NTE) contract ceiling amount is To Be Determined (TBD) and will be determined based on the total value of all hours 453,080 total hours and estimated travel and ODC values identified in Section B.4. Orders are anticipated to be placed on a yearly basis and incrementally funded in accordance with contract Acquisition Management System (AMS) clause 3.3.1-39. The aggregate value of all task orders placed against this IDIQ will not exceed the total maximum NTE contract ceiling amount. This effort will be funded as hours are ordered. The initial obligation is $TBD (details for how funding is applied to labor hours and/or travel and ODC costs will be outlined at time of award in the individual task order). Regardless of the estimated period of performance, the contractor shall only continue work until the obligated amount of funds are depleted and the contractor is required to notify the CO when 75% of the obligated funds are depleted in accordance with contract AMS clause 3.3.1-39.

B.3 TIME AND MATERIALS (T&M) CONTRACT LINE ITEM NUMBERS (CLINS)

The contractor shall propose fully burdened onsite and offsite labor (if applicable) hour rates as identified in the Pricing Schedule contained in Section B.4. The awarded contract will incorporate the contractor’s Pricing Schedules for task order pricing and billing purposes. The FAA is aiming towards a challenge award date of on or about 30 August 2016. At that time, it is anticipated that a transition period (not to exceed 30 days) will occur. The transition period will be not separately priced and shall be included in the base period services.

T&M LABOR RATES included in Section B.4: The T&M labor rates (Section B.4) are “fully burdened rates.” A fully burdened rate is defined as the direct hourly labor rate that includes wages, overhead, general and administrative expenses, profit, fringe benefits, and direct tax/labor/payroll burden. These rates, which will represent the rates that the Government will accept during the life of this contract, will be used on all task orders issued under this contract.

a. In performance of the effort ordered under the T&M CLINs 0001, 1001, 2001, 3001 and 4001 of this contract, the Contractor shall provide the total number of personnel based on the ordered amount of T&M labor hours as specified in the individual task order for the associated contract period. Work under these CLINs will be performed for all SOW sections in accordance with Section C. For purposes of this provision, labor hours are defined as actual work hours exclusive of vacation, holidays, sick leave and any other absences.

b. Only those labor categories indicated below shall be charged to this contract. The functional descriptions and education and experience requirements for these labor categories are provided at Attachment J-1 Job Descriptions. It is estimated that the following maximum amount of T&M labor hours may be necessary to accomplish the requirements of the SOW. FAA reserves the right to increase or decrease the T&M hours for any contract year depending on requirements, however, the IDIQ contract shall not exceed the maximum NTE amounts established in Section B. Changes to the number of hours will be made in accordance with Section I clause 3.10.1-14 Changes.

B.4 SCHEDULE

BASE YEAR 1 (one year from date of award)

CLIN DESCRIPTION QTY UNIT

UNIT

PRICE

EXTEND

ED

AMOUNT

0001 Performance of services in accordance with all sections of the SOW

Time and Materials (T&M) 84,600 Hours N/A $

The ceiling amount for this CLIN is either 84,600 hours or the Extended Amount, whichever comes first. The number of hours specified below for each labor category is an estimate used only to establish the Extended Amount. Actual hours may exceed or be lower than the estimates below for any given labor category. Written task orders will identify required labor categories and hours.

Below are the labor categories and associated rates available under this CLIN.

SLIN

0001-01 0001-02 0001-03 0001-04 0001-05 0001-06 0001-07 0001-08 0001-09 0001-10 0001-11 0001-12 0001-13 0001-14 0001-15 0001-16 0001-17 0001-18 0001-19 0001-20 0001-21

Labor Category (on-site) Int II Sys Security/Info Assurance Analyst (Incident Handler) Sr II Sys Security/Info Assurance Analyst (Focused Operations) Sr I System Security/Info Assurance Analyst (Sr Monitoring Analyst) Assoc Sys Security/Info Assurance Analyst (Assoc Monitoring Analyst) Sr Cert Sys Security/Info Assurance Analyst (SIEM Content Lead) Sr Cert Sys Security/Info Assur Analyst (Security Analytics Content Lead) Assoc Technical Writer Int II Sys Security/Info Assur Analyst (Cyber Security Svcs Branch Eng) INFOSEC Sys Tech Engineer (Cyber Security Services Branch Team Lead) Programmer - Incident Tracking Tool Programmer Sr I Sys Security/Info Assurance Analyst (Senior Sensor Maintenance) Int II Sys Security/Info Assur Analyst (Intermediate Sensor Maintenance) Sr I Scientist/Eng/Systems Analyst (Security Analytics System Engineer) Senior I Scientist/Engineer/Systems Analyst (FAS Engineer) Sr Cert Sys Sec/Info Assur Analyst (Sr Sys Admin (Infrastruc Team Lead)) Assoc Cert System Security/Info Assurance Analyst (Jr System Admin) Programmer (SIEM Engineer) Sr I System Security/Info Assurance Analyst (Database Mgt Specialist) Program Manager Travel in accordance with Section G.7. Not-to-Exceed amount.

Other Direct Costs (Material) in accordance with Section Paragraph G.10. Not-To-Exceed amount.

Hours 18,800 11,280 5,640

11,280 1,880 1,880 1,880

11,280 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880

Rate/Hr

LO

Total

$15,000

$ 5,000

(Total of Sub-CLINs is the CLIN Extended Amt)

General & Administrative Handling Rate __________% BASE YEAR 1 EST. TOTAL $

*SEE ATTACHMENT J-6 SECTION B PRICING SPREADSHEET

YEAR 2 (one year after the end date of the Base Year 1)

CLIN DESCRIPTION QTY UNIT

UNIT

PRICE

EXTEND

ED

AMOUNT

1001 Performance of services in accordance with all sections of the SOW

Time and Materials (T&M) 92,120 Hours N/A $

The ceiling amount for this CLIN is either 92,120 hours or the Extended Amount, whichever comes first. The number of hours specified below for each labor category is an estimate used only to establish the Extended Amount. Actual hours may exceed or be lower than the estimates below for

1001-01 1001-02 1001-03 1001-04 1001-05 1001-06 1001-07 1001-08 1001-09 1001-10 1001-11 1001-12 1001-13 1001-14 1001-15 1001-16 1001-17 1001-18 1001-19 1001-20 1001-21

Labor Category (on-site) Int II Sys Security/Info Assurance Analyst (Incident Handler) Sr II Sys Security/Info Assurance Analyst (Focused Operations) Sr I System Security/Info Assurance Analyst (Sr Monitoring Analyst) Assoc Sys Security/Info Assurance Analyst (Assoc Monitoring Analyst) Sr Cert Sys Security/Info Assurance Analyst (SIEM Content Lead) Sr Cert Sys Security/Info Assur Analyst (Security Analytics Content Lead) Assoc Technical Writer Int II Sys Security/Info Assur Analyst (Cyber Security Svcs Branch Eng) INFOSEC Sys Tech Engineer (Cyber Security Services Branch Team Lead) Programmer - Incident Tracking Tool Programmer Sr I Sys Security/Info Assurance Analyst (Senior Sensor Maintenance) Int II Sys Security/Info Assur Analyst (Intermediate Sensor Maintenance) Sr I Scientist/Eng/Systems Analyst (Security Analytics System Engineer) Senior I Scientist/Engineer/Systems Analyst (FAS Engineer) Sr Cert Sys Sec/Info Assur Analyst (Sr Sys Admin (Infrastruc Team Lead)) Assoc Cert System Security/Info Assurance Analyst (Jr System Admin) Programmer (SIEM Engineer) Sr I System Security/Info Assurance Analyst (Database Mgt Specialist) Program Manager Travel in accordance with Section G.7. Not-to-Exceed amount.

26,320 11,280 5,640

11,280 1,880 1,880 1,880

11,280 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880

LO

LO

Total is the CLIN Extended Amt)

General & Administrative Handling Rate __________% YEAR 2 EST. TOTAL $

YEAR 3 (one year after the end date of Year 2)

UNIT

PRICE

EXTEND

ED

AMOUNT

2001 Performance of services in accordance with all sections of the SOW

Time and Materials (T&M) 92,120 Hours N/A $

The ceiling amount for this CLIN is either 92,120 hours or the Extended Amount, whichever comes first. The number of hours specified below for each labor category is an estimate used only to establish the Extended Amount. Actual hours may exceed or be lower than the estimates below for

2001-01 2001-02 2001-03 2001-04 2001-05 2001-06 2001-07 2001-08 2001-09 2001-10 2001-11 2001-12 2001-13 2001-14 2001-15 2001-16 2001-17 2001-18 2001-19 2001-20 2001-21

Labor Category (on-site) Int II Sys Security/Info Assurance Analyst (Incident Handler) Sr II Sys Security/Info Assurance Analyst (Focused Operations) Sr I System Security/Info Assurance Analyst (Sr Monitoring Analyst) Assoc Sys Security/Info Assurance Analyst (Assoc Monitoring Analyst) Sr Cert Sys Security/Info Assurance Analyst (SIEM Content Lead) Sr Cert Sys Security/Info Assur Analyst (Security Analytics Content Lead) Assoc Technical Writer Int II Sys Security/Info Assur Analyst (Cyber Security Svcs Branch Eng) INFOSEC Sys Tech Engineer (Cyber Security Services Branch Team Lead) Programmer - Incident Tracking Tool Programmer Sr I Sys Security/Info Assurance Analyst (Senior Sensor Maintenance) Int II Sys Security/Info Assur Analyst (Intermediate Sensor Maintenance) Sr I Scientist/Eng/Systems Analyst (Security Analytics System Engineer) Senior I Scientist/Engineer/Systems Analyst (FAS Engineer) Sr Cert Sys Sec/Info Assur Analyst (Sr Sys Admin (Infrastruc Team Lead)) Assoc Cert System Security/Info Assurance Analyst (Jr System Admin) Programmer (SIEM Engineer) Sr I System Security/Info Assurance Analyst (Database Mgt Specialist) Program Manager Travel in accordance with Section G.7. Not-to-Exceed amount.

11,280 5,640

11,280 1,880 1,880 1,880

11,280 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880

LO

LO

Total is the CLIN Extended Amt)

General & Administrative Handling Rate __________% YEAR 3 EST. TOTAL $

YEAR 4 (one year after the end date of Year 3)

UNI

T

PRI

CE

EXTEND

ED

AMOUNT

3001 Performance of services in accordance with all sections of the SOW

Time and Materials (T&M) 92,120 Hours N/A $

The ceiling amount for this CLIN is either 92,120 hours or the Extended Amount, whichever comes first. The number of hours specified below for each labor category is an estimate used only to establish the Extended Amount. Actual hours may exceed or be lower than the estimates below for

3001-01 3001-02 3001-03 3001-04 3001-05 3001-06 3001-07 3001-08 3001-09 3001-10 3001-11 3001-12 3001-13 3001-14 3001-15 3001-16 3001-17 3001-18 3001-19 3001-20 3001-21

Labor Category (on-site) Int II Sys Security/Info Assurance Analyst (Incident Handler) Sr II Sys Security/Info Assurance Analyst (Focused Operations) Sr I System Security/Info Assurance Analyst (Sr Monitoring Analyst) Assoc Sys Security/Info Assurance Analyst (Assoc Monitoring Analyst) Sr Cert Sys Security/Info Assurance Analyst (SIEM Content Lead) Sr Cert Sys Security/Info Assur Analyst (Security Analytics Content Lead) Assoc Technical Writer Int II Sys Security/Info Assur Analyst (Cyber Security Svcs Branch Eng) INFOSEC Sys Tech Engineer (Cyber Security Services Branch Team Lead) Programmer - Incident Tracking Tool Programmer Sr I Sys Security/Info Assurance Analyst (Senior Sensor Maintenance) Int II Sys Security/Info Assur Analyst (Intermediate Sensor Maintenance) Sr I Scientist/Eng/Systems Analyst (Security Analytics System Engineer) Senior I Scientist/Engineer/Systems Analyst (FAS Engineer) Sr Cert Sys Sec/Info Assur Analyst (Sr Sys Admin (Infrastruc Team Lead)) Assoc Cert System Security/Info Assurance Analyst (Jr System Admin) Programmer (SIEM Engineer) Sr I System Security/Info Assurance Analyst (Database Mgt Specialist) Program Manager Travel in accordance with Section G.7. Not-to-Exceed amount.

11,280 5,640

11,280 1,880 1,880 1,880

11,280 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880

Rate/ Hr is the CLIN Extended Amt)

General & Administrative Handling Rate __________% YEAR 4 EST. TOTAL $

YEAR 5 (one year after the end date of Year 4)

UNIT

PRICE

EXTEND

ED

AMOUNT

4001 Performance of services in accordance with all sections of the SOW

Time and Materials (T&M) 92,120 Hours N/A $

The ceiling amount for this CLIN is either 92,120 hours or the Extended Amount, whichever comes first. The number of hours specified below for each labor category is an estimate used only to establish the Extended Amount. Actual hours may exceed or be lower than the estimates below for

4001-01 4001-02 4001-03 4001-04 4001-05 4001-06 4001-07 4001-08 4001-09 4001-10 4001-11 4001-12 4001-13 4001-14 4001-15 4001-16 4001-17 4001-18 4001-19 4001-20 4001-21

Labor Category (on-site) Int II Sys Security/Info Assurance Analyst (Incident Handler) Sr II Sys Security/Info Assurance Analyst (Focused Operations) Sr I System Security/Info Assurance Analyst (Sr Monitoring Analyst) Assoc Sys Security/Info Assurance Analyst (Assoc Monitoring Analyst) Sr Cert Sys Security/Info Assurance Analyst (SIEM Content Lead) Sr Cert Sys Security/Info Assur Analyst (Security Analytics Content Lead) Assoc Technical Writer Int II Sys Security/Info Assur Analyst (Cyber Security Svcs Branch Eng) INFOSEC Sys Tech Engineer (Cyber Security Services Branch Team Lead) Programmer - Incident Tracking Tool Programmer Sr I Sys Security/Info Assurance Analyst (Senior Sensor Maintenance) Int II Sys Security/Info Assur Analyst (Intermediate Sensor Maintenance) Sr I Scientist/Eng/Systems Analyst (Security Analytics System Engineer) Senior I Scientist/Engineer/Systems Analyst (FAS Engineer) Sr Cert Sys Sec/Info Assur Analyst (Sr Sys Admin (Infrastruc Team Lead)) Assoc Cert System Security/Info Assurance Analyst (Jr System Admin) Programmer (SIEM Engineer) Sr I System Security/Info Assurance Analyst (Database Mgt Specialist) Program Manager Travel in accordance with Section G.7. Not-to-Exceed amount.

11,280 5,640

11,280 1,880 1,880 1,880

11,280 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880 1,880 is the CLIN Extended Amt)

General & Administrative Handling Rate __________% YEAR 5 EST. TOTAL $

B.5 PRICE SUMMARY

Base Year 1Maximum Estimated Total:

(Total of CLIN 0001) $

Year 2 Maximum Estimated Total:

(Total of CLIN 1001) $

Year 3 Maximum Estimated Total:

(Total of CLIN 2001) $

Year 4 Maximum Estimated Total:

(Total of CLIN 3001) $

Year 5 Maximum Estimated Total:

(Total of CLIN 4001) $

Total Contract Maximum Estimate: $

B.6 PRODUCTIVE LABOR HOURS

The Government will only pay for productive, direct labor hours, i.e. those hours authorized by the CO and applicable task order(s), in performing work under this contract. This does not include sick leave, holiday,vacations, jury duty, military leave, administrative leave, etc.

PART I - SECTION C

DESCRIPTION/SPECIFICATIONS/WORK STATEMENT (Rev 1)

TABLE OF CONTENTS

DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 BACKGROUND

C.2 MISSION/OBJECTIVES/GOALS

C.3 REQUIREMENTS

C.3.1 - SOC OPERATION TEAMS

C.3.1.1 - SOC Operations

C 3.1.1.1: Incident Handler C.3.1.1.2: Focused Operations C.3.1.1.3: Monitoring Analyst C.3.1.1.4: Security Information and Event Management Content Lead C.3.1.1.5: Security Analytics Content Lead

C.3.1.2 - SOC Services C.3.1.2.1: Cyber Security Services C.3.1.2.2: Incident Tracking Tool Programmer C.3.1.2.3: Database Support

C.3.1.3 - SOC Support C.3.1.3.1: Program Management Support C.3.1.3.2: Sensor Maintenance Support C.3.1.3.3: Security Information and Event Management Engineer Support C.3.1.3.4: Security Analytics System Engineer Support C.3.1.3.5: System and Network Support C.3.1.3.6: Technical Writer Support

C.4. DELIVERABLES

C.4.1 - SOC OPERATION TEAMS

C.4.1.1 - SOC Operations C.4.1.1.1: Incident Handler Support C.4.1.1.2: Focused Operations Support

C.4.1.2 - SOC Services C.4.1.2.1: Cyber Security Services C.4.1.2.2: Incident Tracking Tool Programmer

C.4.1.3 - SOC Support C.4.1.3.1: Program Management Support C.4.1.3.2: Sensor Maintenance Support C.4.1.3.3: Security Information and Event Management Engineer Support C.4.1.3.4: Security Analytics System Engineer Support C.4.1.3.5: Technical Writer Support

C.5.1 – Special Projects Support C.5.1.1 - Special Projects Support C.5.2.1 - Deliverables

C.1 BACKGROUND

The operation of a Federal Aviation Administration (FAA) Security Operations Center (SOC) function for information systems is required by FAA Order 1370.82A and Homeland Security Presidential Directive (HSPD) 7, Federal Information Security Management Act (FISMA) of 2002, OMB-Circular Act A-130 and Federal Information Technology Acquisitions Reform Act (FITARA) to improve the security and privacy of sensitive information in Federal computer systems and to establish a minimum acceptable security practice for such systems. The FAA established the SOC to assure the security of all Operating Administrations (OA). For example, the Department of Transportation (DOT) Common Operating Environment and other DOT Modes, FAA’s National Airspace System (NAS) subsystems, FAA’s NAS Mission Support, FAA’s Research and Development (R&D) subsystems, FAA’s Lines of Business (LOBs), and FAA’s administrative systems would all be protected by the SOC. Thus, the SOC was created to combat both internal and external cyber-based attacks targeting the FAA and DOT systems. These systems must be afforded the appropriate level of protection required to ensure safe and unimpeded operations. The appropriate safeguards are essential to ensure the availability, integrity, and confidentiality of the information processes across the aforementioned systems.

The SOC was established as the FAA and DOT focal point for all information security incidents and provides a centralized operation responsible for monitoring and tracking information security incidents, conducting sensor data analysis, establishing trend analysis documentation, providing proactive and responsive corrective action capability, and providing the FAA and DOT with a wide information security technical assistance with cyber disaster recovery and other Information Security (IS) functions. The SOC’s compliance and certification for security assurance is based on industry best practice of ISO Security Certification. ISO17799, International Security Standards is the major standard for information security. It is comprised of “a comprehensive set of controls comprising best practices in information security”, which includes a code of practice, a specification for an information security management system, and internationally recognized information security standard.

The objective of the SOC is to identify, protect, detect, respond to, and recover from cyber attacks on the FAA information systems. The SOC tasks include advising the FAA and DOT of proper security measures, encouraging industry best security practices, intrusion detection and analysis support, managing telephone trouble calls, issuance of Information System Security (ISS) Alerts, Advisories, Bulletins and ISS related information messages, administration of the SOC secure web page, incident handling and response, forensics, and metrics reporting. The SOC’s goal of achieving Information Assurance is accomplished by implementing layered defense methodologies by performing vulnerability assessment, compliance verification, security patch and virus notification, intrusion detection and prevention, incident handling and assistance with cyber disaster recovery, agency-wide.

The FAA SOC is strategically moving toward a team methodology with agile cells of analysts who can pivot quickly between intelligence gathering, event triage, incident detection, incident response, and hunting activities. This approach is meant to encourage mobility within the threat, internal and external forensics, detection, and incident management. This methodology provides flexibility to dynamically adjust to changing attacks, workloads, and investigations. Ultimately with the Contractor support the SOC will drive a stronger security posture through improved intelligence, feeding detection and tracking of campaigns.

http://www.dhs.gov/homeland-security-presidential-directive-7 http://www.dhs.gov/homeland-security-presidential-directive-7 http://www.gpo.gov/fdsys/pkg/PLAW-107publ347/html/PLAW-107publ347.htm http://www.gao.gov/products/GAO/AIMD-00-183R http://www.gao.gov/products/GAO/AIMD-00-183R https://awastmtg1.faa.gov/stconf.nsf/WebAttendFrameset?OpenAgent&view=Attend&docID=83A95E8AD606A85A85257EC0005E8075&meetingID=83A95E8AD606A85A85257EC0005E8075&join_type=mrc&subject=SO%20mgt&login

The SOC is expanding and continuously maturing. An outline of key points in achieving the objective above includes the following:

• Provide state of the art expertise and advice to the SOC providing best practice guidance in cyber security related activities.

• Provide a detailed assessment of the defense posture of the FAA network environment and provide recommendations and a roadmap identifying short term and long term actions for identified gaps during the assessment.

• Maintain existing hardware platforms and software applications and work to improve efficiency/reduce hardware and software.

• Provide expertise in situational awareness and an up-to-date snapshot of cyber events that are on-going within the world of cyber security.

• Provide expertise in the interpretation of the alerts issued by the Commercial Off-The-Shelf (COTS) vendor arena.

• Coordinate, collaborate with, and support the NAS Cyber Operations Center (NCO) in determining susceptibility to cyber incidents and vulnerabilities.

• Serve as the interface for the FAA and DOT in reporting incidents to the Department of Homeland Security (DHS), U.S. Computer Emergency Response Team (US CERT), Industrial Control Systems Computer Emergency Response Team (ICS-CERT) within the National Cybersecurity and Communications Integration Center (NCCIC), and provide expertise and coordination with the FAA Security and Hazardous Materials Safety (ASH) Office.

The Contractor shall use Standard Operating Procedures (SOPs) provided by FAA SOC program managers, infrastructure managed through SOC operations and maintenance services support, and capabilities provided through advanced security services to provide an integrated cyber response.

The Federal Aviation Administration Office of Information and Technology (AIT) provides a variety of IT services, products, and support across FAA and DOT and other Federal agencies. Due to the different organizational missions and resources used by those activities this agreement may be funded from a variety of funding types, which source types may include but are not limited to Facilities and Equipment (F&E), Operations (OPS), Research and Development (R&D), and Airport Grant funding.

The details of these primary initiatives are described throughout the remainder of this document.

C.2 MISSION/OBJECTIVES/GOALS

The overall mission of the SOC is to protect the FAA and DOT’s critical Information Systems, infrastructure, and operations from being negatively influenced, disrupted, or terminated through the exploitation of internal or external information systems. The primary objective of the SOC is to assure Confidentiality, Integrity, Availability, and to enhance the security of the FAA network infrastructure and systems. The SOC’s goal is to identify, protect, detect, respond to and recover from cyber-attacks on the FAA’s information systems.

C.3 REQUIREMENTS

The Contractor shall assist the SOC Management and the FAA in maintaining the current twenty four

(24) hours a day, seven (7) days a week, three hundred sixty five (365) days per year, operations center to protect the FAA and DOT information technology infrastructure. The Contractor must support all SOC activities. The Contractor must be able to support these activities during periods of Continuity of Operations and exercises. That is, if it becomes necessary to temporarily relocate to a selected alternate site for emergency or test scenarios, the Contractor must be able to support, and extend normal SOC operations to that remote location.

The specific tasks necessary for this support are outlined in the following requirements. Labor category descriptions and staff qualification requirements are included in Attachment J-1. It should be noted that all staff will be required to hold a current minimum active security clearance of SECRET unless otherwise noted.

The Contractor will maintain a presence and provide technical support of SOC Operations as directed by the Contractacting Officer Representative (COR) at the current government facility, other co-located Government locations, or other locations, as agreed upon, and as required.

C.3.1 - SOC OPERATION TEAMS

C.3.1.1 - SOC Operations

C 3.1.1.1: Incident Handler The Contractor must maintain incident handling capability twenty four (24) hours a day, seven

(7) days a week, three hundred sixty five (365) days a year. The Incident Handler must receive, document, and report cyber security events; categorize incidents and implement corresponding escalation procedures; communicate and coordinate incident response efforts; conduct daily operational update meetings for SOC staff and unscheduled situational update briefings for FAA leadership as necessary; analyze reports to understand threat techniques and extract Indicators of Compromise (IOCs); provide telephone, e-mail and ticket service to customers;

reference applicable departmental and operating administration policies in work products; and access, secure and inspect local classified information processing areas.

The Contractor will handle day to day administrative tasks; direct communications to the proper channels; fulfill data calls and other external data requests; and create tickets from inbox and telephone calls which provide documentation of all analysis, intrusion detection sensors reports, forensics and threat analysis reports, associated vulnerability scan results, policy references and recommendations for restoring secure operating capabilities.

For each issued order under this contract, the Contractor must utilize ordered hours for the Incident Handler staff to provide coverage twenty four (24) hours a day, seven (7) days a week, three hundred sixty five (365) days per year. Required shifts are: (0600-1600, EST\EDT), (1400-0000, EST\EDT), (2200-0800, EST\EDT), including Federal government holidays.

Backfill of absent Incident Handlers are required for periods of scheduled and unscheduled leave. The Contractor shall perform the responsibilities and possess the qualifications, as noted in the J-1 attachment.

C.3.1.1.2: Focused Operations The Contractor must contribute to daily operational update meetings for SOC staff and unscheduled situational update briefings for FAA leadership as necessary; analyze reports to understand threat techniques and extract IOCs; reference applicable departmental and operating administration policies in work products; recommend sound remediation and recovery strategies, suggest defensive policy enhancements and information technology procedures;

access, secure and inspect classified information processing areas; assist FAA and DOT law enforcement and counter intelligence offices with cyber investigations; provide forensic and network analysis, threat detection and trend analysis; understand and convey of the lifecycle of the network threats, attack vectors, and network vulnerability exploitation; maintain awareness of directives, orders, alerts, and messages; provide content for FAA and DOT shared situational awareness mechanisms i.e., websites, blogs, and Wikipedia style mechanisms; maintain relationships with Intelligence Agencies, Law Enforcement, and US Government organizations; maintain situational awareness of cyber activity in the Information Technology (IT) by reviewing open source reporting for new vulnerabilities, malware, or other threats that have the potential to impact the organization; develop indicators of compromise and context for content creation; search for anomalous activity and investigate to provide identification;

produce reports and briefs to provide an accurate depiction of the current threat landscape and associated risk; use customer, community, and open source reporting.

For each issued order under this contract, the Contractor must utilize ordered hours for the Focused Operations staff to provide coverage eight (8) hours a day, five (5) days a week, fifty two (52) weeks per year. Under low/guarded risk level, required shifts are: (0800-1700 EST\EDT), Monday - Friday. Under the elevated or high risk levels, the required shifts are (0600-1400, EST\EDT) and (1000-1800 EST\EDT), Monday - Friday. Under the severe risk level, the Contractor must have the capability to augment staffing levels to support additional required shifts of (0800-1700 EST\EDT), Saturday and Sunday. Under all risk levels, the backfill of absent Focused Operations are required for all periods of scheduled and unscheduled leave. The Contractor shall perform the responsibilities and possess the qualifications, as noted in the J-1 attachment.

C.3.1.1.3: Monitoring Analyst The Contractor must support monitoring of all Information Assurance Devices to identify and document all intrusions and attempted intrusions; populate and maintain an intrusions database, and provide data analysis support; analyze data from sensors, network security devices and applications using the security information event management systems, log servers, application interfaces and device consoles provided; document of evidence of system security compromise, generate of trend reports, collect evidence of malicious or anomalous activity; report security incidents and/or network intrusions to Incident Handlers for dissemination to appropriate FAA and DOT points of contacts. Identify anomalous and malicious activity; contribute to content creation; prioritize, rank and escalated incidents; provide support in the detection, response, mitigation, and reporting of cyber threats affecting client networks; maintain an understanding of the current vulnerabilities, response, and mitigation strategies used in cyber security operations; assist in producing status reports and briefs to FAA leadership; provide analysis for correlated information sources; provide liaison to other agency cyber threat analysis entities such as intra-agency and inter-agency Cyber Threat Working Groups; maintaining proficiency in the use and production of visualization charts, link analysis diagrams, and database queries;

analyze and report cyber threats as well as assist in deterring, identifying, monitoring, investigating and analyzing computer network intrusions. Monitoring Analysts must provide recommendations based on best practice and experience to develop processes that will enhance efficiencies needed to perform the above.

For each issued order under this contract, the Contractor must utilize ordered hours for the Monitoring Analysis staff to provide coverage twelve (12) hours a day, five (5) days a week, including Federal government holidays. Under all risk levels, required shifts are (0600-1400 EST\EDT) and (1000-1800 EST\EDT), Monday - Friday, including Federal government holidays. Under all risk levels, the backfill of absent Monitoring Analysts are required for all periods of scheduled and unscheduled leave. At the direction of the COR, the Contractor may be required to move personnel shifts in order to support demanding workloads, especially during core business hours. The Contractor shall perform the responsibilities and possess the qualifications, as noted in the J-1 attachment.

C.3.1.1.4: Security Information and Event Management Content Lead The Contractor shall provide a Security Information and Event Management Content Lead to develop content for enterprise full-packet capture security application, combining big data security information collection, management, and analytics capabilities with full network and log-based visibility and automated threat intelligence from commercial vendor and other government agencies. Develop dashboards, channels, filters, and rules; and integrate threat intelligence.

For each issued order under this contract, the Contractor must utilize ordered hours for the Security Information and Event Management Content Lead to provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week, Monday - Friday between the hours of (0500-0000, EST\EDT). Backfill of absent Security Information and Event Content Lead is required for all periods of scheduled and unscheduled leave. The Contractor shall perform the responsibilities and possess the qualifications, as noted in the J-1 attachment.

C.3.1.1.5: Security Analytics Content Lead The Contractor shall provide a Security Analytics Content Lead to develop content for enterprise full-packet capture security application, combining big data security information collection, management, and analytics capabilities with full network and log-based visibility and automated threat intelligence from commercial vendor and other government agencies.

Develop dashboards, channels, filters, and rules; and integrate threat intelligence.

For each issued order under this contract, the Contractor must utilize ordered hours for the Security Analytics Content Lead to provide coverage and maintain a presence in the SOC eight

(8) hours per day, five (5) days per week, Monday - Friday between the hours of (0500-0000, EST\EDT) . Backfill of absent Security Analytics Content Lead is required for all periods of scheduled and unscheduled leave. The Contractor shall perform the responsibilities and possess the qualifications, as noted in the J-1 attachment.

C.3.1.2 - SOC Services

C.3.1.2.1: Cyber Security Services For each issued order under this contract, the Contractor must utilize ordered hours for the Cyber Security Services Branch staff to provide coverage and maintain a presence in the SOC twelve (12) hours per day, five (5) days per week, Monday - Friday between the hours of (0600

- 1800, EST/EDT), excluding Federal government holidays. On Federal government holidays that do not fall on Saturday or Sunday, the Services Branch presence in the SOC will be maintained eight (8) hours per day (0800 – 1600, EST/EDT). In order to meet emerging specific FAA and DOT website, database, and operating system scanning requirements, work hours outside of the schedule will be occasionally required. These non-standard hours may include various hours during evenings and weekends. The Contractor must utilize ordered hours to provide staff during these hours to meet the scanning requirements. With a minimum of one (1) week notice seven (7) calendar days, the Contractor will make staff available to perform system scans during non-standard hours. When this activity requires a gap in the normal hour coverage (0600 – 1800, EST/EDT), the Contractor will notify the COR and must fill the schedule gap. The Contractor shall perform the responsibilities and possess the

C.3.1.2.2: Incident Tracking Tool Programmer The Contractor shall provide Programmer support which specializes in web application development and database development and integration to support this SOC internal custom developed application. The programmer will provide the following services with respect to software development lifecycle of the internal custom developed application: Analysis of requirements either provided or approved by FAA leadership; design, development, testing, and implementation of code changes; release management and configuration management; User management and production support. Additional developer responsibilities: requirements gathering, analysis and management; user support, training, presentations and demos;

development of new features; thorough testing by performing unit, system, regression, security testing and code migration testing; implementation to production systems; providing testing support for database upgrades, security patches, browser upgrades; fixing reported bugs and bugs found during testing cycles; production support and building of adhoc reports; developing scripts for data updates; configuration and change management; overall project management;

handling multiple development lifecycles at once.

For each issued order under this contract, the Contractor must utilize ordered hours for the Incident Tracking Tool Programmer to provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week, Monday - Friday between the hours of (0600 – 1800, EST/EDT). The Contractor shall perform the responsibilities and possess the

C.3.1.2.3: Database Support The Contractor shall maintain and ensure the integrity of all databases containing information interpreted from SOC sensor data and reported by information sharing partners for government and the private sector. The Contractor shall support remote installation and maintenance of

SOC hardware and software. The database support also has the following responsibilities:

Develop system integration solutions between COTS databases (any vendor) or data streams and custom developed application database; design, develop and test a combination of various scripts and PL/SQL procedures in order to support above activities; design, develop, test and execute data migration and data import techniques utilized in current and future incident reporting tool features; design, test, implement, support and monitor security and availability features such as data encryption in rest and in motion, and disaster recovery site; provide performance tuning on queries and databases throughout system development lifecycle and on production systems; maintain all development and test databases in the lab and CSNET; install and maintain new databases or servers as needed; provide support during release installations, code migrations; upgrade databases to latest releases and provide installations and testing of database patches; provide Application User Support; troubleshoot all production, development and test database issues; monitor database resource use and alert infrastructure team when more resources are needed; develop, test and implement code for incident reporting tool; research new or existing features available in COTS databases and evaluate their value and usefulness for custom developed applications, and provide recommendations on their implementation

For each issued order under this contract, the Contractor must utilize ordered hours for the Database Support staff to provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week Monday - Friday between the hours of (0600 – 1800, EST/EDT). The Contractor shall perform the responsibilities and possess the qualifications, as noted in the J-1 attachment.

C.3.1.3 - SOC Support

C.3.1.3.1: Program Management Support The Contractor shall provide an individual, with extensive experience and broad knowledge base of IT Security and has worked in a Security Operations environment who will serve as the On-Site Program Manager (PM). In order to support the growth of the SOC, the PM will have hands-on technical experience, coupled with leadership and managerial experience in a fast-paced twenty four (24) hours a day, seven (7) days a week, three hundred sixty five (365) days a year environment. The PM will act as the liaison and subject matter expert in the area of cyber security and promote the SOC to its customers, as needed. The PM may be called upon to give briefings to Executive Management community and to potential Federal sector customers of SOC. The PM will provide assistance and guidance in the areas of Response, Detection, and Services. The PM will support the initiatives of SOC by making recommendations of technologies and processes to enhance situational awareness and efficiency. The PM will lead large tasks within the SOC to ensure successful and on-time delivery. The PM will provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week, Monday - Friday between the hours of (0500-0000, EST\EDT).

The final selection of the PM position candidate will be reviewed and evaluated against established criteria and provided to the SOC’s Management Team.

The program management effort shall include:

• Preparing and presenting written communications, plans, reports, briefings and briefing materials

• Participation in meetings and discussions

• Establishing, documenting, and managing the scope, schedule, and resource allocation for projects and sustaining activities

• Providing the Government with a consolidated point of contact for communication

• The Contractor shall perform an integrated Program Management function to ensure effective cost, schedule, and technical requirements are achieved. The Contractor shall manage the program in accordance with Contract requirements, the and work schedule(s)

• The Contractor shall identify problems and risks that could adversely impact performance, cost and/or delivery schedule

• The Contractor shall gather and provide multiple levels of metrics for management tier review showing functionality of the services and value add to the organization

• The Contractor shall produce relevant cyber security metrics that allow the SOC to provide FAA leadership with metrics that show cost/benefit of the SOC, possible savings that could occur with improvements

The PM must have technical knowledge and be able to provide guidance and recommendation on solutions to the following technologies when called upon:

• Host-based Intrusion Detection

• Network-based Intrusion Detection

• Security Information Management

• Antivirus, Antispyware, and content filtering

• Firewall

• Help Desk Systems Management, and Network Management

• Data Visualization

The Contractor shall perform the responsibilities and possess the qualifications, as noted in the J-1 attachment.

C.3.1.3.2: Sensor Maintenance Support The Contractor shall provide the technical expertise required to modify (upgrade) and/or replace existing SOC monitoring devices as needed. For each issued order under this contract, the Contractor must utilize ordered hours for the Systems and Network Support staff to provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week, Monday - Friday between the hours of (0600 – 1800, EST/EDT) with augmentation staff available twenty four (24) hours a day, seven (7) days a week, three hundred sixty five (365) days per year, within three (3) hour notice to respond to FAA and SOC Management requirements. The SOC install, maintain, monitors and decommissions sensor devices. All sensors are configured in accordance with FAA and DOT standards. The Contractor must maintain configuration control of all signatures and test them before being deployed in the operational environment. The Contractor shall evaluate and test all upgrades and patches prior to deployment in production. Additionally, these systems are deemed critical to the SOC and require maintenance of all product and process documentation. This is the responsibility of the Contractor to maintain and update.

The Contractor shall identify requirements for additional sensor locations which will enhance the situational awareness capability. Underlying factors affecting the expansion of sensor deployment will be the results of the ongoing Network Mapping task and the continued installation of Intrusion Detection Sensors.

The Contractor shall coordinate and assist local personnel in the installation of network intrusion detection systems approved by the COR or designee. The Contractor shall support the DOT in the preparation of site coordination reports for each installation. These reports will contain at a minimum: Point-of-Contact (POC) information from the site (e.g., network technician and Information Systems Security Manager (ISSM), if applicable), installation location and applicable addresses, network diagrams to include Network Intrusion Device sensor configuration information (proposed and installed), connection details, and facility requirements. The Contractor shall perform the responsibilities and possess the qualifications, as noted in the J-1 attachment.

C.3.1.3.3: Security Information and Event Management Engineer Support The Contractor shall provide Security Information and Event Management Engineer support with research, development, integration and administration duties as directed by the COR. For each issued order under this contract, the Contractor must utilize ordered hours for the Security Information and Event Management Engineer staff to provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week, Monday - Friday between the hours of (0600 – 1800, EST/EDT) with augmentation staff available twenty four (24) hours a day, seven (7) days a week, three hundred sixty five (365) days per year, within six (6) hour notice to respond to FAA and SOC Management requirements. The Contractor shall perform the responsibilities and possess the qualifications, as noted in the J-1 attachment.

C.3.1.3.4: Security Analytics System Engineer Support The Contractor shall provide Security Analytics Engineer support with research, development, integration and administration duties as directed by the CORor designee. For each issued order under this contract, the Contractor must utilize ordered hours for the Security Analytics Engineer staff to provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week, Monday - Friday between the hours of (0600 – 1800, EST/EDT) with augmentation staff available twenty four (24) hours a day, seven (7) days a week, three hundred sixty five (365) days per year, within six (6) hour notice to respond to FAA and SOC Management requirements. The Contractor shall perform the responsibilities and possess the qualifications, as noted in the J-1 attachment.

C.3.1.3.5: System and Network Support The Contractor shall provide personnel who are qualified in areas of Storage Area Network (SAN) / Local Area Network management. Support may be accomplished either with an on-site visit or via Virtual Private Network. The Contractor shall ensure that all SOC hardware and software are secure and free from vulnerabilities and possible compromise by applying all appropriate patches and fixes in accordance with the SAN and fail safe roll over capability.

For each issued order under this contract, the Contractor must utilize ordered hours for the System Administrator staff to provide coverage and maintain a presence in the SOC eight (8) hours per day, five (5) days per week, Monday - Friday between the hours of (0600 – 1800, C.3.1.3.6: Technical Writer Support The Contractor shall provide Technical Writer support which collaborates with SOC personnel to prepare and review documentation for internal and external customers as required and will also support SOC Management support including review of SOC documentations.