EVSS_PWS_Draftv21-2021-04-23 SS.pdf

SBU – CONTRACTING AND ACQUISITIONS

Contents

1. BACKGROUND

2. SCOPE

2.1. Security Posture

2.2. Scanning Responsibilities

2.3. Scalable Capacity

3. OBJECTIVES

4. FUNCTIONALITY & CAPABILITIES

4.1. Solution Management

4.2. Feed Ingestion

4.3. Scanning Domain

4.4. Scheduling

4.5. Logs 9

4.6. Federal Regulatory Requirements

4.7. FedRamp Certification

4.8. Reporting

4.9. Cloud Scanning

4.10. Restricted Environments

4.11. Ad Hoc Scans

5. SYSTEM INTEGRATION

5.1. Enterprise Management Solution (iPost) Integration

5.2. Privileged Account Management (PAM) CyberArk integration

5.3. Data Analytics Platform (Splunk) integration

6. INSTALLATION SERVICES

6.1. On-site Expertise

6.2. Project Management resource(s)

7. SERVICES AND SUPPORT

7.1. U.S. Citizen Support

7.1.1. Support by U.S. citizen accessible 24 hours a day x 7 days a week,

7.2. Dedicated Subject Matter Expert(s)

7.3. Escalation Process

7.4. Warranty, License, and Maintenance Support

7.5. Customer Portal

7.6. Returned Merchandise Authorization (RMA) Process

7.7. System Update Notices

7.8. Monthly On-Site Subject Matter Expertise

8. SOLUTION TRAINING

8.1. Training Curriculum

8.2. Operator Training

8.3. Administration Training

8.4. Status Meetings

9. DELIVERABLES

10. SECURITY REQUIREMENTS

11. DELIVERY

11.1. Hardware/Software Delivery

11.2. Software License/Keys

11.3. Delivery Address

12. SPECIAL REQUIREMENTS

THIS PAGE IS

INTENTIONALLY LEFT BLANK

U.S. DEPARTMENT OF STATE

BUREAU OF DIPLOMATIC SECURITY

**DS/CTS/CMO/CO EVSS

Performance Work Statement

1. BACKGROUND

1.1. The Cyber Protection (CP) program within the Department of State’s Bureau of

Diplomatic Security, Directorate of Cyber and Technology Security, Office of Cyber

Monitoring and Operations, Cyber Operations (DS/CTS/CMO/CO) Division manages a comprehensive portfolio of cybersecurity tools deployed to secure the Department of

State’s (DOS) networks and data. This document outlines the requirements supporting the technical refresh of the Department’s Enterprise Vulnerability Scanning Solution

(EVSS).

2. SCOPE

2.1. Security Posture

2.1.1. The DOS Cyber Protection program requires the capability to rapidly scan, assess, and report on the security posture of the Department’s networks. The ideal solution will evaluate both IPv4 and IPv6 addressed endpoints, applications, and infrastructure for vulnerabilities. The Department needs a solution that will provide analysis, monitoring, reporting, configuration, as well as policy and device management.

2.2. Scanning Responsibilities

2.2.1. The scope of the Department’s scanning responsibilities encompasses a hosted environment (network) that includes: 1) on-prem Sensitive but Unclassified (SBU);

2) Classified enterprise networks; 3) SBU Azure Cloud environment, and 4) SBU

AWS cloud environment. Various applications and services are hosted through multiple cloud service models such as IaaS, PaaS, and SaaS.

2.3. Scalable Capacity

2.3.1. In addition, the Department recognizes the need for any scanning solution to include a strategy and scalable capacity to scan multiple disparate environments.

These environments include: air-gapped networks; dedicated internet networks

(DINS); Demilitarized Zones (DMZs) hosted domestically and overseas (not connected to the enterprise network); and multiple, distinct Cloud Service Providers

(CSPs) such as Google Cloud, AWS Commercial, AWS GovCloud, Azure

Commercial, and Microsoft Azure Government (MAG).

3. OBJECTIVES

The objectives of the solicitation for the life-cycle refresh for the Department’s Enterprise

Vulnerability Scanning Solution (EVSS) include the following: Functionality & Capabilities, Department System Integration, Services and Support, and Solution Training.

4. FUNCTIONALITY & CAPABILITIES

The Functionality & Capabilities requirements define the minimum acceptable levels of operations and functionality that the Enterprise Vulnerability Scanning Solution (EVSS) shall be required to meet, as defined by industry-standard criteria, federal policies, and anticipated future needs of the Department of State.

The contractor shall provide the functionality and capability listed below which includes but is not limited to the following:

4.1. Solution Management

4.1.1. Provide consolidated management capability allowing for centralized analysis, monitoring, reporting, configuration, policy assignment, and device management.

4.1.2. Ensure high-availability of solution management (console resilience).

4.1.3. Implement role-based access controls (RBAC) supporting the assignment of administrators, users, and readers into hierarchical roles and/or groups with varying and customizable levels of access, permission, and management.

4.2. Feed Ingestion

4.2.1. Provide a one-to-one mapping of vulnerability assessment results to Common

Vulnerabilities and Exposures (CVE) dictionary of common names (i.e., CVE

Identifiers) for publicly known information security vulnerabilities.

4.2.2. Provide up to date threat feeds to include security content, and scan definitions supporting detection of current, emerging, and historical vulnerabilities and threats.

4.3. Scanning Domain

4.3.1. Provide credentialed vulnerability scanning of the Department’s 250,000, and continually increasing, nodes including:

4.3.2. Data processing systems:

4.3.2.1.1. Windows Desktop 7, 10

4.3.2.1.2. Windows Server 2012

4.3.2.1.3. Oracle Linux 5

4.3.2.1.4. RHEL 6

4.3.2.1.5. CentOS 5

4.3.2.2. Infrastructure:

4.3.2.2.1. Cisco iOS 12

4.3.2.2.2. Palo Alto PAN OS 7

4.3.2.2.3. Citrix OS 10

4.3.2.2.4. F5 Networks TMOS 14

4.3.2.2.5. Citrix XenServer 10

4.3.2.2.6. VMware ESXi 7

4.3.2.2.7. VMware VCenter 4

4.3.2.3. Databases

4.3.2.3.1. Microsoft SQL Server 2012

4.3.2.3.2. Oracle 10g

4.3.2.3.3. Oracle 12c

4.3.2.3.4. MongoDB 4

4.3.2.4. Web applications

4.3.2.4.1. Microsoft ISS 6

4.3.2.4.2. Apache 2

4.3.2.4.3. Oracle HTTP Server 12

4.3.2.4.4. Apache Tomcat 9

4.3.2.4.5. Apache HTTP Server

4.3.3. Provide vulnerability scanning functionality into security containers and solutions leveraging micro-segmentation.

4.3.4. Provide application discovery capabilities and include vulnerability findings for software and applications that are end-of-life.

4.4. Scheduling

4.4.1. Provide enterprise-wide vulnerability scanning of the Department’s networks and endpoints (250,000+) at a minimum of twice per week.

4.4.2. Provide the capability to schedule vulnerability scans with defined user input

(i.e., hostnames, host pools/groups, Internet Protocol (IP) range, geographic location, time, and date).

4.4.3. Provide capability for the implementation of multiple vulnerability scan schedule policies with varying configurations allowing for assessments of not only

Department domestic endpoints with Eastern to Pacific Time Zones, but also U.S

Embassies and Posts overseas on local time and after business hours.

4.5. Logs

4.5.1. Provide capability to securely, automatically transmit to a syslog server:

4.5.1.1. Authentication logs.

4.5.1.2. Solution application logs.

4.5.1.3. Solution audit/system logs.

4.5.2. Provide capability to securely, automatically transmit system and application logs that assist in troubleshooting by providing information relevant to permission issues or account credential failures for failed or partial scans.

4.5.3. Provide access to solution logs that assist in troubleshooting permission or credential failures when executing vulnerability assessments.

4.6. Federal Regulatory Requirements

4.6.1. Provide solution FIPS 140-2 module validation certificate numbers as they apply to solution user interface, data in motion, and data at rest.

4.6.2. Provide evidence of solution compatibility with the Dell EMC CloudLink Key

Management Server solution or provide similar solution functionality through alternate disk encryption capabilities such as self-encrypting drives.

4.6.3. Provide capability to assess IPv6 addressed endpoints with capabilities defined in the PWS. The Department will transition infrastructure, nodes, networks, and endpoints in accordance to direction provided in OMB Memo M-21-07 to incorporate the technical capabilities defined in the USGv6 Profile (NIST Special

Publication 500-267).

4.6.4. Provide evidence of solution compliance with Section 508 of the Rehabilitation

Act (29 U.S.C. § 794d) via submission of solution Voluntary Product Accessibility

Template (VPAT) statement.

4.7. FedRamp Certification

4.7.1. Finally, contractor solutions incorporating cloud-hosted capabilities must be

FedRamp certified. Specifically, offerors must have provisional authorization through the Joint Authorization Board (JAB) or an Authorization to Operate (ATO) through a federal government agency.

4.8. Reporting

4.8.1. Provide out-of-the-box reporting capabilities on host, network, and enterprise vulnerability findings cross-referenced to the Common Vulnerabilities and

Exposures (CVE) list.

4.8.2. Provide the capability to generate vulnerability assessment reports using defined user input (i.e., hostnames, host pools/groups, Internet Protocol (IP) range, geographic location, time, and date).

4.8.3. Provide capability to define SMTP relay for delivery of vulnerability scan reports to designated recipients (i.e., email address, distribution list).

4.8.4. Apply a Common Vulnerability Scoring System (CVSS) risk score to indicate the characteristics and severity of vulnerabilities.

4.9. Cloud Scanning

4.9.1. Provide vulnerability scanning of cloud hosted solutions, infrastructure, and services (i.e., Microsoft Azure Government (MAG) Cloud, AWS)

4.9.2. Demonstrate solution capability to integrate with Department's continuous integration and continuous delivery (CI/CD) pipeline supporting detection and remediation of vulnerabilities and malware during development.

4.9.3. Demonstrate solution scalability provide vulnerability identification across multiple disparate cloud service providers (e.g., Google, Azure Commercial, AWS

Commercial, etc.)

4.9.4. Provide vulnerability identification across multiple disparate cloud service providers (i.e., MAG, AWS) via API gateways.

4.10. Restricted Environments

4.10.1. Provide vulnerability assessments (e.g., design and configuration limiting WAN bandwidth utilization and Foreign Post mission impact) across a world-wide network that includes but is not limited to 60 low bandwidth internet connection

(<1Mbs) remote offices.

4.10.2. Demonstrate solution scalability and capability to provide vulnerability assessments of Department’s dedicated internet networks (DINs), isolated internet connected networks that are hosted throughout the world.

4.10.3. Provide capability to conduct vulnerability assessments on Department’s air-gapped networks (isolated non-internet connected networks) nodes (data processing systems, networking devices, databases, virtual infrastructure, and web applications).

4.11. Ad Hoc Scans

4.11.1. Provide capability to conduct ad hoc vulnerability scans allowing for the assessment of nodes or networks outside of the normally scheduled enterprise scan policy time window.

4.11.2. Provide the capability to execute ad hoc scans with customizable user input

(i.e., hostnames, host pools/groups, Internet Protocol (IP) range, geographic location, time and date).

5. SYSTEM INTEGRATION

The System Integration section set of requirements detail the required integrations between the

Contractor’s unique solution and the Department’s existing hosted technologies critical to the

EVSS solution.

5.1. Enterprise Management Solution (iPost) Integration

5.1.1. Provide solution integration with Department’s Enterprise Risk Management

Platform iPost. The solution shall make available, at a minimum, the fields identified below via a database connection (SQL preferred). This data shall be available to iPost for ingestion by asset scanned.

5.1.1.1. Frequently Queried Domain Name (FQDN)

5.1.1.2. Internet Protocol (IP) Address

5.1.1.3. Last Scan Date

5.1.1.4. Installed Operating System (OS)

5.1.1.5. Common Vulnerability and Exposure (CVE)

5.1.1.6. Vulnerability Name

5.1.1.7. Cause of Vulnerability

5.1.1.8. Vulnerability Resolution

5.1.1.9. Vulnerability Description/Details

5.1.1.10. Vulnerability Risk Level

5.1.1.11. Vulnerability Category, and

5.1.1.12. Affected Ports

5.2. Privileged Account Management (PAM) CyberArk integration

5.2.1. Provide solution integration with Department’s Privileged Account Management solution CyberArk. The solution shall provide capability to select CyberArk managed credentials when executing scans and defining scheduled scans.

5.3. Data Analytics Platform (Splunk) integration

5.3.1. Provide for integration with Department’s data analytics solution: Splunk.

5.3.2. The solution shall make available to Splunk all vulnerability assessment findings.

The existing vulnerability scanning solution provides this functionality via a database connection.

6. INSTALLATION SERVICES

The Installation Services set of requirements define the minimum acceptable level of Contractor resource support necessary to complete the installation, configuration, and optimization of the

Contractor’s solution.

6.1. On-site Expertise

6.1.1. On-site Engineering and Vulnerability Scanning solution Subject Matter Expert

(SME) resource(s).

6.1.2. The on-site SME resource(s) will lead installation, configuration, and optimization efforts necessary to deliver the solution(s) as defined within the EVSS

PWS & Scope.

6.2. Project Management resource(s)

6.2.1. The contractor shall provide Project Management (PM) resource(s) to manage contract resource(s) and the delivery for the contractor.

6.2.2. The contractor Project Manager will be responsible for planning, organizing, and directing contract resources, and delivery activities to complete the solution delivery. Per Deliverables table Section 9 Deliverables, this includes furnishing the:

6.2.2.1. Project Plan & Major Milestones (D0003, within 15 days of discovery session).

6.2.2.2. Project schedule (D0003, within 15 days of discovery).

6.2.2.3. Weekly status updates on installation and implementation activities

(D004, weekly).

6.2.2.4. Spot reports on project risks (D0012, monthly and as needed).

6.2.2.5. Monthly roll-up report (D0005, monthly).

7. SERVICES AND SUPPORT

The Services and Support set of requirements describes how the contractor will provision its professional resources to DOS for the Enterprise Vulnerability Scanning Solution, throughout the acquisition, installation, and operations phases of the solution lifecycle.

7.1. U.S. Citizen Support

7.1.1. Support by U.S. citizen accessible 24 hours a day x 7 days a week, by phone, web, and email.

7.2. Dedicated Subject Matter Expert(s)

7.2.1. Dedicated account subject matter expert(s) (SME).

7.3. Escalation Process

7.3.1. A clearly defined escalation and resolution process.

7.4. Warranty, License, and Maintenance Support

7.4.1. A detailed description of warranty, license, and maintenance support services to include service level agreements, response time agreements for low, medium and high incidents, and mean time to resolution (MTTR) projections for standard and severe support incidents.

7.5. Customer Portal

7.5.1. Access to a secure customer web portal with the following minimum characteristics:

7.5.1.1. Inventory of all assets and versioning details;

7.5.1.2. Contractor’s Solution administrative guides, white papers;

7.5.1.3. Repository of searchable knowledgebase articles (KBAs) for engineers and analysts; and

7.5.1.4. Online ticketing for break/fix requests and historical tracking.

7.6. Returned Merchandise Authorization (RMA) Process

7.6.1. A clearly outlined, defined Returned Merchandise Authorization (RMA) process for any solution hardware/equipment, with four-hour drop shipment of replacement components.

7.6.2. Contractor shall assume and accept that the Department of State will not return any hard drives.

7.7. System Update Notices

7.7.1. Provide notices of recurring software system updates via email; these updates must be accessible via a secure download method to provide:

7.7.1.1. New feature updates

7.7.1.2. Bug fix and security updates

7.7.1.3. New knowledge base documents

7.7.1.4. Updated threat signatures and security content

7.8. Monthly On-Site Subject Matter Expertise

7.8.1. System Health Checks -- onsite SME support to conduct system-health checks.

7.8.2. Configuration Management Support -- Support to the Department with solution configuration, upgrades, and optimization.

8. SOLUTION TRAINING

The Solution Training requirements define the minimum acceptable level of service from the contractor for administration, operation, and use of the solution.

8.1. Training Curriculum

8.1.1. Instructor-led training in both classroom and virtual format for required Operator

Training and Administration Training participants.

8.1.2. All instructional materials, including: printed manuals, video, audio, and complete equipment operating instructions.

8.2. Operator Training

8.2.1. Operation Training must cover the features, operation and special care associated with the supplied solution. Operator training shall include:

8.2.1.1. Three (3) classes with a maximum of twelve (12) people per class.

8.2.1.2. Ensure clients have a clear understanding of solution capabilities, operation, and impact of content/product updates.

8.3. Administration Training

8.3.1. Administration Training covering the theory, maintenance, and repair of each element of the solution shall include at a minimum:

8.3.1.1. One (1) class with a maximum of twelve (12) people per class.

8.3.2. Topics must include

8.3.2.1. Monitoring and managing system performance

8.3.2.2. Troubleshooting

8.3.2.3. Repair and servicing techniques

8.3.2.4. Generating reports

8.4. Status Meetings

The contractor shall meet with the COR weekly to brief the Project Management Weekly

Status Report and discuss the following:

8.4.1. Program status, including work completed, and work that remains outstanding.

8.4.2. Issue or obstacles impeding progress and recommended solution.

8.4.3. Status of deliverables.

8.4.4. Progress achieving milestones.

8.4.5. Issues and resolutions.

8.4.6. Resource planning and status.

8.4.7. Topics identified by the Government (e.g., reports from DOS systems and applications).

9. DELIVERABLES

This section identifies deliverable items that the contractor shall deliver to the Government. All deliverables shall be provided to the COR or designated Government Task Manager (GTM) via electronic mail. Deliverables shall be submitted in accordance with dates and timeframes identified in the table below (unless otherwise specified). For specific deliverables identified by the Government, the contractor shall submit drafts (unless otherwise specified) to meet the dates shown. After Government review and feedback, the contractor shall then finalize the product.

Deliverable Format: Deliverables shall be submitted in a format and file type as specified by the

COR and Government Contract Lead (GTL).

Identifier Deliverable Description Timeframe/

Delivery Method

D0001 Kick Off

Meeting

Contractor will outline project objectives and provide orientation on implementation and solution.

Within 10 days of award

D0002 Discovery

Session

Conduct on-site discovery session with designated Government Task Manager

(GTM) to gather needed details for furnishing deliverable D0003.

Within 10 business days of Kick Off meeting

D0003 Solution

Project Plan, Schedule &

Milestones

Post-discovery project plan & milestones, schedule, and resources plan.

Within 15 business days of Discovery

Session

D0004 Project Status

Report

Status report identifying activities and work completed, progress against plan, and risk management. List supporting resources, updated timelines and remaining tasks.

Weekly

D0005 Monthly Roll-up Report

Monthly roll-up of weekly project status reports.

Monthly by the

5th day of the month

D0006 System

Delivery

Delivery of total solution, including all software and license keys, RMA processes, Warranties, terms of service, complete maintenance support plan, and product literature.

At completion of contractor integration

D0007 Solution administration documentation

Solution administrative documentation. At completion of contractor integration

Identifier Deliverable Description Timeframe/

Delivery Method

D0008 Solution diagrams

Physical and logical solution diagrams. At completion of contractor integration

D0009 Solution training course

Provide training to specified personnel. Within 30 days of completion of contractor integration

D0010 Training schedule

Coordinated schedule of training classes.

At completion of contractor integration

D0011 Training package

All training materials, including videos, reference sheets, URL for updated

FAQs, course manuals.

At training course

D0012 System Health

Check Report

System optimization, performance and health check report, including recommendations.

Monthly to begin at completion of contractor solution integration

10. SECURITY REQUIREMENTS

A facility clearance at the Secret level is required for contract performance in accordance with the DD Form 254, Department of Defense Contract Security Classification. Personnel working on site require a Secret clearance.

11. DELIVERY

11.1. Hardware/Software Delivery

11.1.1. The contractor shall provide hardware and software delivery within thirty (30) days After Receipt of Order (ARO).

11.2. Software License/Keys

11.2.1. The contractor shall provide any software license/keys as well as confirmations and/or receipts to the following address: CS-License@state.gov, and

ThomasJG@state.gov

11.3. Delivery Address

11.3.1. The contractor shall provide all deliveries to the following address:

U.S. Department of State – DS/CTS/CMO/CO mailto:CS-License@state.gov mailto:ThomasJG@state.gov

Attention: Brett Morgan -301-985-8770

8101 Odell Rd.

Beltsville, MD 20705

12. SPECIAL REQUIREMENTS

The contractor must be an authorized product reseller and must provide all items as Original

Equipment Manufacturer (OEM), with no exceptions.