Attachment_J-3_CD.D5.4.pdf

UNCLASSIFIED//FOUO

SUBJECT MATTER EXPERT SERVICES

TASK ORDER STATEMENT OF WORK (TOSOW)

COUNTERINTELLIGENCE DIVISION (CD) – D5

Insider Threat Programs and Safeguarding Measures

Version 1.0

Task Order CD/D5-4

Authored by:

Leonard S. Freiberg III

Federal Bureau of Investigation

COR CONTACT INFORMATION

Task Lead Name Leonard S. Freiberg

Work Phone Number 301-227-8631

Branch/Division/Section/Unit NSB/CD/CD-4/NITTF

Mobile Phone Number 202-510-4522

Fax Number LSFREIBERG@FBI.SGOV.GOV

E-mail leonarsf@dni.gov

Address

J. Edgar Hoover Building

Attn: Leonard S. Freiberg

935 Pennsylvania Ave, NW

Room 4848

Washington, DC 20535

SOW CHANGE HISTORY

Date Version Change Description

12/31/2014 1.0 Initial Release

Table of Contents

1.0 BACKGROUND

2.0 OBJECTIVES

3.0 SCOPE

4.0 TASKS

5.0 PERIOD OF PERFORMANCE

6.0 CONTRACT TYPE

7.0 PLACE OF PERFORMANCE

8.0 SME LABOR CATEGORY AND HOURS

9.0 SECURITY

10.0 DELIVERY/DELIVERABLES

11.0 GOVERNMENT FURNISHED PROPERTY

12.0 TRAVEL

13.0 SPECIAL REQUIREMENTS

14.0 QUALIFICATIONS

15.0 PERFORMANCE METRICS

16.0 APPENDIX A: GLOSSARY

UNCLASSIFED//FOUO

Insider Threat Programs and Safeguarding Measures - TOSOW

1.0 BACKGROUND

Executive Order (EO) 13587, “Structural Reforms to Improve the Security of Classified

Networks and the Responsible Sharing of Classified Information”, directs the Executive Branch to plan for and implement insider threat programs and safeguarding measures. These insider threat and associated safeguarding requirements present unique challenges to our non-IC

Departments and Agencies (D/As).

After issuing EO 13587 in 2011, the President demonstrated his commitment to establish and operate insider threat programs in Executive Branch D/As by signing in November 2012 the

National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat

Programs.

In furtherance of the President’s insider threat initiative, the use of subject matter expert (SME) capabilities to evaluate and recommend improvements to these programs at non-IC elements is justified and prudent.

Dedication of expertise and capabilities focused on the planning, development and implementation of key components of an effective insider threat program at these agencies will both accelerate successful achievement of the Presidential mandate and facilitate a more uniform and standardized USG capability for protecting classified information. It will also establish scalable assistance capabilities that can be re-applied more broadly to other elements. In addition, other opportunities for shared services and capabilities will be identified and barriers to information sharing that might arise will be minimized at the earliest possible stage of development.

This project builds on efforts of the Office of the Director of National Intelligence (ODNI) over recent years to develop programs that combat insider threats through coordinating counterintelligence, security and information assurance components within D/As to provide early identification and mitigation of those who abuse their trusted access and compromise classified materials. For agencies outside the IC which lack familiarity with these concepts and initiatives, insider threat program development is particularly difficult without expert guidance. As a result of information sharing and interconnectivity, the lack of effective programs in these organizations creates vulnerabilities for the rest of the USG and the IC. This effort seeks to accelerate the standup of these capabilities and programs and thereby to enhance the overall effectiveness, and a more rapid accomplishment, of national level direction and Presidential mandates.

2.0 OBJECTIVES

The objective of this Task Order (TO) Statement of Work (SOW) is to contract professional services with counterintelligence/intelligence subject matter expertise and experience in program management. The contractor(s) will work with the FBI and the National Insider Threat Task

Force (NITTF) to provide liaison services to Executive Branch departments and agencies, and others as specified, and aide in the development and implementation of insider threat detection programs, as directed by EO 13587.

3.0 SCOPE

The FBI and NITTF require resources and expertise concerning the establishment and evaluation of insider threat program capabilities within selected non-IC departments and agencies. The contract staff shall provide personnel with specialized backgrounds in counterintelligence/intelligence and program management. Where the department or agency may have limited or no insider threat capability, the contract staff shall be capable of providing expertise and recommendations on the baseline capabilities needed to ensure compliance with policy and minimum standards and guidance issued by the NITTF. Where a capability already exists, the contract staff shall provide the capability to analyze and identify any gaps in services or resourcing, and make recommendations to improve those insider threat capabilities.

4.0 TASKS

As a part of the FBI/NITTF program team, the Contractor personnel shall assist with the development, implementation, analysis, and assessment of insider threat programs within selected non-IC departments and agencies. Personnel shall be expected to support meetings, draft and review documents, conduct liaison with specified departments and agencies, and provide other related services in performance of this contract, specifically in the areas of program outreach and liaison services. The contract staff shall be responsible for performing the following deliverables and/or tasks:

4.1 Task 1 – Provide “Insider Threat” Expertise and Assistance

Provide “insider threat” expertise and assistance (as further defined under

“Delivery/Deliverables”) to the National Insider Threat Task Force, in support of its efforts to identify vulnerabilities and provide guidance to the USG on the detection and mitigation of insider threats.

4.2 Task 2 – Conduct Liaison with Specified NT10/50 Departments/Agencies

Through interaction with specified NT10/50 departments and agencies, aid in the implementation of the National Insider Threat Policy and Minimum Standards. This includes assisting departments and agencies draft policies, implementation plans, and other guidance or procedures necessary to meet the standards.

4.3 Task 3 – Identify Vulnerabilities and Gaps

Through liaison with specified NT10/50 departments and agencies, and by supporting NITTF independent assessments, identify any vulnerability requiring risk mitigation strategies, as well as any gaps or impediments to insider threat program implementation, and provide recommendations/solutions to close gaps and shortfalls.

5.0 PERIOD OF PERFORMANCE

Task Order Period of Performance

From: TBD To: 12-months commencing upon Task Order execution and includes four

12-month option periods thereafter.

6.0 CONTRACT TYPE

This task order shall be priced as: Time and Materials

7.0 PLACE OF PERFORMANCE

Contractor staff work, meetings, progress reporting, and other tasks as necessary will be performed at various Government and, if applicable, Contractor sites within Washington, D.C.

and the National Capital Region. No portion of this work shall be performed on a personal or home computer/PDA.

8.0 SME LABOR CATEGORY AND HOURS

SME Labor Category Number of Positions Annual Hours Core Operating Hours

SME II 5 1920 per Position 9am – 2pm

(SME’s 8 hour shifts must include these core hours)

9.0 SECURITY

Unique Security Requirements

1. All contractor staff shall possess a current and updated TOP SECRET clearance and a favorable

Sensitive Compartmented Information adjudication

10.0 DELIVERY/DELIVERABLES

Action Plan: Within 30 days from the date of initial assignment. The Action Plan will include identification of contract personnel and their assignment to specified NT10/50 departments and agencies, in consultation with the NITTF; articulation of the engagement strategy for initiating/continuing engagement with NT10/50s; and plans to assess and address existing gaps and shortfalls in insider threat implementation.

Monthly Status Report: Every 30 days, and not later than 5 days after the end of each month.

The report shall summarize the individual contractors activities for the previous 30 days and will include the status of any current or ongoing liaison interactions with NT10/50 departments and agencies; the status of insider threat program implementation projects within assigned departments and agencies; identification of issues, obstacles, or limiting factors for implementation of insider threat programs not previously reported; and considerations and recommendations for improving department or agency programs.

Close-Out Report: At the conclusion of the initial Period of Performance and at the end of any subsequent Option Period. The report shall summarize the holistic view of the insider threat program for each NT10/50 department and agency. The Close-Out Report should include any observations recommendations, best practices and lessons learned from liaison interactions with

NT10/50 departments and agencies.

Deliverable Description Quantity/Media Date

1. Action Plan One per assigned contractor; Printed or

Electronic delivery

Within 30 days from date of initial assignment

2. Monthly Status Report One per assigned contractor; Printed or

Electronic delivery

Within 5 days of the end of each month

3. Close-Out Report One per assigned contractor; Printed or

Electronic delivery

End of Period of

Performance

11.0 GOVERNMENT FURNISHED PROPERTY

The FBI shall provide contractor personnel security access control badges for access to FBIHQ and other appropriate departments/agencies;

The FBI shall provide contractor personnel FBI UNET accounts with access to email including access to internet email through 324mail;

The FBI shall ensure contractor personnel have access to FBI UNET computers within FBIHQ in a place or office designated by FBI to be used as work stations and for access UNET based email.

12.0 TRAVEL

Routine travel within Washington, D.C. and the National Capital Region (NCR) will be required for the performance of contract duties. Travel will include, but not be limited to, travel to visit governmental offices of Executive Branch departments and agencies within the NCR; travel to

FBI and NITTF office space for meetings, briefings, and other collaboration; and possible domestic travel outside the NCR for similar work related activities.

Under 50 mile trips are required Over 50 mile trips are required

Routine travel within the NCR to perform contracted services multiple times per week.

Not Anticipated, but possible

13.0 SPECIAL REQUIREMENTS

13.1 Key Personnel / Continuity of Operations (COOP)

There are no Key Personnel/COOP special requirements.

13.2 Performance Required Beyond Standard Workday

There are no performance requirements beyond the standard workday.

13.3 Special Clauses

N/A

14.0 QUALIFICATIONS

14.1 Educational Requirements

Bachelor’s Degree

14.2 Experience Requirements

Ten (10) years investigative/analytical counterintelligence/intelligence experience with a federal agency in a classified environment. (insider threat experience preferred:

Understanding how to leverage security, CI, and information assurance within organizations to deter, detect and mitigate threats by insiders; Some Personnel Security experience and network experience can be substituted for CI experience);

Six (6) years of Program/Project management experience, preferably with a large organization; proven ability to establish goals and objectives; meeting strict deadlines for complex deliverables (prefer HQ level experience);

Experience in developing, drafting, costing, and implementing policy and guidance at the federal level;

Strong presentation skills, to include producing written reports, providing oral briefings and developing support materials such as charts, PowerPoint presentations, and other handouts/pamphlets;

Experience in training federal workforce;

Ability to travel in Washington, D.C. and the National Capital Region; possibility of travel outside NCR;

Experience in interagency liaison;

Experience in assessing risk for security, CI, and information assurance purposes;

Experience in federal personnel security procedures and practices, particularly as related to a classified environment;

Experience with network security issues, procedures and policies, for a federal agency that may include knowledge of:

o Enterprise audit tools and their use;

o User behavior monitoring tools and techniques;

o Interpreting technical data for use by analysts and investigators and establishing insider threat detection triggers;

o Knowledge of legal processes and mandates relating to investigations;

15.0 PERFORMANCE METRICS

The contractor shall develop and submit a Quality Assurance Surveillance Plan (QASP) for this task order which outlines the performance standards, surveillance methods, metrics and penalties/rewards. The following shall be included in the QASP.

The following four criteria will be used to assess the quality of tasks performed and deliverables submitted in this task order:

The contractor’s overall performance on this task order as well as staffing and replacing personnel.

The Contractor response to urgent communications within 1 hour 90% of the time.

The Contractor response to routine communications within 8 hours 90% of the time.

The Contractor’s submission of deliverables in a timely manner and corrections required by the government on written documents within 10 working days.

16.0 APPENDIX A: GLOSSARY

Word / Term Description

CD Counterintelligence Division

D/A Departments and Agencies

D5 FBI Division 5 (Counterintelligence Division)

EO Executive Order

IC Intelligence Community

NITTF National Insider Threat Task Force

NSB National Security Branch

ODNI Office of the Director of National Intelligence

USG U.S. Government