Federal_Resources_Corporation-FRC_Section5_General_Requirements.pdf

Section 5: General Requirements State of Wisconsin

Department of Administration

Governance, Risk, and Compliance Tools Reference # 28443-SM

Response Date: September 3, 2025, 2PM CT

Submitted To:

Submitted By:

State of Wisconsin Department of Administration State Bureau of Procurement PO Box 7867 Madison, WI 53707-7867

Attn: Susanne Matschull Susanne.matschull@wisconsin.gov 608-266-9796

Federal Resources Corporation (FRC) Small Business 153 E. 13th Street, Ste 1100 Erie, PA 16503 Phone: (814) 636-8020 Fax: (301) 990-1378

DUNS: 102932709

CAGE: 1QBT0

UEI: FZK7KZZJYNQ9

FRC Point of Contact:

Chris Zeiders, VP of Technology 703-795-3257 czeiders@fedresources.com

This response includes data that shall not be disclosed outside the Government and shall not be duplicated, used, or disclosed – in whole or in part – for any purpose other than to evaluate this response. This restriction does not limit the Government’s right to use information contained in this data if it is obtained from another source without restriction. The data subject to this restriction are contained in all sheets.

mailto:Susanne.matschull@wisconsin.gov

Federal Resources Corporation | Reference # 28443-SM Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

PAGE

TABLE OF CONTENTS

Introduction

5.1 Organizational Capabilities

A. Team FRC Experience B. Team FRC Organizational Lines of Authority C. Team FRC Escalation Process

5.1.1 Cyber Security Policy

5.1.2 SOC 2 Type 2 & FedRAMP

5.2 Staff Qualifications

5.2.1 Key Personnel

5.3 Relationships with Subcontractor Partners

5.4 Relevant Projects

Project 1 (TrustCloud): State of New Mexico, Department of IT GRC Support Project 2 (TrustCloud): GSK Support Project Project 3 (TrustCloud): Schneider Electric Support Project Project 4 (FRC): Department of State HR Modernization

Appendix 1 – Supply Chain Risk Management and Cybersecurity Plan

Appendix 2 – Key Personnel Resumes Darryl Lawton (Contract / Project Manager) Jena Peoples (Technical / Security Lead) Melissa Regan (GRC Director / Solution Architect) Brad Swenson (Enterprise Customer Success Manager / Implementation Lead)

Appendix 3 – Subcontractor Letter of Intent

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

INTRODUCTION

Federal Resources Corporation (FRC) is pleased to submit this response detailing our capability to the State of Wisconsin, Department of Administration (DOA) in support of the Governance, Risk, and Compliance (GRC) Tools Requirement (Reference # 28443-SM).

FRC is a small business, headquartered in Erie, PA with employees throughout the United States. Founded in 1998, FRC has a proven track record as a mission-focused aggregator of cybersecurity and privacy products as well as in delivering solutions tailored for US Federal, State, and Local Government mission environments. FRC employs experts in areas such as networking, cloud computing, cybersecurity, mobile solutions, internet of things, industrial control systems, and managed security services. Not your typical technology reseller, we pride ourselves on building productive working relationships with our customers and technology partners. FRC offers the DOA an aggregation of best-of-breed technologies and services required to deliver a best practice for today’s cloud and networking landscape, as well as anticipating ongoing changes in that landscape to ensure the delivered solution has longevity, scalability, and flexibility.

FRC was recently named to the Inc. 5000 Fastest Growing Private Companies list for the fourth year in a row, boasting an 827% 3-year growth. FRC also holds an ISO 9001:2015 certification, has been appraised at CMMI Maturity Level 3, and has a Top-Secret Facility Clearance.

Beyond the best-in-class technology, FRC brings significant value to this effort. As a small business, FRC is flexible and nimble in its business methodologies. FRC specializes in aggregating technologies to streamline procurement for our customers and has extensive experience in working with customers to scale creatively and efficiently across work sites or business units, utilizing bundled SKUs and optional CLINs to simplify procurement for customers.

FRC has partnered with TrustCloud to present its next-generation Security Assurance Platform to the State of Wisconsin. TrustCloud (https://www.trustcloud.ai/) transforms governance, risk, and compliance (GRC) from a legacy, manual, check-the-box activity into a modern, automated, strategic business enabler. It empowers organizations to unify continuous control assurance, real-time risk quantification, third-party assessments, audit readiness, and customer and regulatory facing trust operations into one seamless, AI-and API-powered platform – delivering resilience and assurance to its customers.

We will refer to FRC and TrustCloud as “Team FRC.”

5.1 ORGANIZATIONAL CAPABILITIES

A. Team FRC Experience

FRC, in partnership with TrustCloud, brings extensive experience supporting Federal, State, and private sector clients in the areas of Governance, Risk, and Compliance (GRC). FRC has provided GRC support to numerous federal agencies, including the Department of Defense (DoD), Defense Information Systems Agency (DISA), Department of State (DOS), and the Centers for Disease Control and Prevention (CDC).

TrustCloud is a leading GRC platform, serving over 1,800 organizations across a wide range of industries worldwide. Its clients include the State of New Mexico and top-tier enterprises such as GlaxoSmithKline (GSK), Waste Management, Schneider Electric, ServiceNow, and NOV. TrustCloud is also used by academic institutions like Southern Methodist University (SMU) to automate manual workflows and provide end-to-end assurance across their GRC programs.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Team FRC can provide complete end-to-end lifecycle for security controls providing Wisconsin State Agencies with an automated, continuous, and scalable control assurance engine.

Team FRC has highly relevant GRC performance within the State of New Mexico, Department of IT (DoIT).

DoIT leverages TrustCloud's GRC platform to assess the security and compliance posture of various agencies across the State of New Mexico, similar to what the State of Wisconsin is proposing. Educational institutions, such as Southern Methodist University (SMU), also use TrustCloud to automate manual workflows and provide end-to-end assurance across their GRC programs.

Additionally, Team FRC has a wide range of performance across the US Public Sector in areas such as cybersecurity, privacy, and IT modernization. In one example with the US Department of State, Bureau of Global Talent Management, FRC supported a department-wide modernization initiative to implement a cloud-based, enterprise Government Technology Modernization (GTM) platform. This solution integrated multiple applications, enabling capabilities such as ticketing, enhanced case management, transparent dashboards, and a centralized hub for policy management and compliance monitoring. Over time, the DOS expanded the scope of work to include the migration of additional tools and platforms into the GTM system, further enhancing its functionality based on DOS priorities.

B. Team FRC Organizational Lines of Authority

Figure 1 presents an organizational chart that outlines how we will support this engagement.

Figure 1: Team FRC Organizational Chart

Our project team will include members from both FRC and TrustCloud. The core team will consist of a Contract/Project Manager, Technical/Security Lead, Solution Architect, and Implementation Lead.

The team will be supported by the FRC Program Management Office (PMO), which provides essential back-office services in HR, security, and accounting.

FRC Senior Leadership provides executive-level support to the project through a combination of strategic guidance and hands-on oversight. In addition to offering strategic guidance, these leaders serve as an escalation path for addressing customer issues that cannot be resolved by the Project Manager. They will remove roadblocks and provide resources.

The Project Manager will oversee day-to-day project activities and serve as the primary communication channel with the customer. However, the Project Manager will not act as a gatekeeper. To promote transparency and efficiency, customers will have direct access to all project team members. The dotted-

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

line reporting structure reflects this open communication approach. Table 1 indicates the roles and responsibilities of each team member.

Table 1: Roles and responsibilities of key personnel.

Role Primary Roles & Responsibilities

FRC Senior Leadership (CEO & VP of Technology)

• Provide project oversight and ensure team has all needed resources for successful implementation.

• Provide escalation route for addressing any customer issues that cannot be resolved by the Project Manager.

FRC Program Management Office (PMO)

• Provides back office support in areas of HR, finance, and security.

Contract/Project Manager (PM)

• Functions as primary point of contact for client and contract oversight.

• Addresses customer issues should they arise.

Technical/Security Lead

• Responsible for security and compliance oversight.

• Provides architecture and design input to define security controls and identify potential security gaps.

Solution Architect • Works with client to understand business needs and meet with stakeholders for collecting key information.

• Responsible for design of the solution architecture.

• Creates needed technical documentation, and guides development and supports deployment.

Implementation Lead

• Develops implementation plan, schedule and resources assignments.

• Leads project work in system configuration, integration and deployment activities.

• Supports any required post-implementation activities.

C. Team FRC Escalation Process

Team FRC utilizes the following proven escalation process to quickly and effectively address project issues, problems, and critical concerns that cannot be easily handled with normal project communication.

1. Identify Issue: Customer notifies the Team FRC PM of a complaint or issue via email, phone, or verbal communication. FRC PM logs the issue and confirms the details with the customer via email.

2. Review Issue: Team FRC PM analyzes the issue to determine scope, resources, and responsible parties. PM coordinates with the project team and/or FRC leadership as needed. PM establishes a resolution timeframe.

3. Communicate Issue Status / Action: Team FRC PM shares the proposed solution, status, and updates with the customer via email. PM coordinates solution development with the project team and monitors progress to ensure timely resolution.

4. Escalate Issue: If unresolved within the agreed timeframe or if the customer is dissatisfied, the Team FRC PM escalates to senior leadership.

5. Issue Resolution: Once resolved, the solution and actions taken are documented. Team FRC PM provides closure and confirmation to the customer via email.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

5.1.1 CYBER SECURITY POLICY

Team FRC follows a best-practice approach to risk management, with a strong emphasis on supply chain security and cybersecurity. Our framework is based on ISO 20243:2018, the ISO 27000 series, and the ISO 28000 series, and covers the full lifecycle of risk identification, assessment, and treatment. While ISO standards serve as the foundation of our program, we adapt their principles to fit our operating environment, ensuring comprehensive coverage across security, crisis management, business continuity, and recovery. This approach enables us to avoid, minimize, or mitigate risks that could impact our cyber operations, supply chain, or customers.

FRC’s program incorporates standards and practices across physical security, access controls, personnel security, protection of PII, employee education and training, procedural safeguards, IT security, business-partner security, and secure conveyance from origin to destination within the supply chain. The goal of our cybersecurity policy is to provide clear, documented, and effective processes for protecting both FRC’s and our clients’ systems and information. A full copy of our Supply Chain Risk Management and Cybersecurity Plan is available as Appendix 1 to this section.

Our partner, TrustCloud, maintains a transparent security posture, publicly available at https://trust.trustcloud.ai/. TrustCloud also operates a robust internal security and compliance program, self-attesting to NIST CSF, NIST AI RMF, NIST 800-53, ISO 42001, GDPR, and CCPA.

5.1.2 SOC 2 TYPE 2 & FEDRAMP

TrustCloud has successfully completed audits for several compliance certifications and attestations, including SOC 2 Type 2 (covering all Trust Services Criteria), ISO 27001, and ISO 27002. While TrustCloud can operate on AWS GovCloud, it has not yet obtained FedRAMP authorization. The company is currently preparing to pursue FedRAMP 20x certification.

5.2 STAFF QUALIFICATIONS

Team FRC has been supporting federal and state clients since 1998, with a proven track record in governance, risk, and compliance (GRC) engagements. We have built a team with extensive experience in serving government clients and implementing GRC solutions. Descriptions of key personnel are provided in Section 5.2.1. All proposed personnel are fully capable of passing background checks. Team FRC also acknowledges that the State of Wisconsin reserves the right to request the removal and replacement of personnel for poor performance during the life of the contract.

5.2.1 KEY PERSONNEL

This section contains the FRC Team members being proposed for this engagement. Below we provide an overview of each team member. A full resume for each team member is provided in Appendix 2.

Darryl Lawton (FRC) – Contract / Project Manager

Mr. Lawton has over 20 years in program and project management supporting Federal, State, and Tribal clients. He will function as the main POC and conduct project oversight. Key examples of his successes include:

• Management of a 12-member IT support team within the Defense Health Agency (DHA) enterprise on a multi-million dollar FRC contract.

https://trust.trustcloud.ai/?utm_source=chatgpt.com

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

• Provision of operational and contract management on a multi-million dollar Naval Reactor HQ contract, where the team developed reports and integrated financial data for improved understanding of submarine development.

Jena Peoples (FRC) – Technical and Security Lead

Ms. Peoples is an experienced Senior Security Engineer with over 20 years of expertise in architecting, deploying, and managing resilient cybersecurity solutions. She is highly skilled in Splunk Enterprise architecture, multi-cloud environments (AWS, GCP, Azure), and infrastructure automation using Terraform. She is adept at integrating generative AI tools into security workflows. Key examples of her successes include:

• Optimization of a large-scale system handling up to 26 TB/day of data ingestion and delivering NIST-compliant, secure infrastructure solutions.

• Served as the primary Splunk Architect focused on building reliable and scalable infrastructure, developing repeatable playbooks for Splunk Cloud troubleshooting, including dispatch cleanup, DMA tuning, lookup hygiene, and correlation search TTL management.

Ms. Peoples holds the following certifications:

• AWS Certified Cloud Practitioner

• Certified Information Systems Security Cissp

• Splunk Enterprise Certified Architect II

Melissa Regan (TrustCloud) – GRC Director / Solution Architect

Ms. Regan is an information security and compliance professional who understands the pain points and complexities of implementing information security frameworks and performing assessments for growing organizations. She has functioned as both an auditor and an internal GRC professional and understands how to support ongoing and continuous compliance. She currently functions as the GRC Director responsible for onboarding TrustCloud customers to the platform and serves as a compliance subject-matter expert.

Brad Swenson (TrustCloud) – Enterprise Customer Success Manager / Implementation Lead

Mr. Swenson is an experienced customer success manager with success functioning as a customer advocate. He has recently supported GRC projects with the State of New Mexico, GlaxoSmithKline, and Schneider Electric. Mr. Swenson is ITIL certified and holds a Linux LF3171X Blockchain for Business Certificate.

5.3 RELATIONSHIPS WITH SUBCONTRACTOR PARTNERS

FRC will partner with TrustCloud as a subcontractor to deliver the State of Wisconsin’s Enterprise GRC solution. This partnership combines FRC’s decades of government project management experience with TrustCloud’s proven expertise in implementing and supporting GRC platforms. TrustCloud has successfully supported the State of New Mexico Department of IT on a project of similar size, scope, and complexity— demonstrating their ability to meet Wisconsin’s needs with confidence. As TrustCloud’s public distributor, FRC brings over 20 years of experience leading projects and delivering solutions across federal and state government sectors. Together, Team FRC and TrustCloud provide a trusted, experienced, and highly capable partnership for Wisconsin. The subcontractor organizational chart is shown in Figure 2.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Figure 2: TrustCloud Organizational Chart.

Over a projected 10–12 week period, TrustCloud will follow an eight-phase approach (detailed in Section

6.1.1 of the Technical Requirements volume) to help establish the State of Wisconsin Enterprise GRC solution. This effort will include all necessary services to deliver a platform for designing, managing, and monitoring custom compliance frameworks. The three primary service areas provided by TrustCloud include:

1. Automation Engine: Supporting evidence collection and continuous assessment.

2. Workflow Automation: Streamlining GRC processes such as risk assessments, control attestations, policy exceptions, and Plans of Action & Milestones (POA&M).

3. Custom Framework and Policy Support: Assisting with development and implementation of tailored compliance frameworks.

TrustCloud has provided a letter indicating their commitment to provide the attached services, which can be found in Appendix 3. Subcontractor references are provided in form DOA-3832, and a list of relevant projects demonstrating TrustCloud and FRC’s corporate experience is included in Section 5.4.

5.3 RELEVANT PROJECTS

This section details relevant projects, three from subcontractor TrustCloud and one from FRC.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

PROJECT 1 (TRUSTCLOUD): STATE OF NEW MEXICO, DEPARTMENT OF IT GRC SUPPORT

Contract Number TC-20245-420412

Customer State of New Mexico, Department of IT

Type of Contract Firm Fixed Price Software as a Service Subscription and Managed Services

Total Cost Unable to provide due to customer NDA

Period of Performance 08/08/2024 – 08/08/2025

Organizational Structure of Contract Delivery

State of New Mexico, Department of IT

• CISO/CIO (Executive Sponsor)

• Deputy General Council

• Program Manager

TrustCloud

• CEO (Executive Sponsor)

• Customer Success Manager

• Solution Architect

• Implementation Lead

Key Assigned In-House Staff

Customer Success Manager – Brad Swenson

Solution Architect – Jikku Venkat

Implementation Lead – Richa Tiwari

Subcontractors Used None

Schedule History Project length was 1 year and the project timeline was met successfully.

Continuing Services TrustCloud continues to assess security and compliance posture of various agencies in the State of New Mexico.

SDLC Methodology Used

Agile. It allowed the team to discover new scope and shape the project to meet new requirements.

User Acceptance User acceptance was based on completing assessments successfully, which was accomplished.

Ensuring Business User Needs Were Met

The key business need was to have accurate security and compliance posture reporting. This was delivered and success ensured through the completion of assessments.

Process Used to Deliver Code and Applications

Agile, incremental delivery. Note this is a configuration / implementation of the TrustCloud platform.

Documentation Delivered for User Acceptance Testing

Completed assessments

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

PROJECT 2 (TRUSTCLOUD): GSK SUPPORT PROJECT

Contract Number TC-2024-403564

Customer GlaxoSmithKline (GSK)

Type of Contract Firm Fixed Price Software as a Service Subscription and Managed Services

Total Cost Unable to provide due to customer NDA

Period of Performance 01/30/2024 – 07/05/2028

Organizational Structure of Contract Delivery

GSK

• CISO (Executive Sponsor)

• VP of Cyber Risk and Assurance

• Program Manager

TrustCloud

• CEO (Executive Sponsor)

• Customer Success Manager

• Solution Architect

• Implementation Lead

Key Assigned In-House Staff

Customer Success Manager – Brad Swenson

Solution Architect – Ivan Stoyanov

Implementation Lead – Tejas Ranade

Subcontractors Used None

Schedule History Project was 5 years in length with 1-year deliverables. Project continues to be delivered successfully and on-time.

Continuing Services Continue to assess security and compliance posture of digital crown jewel applications in the GSK IT landscape.

SDLC Methodology Used

Agile. It allowed the team to discover new scope and shape the project to meet new requirements.

User Acceptance User acceptance was based on completing assessments successfully, which was accomplished.

Ensuring Business User Needs Were Met

The key business need was to have accurate security and compliance posture reporting. This was delivered and success ensured through the completion of assessments.

Process Used to Deliver Code and Applications

Agile, incremental delivery. Note this is a configuration / implementation of the TrustCloud platform.

Documentation Delivered for User Acceptance Testing

Completed assessments of digital crown jewel applications.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

PROJECT 3 (TRUSTCLOUD): SCHNEIDER ELECTRIC SUPPORT PROJECT

Contract Number TC-2024-452686

Customer Schneider Electric

Type of Contract Firm Fixed Price Software as a Service Subscription and Managed Services

Total Cost Unable to provide due to customer NDA

Period of Performance 04/30/2025 – 04/30/2030

Organizational Structure of Contract Delivery

Schneider Electric

• CISO (Executive Sponsor)

• VP of Engineering

• Program Manager

TrustCloud

• CEO (Executive Sponsor)

• Customer Success Manager

• Solution Architect

• Implementation Lead

Key Assigned In-House Staff

Customer Success Manager – Brad Swenson

Solution Architect – Tejas Ranade

Implementation Lead – Abigail Morrison

Subcontractors Used None

Schedule History Project was 5 years in length with 1-year deliverables. Project continues to be delivered successfully and on-time.

Continuing Services Continuous control monitoring, and automation of the company’s various compliance frameworks for audit readiness, policy governance, and risk management program, Custom Assurance Portal, and AI to complete security questionnaires

SDLC Methodology Used

Agile. It allowed the team to discover new scope and shape the project to meet new requirements.

User Acceptance User acceptance was based on completing assessments successfully, which was accomplished.

Ensuring Business User Needs Were Met

The key business need was to have accurate security and compliance posture reporting. This was delivered and success ensured through the completion of assessments.

Process Used to Deliver Code and Applications

Agile, incremental delivery. Note this is a configuration / implementation of the TrustCloud platform.

Documentation Delivered for User Acceptance Testing

Completed compliance program, customer trust portal, continuous control monitoring functionality with example test reports

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

PROJECT 4 (FRC): DEPARTMENT OF STATE HR MODERNIZATION

Contract Number 19AQMM20F25126

Customer US Department of State

Type of Contract Firm Fixed Price, Competitive Best Value

Total Cost $40,699,437

Period of Performance 07/20/2020 – 06/19/2025

Organizational Structure of Contract Delivery

Department of State

• Bureau of Human Resources

• Bureau of Global Talent Management

• Bureau of Diplomatic Technology

FRC

• CEO – Jeremy Young

• VP of Sales – Julie Trainor

• Global Director of Program Management – Dan Williams

• FRC Delivery Team

Key Assigned In-House Staff

Program Manager - Peggy Brennan

User Experience Researcher - Justin Hardin

Chief Architect - Michael Zecarias

Business Analyst - Anna Chernikova

User Experience Researcher (PT) - Sloan Echo

Leadership - Devon Halley

User Researcher (PT) - Jacqueline Sun

Subcontractors Used ServiceNow

Schedule History Contract encountered no major technical problems or delays. There were no deviations or waivers to technical requirements that were necessitated. The only challenges encountered were minor risks to the program schedule, such as a delay in 3rd party deliverables necessary for FRC to continue work. These were all mitigated by FRC program managers to ensure there were no slippages in the overarching timeline of deliverables to the customer.

Continuing Services The ServiceNow platform is regularly upgraded every six months to incorporate new features, applications, and functionality. FRC manages all aspects of these upgrades, including fielding requests from around the DOS, planning and designing, delivery, and ticket management.

SDLC Methodology Used

Agile -based delivery system executing on 2-week sprints, FRC built dashboards tailored for the HR Specialist, HR, Program Management, other personas within the GTM. This contract extensively involved implementing a tailored configuration of the ServiceNow HR Service Delivery platform, a SaaS solution, including dashboards and workflows. FRC developed and deployed

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

additional SaaS applications for career pathing, succession planning, and performance management within the ServiceNow environment.

User Acceptance Internal testing was conducted with stakeholders before the solution is fully deployed and change management activities, including communications and training are conducted. Then this iterative process restarts utilizing feedback from user stakeholders.

Ensuring Business User Needs Were Met

FRC worked in an iterative manner, performing discovery, documenting process maps, developing personas and journey maps, and establishing baseline metrics before conducting process redesign sessions and future state process maps alongside metrics for success. Development entailed defining roles and security requirements and defining a minimum viable product design and prioritizing user stories. Internal testing was conducted with stakeholders before the solution is fully deployed and change management activities, including communications and training are conducted. Then this iterative process restarts utilizing feedback from user stakeholders.

Process Used to Deliver Code and Applications

Agile, iterative delivery. Note this is a configuration of the ServiceNow SaaS platform.

Documentation Delivered for User Acceptance Testing

FRC has consistently demonstrated superior performance on this contract, with on-time deliverables and a strong focus on communications, training, and product support during and following each release. FRC produced over 17 communications products, including emails, roadshows, podcasts, surveys, and more to inform DOS/GTM employees of changes in their processes. The ServiceNow platform is regularly upgraded every six months to incorporate new features, applications, and functionality. FRC manages all aspects of these upgrades, including fielding requests from around the DOS, planning and designing, delivery, and ticket management.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

APPENDIX 1 – SUPPLY CHAIN RISK MANAGEMENT AND CYBERSECURITY PLAN

1. INTRODUCTION

Federal Resources Corporation (FRC) is a small business headquartered in Erie, Pennsylvania with employees throughout the United States. Founded in 1998, FRC has a proven track record as a mission-focused aggregator and reseller of cybersecurity and privacy products as well as in delivering solutions tailored for US Federal Government mission environments. FRC employs experts in areas such as cybersecurity, privacy, public and hybrid cloud solutions, accreditation and authorization (A&A), mobile solutions, internet of things, industrial control systems, and managed security services. With a new management team formed in 2020 focused on US Federal cybersecurity and privacy, FRC rapidly grew into #235 on the Inc. 5000 fastest growing private companies in the United States.

We value our broad industry partnerships and through them, we can offer a highly skilled set of products, services, and personnel available to ensure that our customers’ IT environments are optimized and ready for today’s cybersecurity demands and scalable to meet future requirements. We excel in identifying, aggregating, and scaling solutions which allow our customers to successfully and strategically meet and exceed mission objectives, whether related to people, processes, or technologies.

FRC is an ISO-certified firm under the 9001:2015 standard. Through our 20+ years of experience managing enterprise technology contracts in mission-critical environments, we have developed and honed our Supply Chain Risk Management (SCRM) process to meet the everchanging and rigorous demands and challenges of our customers.

2. OVERALL APPROACH

In this document, we provide the FRC approach to risk management. Our process, based on the ISO 20243:2018, ISO 27000 series, and ISO 28000 series standards, covers elements of risk identification, risk assessment, and risk treatment. ISO standards are a key building block to our approach. Though the ISO standards are key building blocks of our approach, we recognize the need to adapt their philosophies to our own environment in order to strive for practices that best cover security, crisis management, continuity, and recovery so as to avoid, minimize, or mediate all types of risk that threaten our supply chain and potentially impact our end customer. FRC’s approach includes basic standards for physical security, access controls, personnel security, education and training, procedural security, information-technology (IT) security, business- partner security, and conveyance security from the point of origin to destination within our supply chain. The goal of this document is to provide insight into FRC’s documented and effective processes for protecting and securing our supply chain.

FRC uses a SCRM process that begins with procurement source selection strategy and supplier qualification and ends with proper disposition of equipment and completion of services provided to the Government. Our SCRM process flows down to our partners and subcontractors. The National Institute of Science and Technology (NIST) Special Publication (SP) 800-161, Supply Chain Risk Management Practices for Federal Information Systems and Organizations, issued April 2015, details a comprehensive approach to manage supply chain risks for agencies. FRC has developed a Supply Chain Risk Management Plan (SCRMP), based on the FRC’s information security policy that describes the necessary steps to protect the supply chain in accordance with the NIST SP 800-53 Rev 4, Security and Privacy Controls for Federal Information Systems and Organizations, issued April 2013, and its supplemental guidance.

Additionally, FRC makes strong efforts to work with suppliers who are approved, certified, and have the appropriate quality control measures to prevent counterfeit items from being introduced into the supply chain. FRC’s process includes:

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

• Industry- and Government-Approved shipping methods

• Tamper-resistant packaging used for shipping

• Electronic bar coding for tracking

• Secure storage (with limited access)

• Equipment only handled by authorized personnel

• Replacement equipment purchased from approved suppliers

Figure A-1 illustrates FRC’s SCRM process framework that summarizes our guidance to ensure that our entire organization follows the guidance found in the NIST requirements. Having acute awareness of today’s external threats to IT environments, FRC is committed to providing a secure IT infrastructure free of vulnerabilities that could negatively impact our supply chain or our Government end-clients.

For each of the SCRM Process Framework areas, FRC process owners and their teams continuously apply SCRM Risk Assessment best practices by monitoring and reviewing each supply chain component (both inputs and outputs); applying risk assessment; identifying threats and risks to both internal and external environments (e.g. our Original Equipment Manufacturer [OEM] suppliers’); and by communicating and consulting with our suppliers, our employees, and our Government customers. This is illustrated in Figure A-2.

Implementing SCRM Security Requirements

To ensure that integrity and availability controls are in place, FRC monitors and distributes information on all known malicious risks (e.g., unintentional supplier actions that allow potential unwanted functionality).

The FRC supply chain management group will audit the supply chain risk management processes and ensure they are all in-line with current NIST and contract-specific requirements. FRC will apply security controls for the life of all contracts and will tailor those controls to the specific contract as required.

Figure A-1: FRC SCRM Process Framework Figure A-2: Our team applies SCRM Risk Assessment best practices to each area of our Process Framework.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

2.1 PRODUCT INTEGRITY

FRC uses a defined process to ensure that OEM equipment resellers only provide new, non- counterfeit, and unmodified hardware from authorized sources. FRC takes the necessary precautions to ensure against “gray market” or counterfeit hardware or software from entering our supply chain. We ensure that all firmware and software is purchased only from Government- and FRC-approved sources that are subject to our rigorous procurement processes. We include in our contractual terms and conditions with suppliers that equipment must be new. OEM and supplier certifications are maintained by FRC procurement on file.

Using our internal systems, we will track purchased equipment, including spare parts, as follows:

Shipping— Warehouse and shipping functions are provided by Channel partner arrangements for the supply chain. Suppliers will provide the OEM tracking numbers and electronic notice of shipment to FRC and include this information in the packing list.

Site installation—The FRC installation technician will inspect the shipped package and hardware for signs of tampering and either scan for existing barcodes to validate a match with items shipped from FRC Channel partner(s).

• Shipped directly from the supplier: The installation technician will annotate the packing list and return the signed and dated purchase order with the barcode or serial number to FRC property management.

• Integrity check: Once the hardware is installed, the installation technician will run a full test profile, and prior to activation FRC personnel will conduct operational integrity testing.

Preventive maintenance—Preventive maintenance records will be tracked through FRC’s Channel partners who provide asset dispositions and warranty info.

• The technician performing maintenance (or other sustainment activities) has limited access to the equipment and FRC secure websites containing equipment configuration data. The technician must have pre-coordinated authorization to access the facility and then must log into the equipment using proper login information. Once the work is complete, the technician will close the work order. FRC maintains a history of all maintenance transactions.

Emergency maintenance—For non-preventive maintenance calls, a trouble ticket will be generated and an FRC technician will be dispatched to the site to troubleshoot the problem. If defective equipment is found, the technician will request a replacement to be dispatched from our supplier to the site. The defective part will be replaced and returned to the supplier. To verify integrity, prior to activation of a replacement, components, or software, FRC will run a full security scan and validation test on all replacement components.

Integrity Check—Prior to activation of a replacement, components, or software, FRC technicians will run a full security scan and validation test on all replacement components.

De-installation and disposal—When directed, FRC personnel will clean the equipment, and our technician will de-install and remove appropriately, according to contract requirements. The program office will inform property management if the equipment is no longer of use. The property management team will coordinate with the PMO and then prepare an equipment inventory for disposition as directed by the Government. Prior to disposal, FRC will verify that equipment is fully sanitized, and that all security-sensitive components and software are removed. Once an item is sent off for disposal, we retire those assets and maintain a historical file.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

2.2 SUPPLIER RELATIONSHIPS

FRC will apply our procurement system for purchase of federal hardware and software for all contracts and task orders. FRC has well-established relationships with the primary OEMs we use for Government and commercial programs. FRC will not establish relationships with unknown or unidentified sources.

3. NIST BASED SUPPLY CHAIN CONTROL AREAS OF RESPONSIBILITY

The following sections detail FRC’s policies aligned with the following NIST-Based Supply Chain Control Areas of Responsibility.

3.1 AT-1: SECURITY AWARENESS AND TRAINING POLICIES AND PROCEDURES

FRC has developed, organized, and implemented a Security Awareness Program (SAP) and provides its employees security training that is compliant with NIST standards and is also in-line with today’s industry standards and best practices. This training includes modules in situational awareness and understanding of the supply chain security program, recognizing insider threats, maintaining supply chain integrity, and determining and addressing unauthorized access. Throughout, it encourages active employee participation in security controls.

FRC ensures that key personnel receive regular training no less than once per year on security procedures and requirements. FRC provides this on-going security education and awareness training program to all employees, new hires, consultants, and contractors. Awareness training is tailored to specific departments/job functions within FRC as well as to NIST-based security controls outlined and described in the most current versions of CNSSI 1253, Appendix D and E; NIST SP 800-53; NIST SP 800-161; NIST SP

800-171; NIST SP NIST SP 800-12; NIST SP 800-16; NIST SP 800-50; NIST SP

800-100; and related industry standards. Training modules include:

• ICT Supply Chain Risk Management

• Anti-Counterfeit

• Insider Threat

• IT Security Controls and Procedures

• Security procedures and duties applicable to the employee’s job

• Operational Security (OPSEC)

• Cyber Threats

• CI Awareness

• Supplemental ICT SCRM: Security Training – Physical Security Controls

FRC Sales and Operations personnel are made aware of and trained on the use of the FRC Supplier Status Matrix. This tool is used to communicate throughout the organization information about FRC’s suppliers including their product offerings; their points of contact; and the appropriateness of purchasing from them, as determined by FRC. Significant changes to the Supplier Status Matrix, such as a change to a supplier’s status that would prevent the use of it as a source for product to resale, are announced to relevant personnel. FRC provides additional security awareness through a security newsletter that is transmitted quarterly to all employees. Management reviews our training programs on an ongoing basis and updates security policies and procedures as necessary, but not less than annually. FRC will provide evidence of compliance or successful documented operational implementation of our training and policies upon request.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Finally, although the external aspects of the SCRM Plan cannot feasibly be 100% guaranteed or controlled by FRC, we request our OEM suppliers maintain their SCRM plans and tight controls over their supply chains via the same NIST standards and industry best practice on which we base our own.

3.2 CM-1: CONFIGURATION MANAGEMENT PROCEDURES

FRC has developed and maintains an effective implementation of information security and privacy controls and control enhancements in the Configuration Management family of controls that:

1. Ensure configuration management procedures are consistent with applicable federal laws, executive orders, mandates, directives, regulations, and policies, standards, and guidance;

2. Ensure scheduled changes to networks or systems are authorized prior to implementation and are not permitted outside of the configuration management process;

3. Monitor system configurations and changes to ensure configuration management processes and procedures are followed;

4. Evaluate the configuration management process periodically as part of the required 2GIT reporting process to verify adequacy and effectiveness; and

5. Ensure a proper adherence to a Risk Management Framework (RMF) to insure near real-time risk management via robust continuous monitoring of systems with automated technology.

3.3 CM-3: CONFIGURATION MANAGEMENT – CHANGE CONTROL

FRC has developed and maintains an effective implementation of a set of Change Controls in the form of a Configuration Management Plan (CMP) in the Configuration Management family that:

1. Avoids configuration errors by analyzing configuration changes before they are applied;

2. Checks configurations against corporate polices and external standards like PCI, HIPAA, and ITIL;

3. Reduces room for manual errors by standardizing and consolidating management of multi- vendor devices. This helps simplify deployment of standard configurations on multiple devices;

4. Follows a change approval process and implements user roles to restrict access to making configuration changes;

5. Establishes and maintains baselines for devices in the network—critical devices most importantly;

and

6. Knows what devices are running in a network and removes unused devices.

Additionally, within the FRC CMP, we have established Configuration Control Board (CCB) comprised of senior leadership and stakeholders from each FRC organizational department to apply security- focused configuration management practices to information systems. FRC CCB activities include development of a methodology for configuration item identification, establishment of the baseline configuration, development of a configuration change control process, and development of a process for configuration monitoring and reporting.

The FRC CCB activities, based on industry-established best practices, are organized into four major phases

– Planning, Identifying and Implementing Configurations, Monitoring, and Controlling Configuration Changes. It is through these phases that FRC not only supports security for an information system and its components, but also supports the management of organizational risk. The four phases are illustrated below in Figure A-3.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

Figure A-3: Four phases of the FRC Configuration Management Process.

3.4 CM-5: CONFIGURATION MANAGEMENT – ACCESS RESTRICTION

FRC offers the Government an effective SCRM Plan by ensuring that we have implemented appropriate measures to secure the Supply Chain and all its components fully. FRC understands that supply chain security is essential from two perspectives. First, it needs to prevent unauthorized intrusion into shipments that could enable insertion of contraband (e.g., drugs, weapons, explosives, human trafficking, counterfeit or gray market goods, etc.), loss of intellectual property or technology contained in the shipments, and tampering (e.g., insertion of "Trojan horses", malware, malicious code, etc. in computers).

Second, an effective SCRM Plan needs to prevent loss from theft or damage.

Our supply chain security and protection include basic standards for physical security, access controls, personnel security, education and training, procedural security, IT security, business- partner security, and conveyance security from the point of origin to the destination within the Government’s supply chain.

FRC mandates the following physical security controls:

• Access to the FRC Headquarters Office in Erie, PA is controlled by a key fob. Our Security Office (Security) controls and issues key fobs to employees that work at HQ. It also issues them to personnel that work remotely but need to work at the HQ location periodically. There are two entry/exit points to the suite. Employees can only use their issued key fob at the main door. The second door is an emergency exit only.

• Security collects all key fobs from terminating employees on their last day of employment as required by the company’s termination process.

• Employees with key fob access are required to report to Security immediately when a key fob is lost or stolen. Security will remove the key fob from the access system.

• The HQ office suite is alarmed. Based on the employee’s job function along with management approval, Security assigns them an individual and unique alarm code to activate and deactivate the alarm system. Security regularly audits and maintains the list of employees with access codes.

Security immediately removes an employee code the access system upon that person’s employment termination.

• An off-site alarm monitoring company monitors the suite alarm. The monitoring company has an authorized list of emergency contacts with contact information should the alarm to the suite be inadvertently activated.

Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

• The company has cameras monitoring all entry/exit points to the suite as well as one monitoring access to the server room door. All video is recorded with a capacity of 2 (two) weeks of storage.

It overrides the oldest data as needed.

• The server room door is secured with a combination door lock. IT and Security maintains a list of those employees with server room access. The combination to the door lock is changed semi-annually, at a minimum, and immediately upon the termination of an employee with server room access.

• All visitors are met at the door by an FRC employee. Visitors are required to sign in on a visitor log and are escorted to their destination. The visitor must then sign out before leaving the premises.

3.5 CM-8: CONFIGURATION MANAGEMENT – COMPONENT INVENTORY

After FRC Channel partners and resellers ship hardware and software to a site for installation, FRC technicians will conduct a high-level validation and verification of all equipment and components received. The process used by FRC to ensure equipment has not been tampered with during transit includes:

1. Receiving

• Visual (noninvasive) inspection

• Random component testing (as required on a program-specific basis)

• Documented and audited storage practices

• Strict control over inventory by authorized personnel

• Separate parts/storage areas for different customers in secure areas

• No commingling of parts from different suppliers unless parts are sealed and easily identified

• General inventory auditing

2. Inventory Procedures for Returns and Excess Hardware and Components

• Supplier sent damaged, poor quality, or wrong part: The supplier provides FRC with a return material authorization (RMA) and equipment is returned

• Failed or defective network equipment: The FRC RMA coordinator will contact the supplier to open an RMA and:

• Determination of warranty status

• The supplier will send a like for like replacement and the replacement shipment will contain the return label for shipping the defective asset back to supplier.

Once the replacement arrives, it will undergo the same receipt procedures as new equipment. The RMA coordinator will ship the defective unit back to supplier.

• If warranty is fix and repair, the defective item will be returned to the supplier to repair or replace.

• Working equipment no longer needed in the field but is still of use to the program will be returned and placed in spare stock for that program.

3. Excess Equipment

• Property management will send an inventory report to the Government’s property administrator requesting disposition instructions

• When instructed,…