FISMA_2019.pdf

DEPARTMENT OF JUSTICE

FEDERAL PRISON INDUSTRIES

Office of the Chief Information Officer

FISMA and FISCAM Continuous Monitoring and Assessment of

Cyber Security Controls

Continuous Monitoring and Assessment 2

Table of Contents

Background ………………………………………………………………………..3

Office of the CIO (Chief information Officer) ISO (Information Security Officer)…….………………………………………………………………………..4

Statement of Work

(SOW)……………………….………………………………………………………5

Use of CSAM Tool………………………………………………………………………………….9

Technical Proposal Instructions……………………………………………..…………………………10

Notice of Small Business Set-side.…………………………………………….11

Evaluation Factors for Award……………………….………………………………………….………….12

Period of Performance and Place of Performance ………………………

Continuous Monitoring and Assessment 3

BACKGROUND

The Federal Information Security Management Act of 2002 (FISMA) was passed by Congress and signed into law by the President in

2002.3 3 44 U.S.C. § 3541, ET. seq. (2002) FISMA requires the head of each agency to implement policies and procedures to cost-effectively reduce risks to an acceptable level. The act assigns specific responsibilities to federal agencies, the National Institute of Standards and Technology (NIST), and the Office of Management and Budget (0MB) in order to strengthen federal information system security.

FISMA also requires federal agencies to enforce agency-wide risk-based information security programs that include: (1) periodic assessments of risk and magnitude, (2) information security throughout the lifecycle of each information system, (3) security awareness training,

(4) Remedial actions, (5) reporting and responding to security incidents;

and (6) continuity of operations for the information systems. To ensure the appropriateness and effectiveness of information security controls, FISMA requires agency program officials, Chief Information Officers (CIO), and Inspectors General to conduct annual reviews of the agencies' information security programs and reports the results to 0MB.

0MB uses this data to assist in its oversight responsibilities and to prepare its annual report to Congress on agencies' compliance with

FISMA.

Office of CIO (Chief Information Officer and ISO (Information Security Officer)

The office of CIO and ISO provide guidelines for applying the Risk Management Framework to information systems to include conducting the activities of security categorization, security control selection and implementation, security control assessment, information system authorization, and security control monitoring.

Continuous Monitoring and Assessment 4

The guidelines have been developed:

1) To ensure that managing information system-related security risks is consistent with the Organization's mission/business objectives and overall risk strategy established by the senior Leadership through the risk executive (function);

2) To ensure that information security requirements, including necessary security controls, are integrated into the organization's enterprise architecture and system development life cycle Processes.

3) Issuing IT Security policies, standards, and guidelines to address

IT Security planning, management, and implementation

4) Developing and maintaining the Department IT Security Program

Management Plan (PMP) in accordance with Federal laws and regulations; Developing, implementing and managing a Department wide Plan of Action and Milestone (POA&M) process to correct IT Security weaknesses.

Continuous Monitoring and Assessment 5

Statement of Work

PLEASE READ THIS STATEMENT OF WORK CAREFULLY

Assessment of NIST's SP800-53 Rev IV Controls:

Contractors shall assist UNICOR with assessment of NIST' SP800-53 Rev IV Controls for Moderate Systems. This solicitation is for five systems:

a) UNICOR General Support System - subject to OMB-A123 Controls

b) SAP – SAP HANA 4 Financial Application - subject to OMB-A123 Controls

c) Federal Prisons Industries Web Services (AWS) will consist of General support system devices

d) UNICOR Services Business Group – Consisting of various business systems

e) Vehicle Management Information System (VMIS) Contractor Managed System

Contractor shall perform assessment of Management, Operational and Technical security controls prescribed for an information system to protect the confidentiality, integrity and availability of the system.

Continuous Monitoring:

Contractor shall assist with a strategy and implementation of a program for the continuous monitoring of security control effectiveness including the potential need to change or supplement the control set, taking into account any proposed/actual changes to the information system or its environment of operation.

1. Security impact analyses on proposed or actual changes to organizational information Systems and environments of operation;

Continuous Monitoring and Assessment 6

2. Assessment of selected security controls (including system-specific, hybrid, and common controls) based on the organization-defined continuous monitoring strategy; Security status reporting to appropriate organizational officials;

3. Active involvement with authorizing officials in the ongoing management of information System-related security risks;

4. Assessment of Security controls in compliance with FISMA SP800-53, department directives, 0MB Guidance and DOJ ITSS Security Standards.

5. Assistance with steps needed in Risk Management Framework (RMF) described in NIST Special Publication 800-37. Revision 1, Applying the Risk Management Framework to Federal Information Systems;

6. Assistance with near real-time risk management and ongoing information system authorization through the implementation of robust continuous monitoring processes;

7. Documentation and artifacts gathering in support of FISMA SP800-53 Controls Assessments;

8. Continuous monitoring and Assessment of Security controls in place, compliance with FISMA SP800-53 Controls;

9. Assistance with documentation of proposed or actual changes to an information System or its environment of operation and subsequently assessment of potential impact of those changes;

10. The Contractor shall provide personnel capable of providing technical writing as may be required by the CIO, deputy CIO and Office of ISO. Products include draft security SOP's, and procedures, security training manuals, position papers, draft security slide presentations to be made to various employee levels including FPl's senior management;

11. Continuous monitoring results are considered with respect to any necessary updates to the security plan, security assessment report, and plan of action and milestones;

Continuous Monitoring and Assessment 7

12. Assistance with yearly assessment of department GSS {General Support System), SAP (1 General Support System and 1 applications - Department's SAP application requires testing of 0MB A-123 controls in addition to NIST SP800-53).

13. FISCAM - 0MB A-123 Controls (Applicable to Financial Systems Only)

14. Top-down, risk based approach that considers materiality and significance in determining effective and efficient audit procedures and is tailored to achieve the audit objectives.

15. Evaluation of entity wide controls and their effect on audit risk.

16. Evaluation of general controls and their pervasive impact on business process application controls.

17. Evaluation of security management at all levels (entity wide, system, and business process application levels).

18. A control hierarchy (control categories, critical elements, and control activities) to assist in evaluating the significance of identified IS control weaknesses.

19. Groupings of control categories consistent with the nature of the risk.

20. Assessment of Information System Controls significant to Financial Reporting confirm that identified weaknesses and deficiencies in the information system have been addressed;

Support continuous monitoring activities and information security situational awareness;

The Agency (FPI) has the option to require the current contracted employee’s be retained by the Vendor selected.

Use of Cyber Security Assessn1ent and Management (CSAM)

DOJ and DOJ's component departments use CSAM, a web based tool which provides automation in support of FISMA and other mandated requirements. CSAM serves as the formal system of record for DOJ's inventory of information systems. Documentation required for Information System security management and compliance reporting are collected, developed, maintained and reported out of CSAM. CSAM supports the development and maintenance of Risk Assessments, Security Requirements Traceability Matrix, System Security Plans (SSP), Security Test and Evaluation (ST&E) test cases, and testing results for each. Contractors shall use CSAM during the course of this project, and all POA&M's, testing of NIST's and 0MB controls, and artifacts will be submitted and stored in CSAM.

TECHNICAL PROPOSAL INSTRUCTIONS

The offered shall include in its proposal a discussion of the offer's proposed technical approach to respond to the requirements in the Statement of Work. The offered must propose to provide all the requirements specified in the Statement of Work. The discussion is expected not to exceed twenty (25} pages. The page limit excludes the proposed resumes.

In its proposed technical approach, the offered shall summarize its corporate experience (including results) with professional management and administrative support contracts similar to this solicitation that the offered has successfully performed in the past three years. The information presented shall be in sufficient detail to describe the previous experience and effectiveness of the offered in similar or closely related work, and to demonstrate the offer's current ability to accomplish the tasking in this solicitation.

Continuous Monitoring and Assessment 9

Resumes: The offered shall include in its response to the statement of work a resume for each proposed personnel for the project. Individual resumes shall be no more than three pages in length.

Security Clearance: All submitted personnel shall be US citizen and clearable for NACI, OPM background and Urinalysis drug testing.

Telework will be on a case by case.

UNICOR will provide the equipment.

Face to Face interview maybe required

Experience will be accept

Current Vendor: Questech Systems, LLC

NOTICE OF SMALL BUSINESS SET-ASIDE

Offers are solicited only from small business concerns and have prior experience in FISMA and 0MB A-123 assessment.

The procurement is to be awarded only to one or more such concerns, organizations, or individuals. This action is based on a determination by the Contracting Officer, alone or in conjunction with a representative of the Small Business Administration, that it is in the interest of maintaining or mobilizing the Nation's full productive capacity, or in the interest of war or national defense programs, or in the interest of assuring that a fair proportion of Government procurement is placed with small business concerns. Bids or proposals received from others will be considered non-responsive.

EVALUATION FACTORS FOR AWARD

The major evaluation factors for this solicitation include technical (which encompasses experience and past performance factors) and cost/price factors. Although technical factors are of paramount consideration in the award of the contract, cost/price is also important to the overall contract award decision. All evaluation factors other than cost or price, Continuous Monitoring and Assessment 10 when combined, are significantly more important than cost or price. In any case, the Government reserves the right to make an award(s) or offer to the proposal that provides the best overall value to the Government.

The evaluation will be based on the demonstrated capabilities of the prospective contractors in relation to the needs of the project as set forth in the RFP. The merits of each proposal will be evaluated carefully.

Each proposal must document the feasibility of successful implementation of the requirements of the RFP. Proposal must not include hours for site managers any on site management required by the award winner will be at their own expense.

Continuous Monitoring and Assessment 11

Past Performances:

Offers are encouraged to furnish at least three Past Performances with work of same or similar scope. Past performances details shall include previous Federal, State Government or private contract of Information Security, FISMA Implementation, 0MB A-123, FISCAM or other experience with GAO/PCIE Financial Audits in accordance with auditing standards generally accepted in the United States of America. BEST

VALUE TO THE GOVERNMENT

The Past Performances shall highlight: Name of contract or project;

Contract Number;

Role (Prime or Subcontractor); Sponsoring Organization or Company;

Contract type;

Period of Performance;

Total Contract Value;

Contract Manager and telephone number;

Project description, scope of work performed, services or products delivered;

Period of Performance:

The Contract Period of performance will be from date of Award 2,080 hours or 1 year at the discretion of FPI, to include 4 option years or equivalent hours at the discretion of FPI.

Place of Performance:

The primary place of contract performance will be at the Federal Prison Industries, UNICOR/FPI Central office, and 400 1st ST, NW Washington, DC 20534. When it is advantageous to the Government

Continuous Monitoring and Assessment 12 for the contractor's work to be performed at another location, arrangements will be made in advance and authorized by the COTR in writing. The Government will not reimburse the contractor for travel expenses to, or parking at FPI Washington, DC office premises. All proposed personnel shall report to onsite.

Questions:

Offers must submit all technical questions concerning this solicitation in writing by email only to the ISO, Edward G. Burrell, Edward.burrell@usdoj.gov and Vivian.Drammeh@usdoj.gov. All questions must be received no later than 2:00 PM Eastern Time, 04/12/2019.

No telephone calls please.

Proposal submission: Must include:

Resumes

Past performance

Pricing/quote - must be on separate page Any Amendments (signed)

Signed SF1449

Candidates must have the following:

1. At least Security+ Certification

2. Certified Tenable.sc proficiency

a. Tenable Advanced Threat Detection

3. Certified TrendMicro Tipping Point Security Solutions Administration

a. AWS Essentials for Tipping Point Administrators mailto:Edward.burrell@usdoj.gov mailto:Vivian.Drammeh@usdoj.gov

Continuous Monitoring and Assessment 13

4. Managing experience and knowledge working with Intrusion Prevention systems.

5. Expert level knowledge working with CSAM tool

6. Working knowledge of ELMs tool

7. Senior level knowledge and work ability with Trust wave Db Protect with SQL and SAP servers and services.

8. Senior level knowledge and work ability with App Scanner

9. Proficient in Wireshark

10. Expert level knowledge Solar winds Logging and Event Manager

11. Full understanding of DISA STIGS compliance for network devices, servers, systems, and applications.

12. Expert level knowledge with Change Auditor for log reporting

13. Spunk Enterprise scripting

14. Linux administration

15. Familiar and working knowledge of Linux/Microsoft Windows forensic tools

Continuous Monitoring and Assessment 14

Federal Express or Regular Mail your submission:

Vivian Drammeh, Contract Specialist

UNICOR Federal Prison Industries 400 First St, NW, 8th Floor Washington, DC 20534

202-305-7324

Closing Date and Time:

Proposal Due Date:04/22/2019

Time: 2:00 P.M Eastern Time