VMTT_Enhancement_SOW_v1.4_FBO.docx

VMTT System Enhancement SOW U.S. Department of Education Federal Student Aid

Information Technology Risk Management (ITRM) Vulnerability Management Tracking Tool (VMTT)

Statement of Work (SOW) For System Enhancements Version 1.4

January 9, 2017

VMTT System Enhancement SOW

Page ii Table of Contents

Document Version History

Background /Overview

The Federal Student Aid (FSA) FSA Security Program is responsible for monitoring and enhancing FSA’s IT security and cyber environment. The goal of the Security Program is to provide FSA with better situational awareness pertaining to IT security within its IT enterprise; enhance network monitoring efficient and effective incident response; and maintain IT security vulnerabilities at an acceptable risk level.

As required by (OMB # Directive) the Department of Education(ED) and FSA were required to transition from Operational Vulnerability Management System (OVMS) to the Department of Justice (DOJ) Cyber Security Assessment and Management (CSAM). Working in collaboration with ED and Department of Justice (DOJ) the transition this successful implementation was completed in Q4 of 2016 and closed two OIG security related findings.

OVMS and CSAM have similar capabilities, however to improve FSA’s overall security posture a gap analysis was conducted and identified areas where CSAM would not be able to capture data FSAs vulnerability management data. The Integrated Project Team met with the ITRM; Independent Verification & Validation (IV&V) and Plan of Actions and Milestones (POAM) teams validated their requirements. The IPT conducted alternatives analysis to address vulnerability management challenges and developed the Vulnerability Management Tracking Tool (VMTT).

FSA’s Vulnerability Management Tracking Tool (VMTT) is part of FSA’s overall vulnerability management process. This tool is intended for use by the ITRM and Independent Verification & Validation (IV&V) teams to track and manage the lifecycle of vulnerability scans.

Vulnerability management is the process in which vulnerabilities are identified and the risks of these vulnerabilities are evaluated. This process includes an analysis and evaluation of information and leads to correcting the vulnerabilities and removing the risk or a formal risk acceptance by the FSA leadership.

Scope

The Vulnerability Management Tracking Tool (VMTT) is hosted in FSA’s SharePoint environment within the EDUCATE network. The VMTT resides under the FSA POA&M SharePoint site and is restricted to key ITRM Leadership stakeholders including Information System Security Officers (ISSOs) and the Independent Verification & Validation (IV&V) teams.

The VMTT was developed in house by the Technology Office’s ITRM leveraging FSA‘s existing SharePoint 2013 Platform and SharePoint Designer 2013. The VMTT was built in accordance with federal security requirements and aligned with the Department of Education OCIO guidance and the DOJ’s Cyber Security Assessment & Management System (CSAM).

The VMTT provides visibility by incorporating two related concepts vulnerability management and vulnerability scanning.

· Vulnerability Scanning Consists of using a computer program to identify vulnerabilities in networks, computer infrastructure or applications.

· Vulnerability Management The process surrounding vulnerability scanning, also taking into consideration other aspects such as risk acceptance and remediation.

The VMTT is a central repository for tracking vulnerability management scans.

Storage capacity of the VMTT is 96,024 MB. Based upon the storage capacity the VMTT can support an estimated 30,000,000 records. The VMTT can support a maximum number of 6,772 users simultaneously. Note: OVMS has a capacity to support approximately 200 users.

The maximum number of views (custom web presentations of data) in Sharepoint at one time is 5,000 concurrent views.

This scope of this Statement of Work (SOW) is to secure software development resources for the continued development of the VMTT to support FSA’s business needs. The VMTT will enable ITRM leadership additional visibility into an ever-changing threat landscape. This will be accomplished by providing vulnerability analysis, automated notifications, tracking, metrics and enhanced reporting capability.

Objectives

The overall objective of the VMTT is to improve FSA’s the overall security posture. The VMTT was developed to enhance FSA’s vulnerability management through automatic notifications and enhanced reporting capability.

The objective of this scope of work is to further develop components that enhance the functionality of the VMTT. This will be achieved by building upon the existing VMTT components including, Sharepoint lists, workflows, queries, dashboards, web parts and Sharepoint views.

Tasks Task 1) Appending Lists

· Develop the capability to append existing Sharepoint lists using the import functionality within Sharepoint.

Note: In phase 1 of the VMTT only one (1) Sharepoint list needs to be modified.

· The existing list(s) cannot be renamed when appending lists in the VMTT.

· The existing records cannot be overwritten, modified or deleted when appending lists in the VMTT.

· The append functionality is to support the import of [*.xls] and [*.CSV] formatted a files.

· The [*.xls] and [*.CSV] files are generated from multiple sources and will be uploaded manually in phase one of the VMTT. Upload (importing) of the data may be automated in the future.

· The column headers for each [*.xls] and [*.CSV] file are static however, the number of records (rows) in each are dynamic.

· Each up load (import) is to generate a unique number for each record which can be then be used to develop reporting metrics.

· The tool(s)/script(s) for appending is to have an error handling requirement to report for failed upload and/or syntax errors.

Task 2) Reporting Metrics and Dashboards Develop VMTT dashboard and reporting metrics with graphical representations in Sharepoint as to generate trending reports to include but not limited to:

Reporting Metrics

· VMTT Vulnerability Trending 30 Days Vulnerability trending (monthly) (Range 90 days) Attributes: Overall count of all open/closed vulnerabilities statistics monthly. Single lines showing open (red trend line) remediated (green trend line). Update chart frequency is weekly.

· VMTT Vulnerability Trending 90 days Attributes: Overall count of all open vulnerabilities based on criticality. Graph showing open items based on criticality rating (Critical, High, Moderate, Low). Update chart frequency is daily.

· VMTT Vulnerability Aging Attributes: Capture vulnerability aging based on time. <5, <30, <90 days based on threat level (Critical, High, Moderate, Low). Update chart frequency is daily.

· VMTT Vulnerabilities by Business Unit Attributes: Capture the Business Unit, Threat Level, Total count. The associated trigger is based on the number of vulnerabilities and threat level (stacked). Update chart frequency is daily. (Drill down capability to see details on affected assets and details).

· VMTT Vulnerability Tracking Progress Summary (Daily) Attributes: Display all totals of vulnerabilities open by: status, threat level, CVSS score, and overall count of open/resolved. Update chart frequency is hourly, statistics reported.

· Reporting Attributes /Variables The “timing” variables for frequency for reporting metrics are to be dynamic and be in real-time.

· Administrative Guide/SOP Development Assist FSA in developing repeatable processes to create the formulas, (calculations) for additional metrics. This is to include documentation for VMTT Standard Operating Procedures’ an administrative guide.

VMTT Dashboards and graphical representations Refer to Appendix for sample examples of Dashboards Task 3) VMTT Application Roles The vendor will provide support and assistance in refining the role based access requirements for the VMTT to align with ITRM policy procedures.

Task 4) Optional Ongoing support, development and maintenance The vendor is to provide support and development resources in an on-call capacity not to exceed (24) Hours /month for up to 6 months.

VMTT Support Structure

Application issues

ISSO Supervisor POA&M Team IV&V Team M-F 9-5pm

Delivery and Building Instructions

The vendor is to develop with FSA’s preferred tools including but not limited to Microsoft SharePoint 2013 “Out of the Box” suite, Microsoft SharePoint Designer 2013, and Microsoft InfoPath, leveraging SharePoint Chart Web Part, Excel Web Services, and Reporting Services.

Work product such custom scripts, templates, workflows, dashboards and widgets are to be delivered electronically via secure an encrypted transport to FSA.

The contractor will be required to provide supporting documents for VMTT work product. All work products are to be scanned for prior to import in the VMTT.

The contractor will develop the VMTT work product in with guiding principles outlined with FSA’s Information Resources Program Elements (IRPE).

FSA will provide the contractor with the Information Resources Program Elements, IRPE Checklist, and IRPE Workflow Process Map.

Government Furnished Property The contractor will perform VMTT development work off site at the contractor facilities.

The contractor will not require Department of Education office space. The work will be performed at the vendor’s office with some meetings and activities at the Department of Education Offices in Washington DC. The work will be performed at the contractor facilities.

The Department of Education / FSA will not be providing software tools or hardware to the contractor for the tasks identified in this development work.

Security Requirement Vulnerability Management Tracking Tool (VMTT) is hosted in FSA’s SharePoint environment within the EDUCATE network. The VMTT resides under the FSA POA&M SharePoint site and is restricted to key ITRM Leadership stakeholders.

Period of Performance The Period of Performance for development, testing, implementation and validation is 90 days from the time of contract execution.

VMTT System Enhancement SOW

VMTT Work Flow Diagram

Sample VMTT Dashboards ISSO Dashboard

Coming Due 30, 60, 90 Days

Threat Level Trend A Pie Chart such as this:

Business Unit Dashboard

Threat Level Trend by Business Unit and by System per Business Unit

Open Vulnerabilities per System by Business Unit

Business Unit Dashboard

Coming Due 30 days by Business Unit

Systems

Vulnerabilities by Business Unit

Executive Tab Dashboard

Open Vulnerabilities/Closed Vulnerabilities/POAM created monthly – 6 months

Vulnerabilities Scan Source by Business Unit

Same as above, Color code

Acronyms and Abbreviations

BI

BO

Business Intelligence Business Operations

Coming Due by Days POA & Ms 0-30 Days, 235, 45% 31 - 60 Days, 181, 34% 90 Days, 112, 21%

Moderate, 181, 34% High, 112, 21% 0-59 Days 60-119 Days 120+ Days 235 181 112 Business Operations Technology Office FSA Enterprise Customer Experience Risk Management Program Compliance 645 179 4 83 2 8 Business Unit CAPs Coming Due POAMs 0-30 Days PCA-CRS VDC PCA-TSI AIMS HOPS DMCS 2 PAS CPS PCA-FMS NSLDS SMCS ISE ISE PCA-NCS NFPISL FSAIC PEPS PCA-BCS COD FMS PCA-DMA FPDM PCA-CTI ESB PCA-AFS PCA-CCA IFAP PCA-ACT PCA-BA PCA-CBE PCA-CCMS PCA-ERS PCA-PBCM GLCS NFPED Financial NFPOSLA NFPUTAH NLCS PCA-EDCS PHCS PM SAIG 152 23 28 14 10 1 12 6 4 4 4 0 0 23 2 2 3 1 3 1 1 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 12 0 0 0 31-60 Days PCA-CRS VDC PCA-TSI AIMS HOPS DMCS 2 PAS CPS PCA-FMS NSLDS SMCS ISE ISE PCA-NCS NFPISL FSAIC PEPS PCA-BCS COD FMS PCA-DMA FPDM PCA-CTI ESB PCA-AFS PCA-CCA IFAP PCA-ACT PCA-BA PCA-CBE PCA-CCMS PCA-ERS PCA-PBCM GLCS NFPED Financial NFPOSLA NFPUTAH NLCS PCA-EDCS PHCS PM SAIG 12 12 0 7 7 9 1 0 20 0 3 0 0 0 0 21 1 0 2 0 0 1 71 0 13 4 0 1 7 32 7 1 2 1 0 0 0 0 16 3 0 0 61-90 Days PCA-CRS VDC PCA-TSI AIMS HOPS DMCS 2 PAS CPS PCA-FMS NSLDS SMCS ISE ISE PCA-NCS NFPISL FSAIC PEPS PCA-BCS COD FMS PCA-DMA FPDM PCA-CTI ESB PCA-AFS PCA-CCA IFAP PCA-ACT PCA-BA PCA-CBE PCA-CCMS PCA-ERS PCA-PBCM GLCS NFPED Financial NFPOSLA NFPUTAH NLCS PCA-EDCS PHCS PM SAIG 60 60 0 1 0 8 6 4 16 0 11 1 1 76 0 0 23 0 13 2 0 17 0 2 0 0 1 0 12 1 0 0 3 3 1 2 4 0 1 1 4 Coming Due POA&Ms

Business Operations Technology Office FSA Enterprise Customer Experience Risk Management Program Compliance 645 179 4 83 2 8 Business Unit CAPs Business Operations Technology Office FSA Enterprise Customer Experience Risk Management Program Compliance 645 179 4 83 2 8 Business Unit CAPs image1.jpeg image2.png image3.png image4.png image5.png image6.png image7.png