Attachment 2 - Information Assurance Sample Task Order FINAL 20120405 1250.docx

SOURCE SELECTION INFORMATION - SEE FAR 2.101 & 3.104

DISA CIO - DISA IT Enterprise Support Services

HC1028-13-R-XXXX TASK ORDER 0001

31 January 2012

APPENDIX B –QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

APPENDIX C –QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

Defense Information Systems Agency

Chief Information Officer DISA Information Technology Enterprise Support Services (DESS)

HC1047-12-D-XXXX

Task Order (TO) 0002 Information Assurance Support Services (Version 1.0) 22 March 2012

TABLE OF CONTENTS

Page ii

Task Order Contracting Officer’s Representatives (TO/CORs) Primary TO/COR.

Department of Defense Activity Address Code (DODAAC):

HC1047

Alternate TO/COR.

Department of Defense Activity Address Code (DODAAC):

HC1047

Task Order Title:

Defense Information Systems Agency’s (DISA’s) Information Assurance (IA) Support Services Background The Defense Information Systems Agency is a Combat Support Agency responsible for connecting U.S. Forces and their coalition partners to the DoD’s Global Information Technology (IT) Enterprise. DISA provides IT networks, computing infrastructure, and Enterprise services in direct support of U.S. Warfighters to facilitate the seamless exchange of information on a global scale.

The mission of DISA’s Chief Information Officer (CIO) is to, “Lead and govern the delivery and operation of secure world-wide Enterprise IT services enabling the efficient and effective execution of DISA’s global combat support missions.” In order to accomplish this mission, the DISA CIO shall:

· Provide an efficient and effective IT infrastructure and services to support the Agency’s warfighting mission.

· Achieve a Mission Assurance posture that ensures the security and continuity of the Agency’s internal IT Enterprise’s infrastructure and services against an ever evolving spectrum of threats.

· Maintain compliance with all DOD information governance policies and legislation.

· Govern a common architecture and service delivery framework to drive efficiencies in business system investments and portfolio and knowledge management capabilities.

A key component of the DISA CIO mission is Information Assurance (IA), inclusive of Risk Management, IA Training, Cyber Assurance, Public Key Encryption, and Infrastructure (PKE/I). The CIO has designated the CIO IA Division (CI-3) to serve as the DISA Designated Accrediting Authority (DAA) Representative to perform the IA function and its entire component including the development, execution, and oversight of the Agency’s IA program. As such, the CI-3 Division’s mission is to assure DISA’s information systems, assets, and enclaves possess the necessary security measures to ensure their availability, protection, integrity, authentication, confidentiality, and non-repudiation to include monitoring, detection, discovery, and reaction capabilities of internal and external adversaries; and ensure a trained and effective information assurance workforce. The CI-3 team typically reviews 12 to 15 new and/or amended DIACAP Certification and Accreditation (C&A) packages per week, and 50 to 60 new and/or amended C&A packages per month.

The CI-3 Division must ensure that DISA’s information infrastructure and systems satisfy all applicable law, Government and DoD mandates, regulations, and directives. The CI-3 Division is responsible for providing technical security expertise in planning, preparing, oversight and execution of DISA’s Information Assurance program. The CI-3 Division must also ensure DISA’s information infrastructure and systems are compliant with all mandated DoD, National Institute of Standards and Technology (NIST), Office of Management and Budget (OMB), Chairman of the Joint Chiefs of Staff (CJCS), U.S. Strategic Command (USSTRATCOM), U.S. Cyber Command (USCYBERCOM) and DISA tasking orders, directives, instructions, standards, and requirements. The CI-3 division is responsible for applying these mandates, regulations, and directives and analyzing DISA’s information infrastructure or systems to determine and mitigate any security discrepancies, risks, vulnerabilities or non-compliance. Staying abreast of any new or changes to the above references, as well as emerging DoD and Industry technologies is a constant challenge for the CIO’s CI-3 Directorate.

The CI-3 Directorate is also responsible for conducting IA training classes, pertaining to DoD systems certification and accreditation policies and procedures in accordance with Defense Information Assurance Certification and Accreditation Package (DIACAP), entire DoD 8500 series, IA policies and procedures, to DISA’s Information Assurance Managers (IAM) and/or system administers (SA). This training must be conducted in support of new DoD mandates that include the requirements for all new IT devices to be PKE/I enabled. Several new directives have illustrated this point. U.S. CYBERCOM has directed the DoD to aggressively implement PKE/I with the issuance of Communications Task Orders 06-02 and 07-15. DoD implementation policy DoDD 8190.3 dated August 2002 and April 2004 directs implementation of DoD PKE/I programs, including network login, email systems, web applications, and web servers. The Directive also identifies the Common Access Card (CAC) as the PKE/I authentication token. Additionally, Homeland Security Presidential Directive (HSPD – 12) dated 27 August 04 directs smart-card access in gaining physical access to federally controlled facilities and logical access to federally controlled information systems, while Federal Information Processing Standards (FIPS) Publication dated 25 February 05 defines Government-wide Personal Identity Verification (PIV) systems for use in applications such as access to federally controlled facilities and information systems.

Objectives The overarching goal of the DISA CIO IA and Computer Network Defense Directive program is to protect, defend, and secure DISA’s Information Infrastructure and to ensure data assets and information are visible, accessible, understandable, and trusted by all authorized and privileged users, even in the face of a cyber attack. The CIO IA Team (CI-3) has been tasked to take deliberate actions to assure DISA’s Information Infrastructure is properly configured, protected, and monitored against vulnerabilities or threats.

DISA’s authority to operate networks / systems / applications / services in compliance with Federal and Department of Defense (DoD) policies is the responsibility of DISA’s CIO and the DAA. Currently, DISA has designated the same individual to serve as the CIO and DAA (hereinafter, the CIO).

The objectives of the DISA IA Division are:

· Ensure DISA’s information infrastructure and systems satisfy all applicable law, Government and DoD mandates, regulations, and directives.

· Ensure DISA’s information infrastructure and systems are compliant with all mandated DoD, National Institute of Standards and Technology (NIST), Office of Management and Budget (OMB), Chairman of the Joint Chiefs of Staff (CJCS), U.S. Strategic Command (USSTRATCOM), U.S. Cyber Command (USCYBERCOM) and DISA tasking orders, directives, instructions, standards, and requirements.

· Professionalization of the IA Workforce.

· Protect, defend, and secure DISA’s Information infrastructure to ensure data assets and information are visible, accessible, understandable and trusted by all authorized users even in the face of a cyber attack.

· Assure DISA’s Information Infrastructure is properly configured, protected, and monitored against vulnerabilities or threats.

· Enhance the business processes and improve the IA posture of the DoD through widespread use of PK-Enabled applications.

The DISA CIO must achieve compliance with all DOD and DISA approved architectures, programs, standards and guidelines, such as:

· Clinger-Cohen Act

· Federal Information Security Management Act

· Homeland Security Presidential Directive-12

· DoD Directive 0-8530.1, Computer Network Defense (CND)

· DoD Instruction 0-8530.2, Support to Computer Network Defense (CND)

· DoD Manual 0-8530.-1M, DoD Computer Network Defense (CND) Service Provider Certification and Accreditation Process

· Field Security Operations (FSO) Evaluator’s Scoring Metrics: Certification and Accreditation of Computer Network Defense Service Providers

· DoD Directive 8570.01-M, Information Assurance Training, Certification, and Workforce Management

· DoDD 8570.01-M, DoD Information Assurance (IA) Workforce Improvement Program

· DoD Directive, 8500.1, Information Assurance

· DoD Instruction 8500.2, Information Assurance Implementation

· DoD Instruction 8510.01, DoD Information Assurance Certification and Accreditation Process (DIACAP)

· DoD 5200.2-R DoD Personnel Security Program

· DoD 5220.22-M, National Industrial Security Program Operating Manual

· DoD 5220.22-R, Industrial Security Regulation

· DoD 5230.20, Visits, Assignments and Exchanges of Foreign Nationals

· CJCS Manual 6510.01, Defense-In-Depth, Information Assurance (IA) and Computer Network Defense (CND)

· CJCSI Instruction 6211.02C, Defense Information System Network (DISN): Policy, Responsibilities and Processes

· DISA Instruction 630-230-19, Information Assurance

· DISA's Information Assurance Manual

· DISA Computing Services Directorate (CSD) Security Handbook

· JITC Global Information Grid (GIG) IA Technical Framework

· DII Common Operating Environment (COE)

· DII Standard Operating Environment (SOE)

· DoD Security Technical Implementation Guides (STIGs)

· FSO Enhanced Compliance Validation Guide

· FSO Process Guide(s)

· FSO Vulnerability Scanning Procedures

· FSO Security Features User Guide (SFUG)

· FSO Security Review Methodology

· FSO Risk Assessment Guide

· National Security Agency (NSA) Security Guides

· Net centric Enterprise Services (NCES) Framework

· NetOps Policy and Checklists

· NSTISSP No. 11, National Information Assurance Protection (NIAP)

· USCYBERCOM / Orders and Directives

· DISA Orders and Directives

· Joint Security (System Administrator) Checklist (Available on the DoD IASE/IA Portal, under STIGS

· Security Checklists http://iase.disa.mil/stigs/checklist/index.html Scope The scope of this Task Order includes DESS PWS Task Areas 1 and 4. This Task Order encompasses the full range of IA support capabilities required by the DISA CIO to support the Agency. The functional scope of the tasks associated with this effort is detailed below.

Task Order Administration The Contractor shall provide the Government with a dedicated POC to serve as the Task Order Manager.

Risk Management Support As part of the C&A process, the Contractor shall conduct technical analysis support to the DAA's formal accreditation reviews, COMSATCOMs, Change Request, Amendments, Ports/Protocol Service Management (PPSM), Enterprise Mission Assurance Support /Service (eMASS), Circuits Management, Cross Domain Solution (CDS), Network Scanning, Federal Information System Management Act (FISMA) Compliancy, and Information Assurance (IA) Training Programs.

The contract shall conduct technical analysis of specific threats, vulnerabilities, and when process or policy is found to be out of date or requires an amendment or change, recommendations for policy and process improvements will be gathered, archived, and prepared for presentation to that system’s working group, and assess the security posture for DISA. Approximately 700 information systems are currently registered under the DISA DAA's area of responsibility. This shall include analyzing and developing operationally effective process enhancements that will improve DISA's information assurance security posture. Compliance with the DoD security policies, assessing impacts of integrated, interdependent, and interconnected DoD, coalition, and NATO local subscriber environments’ security posture and topology, reviewing security relevant documentation, and preparing technical papers discussing the results of this analysis.

Cyber Assurance Support The Contractor shall provide IA and Cyber Assurance Support in the areas of DISA’s CND Directives, IAVMs, Command Cyber Readiness Inspections (CCRIs), Enterprise compliance tools, security incidents, Host Based Security System (HBSS), CND operations, and IA/CND readiness posture. This will include reviewing and evaluating each accreditation package for compliance with all of the following where applicable: DoD IA vulnerabilities notices (alerts, bulletins and technical advisories); orders and directives, Warning Orders (WARNORDs); operational orders (OPORDs); Security Technical Implementation Guides (STIGs); and security readiness review (SRR) findings.

Public Key Implementation (PKE/I)/Public Key Enabling (PKE) Engineering Support The Contractor shall develop policy and procedures in accordance with DoD policies and procedures related to a number of DoD policies and directives. The USCYBERCOM has directed DoD to aggressively implement PKE/I with the issuance of Communications Task Orders 06-02 and 07-15. DoD implementation policy DoDD 8190.3 dated August 2002 and April 2004 directs implementation of DoD PKE/I programs, including network login, email systems, web applications, and web servers. It identifies the Common Access Card (CAC) as the PKE/I authentication token. Homeland Security Presidential Directive (HSPD – 12) dated 27 August 04 directs smart-card access in gaining physical access to federally controlled facilities and logical access to federally controlled information systems. Federal Information Processing Standards (FIPS) Publication dated 25 February 2005 defines Government-wide Personal Identity Verification (PIV) systems for use in applications such as access to federally controlled facilities and information systems.

Specific Tasks Task 1 – Task Order Administration In order to provide the foundation for effective communication and execution of the Information Assurance (IA) Support Services Task Order, the Contractor(s) shall provide the Government with the following:

In Progress Reviews (IPRs) The Contractor shall conduct a formal In Progress Review within 30 days of Task Order award and monthly thereafter. The purpose of these meetings will be to formally discuss progress, request assistance as required, and deal with issues raised during the execution of the task. The Contractor shall provide a read ahead copy of the briefing to be provided not less than 48 hours prior to the briefing. The Contractor shall include a Contractor roster (list of current/new hires/departing personnel), C&A metrics, IAVA metric, White List metrics, FISMA Monthly Pull metrics, Cross Domains Ticket Status, and a list of personnel DoDD 8570 qualification metrics.

Program Support The Contractor shall perform information system security programmatic support to the DISA DAA. The Contractor shall deliver a maximum of 10 position/white papers per year regarding specific information systems security topics, as directed by the Government.

Task 2 – Risk Management

6.2.1 Accreditations:

Develop, implement, and manage processes that support the accreditation of all DISA sites, circuits, networks, enclaves, ISs, applications, and services worldwide.

Perform as the account manager for DISA instance of eMASS and accounts are maintained at a 97% accurate and accounts processed within 48 business hours of receipt of SF285.

Track and document actions using the Government approved format to include capturing of sufficient data to support weekly reporting requirements as detailed below. Specific data will include, but is not limited to, date documentation is received, date package is begun, Contractor (AO) working the package, date package is completed, date package begins staffing for signature, date package is delivered to Front Office for signature, date package is signed, date package is provided to necessary elements such as program/Directorate Information Assurance Manager (IAM) and Connection Approval Office (CAO) if applicable. Data will also include those fields captured in applicable systems or tools used for Certification and Accreditation (C&A) purposes such as Vulnerability Management System (VMS), Enterprise Mission Assurance Support Service (eMASS), SIPRNet GIAP System (SGS), Ports, Protocols and Services Management (PPSM) system, IASE, Defense Information Technology Portfolio Repository (DITPR), WWOLS-R and Systems Network Approval Process (SNAP). The system data shall be 99.99% accurate across the above databases.

Develop a risk management checklist to include e.g., DIACAP, CAP, PPSM, CDS, FISMA, White List within 60 days of contract award. Review and provide updated copy annually.

Provide Routine System Accreditation Coordination Support.

Review the risk management checklist with the Directorate and the System IAM 120 days prior to accreditation expiration, and provide a written summary of reaccreditation requirements.

Review and evaluate each risk management package in accordance with the following processing timeline: Directors priority – 48 hours, COMSATCOM – 48 hrs, Expiring/New Systems/Extensions/CAP – 5 days- Change Requests/Amendments – 10 days, End of Life - 15 days. for compliance with all of the following where applicable: (e.g., DoD Information Assurance Vulnerability Management (IAVM) vulnerabilities notices (alerts, bulletins and technical advisories); Cross-Domain solutions; Ports, Protocols and Services Management (PPSM); Warning Orders (WARNORDs); operational orders (OPORDs); security technical implementation guides (STIGs); USCYBERCOM orders and directives) Develop and implement a checklist for use in reviewing and evaluating all executive DIACAP packages for accuracy to include the DIACAP Implementation Plan (DIP), System Information Profile (SIP), DIACAP Scorecard, and Plan of Action and Milestones (POA&Ms) as they apply to a final accreditation review.

Prepare a risk management package to the Government (e.g., COMSATCOMs, change requests and amendments) and memo for the DAA that validates the accuracy and completeness of the accreditation packages for Senior Information Assurance Officer (SIAO) and/or Designated Accrediting Authority (DAA) decision, which shall include but is not limited to, Acceptance of Risk, Interim Authorization to Test (IATT), Interim Authorization to Operate (IATO), Authorization to Operate (ATO), Denial Authorization to Operate (DATO), COMSATCOM Packages, Change Approval Requests, Amendments, Connection Approval Process (CAP) packages, policy write/review and approval, policy letters and/or memorandums, Memorandums of Agreement or Understanding (MOA/MOU), documentation review and End of Life (EOL) packages.

Maintain and provide, on a daily basis, an action tracking log of all actions ongoing and completed by the Risk Management team.

Monitor and maintain the CIO-IA-Security mailbox and ensure initial responses are provided within 48 hours. Specific data will include, but is not limited to, date documentation is received, date package processing has begun, Contractor (AO) working the package, date package is completed, date package begins staffing for signature, date package is delivered to Front Office for signature, date package is signed, date package is provided to necessary elements such as program/Directorate Information Assurance Manager (IAM), Connection Approval Office (CAO), Cross Domain Services (CDSs), Internet Service Providers (ISPs), Non-DOD Cross-Component Computing Environments, and Commercial Satellite Communications, if applicable.

Update the CI31 Accreditation Status Board on a daily basis to include, system name, AO working the package, expiration date, circuits assigned (if applicable), and current status (e.g., SIAO or Front Office).

Update the Policy/CIO Accreditation Support Standard Operating Procedures (SOP) document detailing all internal processes; annually on the anniversary of the contract award date. Internal policies/processes will include procedures for documenting specific actions in eMASS/Circuits/ PPSM/CDS/C&A/CAP.

Attend Risk Management meetings and C&A/eMASS/Circuit meetings, Working Groups and conferences as directed, and complete a Memorandum for Record (MFR) and/or Trip Report in accordance with TO/COR requirements.

Develop, present, or brief, training material for DISA personnel on DISA's C&A/eMASS/Circuits processes. These briefings may include internal or external IA Conferences, Symposiums, Working Groups, or periodic training for IAMs, IAOs or PMs.

Prepare and provide a weekly cyber security briefing and monthly status reports on the number of C&A packages submitted to SIAO/DAA for signature. This data will be used to compile weekly, monthly, quarterly, and annual accomplishment reports.

Provide Circuits Support for the C&A Process Provide on-site circuit/CAP support by verifying the accuracy and completeness of the following items prior to submission of the CAP package to the CAO: SIP is correct/current, scorecard, POA&M, Network/Enclave Topology Diagram/SIPRNet Connection Questionnaire (SCQ), and Consent to monitor memo and any other artifacts required by the CAO.

Submit a CAP package to the CAO upon receipt of signed accreditation memo from the DAA.

Update weekly the Circuit Slides to be included in the Cyber Assurance Briefing.

Track the daily status of all DISA owned and DISA sponsored circuit connections via the approved current database.

Provide Cross Domain and Cross Domain Boards/Working Groups Support Perform comprehensive reviews and provide feedback of all Cross Domain implementation documentation each month to support and track status for internal and external DISA customers.

Manage the internal DISA CDS process. Provide input, coordination, and socialization for process improvement at the CDSAP/CDTAB/DSAWG levels.

Track changes required to the SIPRNet GIAP System database. Issue requirements to the CDS. Check for update documentation to close records that have become non-operative or have been superseded by other implementations or revisions.

Ensure delivery of SCQ and topology changes to the DISA C&A team.

Oversee and manage all cross domain related activities in their respective organizations to include but not limited to keeping the UCDMO informed of new requirements, customer needs, and capability gaps.

Maintain knowledge of the cross domain capabilities provided by Enterprise Services (ES) and the UCDMO CD baseline list.

Ensure that any new cross domain developments are:

· Fully coordinated with the UCDMO;

· In line with the goals and objectives of the Cross Domain Community Roadmap and;

· Fully identified capability gaps Provide coordination and support for the organizations cross domain related risk management framework activities.

Review, validate, and prioritize cross domain requirements throughout the implementing organization’s acquisition and SDLC.

Ensure that information assurance requirements for cross domain related activities are addressed throughout the SDLC.

Maintain situational awareness of all cross domain related expenditures throughout the organization’s planning and procurement processes and send an annual progress report of these expenditures to the UCDMO.

Attend cross domain community forums [e.g. Cross Domain Resolution Board (CDRB), Community Security Test Group (CSTG), Requirements Security Engineering Group (RSEG), tiger teams, working groups, etc.] to represent its organizational cross domain needs and provide synopsis.

Maintain organizational access to information regarding cross domain requirements, implementations, installations, and configurations within the supported organization’s jurisdiction for periodic reporting to the UCDMO.

Enter and update weekly, all cross domain technology and operational data to include updates and patches for technologies in the UCDMO managed cross domain community repository.

Coordinate all cross domain issues with the UCDMO.

Attend meetings, in particular, DISA CIO for the Cross Domain Security Assessment Panel (CDSAP), Cross Domain Technical Advisory Board (CDTAB), and Defense Security Information Assurance Working Group (DSAWG), DISN/GIG Flag Panel, and GIG Waiver Panel: advise and assist DISA Lead and provide a synopsis/after action reports of activities.

Review all DISA briefings prior to submission to the board or working group. Provide assessment of the briefing to the briefer and incorporate changes to improve success and or clarity.

Develop and deliver the DISA DAA/CIO, decision/position papers as required supporting DISA position on DSAWG, DISN/GIG Flag Panel, and GIG Waiver Panel topics.

Provide Ports/Protocol/Services Management (PPSM) Support.

Track all DISA PPSM entries in Government authorized database for compliance using all required information sources and provide pre-coordination meeting with Directorate and system information assurance managers.

Review data repositories daily (e.g., VMS, SNAP, GIAP, eMASS, DITPR) for current compliance status of each accreditation package.

Review and evaluate each accreditation package for compliance with all of the following: DoD IA vulnerabilities notices (alerts, bulletins and technical advisories); Cross-Domain solutions; Ports, Protocols and Services Management (PPSM); communication tasking orders (CTOs); Warning Orders (WARNORDs); operational orders (OPORDs); security technical implementation guides (STIGs); security readiness review (SRR) findings Work with CIO and DISA system managers to register ports and protocols in the PPSM Database.

Attend the PPSM Technical Assessment Group to perform interoperability vulnerability assessment on DoD/DISA ports and protocols.

Provide monthly updated PPSM Category Assignment List (CAL) as directed by the Government.

Develop and implement DISA PPSM process model.

eMASS Administration Complete an eMASS training course whether it be online Computer Based Training (CBT) or classroom training. Training should be accomplished prior to receiving an eMASS account and upon a major eMASS version change.

Serve as the eMASS account manager responsible for approving new NIPR and SIPR accounts and creating new user accounts by processing valid DD Form 2875’s within 48 hours of receiving a request. The Contractor shall update Organizations, Lookup Tables and eMASS Communication (including external inheritance relationships and eMASS E-mail) daily.

Receive and process eMASS Task Notifications and perform workload tasks, daily. This includes but is not limited to the following package management tasks of control review, POA&M review of all control and system level weaknesses and associated milestones, and package approval or return for rework.

Contractor shall update, maintain and post the eMASS playbook and job aids to the DISA SharePoint upon eMASS version change, normally twice a year.

Network Vulnerability Assessment Scans Perform IA controls and IAVM validations against network infrastructure devices, Servers(Windows/UNIX), Domain Name Systems, Wireless 802.11 and BlackBerry security, Host-Based Security System (HBSS), and Traditional/Physical Security.

Perform daily, weekly, monthly, and periodic network vulnerability scans.

Perform inventory, compliance, verification, and vulnerability identification scans daily.

Daily monitoring of the Passive Vulnerability Scanner (PVS) to ensure accuracy.

Weekly validation and updating of the network scanner configuration settings.

Provide network vulnerability scanning support for Certification & Accreditation (C&A), Site Assist Visits (SAV), and Command Cyber Readiness Inspection (CCRI) efforts, monthly.

Provide monthly scanning support in validation of patch management.

Perform and provide weekly, monthly and periodic network vulnerability scanning reports. Perform an in-depth technical review of all identified vulnerabilities and technical fix or mitigation options.

Upload daily scan results into the Vulnerability Management System (VMS).

Troubleshoot and document scanning, false positive and reporting issues.

Develop and implement a Vulnerability Scanning SOP detailing the internal policy and processes for IA Control validation activities.

Provide ACAS architecture support.

Attend quarterly IA meetings.

Federal Information Systems Management Act (FISMA) Perform monthly C & A Status Checks, quarterly and yearly data calls/reporting mandated by DoD. Monitor DoD Cyberscope Tool and DITPR to support the FISMA compliance process.

Review the FISMA Data Quality Tab, at least daily, and provide non-compliance notification to DISA IAMs when systems are identified as non-compliant.

Use DITPR to run the FISMA Metrics Report daily using the SOP for pulling reports from DITPR.

Alert IAMs via email with compliance issues, as needed.

Respond to any user questions concerning the FISMA Data Quality in DITPR, within 24 hours of request.

Work with the DISA Sub-Components (Directorates) POCs to update CyberScope (DCS) for Quarterly and FY FISMA reports.

Update daily the Compliance Tab in DITPR with newly issued ATO/IATO accreditation dates.

Meeting Support (DISN Security Accreditation Working Group (DSAWG)/GIG Waiver/DISN/Flag Panel/DISN/Flag Panel/TAG/eMASS CCB/HPT) Perform analysis on all GIG waiver and appeal requests to determine compliance with all appropriate IA policies.

Develop recommendations on the acceptability of the waiver/appeal in meeting IA policy and whether any IA policy waiver should be granted.

Provide recommendations to DISA as a part of the assessment of the waiver/appeal and to the GIG Waiver Panel Chair.

Attend all scheduled DSAWG meetings or ensure a designated alternate is present according to subject meeting’s schedule.

Provide the DISA SIAO with written status updates and recommendations in preparation for briefing the DISA DAA.

Perform as a support element to the DISA office requesting the waiver.

Attend the Flag Panel meetings or ensure a designated alternate is present according to subject meeting’s schedule.

Maintain awareness of DISN/GIG Flag Panel IA activities and decisions to advise, inform, and support the DISA SIAO and the Risk Management Branch Chief.

Provide Configuration Control Management (CCM) of the DIACAP through interfacing with the DoD Component IA programs, IA COIs, and other entities (e.g., the GIG IA Program Office, DSAWG) to address issues that are common across all entities.

Provide detailed analysis and authoring support for the Enterprise portion of the DIACAP Knowledge Service (KS) content.

Recommend changes to the baseline IA controls to the DISN/GIG Flag Panel.

Recommend changes to the C&A process to the DoD SIAO.

Advise the IA Senior Leadership (IASL) and other IA advisory forums identified by the DoD SIAO to resolve C&A priorities and cross-cutting issues.

Develop and manage DoD Enterprise-level C&A automation requirements.

Attend and provide synopsis of DIACAP TAG meetings or ensure a designated alternate is present according to subject meeting’s schedule.

Attend and provide synopsis MASS CCB meetings or ensure a designated alternate is present according to subject meeting’s schedule.

Provide IA position to DISA CIO on all matters under consideration.

Participate in CCB to recommend changes and improvements that promote current issue.

Participate in discussions to report and resolve issues impeding the successful implementation and use of eMASS.

Information Assurance Workforce Professional and Certification Develop and deliver weekly, monthly and quarterly annual training reports. Reports shall include the name of individual that have not completed their annual training.

Track and notify the Government when all the annual training has been completed by DISA employees and Contractors.

Analyze, develop and provide recommendations of the cyber security workforce framework for awareness, education training and professional development.

Review and provide recommendations for training process improvements to include execution and compliance of DODD 8570-01M.

As the CIO SME, participate in meetings, conferences, workshops and working groups and recommend a course of action to the CIO in all training matters. Coordinate meetings, develop briefings and brief at the DISA IAM quarterly meetings. Act as central point of contact for all training delivery issues. (see table below) Review the DoDD 8570 (current version) and provide changes to improve the policy, guidelines, and procedures regarding DISA Workforce Improvement Plan.

Update the Information Assurance Managers (IAM) level 1 list monthly.

Task 3 – Cyber Assurance Host Based Security System (HBSS) Program Provide trained and certified Global administrators able to manage and assume all HBSS Global Administrator responsibilities.

Monitor DISA HBSS Tier 2 and Tier 3 consoles daily for situational awareness of the environment.

Monitor and ensure any and all configuration changes to the ePO environment have been reviewed and approved by the DISA Designated Accrediting Authority.

Consolidate aggregated data from ePO consoles, and communicate this information to the Government for reporting or resolution. This includes any anomalies that may trigger an alert.

Provide global oversight of all HBSS event data/Computer Net Defense (CND) as well as asset compliance data.

Monitor the Event Analysis Process and validate unknown behavior with appropriate DISA functional groups through ePO or HBSS Analysis to determine whether an event is truly a threat to the network Manage all HBSS event discoveries through resolution.

Monitor and remediate daily any and all unmanaged assets detected through rogue system detection Maintain visibility and control of the status and protection of each asset having an agent deployed to include detection of unmonitored hosts in each subnet.

Coordinate with DISA IAMs and HBSS POCs for resolution of HBSS compliance requirements.

Complete all HBSS Global Administrator critical tasks using the timelines established by the Government.

Obtain status updates of each non compliant HBSS POC to obtain status updates of way ahead to achieve compliance. The Contractor shall report results of efforts to the Government in format specified by Government.

Develop HBSS briefings for DISA quarterly IAM training cycle.

CYBERCON Program Develop a solution that will collect a “baseline” of operator-specified information about each machine in a specified network.

Compare two baselines, and generate a comprehensive list of the differences between these two baselines.

USCYBERCOM Directive Compliancy Provide recommendations in the areas of including, but not limited to, CND, training, and networks.

Understand USCYBERCOM order and messaging processes. Develop appropriate orders and messages for distribution.

Develop and maintain standardize operating procedures of DISA CND providers. Propose agreements that codify relationships and information sharing between USCYBERCOM and other organizations at the analytical level Review the USCYBERCOM website daily to ensure DISA complies with any and all orders assigned.

Develop briefings, coordination meetings, and coordinate document reviews for technical input to policy definition.

Participate in CND meetings and working groups as CIO SME and summarize the forum’s pertinent activities, discussions, and or decisions as it pertains to DISA CIO.

Coordinate the completion of DISA assigned action items as a result of these meetings, and working groups with the appropriate organization(s). Facilitate forums i.e., scheduling, hosting.

Coordinate CND and IA technical and analytic projects with CC/S/As and other external organizations.

Review policy and instructions, develop requirements, and monitor and review IA, network and network security programs.

Review and assess CONOPS, CND countermeasures and course of action recommendations.

Review and comment on technical materials consisting of, but not limited to, technical documentation and reports, CND policy and procedures, and planning materials.

Perform data collection for DISA CND presentations; briefings etc.

Review CND related input from various organizations, assembling the information into a consolidated package, and submitting it for inclusion into various CND recurring and by-demand reports.

Develop and provide Standardize Operating Procedures (SOP) for DISA CND.

Provide clarifying guidance and information as it pertains to DISA organizations Verify the information provided upon receiving a request for waiver and prepare coordination of leadership.

Provide guidance relating to the crisis, such as changes or any specific directions from the USCYBERCOM.

Develop or provide input to the development of policy directives, strategies and information which are conveyed to the CC/S/As; apply knowledge of DOD assessment resources, processes, and policy.

Cyber Command Readiness Inspections Site Assist Visits (CCRI/SAV) Program Intermediate understanding of host platform vulnerability assessment, hardening standards and methodologies. Experience with DISA Network Infrastructure, CND, Network checklist, Security Readiness Reviews (SRRs), and Security Technical Implementation Guides (STIGs).

Familiar with the DOD Vulnerability Management System.

Participate in weekly status meeting and prepare weekly CCRI Compliance reports.

Participate in weekly DISA Field Security Officer (FSO) CCRI teleconference(s) or Defense Connect Online (DCO) sessions as it pertains to the upcoming CCRI.

Coordinate advance preparation Cyber Command Readiness Inspections (CCRI) with Program Manager and the site to receive the inspection. Coordinate with local site personnel including System Administrators, Database Administrators to ensure that the site understands the scope of the CCRI.

Coordinate CCRI Compliance VTC briefings with FSO team lead to ensure CIO is prepared with briefs and summaries.

Coordinate with Computer Network Defense Service Providers (CNDSPs) concerning CCRI reporting within VMS and future DOD reporting systems.

Track the CCRI Compliance of all sites with open Category I, II, and III findings.

Prepare CCRI program materials at CCRI conference, etc.

Maintain knowledge of applicable DOD policy documents including, but not limited to 5200.1, 5220.22, 6211, 6510 and 8500 series, Security Technical Implementation Guidelines (STIGs), and Defense Intelligence Certification and Accreditation Process (DIACAP) process.

Identify corrective actions to increase IA compliance within the DISA, analyze and assess the After Action Plan (AAP) submitted by sites.

Prepare reports addressing current and emerging IA/Computer Network Defense (CND) issues specific to the site's CCRI.

White List Develop the White List process and serve as the DMZ White List POC and SME.

Review the DMZ White List submission for completeness and accuracy prior to processing the request received via email which includes but not limited to adding the entry to the DMZ White List.

Provide the White List Project Manager with a monthly written progress report. This report shall cover work performed and completed during the month. The progress report shall identify any problems encountered or still outstanding with an explanation of the cause and resolution.

Develop and maintain the Standard Operating Procedures (SOP) for the DMZ White List to be reviewed upon request.

Information Assurance/Computer Net Defense (IA/CND) Inspections Establish procedures to identify, report, and investigate violations of Removable Media acceptable use policies via the development of an IA/CND Inspection Project Plan.

Review, analyze, and assess reports and logs for discrepancies, anomalies, and CND violations.

Ensure Directorates address findings and track issues until resolved.

Create and maintain a list of all personnel and systems that have been authorized to use Flash media within their environment.

Review Device Control Module (DCM) reports and conduct analysis on events which trigger potential security violations and contact Tier 3 to investigate and resolve.

Develop IA/CND Checklists to conduct annual IA/CND Inspections to ensure DISA Directorates comply with USCYBERCOM directed policies and procedures. The Checklist will address DISA Policy Directives which will include but not be limited to USCYBERCOM Directives, Task Orders, OPORDs, WARNORD.

Secure Configuration Vulnerability Management (SCVM) Acknowledge via VMS within specified time issued by USCYBERCOM of an IAVM and notify the Government via of the issuance of a USCYBERCOM IAVM. Monitors and coordinates DISA’s IAVM compliance and POA&M adjudication within VMS and any other DISA compliance tracking tool. Monitor all active IAVMs as directed by the Government. Active IAVMs are considered as any IAVM listed in VMS.

Maintain and update the DISA IAVM weekly compliance report. Report shall be developed and delivered each week as directed by the Government. Report details DISA’s IAVM Compliance status. The report shall include the status (IAVM title/description, suspense dates, number of assets affected, assets patched, assets POA&M, assets open) regarding active IAVMs.

Maintain and update the DISA IAVM quarterly report. Report is developed and delivered by the 1st duty day of each quarter. The IAVM trending metric chart shall compare the number of IAVAs and IAVBs released by USCYBERCOM for the past three years (current year and two years prior).

Provide daily IAVA status reports to the Government to include both new IAVAs (upcoming POA&M mitigation dates) and expired IAVAs (past POA&M mitigation dates). Report shall be delivered, at a minimum, each morning and again by close of business. The Contractor shall notify the Government when DISA organizations do not meet the specified suspense dates.

Take a proactive approach to determine IAVM POA&Ms that are near their expiration date in VMS and notify the Government of organizations that need to take action. The Vulnerability Compliance Expiration Report (VC07) in VMS will be used to determine this. The report should be ran three days prior to the 1st business day of each month through the 2nd business day to prepare for the release of USCYBERCOM’s monthly compliance status report on the 1st business day of each month.

Take a proactive approach to address the pre-registration assets for new IAVAs. The "Vulnerable within Preregistration Period" column also known as "Pre Registration" is found on the VC01 report in VMS. This is where all newly registered assets reside for 15 days to allow time to determine applicability of IAVAs, verify fix status, or submit POA&Ms. The Contractor shall notify the Government when DISA organizations have pre-registered assets to expire on USCYBERCOM’s POA&M mitigation date to ensure DISA successfully meet all suspense dates.

Develop and deliver a DISA IAVM SOP regarding CIO’s internal IAVM guidance and processes within 45 days after beginning of period of performance. On a quarterly basis, the Contractor shall review the SOP and provide their recommended changes to improve the SOP regarding the IAVM program. Recommended changes will be provided using Word's track changes feature and be provided the 1st duty day of each quarter.

Provide support and training regarding DISA’s IAVM program. Take a proactive and innovative approach in preparing and executing a training session each quarter to DISA IA professionals regarding DISA’s IAVM program (review, execute, process, report, etc.) as directed by the Government. At a minimum, the training should include the top three (3) requests and resolutions over the last three months. Provide the training material/briefing to the Government 1 week prior to the scheduled training session for review and approval. The Government will provide 2 week’s notice before the training session.

Attend IAVM related meetings, workshops, conferences and provide a Memorandum for Record or Trip Report for each meeting, workshop or conference attended in the Government-provided format. The Memorandum of Record or Trip Report shall be delivered within 3 working days after the each meeting, workshop, or conference.

Execute daily management and updating of CI32 coordinated documents located in DISA Workspaces to include IAVM templates, guidance, instructions, briefings, etc. The Contractor shall complete major updates tasked by the Government within 30 days.

Notify the Government (in the Government-provided format) within 48 hours when major tasks are complete.

Provide new capabilities support for IAVM related tasks as requested by the Government (i.e. CRMS).

Take a proactive approach in the daily execution in monitoring, tracking, and coordinating with the Agency’s Directorate POCs, IAMs, Program/Project managers, and the FSO to ensure DISA’s Security Technical Implementation Guide (STIG) compliance. This includes reporting, analyzing, validating and adjudication of STIG POA&Ms for STIGs. Monitor and coordinate DISA’s STIG compliance within VMS. Monitor, track, coordinate, and staff DISA’s STIG POA&Ms within the Agency. Perform duties as the DAA Representative and process STIG and IA Control POA&Ms accordingly within the VMS.

Maintain and update the DISA STIG weekly compliance report. This report shall be developed and delivered each week as directed by the Government. This report details DISA’s STIG Compliance status and includes the number of assets for STIGS and IA Controls broken down by reportable category, i.e., Open, Mitigation Submitted, Adjudicated, Not Reviewed, Not Vulnerable etc. Fields are dependent on those provided within VMS and specific reports are subject to reporting capabilities available. Report format will also include breakdown of data by organization and severity code of vulnerability and include the total number of assets in the open status, total number of assets requiring immediate attention, and the total number of assets addressed/corrected.

Track and notify DISA organizations when compliance falls below the 90 percentile range as recorded on the weekly reports.

Process and document all DAA Risk Acceptance (DRA) requests submitted by SA/PM for STIG vulnerabilities. The Contractor is responsible for ensuring the DRA decision is documented appropriately in VMS.

Develop and deliver a DISA STIG/IA Control SOP regarding CIO’s internal STIG/IA Control guidance and processes within 45 days after beginning of period of performance. On a quarterly basis, the Contractor shall review the SOP and provide their recommended changes to improve the SOP regarding the STIG/IA Control program.

Provide support and training regarding DISA’s STIG/IA Control program. The Contractor shall take a proactive and innovative approach in preparing and executing a training session each quarter to DISA IA professionals regarding DISA’s STIG/IA Control program (review, execute, process, report, etc.) as directed by the Government. At a minimum, the training should include the top three (3) requests and resolutions over the last three months.