Draft_PWS_Comprehensive_Security_contract_9_April_2015.pdf

PERFORMANCE WORK STATEMENT (PWS)

OFFICE OF THE SECRETARY OF DEFENSE COMMUNICATIONS (SDC)

Security Services Information Assurance (IA), Computer Network Defense (CND), Incident

Response (IR) and Physical Security

1. BACKGROUND

The Immediate Office of the Secretary of Defense is the principal staff element to the Secretary of Defense in the exercise of policy development, planning, resource management, and fiscal and program evaluation responsibilities. This organization includes the Offices of the Secretary and Deputy Secretary of Defense, the Executive Secretariat and such other staff offices, which the Secretary designates to assist in carrying out assigned responsibilities.

The Director, Secretary of Defense Communications, is responsible for ensuring the Secretary of Defense can perform his mission essential functions regardless of location and threat scenario. Through this official and his staff, support activities will be assigned and controlled.

2. SCOPE

The Directorate of Secretary of Defense Communications is responsible for ensuring the Secretary of Defense can perform the mission essential functions regardless of location and threat scenario. The primary requirement is to maintain a full-scope Information Assurance (IA), Computer Network Defense (CND), Incident Response (IR) and Physical and Personnel Security programs for the organization. The support is to provide for IA, IR, CND and physical security services on behalf of Secretary of Defense Communications Office (SDC), Security Operations Branch (SO).

3. OBJECTIVES

This requirement encompasses three distinct networks supporting about 300 users and approximately 1050 computers, mostly utilizing Microsoft operating systems and standard business software. Under this contract these numbers could grow to about 400 users 1300 computer. The organization is currently maturing many of its processes. The objective is to procure highly skilled support that can fulfill some of these demands in an ever evolving, multi-tasking, deadline driven, politically sensitive environment.

4. GENERAL INFORMATION

The contractor shall directly support SDC and will work in support of the U.S Government Cabinet level customer. Therefore, the contractor’s on-site staff must present and project professionally in demeanor, comportment and dress. The contractor shall independently and proactively execute the coordination and completion of a myriad of business matters delineated in the PWS. Employees must be capable of communicating professionally and competently while interfacing directly with General Officer, Politically Appointee, and Senior Executive level officials of the government to provide expert-level advice and analysis.

In all activities, the contractor must demonstrate a familiarity with, and ability to be effective in, the SDC working environment, diligently mastering and managing priorities, and communicating the preferences and philosophies of the various directorates and their organization and clients.

The requirements necessitate the ability to interact with various levels of people within and outside of the organization to obtain information. Strong interpersonal, organizational, analytical and planning skills are required. Employees must be capable of communicating professionally and competently while interfacing directly with the SDC officials to provide expert-level advice and analysis.

An integral part of successful performance under this contract is not only the production of quality products as specified herein, but the responsiveness of contractor personnel in the day to day business at hand. The end product or deliverable is vital to successful performance, but so is client interaction and responsiveness.

4.1 Disclosure and Avoidance of Inherently Governmental Functions. The contractor shall not perform or give the appearance of performing inherently governmental functions as described in FAR Parts 2 and 7, and all applicable DoD policy. All contractor personnel shall identify themselves as contracted support personnel in all forms of communication with all entities with whom SDC has business dealings. In other words, the contractor shall never represent themselves as government agents or make decisions on behalf of the government. The contractor shall:

• Answer all telephone calls and have a personalized voice message with an introductory statement that includes the individual is contracted support.

• Ensure all those with whom the person interacts in any face-to-face dealings while supporting SDC understands that the person is contracted support.

Moreover, all contractor personnel attending meetings, answering government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression that they are government officials. All documents or reports produced by the contractor shall be marked as contractor products or otherwise indicate that contractor participation is disclosed.

4.2 Business Relations. The contractor shall successfully integrate and coordinate with the government all activity needed to execute the requirements specified herein. The contractor shall manage the timeliness, completeness, and quality of the contract deliverables. The contractor shall provide corrective action plans, timely contractor replacements with the approval of the government, timely identification of issues, and effective management of all contractor personnel (including subcontractors).

The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

4.3 Contract Management. The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to this requirement. The contractor must maintain continuity between the support operations at the Pentagon (and other sites within the NCR and alternate sites) and the contractor's corporate offices.

The contractor shall establish processes and assign appropriate resources to effectively administer this contract. The contractor shall successfully deliver and respond to government requests for contractual actions in a timely fashion. The contractor shall have a single point of contact between the government and contractor personnel assigned to support this contract. This single point of contact will work onsite and be responsible for managing work assignments and deliverables of all contractors. The contractor shall assign work effort and maintaining proper and accurate time keeping records of personnel assigned to work on this requirement.

4.4 Subcontract Management. The contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement.

The prime contractor will manage work distribution to ensure there are no Organizational Conflict of

Interest (OCI) considerations. Contractors may add subcontractors to their team after notification to the Contracting Officer or Contracting Officer Representative (COR).

4.5 Training. The contractor shall provide training, as necessary, for their own personnel to ensure that FTEs are trained on the common suite of Microsoft Office tools (e.g., Word, Excel, Powerpoint) and other applicable programs. The contractor shall also ensure that all of its employees have been properly trained and are qualified to perform assigned tasks under this PWS. The government will provide or coordinate training on any new government-provided equipment or government-directed training (e.g., Information Assurance). If such training requires travel on the part of contractor employees, local travel costs (i.e., Metro, Car parking fees, fuel, etc) shall be borne by the contract personnel.

The contractor is responsible for maintaining all required certifications. This includes any required training classes or continuing professional education. The contractor will ensure all staff are current on relevant security trends and innovations. The contractor will support attendance of relevant security events such as Blackhat, Defcon, Shmoocon, DerbyCon, Bsides, etc. The contractor will also support training via the DSS STEPP Security Training, Education and Professionalization Portal for traditional security contractors.

The contractor shall be proficient in the use of Microsoft Office software programs to include Word, Excel, Outlook and Power Point.

4.6 Document Management and Format of Documents. Contractor shall follow DoD (DoD 5110.04-M-V1) & SDC guidance and requirements for document preparation, archive, and document management. Where no such criteria of procedures exist, industry best practices, as approved by SDC shall be followed.

4.7 Non-Disclosure Agreement (NDA). All material provided to the Contractor by the Government and results, conclusions, and recommendations obtained thereof shall be considered confidential in business terms and treated with the same level of care that the Contractor treats its own confidential business information. The information shall not be disclosed, copied, modified, used (except in completion of a task order) or otherwise disseminated to any other person or entity at any time to include without SDC’s expressed consent. Contractors may require access to program sensitive information or pre-decisional or sensitive information. Therefore, all contractor personnel are required to sign a Non-Disclosure Agreement (NDA) – see attached NDA form. The NDA will be due no later than 7 days after award; and immediately upon replacement of any personnel under this contract

4.8 SDC Environment. SDC is a deadline and schedule-driven, content and protocol driven, multi-tasking organization. All contractor personnel must be able to adapt to a politically sensitive, high demanding, and evolving organization. The contractor shall provide on-site professional support at all times or as required and shall obtain government approval prior to deploying or circulating anything in the government environment.

4.9 Coordination of Work and Work Area. The contractor shall coordinate all work and perform all work during the hours as coordinated with the government. The contractor shall clean up all debris and discarded materials resulting from their operations at the end of each workday. The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. If performing in a government facility, at the close of each work period, government facilities, equipment, and materials shall be secured.

5. PERFORMANCE STANDARDS

Deliverables are expected to be complete and to have undergone a high level of quality assurance prior to customer delivery. Deliverables will carry a professional appearance, and not contain spelling, grammatical, or other errors. Deliverables will be reviewed by and approved for technical acceptance review by the Director of Security Operations. Contractual acceptance will be by the contracting officer’s representative.

Contract employees will obtain and maintain the following qualifications or equivalents, and Department of Defense (DOD) IA Workforce certifications based on the functional duties that they are performing, as mandated by DOD 8570 policy:

5.1 IA Project Management

Qualifications:

1. Advanced university degree in computer science, engineering, mathematics, business or related field of study from an accredited institution

2. Ten years’ experience in the performance of automated Information System (IS) activities directly related to systems design, analysis, programming, evaluation, development of formal top level specifications, certification, and testing of information management systems to include telecommunications and office automation applications.

3. Experience successfully integrating ITIL process within a large IS organization is highly desirable.

4. DoD Secret clearance that is or has been active within the last two years and the ability to obtain and maintain a Top Secret/SCI clearance

5. CISSP and PMP certification; IAM-III

6. Must possess and maintain an ITILV3 Intermediate Level certification.

5.2 Senior IA Engineer

1. BS in computer science, engineering, mathematics, business or related field of study from an accredited institution.

2. A minimum of eight years’ experience in the following areas:

a. Performing Security Test & Evaluation on UNIX, AIX, Linux, or Windows systems using standard DISA tools. System Administration (SA) experience with UNIX, AIX, Linux or Windows systems highly desired.

b. Evaluating the results of ST&E, determining the system security risks, identifying existing mitigations, and developing feasible solutions to resolve those risks.

c. Developing security documentation in support of system security certification and accreditation.

3. DoD Secret clearance that is or has been active within the last two years and the ability to obtain and maintain a Top Secret/SCI clearance

4. Certification as a Security professional (CISSP, CISM, CISA, or equivalent); IAT-III.

5.3 IA Engineer

2. A minimum of four years’ experience in the following areas:

a. Performing Security Test & Evaluation on UNIX, AIX, Linux, or Windows systems using standard DISA tools. System Administration (SA) experience with UNIX, AIX, Linux or Windows systems highly desired.

b. Evaluating the results of ST&E, determining the system security risks, identifying existing mitigations, and developing feasible solutions to resolve those risks.

c. Developing security documentation in support of system security certification and accreditation.

3. A minimum of two years’ experience as IPT, team, or project leader

4. DoD Secret clearance that is or has been active within the last two years and the ability to obtain and maintain a Top Secret/SCI clearance

5. Certification as a Security professional (CISSP, CISM, CISA, or equivalent); IAM-III.

5.4 IA Analyst

Qualifications

2. Current working knowledge of IA as it relates to operational testing, incident response, and computer network defense.

3. A minimum of 5 years’ experience in the following areas:

a. IA metrics, data collection methodologies, data collating and reporting in an operational testing environment.

b. Vulnerability assessments, results analysis and recommended risk mitigation solutions.

c. Incident response, e.g. preparation, detection, containment, eradication, recovery, and follow-up.

d. Certification as a Security professional (CISSP, CISM, CISA, or equivalent); IAT-II.

5.5 Security Analyst

Qualifications

1. Bachelor’s degree or 12 years experience as a cleared Defense Contractor or Military/Government working in corporate and government environments with primary duties with Industrial or Intelligence Community (IC) personnel & physical security.

2. Expert level experience managing the day-to-day operations of a personnel and physical security program

3. Comprehensive understanding of the applicable laws, rules and regulations relating to Personnel and Physical Security and developments occurring in the Security community;

DOD and IC SCI personnel and physical security requirements (ICD, DCID)

4. Comprehensive understanding of DoDIIS Intelligence Security Policy

5. Experience analyzing security responsibilities by ensuring education and compliance with security directives for employees with access to classified material.

6. Ability to review, implement, and make recommendations for process improvements based on previously conducted business process analyses

7. Completion of all DSS required training. Successful completion of Defense Manpower Data

Center (DMDC) required training for JPAS.

8. Comprehensive understanding of the government security community and information assurance processes

9. Comprehensive understanding of e-QIP, JPAS, certification and accreditation, physical security requirements and procedures

10. Able to interpret government policies in the development and implementation of security plans and procedures.

6. PROCUREMENT REQUIREMENTS

6.1. CND/IR

6.1.1. General

Develop and provide a monthly contract status report that should include, but is not limited to, status of ongoing projects, changes to personnel, individual contractor hours, estimated hours and remaining funding. This report should be delivered to the COR no later than the 10th day of each month.

Within one month of contract award, deliver a Transition Plan, which recommends the steps necessary to migrate from existing government and contractor operations to operations under this contract, inclusive of all hardware/software contracts and maintenance agreements. The plan will be defined in detail by specific task, deliverable, and milestone to ensure an orderly and complete transition. The plan should clearly delineate what software, hardware, training, and other requirements the government needs to provide in order to address potential transition gaps.

At least 60 days prior to the completion of the Task Order, deliver an Exit Transition Plan, which recommends the steps required to transition business application operations from the contractor back to Secretary of Defense Communications (SDC) and/or any follow-on contractor at the conclusion of the Task Order.

6.1.2. Documentation

As needed, develop, maintain and update standard operating procedures for all of the tasks contained in this contract, and integrate these Standard Operating Procedures (SOP) into a holistic IA/CND program concept of operations.

Maintain and update all working files associated with tasks under this contract for each of the functional areas contained in this contract in a logical manner. Maintain and update the information management guide that describes this logic and how to locate particular working files.

All contract deliverables, reports, and products will undergo quality assurance prior to customer delivery to ensure that they maintain a professional appearance, and do not contain any spelling, grammatical, or other errors. Those deliverables that do not meet this standard will be rejected by the government.

6.1.3. Situational Awareness

Develop and maintain a weekly IA/CND situational awareness report that provides accurate and complete information regarding the organization’s IA/CND posture, both from a risk and a compliance perspective. This mechanism will include at a minimum:

• Status of open incidents

• Status of open help desk tickets being worked by SO

• Compliance Status o Status of tasks under extension or waiver o Non-compliant tasks w/ relevant timeline/milestones to achieve compliance

• Status of outstanding and ongoing team tasks

• Any items requiring IAM or government support, action, or decisions

Provide project status updates to the IAM that include the project’s progress, critical path, key milestones, and any risks to meeting project deadlines.

Maintain awareness of major events and trends in the cyber security landscape, parsing this information and sharing items of importance with the IAM. This includes, but is not limited to:

• Newly discovered vulnerabilities and countermeasures to detect and prevent these vulnerabilities

• New threat exploitation and attack methodology and countermeasures to detect and prevent these methodologies

• New cyber security technologies and methodologies

Develop and maintain an Department of Defense Directive 8570.01M (8570) employee overview, which will articulate to the organization’s Certification and Accreditation (C&A) team which contract employees are performing which functional roles as they relate to 8570 policy, and their current and planned status of IA certification. Include an employee functional area specialization mapping, which will inform the organization’s management of which contract employees are performing or capable of performing which functional task areas of the IA/CND contract. This deliverable should be created on the SDC network and accessible by the IAM and COR at all times.

Develop and update IA/CND training and awareness products, as requested by the IAM, to provide training for SecDef Comms personnel. IA training is required for new employees and at least annually for all employees.

6.1.4. Community Liaison and Engagement

Participate in IA, IR and CND community meetings and working groups as requested by the IAM including, but not limited to, daily participation in United States Cyber Command (USCYBERCOM) Defense Connect Online (DCO) sessions. Any relevant information that is obtained during these engagements, including any tasking’s or actions for the organization, must be communicated in a clear, concise written format to the IAM within two days of completion of the engagement.

Research and evaluate emerging capabilities, engaging with external vendors and commercial partners to evaluate technical solutions that will provide new security capability to the organization, and provide recommendations and advice on the technical aspects of new technology.

6.1.5 Surge Support

As directed by the Contracting Officer or the Contracting Officer Representative (COR), the contractor will provide surge support for unexpected events/incidents or unforeseen work within the overall scope of this task order, but not already included in the estimated cost or price

For support of unexpected events/incidents, the contractor will be capable of providing at least remote support within one (1) hour of receiving notification by the COR. Employees should generally be available for after-hours consultation and possible recall to the office. .

The support required may range from an e-mail to a telephone call to short-notice on-site support. Under this contract, e-mail and after-hours telephone calls will be considered within the overall scope of this task order, but after-hours on-site support will be compensated on an hourly basis .Recall to the office is anticipated to be the rare exception for the only the most urgent matters.

The contractor will track surge support usage and report usage to the COR in the monthly report IAW Paragraph 6.1.1.

6.2. Computer Network Defense/ Incident Response

6.2.1. General

Develop, execute, and maintain full-scope CND and IR operations that monitor for, detect, protect against, and respond to cyber exploitation and attack efforts against all of the organization’s systems, networks, and users, ensuring compliance with and meeting all of the requirements set forth by DoD 8530.01 and 8530.02, any updates to these policies, and any future CND policies or regulations produced by the United States Government (USG).

6.2.2. Monitor / Detect

Innovate new methods to use existing tools and data sources (and identify and obtain new data sources) to detect cyber intrusions, while reducing false positives to a manageable level and while not allowing false negatives in the methodologies that are implemented.

Ensure that all alerts are monitored, interpreted, analyzed, and investigated to ensure that network intrusion attempts are detected and prevented from expanding the scope of exploitation beyond the initial detected intrusion point.

Ensure that SDC asset information (e.g. IP addresses, computer equipment identification) is loaded into external reporting tools (e.g. Shadow Server, National Security Agency (NSA), NSA Threat Operations Center (NTOC)), when provided in a secure manner, and monitor any alerts generated by these tools for SDC assets.

Monitor all security-relevant logs and alerts for signs of compromise, attack, or system misuse and policy violations. At a minimum, this should include logs and alerts from the following sources:

• Alerts, notices, and threat tippers from external organizations, including but not limited to the NSA, USCYBERCOM, and Pentagon Computer Incident Response Team

(PENTCIRT).

• Host-based and network-based Intrusion Detection Systems

• E-mail filters and scanning engines

• Web filters and scanning engines

• Host-Based Security System Modules o Anti-Virus o Rogue System Sensor o Policy Auditor

Any open incidents and all alerts must be reviewed and initially diagnosed and addressed with response recommendations provided to the IAM by the end of the business day (1800). Those exhibiting signs of probable compromise must be responded to in real-time. Tracking is done via the Incident Response Database on the SecDef Comms network.

Based on threat indicators received from daily monitoring, community collaboration, incident analysis, and all source reporting, proactively implement detection signatures and mechanisms to detect exploitation and attack using methods linked to those indicators.

6.2.3. Protect

Innovate new methods to use existing tools and data sources, and identify and obtain new data sources, to prevent cyber intrusions, while always maintaining high availability of network and information services to the customer base.

Based on threat indicators received from daily monitoring, community collaboration, incident analysis, and all source reporting, proactively implement protective countermeasures to prevent exploitation and attack using methods linked to those indicators, while ensuring that all potential prevention false positives are briefed to and approved by the IAM.

Proactively implement the following rules sets to prevent exploitation that leverages methods known to be linked to malicious uses as allowed by technology:

E-mail quarantine rule sets addressing by malicious e-mail addresses, IP addresses, subject lines, and other indicators.

Domain Name System (DNS) black hole rule sets addressing known malicious domains.

DNS poisoning rule sets addressing known malicious domains.

Web filtering rule sets addressing known malicious web uniform resource locators (URL)s, strings, and other indicators.

Intrusion detection and prevention rule sets addressing signatures that were developed or otherwise obtained.

6.2.4. Respond

Develop, execute, and maintain a full-scope cyber incident investigation and response (CIIR) program that is compliant with Chairman Joint Chiefs of Staff Memorandum (CJCSM) 6510.01A and any future updates to DOD incident handling and response policy.

Analyze all network security incidents by seeking and obtaining all relevant forensic witness device information in support of an incident investigation, conducting user interviews, and determining recommended response actions to provide to the IAM.

Identify and mitigate any collateral damage associated with an incident to maintain a high level of network and mission assurance.

Research open source and classified reporting to determine if a given incident was related to a generic Internet threat or an advanced persistent threat, and brief the IAM immediately of all advanced persistent threat activity.

For all incidents, write final incident reports to submit to the Joint Computer Emergency Response Team (CERT) Database as required by 6510 policy.

For all incidents that demonstrate signs of uncommon sophistication, deliberate targeting, or other uncommon tactics or techniques, develop comprehensive incident reports outlining the details of the incident, indicators involved, impact to the mission, recommended remediation actions, and any potential countermeasures identified during the investigation.

Maintain the local malicious indicators database, and develop and execute a process to track CND sensor tasking against those indicators.

Maintain the advanced persistent threat incident database, identifying and highlighting trends in persistent targeted threats against the organization.

Respond to all classified message incidents (CMI…aka “spillages”), serving as the CMI action officer and completing all tasks defined in the SDC CMI standard response procedure.

Collect incident and investigation metrics and trending data, identify key trends, and provide situational awareness on these trends to government leadership as required.

6.2.5. Cyber Threat Analysis

Provide cyber threat risk assessments and real time threat mitigation and countermeasures options, as well as course of action planning and execution.

Actively monitor threat reporting, and tune sensors and computer network defense tools to detect and prevent those threats from impacting the organization’s systems and networks.

Develop network and host-based signatures to detect and prevent historic, current, emerging, and anticipated advanced persistent cyber threats, tools, and methodologies.

Analyze high-threat software and system vulnerabilities in order to build signatures and countermeasures to detect and prevent exploitation of those vulnerabilities.

Develop comprehensive strategies for applying security concepts and techniques to systems to increase confidentiality, integrity, and availability in the face of persistent and sophisticated cyber threats.

Evaluate cyber threat in foreign countries and brief selected travelers on the threat and recommended counter-measures.

Analyze network logs and alerts for possible patterns of previously-detected and new advanced persistent threats.

Research cyber threat actors that target the organization – use all available sources to determine attribution, capability, and intent, and leverage this knowledge to develop risk management strategies and tactical countermeasures to detect and protect against these actors.

Perform preliminary malware analysis (dynamic and static) to identify host-level and network-level indicators to facilitate detection of previous and future malware and prevention of future malware.

• Note: In-depth malware analysis and reverse engineering capabilities will be provided by mission partner organizations, and are not expected to be performed under this contract.

6.3. Information Assurance (IA)

6.3.1. General

Develop, execute, and maintain a full-scope IA program that ensures the confidentiality, integrity, and availability of all of the organization’s systems and networks, ensuring compliance with and meeting all of the requirements set forth by DoD Directive 8500.1, DoDI 8500.2, Director Central Intelligence Directive (DCID) 6/3, and the Joint DoD Intelligence Information Systems (IIS) /Cryptologic SCI Information Systems Security Standards (JDCSISSS), any updates to these policies, and any future IA policies or regulations produced by the U.S. Government.

6.3.2. Scanning and Auditing

Quarterly on each network, perform network and system scans using BigFix or similar software and hardware to compile a list of installed software and hardware. Report executive-level results to the IAM highlighting any software or hardware that is discovered but that is not on the master list of approved software or hardware. Track remediation of this unauthorized software or hardware until resolution.

Quarterly on each network, perform universal serial bus (USB) usage scans using a government provided scanning tool to identify USB policy violations. Cross-correlate and analyze scan results to identify USB usage policy violations. Investigate and track resolution of all unauthorized USB activity. Report executive-level results to the IAM.

Quarterly on each network, perform audits on network accounts and identify anomalies that are inconsistent with the approved account management naming convention and process, including dormant accounts, disabled accounts, unauthorized shared accounts, and accounts with excessive privileges. Report executive-level results to the IAM.

Every two weeks, perform audits on all privileged network accounts on all networks, identifying any new or changed accounts and manually confirming that these changes were authorized. Report executive-level results to the IAM.

When requested, report results of mobile devices integrity monitoring using government-provided scanning tools. Report executive-level results to the IAM.

Every two weeks, perform an audit review of remote access logs, identifying, investigating, and reporting on anomalous access and access attempts.

Constantly identify false positives and false negatives within the security policy configurations of each of the organization’s security systems, immediately eliminating false negatives and always reducing false positives to a manageable level. Fully tune all new security systems to eliminate false negatives and to reduce false positives to a manageable level.

6.3.3. Risk Analysis

When requested, perform a risk analysis on any security-relevant changes that are being proposed by the organization, providing recommendations that highlight the risk posed by vulnerabilities based on current and potential threats and how best to mitigate that risk.

Evaluate all new technologies and processes being considered by the organization for security-relevance, and provide recommendations on how best to leverage these new technologies and processes to integrate into the security posture and achieve increased efficiency and/or effectiveness.

6.3.4. Vulnerability Management

Refine, improve, lead, and execute the organization’s IA Vulnerability Management (IAVM) Compliance Program and enter compliance information into the DoD Vulnerability Management System (VMS).

Develop, lead, and execute the organization’s non-IAVM patch and vulnerability management program, ensuring that all software installed on the organization’s systems, including software not tracked for DoD compliance purposes, is identified, tracked, and always patched using software patches made available by the software companies. This will be performed by monitoring software version and patch notices for all companies with software on the organization’s master software list, and identifying out-of-date software versions on the network using BigFix, Retina, and other asset information tools. Once identified, software patching must be tasked to a system administrator through the ticketing system, and remediation tracked until completion.

At least monthly, and also upon request, perform network vulnerability assessment scans using approved vulnerability assessment software. All scans must be coordinated with the IAM prior to execution. Regular scans include, but are not limited to, network security scans and host-based security scans using a variety of scanning tools as directed by the IAM. Note:

This contract does not include the application of any software updates or patches.

Analyze, correlate, and distribute any system vulnerabilities identified by scans or other information sources to the responsible system owner/administrator.

Monitor the progress of remediation and/or mitigation of all identified vulnerabilities, using VMS, providing updates to the IAM as required.

Report vulnerability posture and compliance information into VMS or another approved method prior to the deadlines established by each task. Tasks generally include Communications Tasking Orders, Coordination Alert Messages, IA Vulnerability Alerts and Bulletins, Warning Orders, Operations Orders, etc.

Acknowledge all tasks assigned to the organization using VMS or another approved method prior to the acknowledgement deadlines established for each task.

For any compliance-related tasks that will not be compliant prior to the task deadline, develop and maintain a VMS Plan of Actions and Milestones (POA&M), or other approved POA&M method, prior to the task and POA&M deadlines, in coordination with the organizational branch(s) that is responsible for execution of that task. Any tasks that will not be compliant prior to the task deadline must have their POA&M briefed to the IAM to ensure continual situational awareness of non-compliance risk areas.

Upon receipt of a new cyber tasking, develop a work breakdown structure of key tasks and distribute tasks to each branch of primary responsibility using an approved task tracking system. Track execution of all tasks until completion by each responsible branch, and report any delays, issues, or deviations to the IAM.

6.3.5. System Security Configuration Compliance

Monitor DoD Security Technical Implementation Guides (STIG) / Federal Desktop Core Configuration (FDCC) compliance by working with those administrators who are responsible for system baseline images and Active Directory Group Policy configuration. Annually, perform a full audit of these images and the Group Policy configuration to ensure continued compliance.

For each new system that is introduced to the SDC operational network, review the portions of STIGs and STIG checklists that are designed for the Information Assurance Officer (IAO) (not administrator) to run, as well as verify system and application security configuration settings are compliant with existing DISA, NSA, and software manufacturer security configuration guidance. Correct or mitigate any non-compliant security controls at the direction of the IAM.

6.3.6. Systems Architecture

Maintain the operation of the organization’s IA/CND-related systems, ensuring that the systems are operating effectively, efficiently, and securely.

• Note: These systems include products from McAfee, Sourcefire, and Raytheon. This contract only includes the security-relevant operation, not the administration, of the McAfee Host Based Security System (HBSS) and the BigFix system.

Patch, update, configure, and operate each IA/CND system, including developing and executing daily/weekly/monthly maintenance procedures for each system.

Plan and execute the installation, deployment, operation, and maintenance of new IA/CND-related systems, and the termination of IA/CND-related systems that have reached end-of-life.

Develop and execute a high availability resilient architecture for the organization’s security systems that strategically balances fiscal responsibility with risk management. Develop and maintain this architecture in the form of a security system resiliency matrix.

Develop and execute a detection and prevention sensor strategy that deploys the organization’s existing IA/CND detection and prevention systems in a manner that achieves the greatest management of risk, while also identifying, prioritizing, and highlighting remaining coverage gaps to inform future budgeting and procurement. Distribute security reports from each of the organization’s security systems so as to provide situational awareness and actionable information to other members of SO.

6.3.7. External Evaluations

When requested, coordinate any external IA/CND-related evaluations and inspections, hosting visiting teams and facilitating their overall visit and information requirements. Review the results of any external evaluations and inspections, identifying vulnerabilities and shortfalls that require mitigation, and develop a mitigation action plan. Track and report on the progress of the mitigation action plan until all vulnerabilities and recommendations have been addressed.

• Note: It is anticipated that the organization will undergo approximately 1-3 external evaluations per year.

6.4 Certification and Authorization

6.4.1 General

The Contractor shall develop, execute, and maintain a full-scope C&A program that encompasses all of the organization’s systems and networks, ensuring compliance with the Federal Information Security Management Act (FISMA), DoDI 8510.01, Director of Central Intelligence Directive (DCID) 6/3, and Intelligence Community Directive (ICD)

503. SDC is also currently transitioning from DIACAP to the Risk Management Framework (RMF). The contractor will be required to perform all new C&A efforts utilizing the RMF. The contractor shall provide a weekly status report that track the status of risk assessments, C&A efforts and the status existing C&A packages that must be renewed.

a. In total, this contract covers approximately 25 systems with unique security boundaries that require a full RMF C&A package to be built and/or maintained.

This number is expected to grow by approximately 3-5 systems per year during the period of performance of this contract.

b. RMF C&A packages exist for approximately half of the current systems, but will need to be reviewed and updated. For those systems with no C&A packages, little C&A-relevant documentation exists.

c. This contract includes handling the security requirements for approximately 30 government employees, 35 military active duty personnel, and approximately five prime services contracts employing approximately 50 contractor personnel total.

6.4.2 Certification and Authorization:

Review all of the organization’s systems and networks and identify those systems with unique security boundaries and functionality that will require a full RMF C&A package (“RMF systems”) in compliance with Federal and DoD C&A policy.

Execute full-spectrum RMF activities for all of the organization’s RMF systems, creating accurate and complete RMF packages for every RMF system. If Federal or DoD laws and policies relating to C&A change during the period of performance of this contract, contractor shall adjust processes to meet the new C&A-related requirements set forth by these new laws / policies.

Ensure that RMF packages are built and maintained using a standardized process and non-proprietary publicly available software toolkit, such as, but not limited to, the eMass system, which will allow for easy future maintenance by personnel at the completion of this contracted project.

Upon a major change in the IA posture to an existing RMF system, as determined by the organization’s Information Assurance Manager (IAM), perform an evaluation and update the system’s RMF package in support of a recertification and reaccreditation.

Where efficient and in-line with DoD policy requirements, develop a type accreditation process for those systems that will be duplicated or re-used within the organization.

Leverage type accreditations performed by DoD and other mission partners where applicable.

Develop and execute IA-enabled product evaluations for all IA-enabled products within the organization as dictated by policy.

The contractor shall also conduct Ad Hoc C&A assessments and testing as needed.

6.4.3 Risk Management Framework RMF

Categorize systems utilize the RMF, select appropriate controls for systems and document them utilizing a System Requirements Traceability Matrix (SRTM). Create detailed test plans, conduct detailed technical certification testing and document results in formal risk acceptance reports.

Initiate and Plan IA for each RMF system, initiate a RMF Implementation Plan (DIP), including assigning Mission Assurance Category designations, determining inherited IA controls, assigning new relevant IA controls, and developing a system security test plan.

Where required by policy or directec, develop a System Security Plan and Security Concept of Operations.

Implement and Validate Assigned IA Controls

For each RMF system, review and update the system’s RMF implementation plan, validating and testing all assigned IA controls (operational, administrative, technical) that have been implemented by the RMF system owner.

For each RMF system, document the validation results in a RMF scorecard Determination and Recommendation. For each RMF system, provide a certification package and certification recommendation to the IAM, including a POA&M for any IA controls that were not fully applied.

Conduct Reviews

a. Annually, review, revalidate, and test all IA controls for all RMF systems.

b. Report any deviations to the IAM, and track and report on all deviations until they are remediated.

Maintain ATOs

a. Maintain and track all Interim Authority to Test, Interim Authority to Operate, and Authority to Operate documentation (OpDocs), ensuring that systems are not at risk of non-compliance or expiration.

b. 30 days before certification or accreditation signature is required, prepare all new and renewal OpDocs and associated RMF packages and provide to the IAM.

Decommission. Upon RMF system decommissioning, update all relevant RMF packages, reports, and databases to ensure accuracy and completeness.

Local RMF Process. Develop and maintain a local process for the organization to facilitate the efficient and effective execution of the RMF lifecycle. This process shall include a package that will be provided to RMF system owners that explains the process and clearly articulates the manpower/resource/information/timeline requirements that are placed on them prior to and during each phase of the RMF process.

DoD IT Portfolio Registry (DITPR)

a. For each RMF system, add and maintain an entry in the DITPR database, completing all sections, to include:

• Mission criticality

• C&A lifecycle

• FISMA

• EAUTH

• PIA/PA Compliance

• PKI

• Budget

• Architecture

b. Quarterly, review the DITPR database for completeness and accuracy, and immediately resolve any deviations that are uncovered.

IT Contingency Plan

a. For each RMF system, develop an IT Contingency Plan that is synchronized with or included in the organization’s IT Contingency Plan.

b. Semi-annually, review and update the organization’s IT Contingency Plan(s), in compliance with DoD and Federal C&A policy requirements.

c. Annually, exercise all RMF system IT Contingency Plans, in compliance with DoD and Federal C&A policy requirements. At the direction of the IAM, perform tabletop exercises for those Contingency Plans where a full exercise would negatively impact the organization’s customers’ mission.

6.4.4 Interconnected Networks

For each non-SDC DAA accredited network that is connected to or seeks to connect to a network accredited by the SDC DAA, develop and maintain an interconnection security agreement outlining the security-relevant specifications of the connection.

Execute all other interconnection security requirements as dictated by Federal and DoD policy.

6.4.5 Situational Awareness

Develop and maintain a C&A situational awareness mechanism that provides accurate and complete information regarding the organization’s FISMA/RMF compliance status, showing the timelines associated with all RMF systems, IA-enabled product evaluations, FISMA requirements, Authority to Operates (ATOs), Authority to Connects (ATCs), and interconnection agreements, and highlighting any outstanding non-compliance issues along with the timelines associated with resolving those issues. Update this mechanism on a weekly basis.

Develop and maintain a Workforce Improvement Program (WIP) situational awareness mechanism that provides accurate and complete information regarding the organization’s WIP posture. Update this mechanism on a monthly basis.

Develop and maintain a guest system situational awareness mechanism that provides accurate and complete information regarding guest systems that are hosted in the organization’s security facilities. Update this mechanism on a monthly basis.

Develop and maintain a Tempest certification situational awareness mechanism that provides accurate and complete information regarding the organization’s secure facilities’ Tempest certification status. Update this mechanism every sixty days.

Develop and maintain a mechanism to identify and track the facility accreditation status of all non-SDC owned or operated secure facilities in which classified SDC owned or operated systems and networks reside. Update this mechanism on a bi-monthly basis.

As needed, produce PowerPoint briefing presentations and whitepapers pertaining to C&A-related areas highlighted by the government lead.

6.4.6 External Reporting:

Quarterly, develop and submit the organization’s Federal Desktop Core Configuration (FDCC) compliance status report.

Quarterly, develop and submit the organization’s FISMA compliance status report.

Semi-annually, develop and submit the organization’s DoD IA training compliance status report

6.4.7 Configuration Control

Review and provide recommendations on the security relevant changes to SDC networks and systems. Design and execute a security configuration and compliance review process. Develop and maintain master hardware and master software lists containing all security-relevant details

Review and provide recommendations on the security relevant changes to SDC networks and systems, as is considered during the Configuration Control Board (CCB) process that covers all new hardware, software, configuration, and other changes.

Design and execute a security configuration and compliance review process (SCCRP) that will be used to review all new systems for security vulnerability mitigation and security policy compliance as they are introduced to the CCB.

Apply the SCCRP to all new systems and software to ensure that security controls are in place prior to introducing the system or software to the SDC network.

Develop and maintain master hardware and master software lists containing all security-relevant details for every piece of hardware and software operating within the SDC environment, and synchronize these lists with the sub-lists contained within each RMF package.

Every six months, perform network and system scans using existing software to compile a list of installed software. Report to the IAM any software that is discovered that is not on the master approved software list. Track remediation of this non-authorized software until resolution.

Every six months, perform network scans using existing software to compile a list of hardware on the network. Report to the IAM any hardware that is discovered but that is not on the master approved hardware list. Track remediation of this non-authorized hardware until resolution.

6.4.8 Workforce Improvement Program

Develop an IA Workforce Improvement Program (WIP) for the organization Personnel handling certification and accreditation tasks under this contract shall be at Information Assurance Technical or Information Assurance Management Leven II or higher or shall achieve that level within 4 months of beginning work on the contract.

Develop an IA Workforce Improvement Program (WIP) for the organization that meets all of the requirements set forth in the DoD 8570 series of policies.

Through intra-organizational collaboration, identify all IA positions within the organization and provide recommendations to the IAM for position categorizations according to the categories established by 8570.

Identify all current…