Attachment_J-01_CCRM_PWS_v15.pdf

HQ0147-16-R-0005

Attachment J-01 CCRM PWS

May 2016 1

TECHNICAL, ENGINEERING, ADVISORY and

MANAGEMENT SUPPORT (TEAMS)

Performance Work Statement (PWS) for Cybersecurity Compliance and Risk Management (CCRM)

May 2016 2

1. Top Level Functional Requirements/Scope

1.1. Purpose

The Missile Defense Agency's (MDA) mission is to develop, test, and field an integrated, layered, ballistic missile defense system (BMDS) to defend the United States, its deployed forces, allies, and friends against all ranges of enemy ballistic missiles in all phases of flight.

The MDA Chief Information Officer (CIO), a Senior Executive Service (SES) appointment compliant with Clinger-Cohen Act (Pub. L. 104-106), is responsible for providing MDA with Enterprise (agency wide) Information Technology (IT) capabilities for Administrative and General Services (GENSER) capabilities servicing the MDA administrative and business requirements as well as general services for BMDS Research, Development, Test, and Evaluation (RDT&E) requirements; plus the cybersecurity (historically called Information Assurance (IA) which is subsumed into cybersecurity) lead for the BMDS fielded capabilities and MDA Enterprise. The MDA CIO is the MDA appointed information system Authorizing Official (AO), historically the Designated Accrediting Authority (DAA), for all of MDA to include the BMDS fielded capabilities.

Approved for Public Release 16-MDA-8540 Figure 1.1: The Ballistic Missile Defense System

May 2016 3

Missile defense technology being developed, tested and deployed by the United States is designed to counter ballistic missiles of all ranges—short, medium, intermediate and long. Since ballistic missiles have different ranges, speeds, size and performance characteristics, the BMDS is an integrated, "layered" architecture that provides multiple opportunities to destroy missiles and their warheads before they can reach their targets.

Ballistic missile trajectories are commonly divided into three phases of flight: boost, midcourse, and terminal. Each element will play an important role in a robust system intended to defend against hostile missiles in any phase of flight.

The BMDS system's architecture includes:

Networked sensors (including space-based) and ground- and sea-based radars for target detection and tracking;

Ground- and sea-based interceptor missiles for destroying a ballistic missile using either the force of a direct collision, called "hit-to-kill" technology, or an explosive blast fragmentation warhead; and

A command, control, battle management, and communications network providing the operational commanders with the needed links between the sensors and interceptor missiles.

The BMDS elements are:

Aegis Ballistic Missile Defense (Aegis) Command, Control, Battle Management and Communications (C2BMC) Ground-based Midcourse Defense (GMD) Sensors Terminal High Altitude Area Defense (THAAD) Potential New Technology

With each element having multiple unique components such as: interceptors, fire control, unique sensors, element internal and external communications capabilities, unique command and control configurations, and etc.

1.2 Background

The MDA mission is to develop, test, and field an integrated, layered, BMDS to defend the United States, its deployed forces, allies, and friends. The BMDS weapon system, as depicted in Figure 1.1, is made up of several elements and components. MDA is identified as a rapid acquisition agency with the mission to expedite BMDS capabilities development and testing.

MDA then fields demonstrated BMDS program capabilities as soon as they are available.

The BMDS Mission and MDA Enterprise are both considered ‘national security systems’. Given the significant and growing danger of the cybersecurity threats, it is imperative that leaders at all levels of an organization understand their responsibilities for achieving adequate information cybersecurity and for managing information system-related cybersecurity risks. This advisory and assistance services requirement will provide:

May 2016 4

Improved independent verification and validation analysis and reporting of the BMDS and Enterprise cybersecurity controls.

Expand information cybersecurity knowledge improving the system architecture, system life cycles, and authorization decisions.

Figure 1.2 depicts the top level organizational view (OV-1) Risk Management Framework (RMF) entire cybersecurity life cycle that will be referenced within the performance objectives.

Figure 1.2: RMF OV-1

Cybersecurity is defined as the prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation.

Risk is defined as a measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence.

Note: Information system-related security risks are those risks that arise from the loss of confidentiality, integrity, or availability of information or information systems and reflect the potential adverse impacts to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation. Adverse impacts to the Nation include, for example, compromises to information systems that support

Risk Executive Function

RISK

MANAGEMENT

FRAMEWORK

Cybersecurity Life Cycle

Architecture Description

FEA Reference Models Segment & Solution Architectures Mission & Business Processes Information System Boundaries

Organizational Inputs

Laws, Directives, Policy Guidance Strategic Goals & Objectives Priorities & Resource Availability Supply Chain Considerations

Starting Point

Repeat as necessary

MONITOR

Cybersecurity State

SP 800-37 / 800-53A

CATEGORIZE

Information Systems

FIPS 199 / SP 800-60

Plan of Actions & Milestones

AUTHORIZE

Information Systems

SP 800-37

Cybersecurity Assessment Report

ASSESS

Cybersecurity Controls

SP 800-53A

IMPLEMENT

Cybersecurity Controls

SP 800-70

Cybersecurity Plan

SELECT

Cybersecurity Controls

FIPS 200 / SP 800-53

May 2016 5 critical infrastructure applications or are paramount to government continuity of operations as defined by the Department of Homeland Security.

For cybersecurity, a ‘threat’ is defined as a tool, technique, or methodology with the potential to adversely impact organization operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the nation through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.

Vulnerability is defined as a weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source. Where a vulnerability assessment is the systematic examination of an information system or product to determine the adequacy of security measures, identify security deficiencies, provide data from which to predict the effectiveness of proposed security measures, and confirm the adequacy of such measures after implementation.

Table 1.2 depicts the DoD Cybersecurity Test and Evaluation Guidebook resource breakdown.

This breakdown reflects the detailed differences in the terminology and activities of cybersecurity testing.

Security Controls Assessment Team

Vulnerability Assessment (Blue Team)

Adversarial or Threat Representative Testing

(Red Team)

Assess compliance with security controls

Comprehensive Exploit one or more known or suspected weaknesses

Execute the Security Assessment Plan

Identifies any/all known vulnerabilities present in systems

Attention on specific problem or attack vector

Linked to the Security Assessment Report Activities

Reveals systemic weaknesses in security program

Develops an understanding of inherent weaknesses of system

Based on Security Technical Implementation Guides (STIGs) or similar documentation

Focused on adequacy and implementation of technical security controls and attributes

Both internal and external threats

May 2016 6

Can be determined by multiple methods: hands-on testing, interviewing key personal, etc.

Multiple methods used: hands-on testing, interviewing key personal, or examining relevant artifacts

Model actions of a defined internal or external hostile entity

Include a review of operational and management security controls

Feedback to developers and system administrators for system remediation and mitigation

Report at the end of the testing

Conducted with full knowledge and assistance of systems administrators, owner, and developer

Conducted with full knowledge and cooperation of systems administrators

Conducted covertly with minimal staff knowledge

No harm to systems No harm to systems May harm systems and components and require cleanup

Table 1.2 DoD Cybersecurity Test and Evaluation Guidebook Resources

There are many Federal and DoD regulations for implementing CCRM, see paragraph 2.1 below.

MDA is a component of DoD. The MDA Director is referred to as a “DoD Component Head” or “Head of DoD Component”. The MDA CIO is referred to as a “DoD Component CIO”.

2. Organizational Description

The CIO mission is to ensure that MDA information technology services, management and resources are administered, acquired, managed, and operated in compliance with the priorities set by the MDA Director and the goals and directives of existing statutes and DoD regulations. The MDA CIO vision is to provide effective, secure and affordable enterprise information capabilities for missile defense. MDA has standardized the delivery of core enterprise services and applications into seven Service Lines: End User Support, Unified Communications, Business Automation, Network & Infrastructure, Cybersecurity Computer Network Defense (CND) /Information Assurance, Portal & Data Services, and IT Planning & Solutions. See Figure 2.1 for the MDA CIO Mission, Vision, and Services depiction. MDA CIO strives to deliver integrated services through the seven Service Lines. The MDA data center configurations are both DoD Architecture Framework (DoDAF) and GIG compliant and provide processing, storage, and transport of information, human interaction, systems and network management, information dissemination management, and information assurance functions.

May 2016 7

Figure 2.1: MDA CIO Mission, Vision, and Services

The MDA CIO organization is depicted in Figure 2.2. Within the organization chart the blue highlighted boxes within ICV Cyberspace Management Office (CMO) reflects the associated requirement organizations: Security Controls Assessment, MDA 4-Letter ICVA; Cyber Range OT&E, MDA 4-Letter ICVO; and Cyber Training, Education, Leader Development, MDA 4- Letter ICVT. The CMO, MDA 3-Letter ICV, contains the Program Manager and agency Senior Information Security [Cybersecurity] Officer (SISO).

The CCRM requirements are executed within the ICVA, ICVO, and ICVT organizations.

ICVA validates, assesses, consolidates and reports MDA’s compliance with cybersecurity by performing: MDA/BMDS Mission and non-Mission environment independent verification and validation of the cybersecurity controls and the associated information system’s risk assessment overseen by the Security Control Assessors (SCA), Performance Objective #1 and #4; plus the Software Assurance Manager (SAM), Performance Objective #2.

The ICVO team orchestrates the cyber range OT&E, Performance Objective #3, cybersecurity test team (external and internal organizations) in coordinating/performing

May 2016 8 the BMDS element/component cybersecurity active operational testing with MDA’s Test directorate (MDA/DT) as the overall Test Lead, the BMDS element/component assets under test, and other external agencies.

The ICVT team organizes the agency level cybersecurity training, education, and leadership development, Performance Objective #5, brings cybersecurity knowledge to the MDA workforce.

Figure 2.2: MDA Chief Information Officer (CIO) Organization Chart

2.1 Regulatory Guidelines

Specific regulatory guidelines are applicable throughout this requirement for accomplishment of performance objectives in Section 3. The below list identifies the regulatory guidelines and their current version, but the regulatory guidelines associated with this requirement are not limited to the below guidelines, their current version, or superseding regulations.

ICVA

ICVC

ICVI

ICVO

ICVT

Information System

Security Management

Cyber Range OT&E

Cyber Training, Education, Leader

Development

Regional IT Support MDIOC Senior Offical &

Infrastructure / Event

Support

Cyberspace

Management Office

Information

Management &

Technology Operations

Security Controls

Assessment

Computer Network

Defense

Chief Information

Authorizing Offical Team Architecture &

Engineering Team

ICM ICV ICT

May 2016 9

Figure 2.3: Regulatory Documentation

May 2016 10

Figure 2.3: Regulatory Documentation, continued

May 2016 11

Figure 2.3: Regulatory Documentation, continued

2.2 Data Rights

The contractor shall comply with government data rights in accordance with the Defense Federal Acquisition Regulations Supplement (DFARS), as identified below in the PWS and incorporated in the contract:

All technical data (TD) and computer software (CS), algorithms and related models (see DFARS 252.227-7013 and 252.227-7014) to be produced or developed under this contract shall be delivered to the Government with unlimited data rights. The TD and models shall be delivered to the contracting officer in its entirety at any point during the period of performance (POP) of this contract upon written request of the contracting officer or by the end of the contract. The TD and models are to be developed with only Government funds. Do not use open source computer software unless prior written approval is received from the contracting officer. All copyrights for updated and newly developed technical data and models will be assigned to the Government (see DFARS 252.227-7020, incorporated herein).

3. Performance Objectives and Detailed Requirements

Table 3.0 below contains the Performance Objectives Index outlining the objectives to be performed in accordance with this Performance Work Statement (PWS). Required products for each performance objective shown in Table 3.0 are included within respective PWS paragraphs.

The Contractor Program Manager will reside with the Cyberspace Management Office at Schriever AFB, CO. It is the Governments’ intent to revise this PWS during the contract period of performance as needed based on, but not limited to: DoD Cybersecurity direction/guidance changes, ever changing cybersecurity threats, BMDS mission modifications and upgrades, and/or BMDS RDT&E requirement changes.

Performance Objective Index Location(s)

1) Cybersecurity Controls Validation Testing (CCVT)

Redstone Arsenal, AL (HSV); Schriever Air Force Base (AFB), CO

(COS)

May 2016 12

2) Cybersecurity Software Code Assessment (CSCA) HSV

3) Cyber Range OT&E HSV and COS

4) Cybersecurity Risk Assessment (CRA) HSV and COS

5) Cyber Training, Education, and Leader Development HSV and COS

Table 3.0: Performance Objective Index and Locations

3.1 Performance Objective #1: Cybersecurity Controls Validation Testing (CCVT)

Task Details:

3.1.1 The contractor shall improve independent verification and validation assessment, analysis, and reporting of the BMDS mission (weapon system) and MDA/BMDS non-mission (MDA Admin/Genser and BMDS RDT&E) cybersecurity controls to SCA by performing the Information Assurance Workforce Technical (IAT) functions, as defined in Federal and DoD regulatory guidance.

As part of Figure 1.2 RMF OV-1 step 4 Assess Cybersecurity Controls, the RMF CCVT (which performs the RMF controls vulnerability scans, a subset of a vulnerability assessment that would be performed by a Blue Team) of the BMDS mission and MDA/BMDS non-mission environments are executed as formal assessments. The CCVT Assessors are to validate and analyze the implementation and execution of DoD mandated security measures, evaluating the applicable cybersecurity controls in sufficient detail to determine whether those measures are capable of preventing, or reducing risk to an acceptable level. The CCVT toolkit, utilizes various vulnerability scanning tools, evaluates technical controls and features of the system, causing minimal residual impact on the systems and are typically non-intrusive (passive) in nature. The CCVT finalized results are posted into the DoD database called Enterprise Mission Assurance Support Services (eMASS).

The contractor shall perform the functions as identified in Figure 3.1.1 containing the list of CCVT Assessors IAT Level II and III Functions, for the ISs identified in Table 3.1.1 as well as Remote Connectivity, while executing the tasks in paragraph 3.1.3, producing the Key Products/Technical Data identified in paragraph 3.1.4.

May 2016 13

Figure 3.1.1: CCVT Assessor IAT Level II and III Functions

# IAT Level II Functions

1 Develop CCVT Plan for each evaluation.

2 Obtain authorization from SCA to execute CVT evaluation.

3 Perform authorized coordination with appropriate parties.

Analyze cybersecurity policies and information systems configurations.

Evaluate configuration compliance with cybersecurity policy (to include STIGs and IAVAs).

Conduct authorized CCVT evaluation of the network environment and collect data.

Prepare assessment reports that identify known cybersecurity vulnerabilities and risk, technical and procedural CCVT observations and findings, CCVT collected data and analysis, and root cause(s) analysis.

7 Present assessment report to respective SCA and ISSM/ISSO.

Maintain knowledge of applicable cybersecurity policies, regulations, and compliance documents specifically related to auditing.

9 Maintain deployable CCVT toolkit to support audit mission.

Report cybersecurity incidents in accordance with agency-specific policy to the PM/ISSM/ISSO, BMDS ISSM, ICVA, ICV, and AO when the IS/PIT is compromised.

Coordination with the respective SCA and ISSM(s)/ISSO(s) for initiating protective or corrective measures when a cybersecurity vulnerability is discovered. Ensure that ISSM/ISSO can access the CCVT report and data.

CCVT Assessor

CYBERSECURITY IMPLEMENTATION

CYBERSECURITY ACTIVITIES

CYBERSECURITY-RELATED O&M

CYBERSECURITY-RELATED EVENTS

May 2016 14

Figure 3.1.1: CCVT Assessor IAT Level II and III Functions, continued

# IAT Level III Functions

1 Develop CCVT Plan for each evaluation.

2 Obtain authorization from SCA to execute CCVT evaluation.

3 Perform authorized coordination with appropriate parties.

Analyze cybersecurity policies and information systems configurations.

Evaluate configuration compliance with cybersecurity policy (to include STIGs and IAVAs).

Conduct authorized CCVT evaluation of the enclave environment and collect data.

Prepare assessment reports that identify known cybersecurity vulnerabilities and risk, technical and procedural CCVT observations and findings, CCVT collected data and analysis, and root cause(s) analysis.

7 Present assessment report to respective SCA and ISSM/ISSO.

Maintain knowledge of applicable cybersecurity policies, regulations, and compliance documents specifically related to auditing.

9 Maintain a CCVT schedule of planned events and milestones.

10 Maintain deployable CCVT toolkit to support audit mission.

Report cybersecurity incidents in accordance with agency-specific policy to the PM/ISSM/ISSO, BMDS ISSM, ICVA, ICV, and AO when the IS/PIT is compromised.

Coordination with the respective SCA and ISSM(s)/ISSO(s) for initiating protective or corrective measures when a cybersecurity vulnerability is discovered. Ensure that ISSM/ISSO can access the CCVT report and data.

CCVT Assessor

CYBERSECURITY IMPLEMENTATION

CYBERSECURITY ACTIVITIES

May 2016 15

Table 3.1.1 identifies the BMDS ISs for which the CCVT Assessor IAT Level II and III Functions will be executed. The BMDS IS with their respective Mission Assurance Category (MAC) levels I, II or III, Confidentiality levels (i.e., C is classified, S is sensitive, and P is public) designations, and program locations serviced by these CCVT task are identified in Table

3.1.1. It is the Governments’ intent to revise the PWS (including Table 3.1.1) during the life of the requirement to include as Information Systems are added or deleted.

Table 3.1.1: BMDS Information Systems

May 2016 16

Table 3.1.1: BMDS Information Systems, continued

May 2016 17

Table 3.1.1: BMDS Information Systems, continued

3.1.2 Any and all of the above defined CCVT Assessor IAT Level II and III Functions may be executed for any of the above defined ISs as part of this tasking. The Assessors must comply with the BMDS Security Classification Guide (SCG) and the respective element/component unique SCG and Program Protection Plan. Per DoDI 8500.01 personnel filling Assessor positions must be qualified and sign a Statement of Acceptance of Responsibilities.

3.1.3 The contractor shall perform the following CCVT activities by executing the Assessor IAT Level II and III Functions, listed in Figure 3.1.1:

May 2016 18

a. Establish, within 30 days of contract start, and maintain, annually, the CCVT Standard Operating Procedures (SOPs) within the MDA/ICVA Cybersecurity Handbook; to include as a minimum SOPs for: assessment plans and reports (to include template documents), data controls and handling, event and connectivity scheduling, event and connectivity coordination, and CCVT reporting.

b. Establish, within 60 days of contract start, and maintain the CCVT Joint Worldwide Intelligence Communications Systems (JWICS) portal site where all key products/technical documentation briefings, and event information (plans, data, and reports) are organized and posted. Establish, within 30 days of contract start, and maintain the CCVT Classified MDA Knowledge Online (CMKO) portal site where metrics, trip reports, and schedules are organized and posted.

c. For each IS/PIT CCVT Event perform the following task and continuously populate eMASS:

1) Develop the detailed Cybersecurity Controls Validation Testing Assessment Plan

(also known as Security Assessment Plan within Figure 2.3, #20) to include as a minimum: the IS/PIT configuration under test; the IS/PIT approved controls under test; specific test assets that will be used and their associated configuration; a detailed schedule; the data handling, collection and storage plans; and the test execution procedures. Post the plan to the portal site for SCA review and approval.

2) Prepare and present an Event Decision Briefing to obtain authorization to execute the assessment, along with an SCA memorandum granting authorization to execute the assessment. Post briefing and memorandum to portal site.

3) Following standard change management procedures, install the CCVT toolkit configuration as approved. Note: CCVT toolkit transportation may require Defense Courier Services for some locals which requires additional coordination and scheduling.

4) As part of the test preparation, compile the cybersecurity risk assessment information. Note: The program manager is responsible for implementing effective risk management and tracking to include the identification of all known risks, key assumptions, probability of occurrence, consequences of occurrence (in terms of cost, schedule, and performance) if not mitigated, analysis of mitigation options, decisions about actions to mitigate risk, and execution of those actions. Coordinate with the respective IS/PIT ISSM/ISSO to obtain the IS/PIT risk details.

5) Conduct the test (vulnerability scan) and collect the data following the Assessment Plan as a minimum. During the performance of the test, observations and test deviations may be identified that need to be coordinated and tested with data collected for inclusion in the assessment. All data collected should be posted to the portal site. During the test conduct step, provide daily status to the respective SCA.

May 2016 19

6) Upon test completion, decommission the test environment, following standard change management procedures. Return the information system to its pre-test configuration.

Note: CCVT toolkit and data transportation may require Defense Courier Services for some locals which requires additional coordination and scheduling.

7) Perform assessment analysis based on the controls vulnerability scans, test deviations, observations, and risk data as a minimum.

8) Prepare and deliver the initial Cybersecurity Controls Validation Testing Assessment Report to the SCA for review and approval, documenting:

Executive summary bottom line up front;

Test execution details (to include the asset under test and test resource configurations);

Controls assessed;

Test results including raw collected data, data analysis, identified vulnerabilities, and root cause(s) analysis;

Demonstrated/estimated operational effects;

STIG and Information Assurance Vulnerability Alert (IAVA) implementation and compliance;

Technical and procedural findings; and Controls risk analysis.

Post report to portal site for SCA review and approval.

9) Prepare and present an Event Out-briefing based on the initial Assessment Report to the respective SCA and ISSM/ISSO. Post briefing to portal site.

10) Perform cybersecurity coordination with the ICV teams.

11) Based on the Event Out-briefing and cybersecurity coordination within the ICV team, update/finalize the Cybersecurity Controls Assessment Report and post to portal site.

d. For each Remote Site/Location Connectivity CCVT activity (Note: some remote sites/locations are physically external to MDA facilities, such as Mission Partner locations, and as such have a reduced control set for evaluation) perform the following task and continuously populate eMASS:

1) Develop and maintain a single generic Connectivity Cybersecurity Controls

Validation Testing Assessment Plan/Checklist for remote site/location connectivity CCVT activities, to include the minimum set of connectivity controls to be assessed. Post the generic plan to the portal site for review and approval by the SCA.

2) Finalize and present a remote site/location connectivity completed checklist to the

SCA and obtain authorization to execute the assessment. Post checklist and authorization to portal site.

May 2016 20

3) Following standard change management procedures, install the CCVT toolkit configuration as approved. Note: CCVT toolkits transportation may require Defense Courier Services for some locals which requires additional coordination and scheduling.

4) As part of the test preparation, compile the cybersecurity risk assessment information. Note: The program manager is responsible for implementing effective risk management and tracking to include the identification of all known risks, key assumptions, probability of occurrence, consequences of occurrence (in terms of cost, schedule, and performance) if not mitigated, analysis of mitigation options, decisions about actions to mitigate risk, and execution of those actions. Coordinate with the respective ISSM/ISSO to obtain the risk details.

5) Conduct the test (vulnerability scan) and collect the data following the generic plan as a minimum. Upon performance of the test, test deviations may be identified and should be coordinated, tested, and data collected for inclusion in the assessment. All data collected should be posted to the portal site.

6) Upon test completion, decommission the test environment, following standard change management procedures. Return the information system to its pre-test configuration.

Note: CCVT toolkits and data transportation may require Defense Courier Services for some locals which requires additional coordination and scheduling.

7) Perform assessment analysis based on controls vulnerability scans, test deviations, observations, and risk as a minimum.

8) Prepare and deliver the initial Connectivity Cybersecurity Controls Assessment Report to the SCA for review and approve, documenting:

Executive summary bottom line up front;

Test execution details (to include the asset under test and test resource configurations);

Controls assessed;

Test results including raw collected data, data analysis, identified vulnerabilities, and root cause(s) analysis;

Demonstrated/estimated operational effects;

STIG and Information Assurance Vulnerability Alert (IAVA) implementation and compliance;

Technical and procedural findings; and Controls risk analysis.

Post report to portal site for SCA review and approval.

9) Prepare and present a Connectivity Out-briefing based on the initial Assessment Report to the respective SCA and ISSM/ISSO. Post briefing to portal site.

10) Perform cybersecurity coordination with the ICV teams.

May 2016 21

11) Based on the Connectivity Out-briefing and cybersecurity coordination within the ICV team, update/finalize the Connectivity Cybersecurity Controls Assessment Report and post to portal site.

e. Maintain and status the deployable CCVT toolkit both hardware and software.

f. Perform as the agency’s eMASS administrator(s).

g. Provide Executive Monthly Briefing containing status and performance metrics at the

SECRET level.

h. Prepare and submit SECRET trip reports when executing CCVT’s at other than normal office location.

i. Develop and maintain a detailed schedule looking three months forward (3-month plan) and one month back (actual dates executed) containing CCVT event timelines, technical data deliveries, executive meetings, travel, and etc. It should be noted that multiple CCVT events may be consolidated into a single travel trip based on location.

3.1.4 CCVT Key Products/Technical Data: CCVT SOPs; Cybersecurity Controls Assessment Plans; Remote Site/Location Connectivity Cybersecurity Controls Assessment Plan/Checklist;

Event Decision Briefings; Event Authorization Memorandums; completed Remote Site/Location Connectivity Cybersecurity Controls Assessment Checklists; Cybersecurity Controls Assessment Reports; Remote Site/Location Connectivity Cybersecurity Controls Assessment Reports; Event Out-briefings; Connectivity Out-briefings; technical positions, findings, and reports; change documentation; schedules; trip reports; monthly metrics;

Executive briefings, and portal sites.

Performance Objective #1 Standards Objective Standard AQL

Cybersecurity Controls Validation Testing (CCVT)

Quality – Error-free and technically accurate

No more than two validated customer complaints, in writing, within the monthly reporting period across all locations

Quality – Compliant with applicable DoD, MDA and local security directives policies, procedures and instructions for safeguarding classified information

Zero validated violations, in writing, within the monthly reporting period across all locations

Quality/Business Relations – Works independently with minimum corrective action required

No more than two corrective action events within the monthly reporting period across all locations. Note: A corrective action event is when an action is taken, in a corrective manner, due to lower than satisfactory performance

May 2016 22

Schedule – Timely – Meets schedules. Completes actions within specified deadlines

No more than one late or missed scheduled event within the monthly reporting period across all locations

Table 3.1.2: Performance Objective #1 Standards

3.2 Performance Objective #2: Cybersecurity Software Code Assessment (CSCA)

3.2.1 The contractor shall improve independent verification and validation analysis and reporting of the software code prior to its introduction on to the BMDS mission (weapon system) and/or MDA/BMDS non-mission (MDA Admin/Genser and BMDS RDT&E) environments.

As part of Figure 1.2 RMF OV-1 step 4 Cybersecurity Controls Assess, CSCA are executed as formal assessments. The CSCA Assessors are to verify and validate that the source code meets MDA’s cybersecurity concerns prior to loading the software on an MDA system.

The contractor shall perform the functions as identified in Figure 3.2.1 containing the list of CSCA Assessors IAT functions, while executing the tasks in paragraph 3.2.3, producing the Key Products/Technical Data identified in paragraph 3.2.4.

May 2016 23

Figure 3.2.1 CSCA Assessor IAT Level II and III Functions

# IAT Level II Functions

Develop and maintain a Standard Operating Procedures for both manual and automated software code (COTS, GOTS, contractor developed, etc.) analysis.

Perform manual software code analysis, to include as a minimum verifying if the code is listed in the DoD Approved Products List (APLITS) or in the MDA Approved Products List?

Perform automated software code analysis, collecting data for analysis of detection of false positives, weaknesses, and vulnerabilities.

Prepare and submit assessment report for the SAM that identifies technical and procedural findings, collected data analysis, weaknesses, vulnerabilities, recommend actions for remediation, and hosting recommendation.

Maintain knowledge of applicable cybersecurity policies, regulations, and compliance documents specifically related to auditing.

Maintain automated software assessment code IT configuration (hardware and software) to support your audit mission.

In coordination with the ISSM/ISSO, initiate coordination and out briefing on the assessment discoveries and ensure that a process is in place for the assessment and data to be accessible.

CSCA Assessor

CYBERSECURITY IMPLEMENTATION

CYBERSECURITY ACTIVITIES

May 2016 24

Figure 3.2.1 CSCA Assessor IAT Level II and III Functions, continued

3.2.2 Any and all of the above defined CSCA Assessor IAT Level II and III Functions may be executed as part of this tasking. The Assessors must comply with the BMDS Security Classification Guide (SCG) and the respective element/component unique SCG and Program Protection Plan. Per DoDI 8500.01 personnel filling Assessor positions must be qualified and sign a Statement of Acceptance of Responsibilities.

# IAT Level III Functions

Develop and maintain a Standard Operating Procedures for both manual and automated software code (COTS, GOTS, contractor developed, etc.) analysis.

Perform manual software code analysis, to includeas a minimum verifying if the code is listed in the DoD Approved Products List (APLITS) or in the MDA Approved Products List?

Perform automated software code analysis, collecting data for analysis of detection of false positives, weaknesses, and vulnerabilities.

Prepare and submit assessment report for the SAM that identifies technical and procedural findings, collected data analysis, weaknesses, vulnerabilities, recommend actions for remediation, and hosting recommendation.

5 Maintain the MDA Approved Products List.

Maintain knowledge of applicable cybersecurity policies, regulations, and compliance documents specifically related to auditing.

7 Maintain an CSCA schedule of planned assessments.

Maintain automated software assessment code IT configuration (hardware and software) to support your audit mission.

In coordination with the ISSM/ISSO, initiate coordination and out briefing on the assessment discoveries and ensure that a process is in place for the assessment and data to be accessible.

CYBERSECURITY IMPLEMENTATION

CYBERSECURITY ACTIVITIES

CYBERSECURITY-RELATED O&M

CSCA Assessor

May 2016 25

3.2.3 The contractor shall perform the following CSCA activities by executing the Assessor IAT Level II and III Functions, listed in Figure 3.3.1:

a. Develop, within 30 days of contract start, and maintain, annually, the CSCA Standard Operating Procedures (SOP) for assessing software following the MDA Cybersecurity Handbook processes.

b. Develop and maintain the CSCA CMKO portal site were all key products/technical documentation to include SOP, checklist, findings, schedules, metrics, approved software listing, and briefings are organized and posted.

c. Develop and maintain a detailed CSCA schedule looking three months forward (3-month plan) and one month back (actual dates executed) containing the CSCA timelines, technical data deliveries, meetings, and etc. It should be noted that multiple CSCA efforts are executed simultaneously.

d. For each CSCA:

1) Following the CSCA standard operating procedures, review the requested assessment and determine the assessment type. The requested assessment may be for an individual software or as part of a CCVT the system software.

2) Schedule and coordinate the software assessment.

3) Execute the software scan.

4) Analyze the related STIGS, IAVAs, and scan results.

5) Prepare the CSCA Report documenting the approve/deny recommendation with supporting detailed findings for submission to the SAM. Post the report on the portal, and notify the respective ISSM/ISSO for POA&M inclusion.

6) Based on the SAM review and approval/denial, update the MDA Approved Products

Software List, the system specific classified Software CCVT Report, and eMass.

e. Maintain and status the CSCA toolkit both hardware and software.

f. Prepare and present an Executive semi-annual briefing containing status and performance metrics at the SECRET level.

3.2.4 CSCA Key Products/Technical Data: CSCA SOPs; CSCA Report; MDA Approved Products Software List; system specific Software CCVT Report; technical positions, findings, and reports; change documentation; schedules; trip reports; monthly metrics; Executive briefings, and portal sites.

May 2016 26

Performance Objective #2 Standards Objective Standard AQL

Cybersecurity Software Code Assessment (CSCA)

Quality – Error-free and technically accurate

No more than two validated customer complaints, in writing, within the monthly reporting period across all locations

Quality – Compliant with applicable DoD, MDA and local security directives policies, procedures and instructions for safeguarding classified information

Zero validated violations, in writing, within the monthly reporting period across all locations

Quality/Business Relations – Works independently with minimum corrective action required

No more than two corrective action events within the monthly reporting period across all locations. Note: A corrective action event is when an action is taken, in a corrective manner, due to lower than satisfactory performance

Schedule – Timely – Meets schedules. Completes actions within specified deadlines

No more than one late or missed scheduled event within the monthly reporting period across

Table 3.2.1: Performance Objective #2 Standards

3.3 Performance Objective #3: Cyber Range OT&E

3.5.1 The contractor shall improve the effectiveness of BMDS weapons information system-related cybersecurity risks management and reporting (contained in highly diverse environments of complex and sophisticated cyber threats, with ever-increasing system vulnerabilities, and rapidly changing missions); by performing the Information Assurance Workforce System Architect and Engineering (IASAE) functions, as defined in Federal and DoD regulatory guidance for the BMDS ISs.

As part of Figure 1.2 RMF OV-1 step 3 Implementation and step 4 Assess, cybersecurity examinations of the BMDS element(s) and/or component(s) are executed using ‘active’ evaluation methods (penetration tests) from both internal and external sources. An ‘active’ attack attempts to alter system resources or affect their operation: so it compromises Integrity or Availability of the system. These examinations may contain multiple BMDS elements and components and their associated information systems within a single event. In most cases, MDA/DT leads the overall large system test event of which the cybersecurity examination is a subset.

The contractor shall perform the functions as identified in Figure 3.3.1 containing the list of Cyber Range OT&E Engineer IASAE functions, for the BMDS IS/PITs identified in Table 3.1.1, May 2016 27 while executing the tasks in paragraph 3.3.3, producing the Key Products/Technical Data identified in paragraph 3.3.4.

May 2016 28

Figure 3.3.1 Cyber Range OT&E Engineer IASAE Level II and III Functions

# IASAE Level II Functions

Develop Assessment Plans for external and/or internal active cybersecurity examination(s) of the BMDS element/component assessing threats to and vulnerabilities of the network environment. Each plan should include but not be limited to: audit objective; data handling, collection, and storage; technical interchange meetings (TIMs) schedules and attendees; cybersecurity evaluation methods; analysis methods; security classification procedures; and etc.

Prepare the Assessment Plan for presentation to the Cybersecurity Examination Coordinator for review and concurrence.

Prepare the Assessment Plan briefing for presentation to the respective Program Director (PD)/Program Manager (PM), Element/Component ISSM(s) and ISSO(s), BMDS ISSM, ICVO, ICV, and AO for obtaining authorization to execute active cybersecurity examination of the BMDS element/component.

Perform coordination with appropriate parties as authorized; such as external testing agencies, MDA/DT, and etc.

5 Establish, obtain and manage required nondisclosure agreements.

Orchestrate the cybersecurity examination(s) to ensure that the implementation of security designs properly mitigate identified threats.

Perform analysis of the examination results and observation as to the effectiveness of information protection measures used by the network environment: assessing both technical and procedural findings, were monitoring logs tripped, were automated notifications sent, were manual processes followed, were notifications within the time allotment requirements, and etc.;

including external agency data, observations, and findings; and performing vulnerability analysis, risk assessment analysis, fault analysis, data analysis, root cause analysis, and audit log analysis as a minimum.

Prepare an assessment report and briefing that identifies data, observations, analysis findings, and recommendations. Submit assessment report to government Cybersecurity Examination Coordinator; and present briefing to government Cybersecurity Examination Coordinator, ICVO, respective PM/ISSM/ISSO, BMDS ISSM, MDA/DT Test Lead, ICV, and AO.

Cyber Range OT&E Engineer

CYBERSECURITY IMPLEMENTATION

May 2016 29

Figure 3.3.1 Cyber Range OT&E Engineer IASAE Level II and III Functions, continued

# IASAE Level II Functions

Maintain knowledge of applicable cybersecurity policies, regulations, and compliance documents specifically related to cybersecurity active testing.

10 Maintain a schedule of planned events and milestones.

Report cybersecurity incidents in accordance with agency-specific policy, such as DoDD 8500.2, to the PM/ISSM/ISSO, BMDS ISSM, ICVO, ICV, and AO when the IS/PIT is compromised.

Coordination with the Cybersecurity Examination Coordinator, Element/Component ISSM(s), and BMDS ISSM for initiating protective or corrective measures when a cybersecurity vulnerability is discovered. Ensure that PM/ISSM/ISSO and BMDS ISSM can access the test assessment and data.

# IASAE Level III Functions

Develop Assessment Plans for external and/or internal active cybersecurity examination(s) of the BMDS element/component assessing threats to and vulnerabilities of the entire enclave. Each plan should include but not be limited to: audit objective; data handling, collection, and storage; technical interchange meetings (TIMs) schedules and attendees; cybersecurity evaluation methods; analysis methods; security classification procedures; and etc.

Prepare and present the Assessment Plan to the Cybersecurity Examination Coordinator for review and concurrence.

Prepare and present the Assessment Plan briefing to the respective Program Director (PD)/Program Manager (PM), Element/Component ISSM(s) and ISSO(s), BMDS ISSM, ICVO, ICV, and AO for obtaining authorization to execute active cybersecurity evaluations of the BMDS element/component.

Cyber Range OT&E Engineer

CYBERSECURITY IMPLEMENTATION

Cyber Range OT&E Engineer

CYBERSECURITY ACTIVITIES

May 2016 30

# IASAE Level III Functions

Perform coordination with appropriate parties as authorized; such as external testing agencies, MDA/DT, and etc.

5 Establish, obtain and manage required nondisclosure agreements.

Orchestrate the cybersecurity examination(s) to ensure that the implementation of security designs properly mitigate identified threats.

Perform analysis of the examination results and observation as to the effectiveness of information protection measures used by the enclave environment: assessing both technical and procedural findings, were monitoring logs tripped, were automated notifications sent, were manual processes followed, were notifications within the time allotment requirements, and etc.;

including external agency data, observations, and findings; and performing vulnerability analysis, risk assessment analysis, fault analysis, data analysis, root cause analysis, and audit log analysis as a minimum.

Prepare and present an assessment report and briefing that identifies data, observations, analysis findings, and recommendations. Submit assessment report to government Cybersecurity Examination Coordinator; and present briefing to government Cybersecurity Examination Coordinator, ICVO, respective PM/ISSM/ISSO, BMDS ISSM, MDA/DT Test Lead, ICV, and AO.

Maintain knowledge of applicable cybersecurity policies, regulations, and compliance documents specifically related to cybersecurity active testing.

10 Maintain a schedule of planned events and milestones.

Cyber Range OT&E Engineer

May 2016 31

3.3.2 Any and all of the above defined IASAE functions may be executed for any of the above defined BMDS ISs as part of this tasking. The IASAE must comply with the BMDS Security Classification Guide (SCG), the BMDS Element/Component unique SCG(s), and the respective weapon system Program Protection Plan. Per DoDI 8500.01 personnel filling IASAE positions must be qualified (see Labor Competencies attachment for qualification details) and sign a Statement of Acceptance of Responsibilities.

3.3.3 The contractor shall perform the following cybersecurity activities for the BMDS IS/PITs, listed in Table 3.1.1, by executing the IASAE functions, listed in Figure 3.3.1:

a. Establish, within 60 days of contract start, and maintain, annually, the BMDS Cybersecurity Examination Concept of Operations (ConOps). This high-level ConOps document will contain the flow down of the DoD Cyber Strategy, the DoD Cybersecurity Culture and Compliance Initiative, and the MDA Cyber Strategy into executable concepts. This document will contain as a minimum: the planned examination schedule, high-level planned examination description, the high-level examination timeline, the generic Executive approval process, generic data controls and handling concepts, the generic nondisclosure form, and the generic report template.

b. Establish, within 30 days of contract start, and maintain annually the BMDS Cybersecurity Examination Standard Operating Procedures (SOPs).

c. Establish, within 60 days of contract start, and continuously maintain BMDS Cybersecurity Examination JWICS portal site where all key products/technical documentation, briefings, and schedules are organized and posted. Establish, within 30 days of contract start, and continuously maintain the BMDS Cybersecurity Examination CMKO portal site where metrics, trip reports, and the like are organized and posted.

# IASAE Level III Functions

Report cybersecurity incidents in accordance with agency-specific policy, such as DoDD 8500.2, to the PM/ISSM/ISSO, BMDS ISSM, ICVO, ICV, and AO when the IS/PIT is compromised.

Coordination with the Cybersecurity Examination Coordinator, Element/Component ISSM(s), and BMDS ISSM for initiating protective or corrective measures when a cybersecurity vulnerability is discovered. Ensure that PM/ISSM/ISSO and BMDS ISSM can access the examination report and data.

Cyber Range OT&E Engineer

May 2016 32

d. Participate in the recurring MDA/DT led working groups on: coordinating future BMDS level test as defined within the Integrated Master Test Plan (IMTP); as well as coordinating on currently defined test event efforts.

e. For each Cybersecurity Examination Event:

1) Develop the detailed Assessment Plan to include as a minimum: the weapons system configuration under test; a detailed schedule; the organization(s) performing the cybersecurity examination, the examination toolkit(s) used, the data handling, collection and storage; and the examination procedures. Deliver the Assessment Plan to the Cybersecurity Examination Coordinator for review and approval. The Cybersecurity Examination Coordinator will then coordinate with MDA/DT for their review and approval.

2) Prepare and present an Executive Decision Briefing to obtain authorization to execute the cybersecurity examination, along with an Executive memorandum granting authorization to execute the cybersecurity examination. Authorization will include as a minimum MDA CIO and

MDA/DT.

3) Establish, coordinate and manage the specific nondisclosure forms.

4) Following MDA/BMDS standard change management procedures, coordinate the external active test agency’s toolkit configuration for installation.

5) Orchestrate the cybersecurity examination and data collection following the approved Assessment Plan. From the execution it is important for stakeholders to follow through with their cybersecurity standard operating procedures to record and react to any test related activities, to include initiation of cybersecurity incidents/violations.

6) Upon completion, coordinate with the external active test agency on de-installing their toolkit configuration per change management procedures. Return the weapon system to its pre-test configuration, unless other configuration arrangements have been made.

7) Perform cybersecurity examination critical analysis.

8) Prepare and deliver the Cybersecurity Examination Assessment Report, to the

Cybersecurity Examination Coordinator for review and approval, documenting: an executive summary bottom line up front, the test execution details (to include the test configurations), the technical and procedural findings, collected data and it’s analysis, root cause(s) analysis, and…