Attachment I - PWS C4IT SC IT IA Security Management Support-Final 13 December 2010.pdf

HSCG79-11-R-123456

PERFORMANCE WORK STATEMENT (PWS)

INFORMATION TECHNOLOGY (IT) INFORMATION ASSURANCE (IA) SECURITY

MANAGEMENT SUPPORT SERVICES TO THE UNITED STATES COAST GUARD (USCG)

COMMAND CONTROL COMPUTER AND COMMUNICATIONS INFORMATION TECHNOLOGY

(C4IT) INFORMATION ASSURANCE (IA) DIVISION

1.0 GENERAL.

1.1 SCOPE.

To provide support to the Command Control Computer and Communications Information Technology (C4IT) Information Assurance (IA) Division of the United States Coast Guard (USCG) C4IT Service Center in one or more of the areas of Coast Guard Computer Incident Response Team (CGCIRT), Certification and Accreditation (C&A), Secure Communications Services (SECCOMMS) and training. The contractor shall provide technical, administrative, and security management services for the area of CGCIRT to include network administration, information systems security and systems security analysis; C&A, conduct IT evaluations and assessments, and perform documentation support services for the area of C&A; provide TEMPEST Field Technical Authority (FTA) support for the area of SECCOMMS; and related IA training support in all areas. Tasks shall be performed to address the protection of all USCG systems and information they contain, which shall include the USCG IT infrastructure and connected workstations on the Non-Classified Internet Protocol Router Network (NIPRNET), Secret Internet Protocol Router Network (SIPRNET), and the Joint Worldwide Intelligence Communications System (JWICS).

1.2 BACKGROUND.

The Coast Guard C4IT Service Center Information Assurance (IA) Division is made up of three branches consisting of the following:

Computer Incident Response Team

Certification & Accreditation Branch

Secure Communications Branch

The IA Division is charged with the protection of all Coast Guard systems and information they contain. The IA Division has a continuing responsibility to protect the confidentiality, integrity, and availability of the information that is used and to ensure essential Coast Guard functions are carried out. The Information Assurance program consists of providing:

Guidance on computer security issues, Assistance to CG program offices and the field in researching and developing IA security plans and policies, Certification and Accreditation support, Assistance in developing IA awareness and training programs for Information System Security Officers (ISSO), Evaluations on IA hardware and software products, and

A CG wide incident response program.

1.3 CONTRACTOR PERSONNEL.

The Team Lead shall be the single point of contact for the Contracting Officer (KO) and the Contracting Officer’s Technical Representative (COTR). The Team Lead’s name and that of any alternate(s) who shall act in the absence of Contractor shall be in writing to the KO as part of the Contractor’s proposal. During the absence of the Team Lead, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this task order. The Contractor shall provide notification to the KO and COTR five (5) calendar days prior to any scheduled absence of the Team Lead. The Team Lead and all designated alternate(s) shall be able to read, write, speak and understand English.

The Team Lead’s duties shall include but not limited to the following: (1) attending meetings with the COTR and KO to discuss any technical problems or issues dealing with the contract, (2) knowledgeable of of field activities that are summarized in a monthly report(s) from the ISSOs in the field, (3) submitting reports from the CGCIRT Watchstanders, (4) coordinate the submission of travel and training requests.

1.3.2 Team Lead’s Availability.

The Team Lead shall be available to the COTR via telephone during the core hours of 0700 and 1600 EST, Monday through Friday, and shall respond to a request for discussion or resolution of technical and/or administrative problems within two (2) hours of notification.

1.3.3 Qualified Personnel.

The Contractor shall provide qualified personnel to perform all requirements in this contract. All Contractor employees supporting this contract shall be citizens of the United States, shall be able to read, write, speak and understand English. All Contractor employees supporting this contract must be able to obtain and sustain a Secret Clearance throughout the duration of this task order. However, the contractor may be required to have a Secret, Top Secret (TS), and Top Secret (TS) Sensitive Compartmented Information (SCI). As a condition of privileged access to any information system, personnel performing IA functions as described in the Information Assurance Workforce Improvement Program, DoD 8570.01-M, must satisfy both preparatory and sustain DoD IA training and certification requirements (see DoD 8570.01-M, Chapters 3, 4, 5, 10 and 11). Additionally, contractor personnel with privileged access must complete a Privileged Access agreement (see DoD 8570.01-M, Appendix 4). Additional guidance regarding these requirements also be referenced in the Information Assurance Workforce Improvement Program, DoD 8570.01-M.

1.3.4 Employee Identification.

Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display the Government issued badge in plain view above the waist at all times.

Contractor employees visiting Government facilities shall wear an identification badge that, at minimum, displays the Contractor name, the employee’s photo, and name, clearance-level and badge expiration date.

Visiting Contractor employees shall comply with all Government escort rules and requirements.

1.3.5 Employee Conduct.

Contractor’s employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, flag officer courtesy, “off limits” areas, wearing of parts of military uniforms, and possession of firearms) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect a discredit on the United States, the USCG or the Department of Homeland Security (DHS).

1.3.6 Removing Employees for Misconduct or Security Reasons.

The Government may at its sole discretion, direct the Contractor to remove any Contractor employee from USCG’s and DHS’s facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required in this contract. The KO will provide the Contractor with an immediate written explanation of the request to remove the employee. Once removed, the Contractor shall immediately replace the Contractor employee with another who possesses equal or superior qualifications and experience.

1.3.7 No Violation of Security Protocol.

The Contractor shall adhere to the information systems security (ISS) policies, plans, and procedures administered by the USCG and DHS. The Contractor shall maintain the highest degree of security trust when accessing USCG’s resources, networks and, systems.

1.3.8 Conflict of Interest.

The Contractor shall not employ any person who is an employee of the United States Government if that employment would appear to cause a conflict of interest.

1.3.9 Training.

If the Government provides training to a Contractor employee, then the specific skill set learned from the training becomes a job position requirement. The Contractor is responsible for supplying and ensuring that any replacement employee has that skill set.

1.4 KEY PERSONNEL.

All Contractor employees identified by name under this contract are key personnel. Before replacing any individual identified as Key, the Contractor shall notify the Contracting Officer no less than fifteen (15) business days in advance, submit written justification for replacement and provide the resume of any proposed substitute(s). Any proposed substitute shall possess qualifications equal or superior to those of the Key person being replaced. The Contractor shall not replace Key Contractor personnel without written consent from the Contracting Officer. The Government may designate additional Contractor personnel as Key prior to the task order date of award.

1.5 SECURITY.

Contractor access to classified information may be required under each task order. The details are specified in the attached Department of Defense Form 254 and in section 1.3.3 of this PWS.

1.6 PERIOD OF PERFORMANCE.

The period of performance for this contract is 60 months from date of award.

1.7 PLACE OF PERFORMANCE.

The primary places of performance will be TISCOM, C2CEN, OSC, and Electronic Support Unit facilities located throughout the United States. Additionally, performance at other facilities and vessels (air and sea) both CONUS and OCONUS may be required. Each individual task order will specify the actual place of performance.

1.8 HOURS OF OPERATION.

Contractor employees shall perform all work during the hours agreed upon by the Contractor and the COTR from Monday through Friday except Federal holidays. However, there may be occasions when Contractor employees shall be required to work other than normal business hours, including weekends and holidays.

The Contractor employees assigned to provide support as watchstanders shall perform all work 24x7x365, Monday through Sunday, including holidays. (See PWS 7.1.3.1)

1.9 INCLEMENT WEATHER OR EMERGENCY CONDITIONS.

In the event that inclement weather or other emergency conditions forces CGCIRT’s closure during normal operating hours, the COTR will notify the Team Lead. The Contractor shall adhere to CGCIRT's facility policies on closing or delayed opening due to inclement weather, or other reasons as directed by the Commanding Officer through the KO. This policy also applies to the Contractor employees that are providing support as ISSOs at locations specified in section 1.7 of the PWS. Watchstander Contractors shall be available 24x7, 365 days irrespective of weather conditions. In the event the situation occurs, the Contractor shall coordinate with COTR and KO.

1.9.1 Emergencies and Disasters.

In the event of fire, flood, hurricane, tornado, or similar emergency or disasters, Contractor support may be required to support Continuity of Operations (COOP). COOP operations may involve travel to an alternate location for an extended period. The KO or the COTR will be contacted to notify the Contractor and request support. The Contractor shall submit documentation of work performed to the KO.

1.10 TRAVEL.

Contractor travel shall be required to support this contract. All travel required by the Government outside the local commuting area(s) will be reimbursed to the Contractor in accordance with the Federal Travel Regulations. The Contractor shall be responsible for obtaining COTR approval via electronic mail, for all reimbursable travel in advance of each travel event.

Contractor employee travel may be required, but not limited to the following primary places of performance:

TISCOM, C3CEN, OSC, and Electronic Support Unit facilities located throughout the United States.

Additionally, travel to other facilities and vessels (air and sea) both CONUS and OCONUS may be required.

The Contractor shall provide trip reports to the COTR and KO via electronic mail no later than five (5) business days after the completion of the trip.

1.11 KICK-OFF MEETING.

The Project Manager shall attend a Kick-Off Meeting with the KO and the COTR no later than five (5) business days after the date of task order award. The purpose of the Kick-Off Meeting which will be chaired by the KO, is to discuss technical and contracting objectives of this task order and review the Contractor's project plan. The Kick-Off Meeting will be held at the Government’s facility.

1.12 PROJECT PLAN.

The Contractor shall provide a draft Project Plan for each task order at the Kick-Off Meeting for Government review and comment. The Contractor shall provide a final Project Plan to the COTR no later than five (5) business days after the Task Order Kick-Off Meeting.

1.13 PROGRESS REPORTS.

The Contractor shall provide a monthly progress report to the COTR and KO via electronic mail by the fifth (5th) of each month. This report shall include a summary of all Contractor work performed, an assessment of technical progress, schedule status, any travel conducted and any Contractor concerns or recommendations for the previous month.

1.13.1 TRIP REPORTS.

The Contractor shall provide a trip report for each task order for Government review and comment. The Contractor shall provide a final Trip Report to the COTR no later than five (5) business days after the completion of the trip.

1.14 PROGRESS MEETINGS.

The Team Lead shall be available to meet with the KO and/or COTR upon request to present deliverables, discuss task order progress, exchange information and resolve emergent technical problems and issues.

These meetings shall take place at the Government's facility. The Team Lead shall record notes from the Progress Meetings and submit to the KO and the COTR via electronic mail no later than five (5) business days. This meeting shall occur no later than 10 business days after the award of a task order and at minimum monthly thereafter.

1.15 GENERAL REPORT REQUIREMENTS.

The Contractor shall provide all written reports in electronic format with read/write capability using Microsoft Office Suite products compatible with the current USCG Standard Workstation.

1.16 PERFORMANCE REQUIREMENTS SUMMARY (PRS).

This contract includes a Performance Requirements Summary (PRS) (see PWS 8.0). The PRS sets forth the expected outcomes (objectives) of the task order, the service(s) required of the Contractor to achieve the objectives, a performance standard per outcome, and an incentive plan (positive or negative) in the event the Contractor does not meet the performance standard. The PRS is not an exclusive remedy and inclusion of the PRS does not preclude the Government from using any other remedy available by law or contract terms, including reductions in payment in accordance with any clause for inspection of services.

1.17 Security Certification/Accreditation.

All hardware, software, and services provided must be compliant in accordance with 140-01 Information Technology Systems Security and the DHS Sensitive Systems Handbooks 4300A for Sensitive But Unclassified (SBU) or 4300B Handbook for Classified Systems.

Security Certification/Accreditation: USCG shall provide personnel with the appropriate clearance levels to support the security certification/accreditation processes under this Agreement in accordance with DHS MD 4300A, DHS Sensitive Systems Policy and Handbook. During all SDLC phases of USCG systems, USCG personnel shall develop documentation and provide any required information for all levels of classification in support of the certification / accreditation process. In addition, all security certification / accreditation will be performed using the DHS certification/accreditation process, methodology and tools.

DHS Sensitive Systems Policy Directive 4300 A, Section 4.1.4 requires the "Separation of duties to prevent a single individual from being able to disrupt or corrupt a critical security process." The Policy requires the following: "Components shall divide and separate duties and responsibilities of critical IT system functions among different individuals to minimize the possibility that any one individual would have the necessary authority or system access to be able to engage in fraudulent or criminal activity." Security testing is but one critical systems function that needs to be performed by a provider (either government or contractor) other than the system designer / developer / operator.

This requirement is based, in part, on NIST 800-53 Rev 3, Security Control CA-2 Security Assessments -enhancement 1 which requires "The organization employs an independent assessor or assessment team to conduct an assessment of the security controls in the information system." Consequently, the vendor that provides C&A services may not perform the security controls testing.

1.18 INTELLECTUAL PROPERTY.

All Contractor developed processes and procedures and other forms of intellectual property developed under this PWS shall be considered Government property.

All documentation, electronic data and information collected by the Contractor and entered into or generated in support of this task order shall be considered Government property, and shall be returned to the Government at the end of the performance period.

1.19 Accessibility Requirements (Section 508).

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology (EIT), they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public. All EIT deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following applicable EIT accessibility standards have been identified:

1.19.1 Section 508 Applicable EIT Accessibility Standards 36 CFR 1194.21.

Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including but not limited to GOTS and COTS software. In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web based applications as described within 36 CFR 1194.22.

36 CFR 1194.22 Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous Javascript and XML (AJAX) then 1194.21 Software standards also apply to fulfill functional performance criteria.

36 CFR 1194.23 Telecommunications Products, applies to all telecommunications products including end-user interfaces such as telephones and non end-user interfaces such as switches, circuits, etc. that are procured, developed or used by the Federal Government.

36 CFR 1194.24 Video and Multimedia Products, applies to all video and multimedia products that are procured or developed under this work statement. Any video or multimedia presentation shall also comply with the software standards (1194.21) when the presentation is through the use of a Web or Software application interface having user controls available.

36 CFR 1194.25 Self Contained, Closed Products, applies to all EIT products such as printers, copiers, fax machines, kiosks, etc. that are procured or developed under this work statement.

36 CFR 1194.26 Desktop and Portable Computers, applies to all desktop and portable computers, including but not limited to laptops and personal data assistants (PDA) that are procured or developed under this work statement.

36 CFR 1194.31 Functional Performance Criteria, applies to all EIT deliverables regardless of delivery method. All EIT deliverable shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

36 CFR 1194.41 Information Documentation and Support, applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required 1194.31 Functional Performance Criteria, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and Applications at a minimum. In addition, any help or support provided in this work statement that offer telephone support, such as, but not limited to, a help desk shall have the ability to transmit and receive messages using TTY.

1.19.2 Section 508 Applicable Exceptions.

Exceptions for this performance work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the COTR and determination will be made in accordance with DHS MD 4010.2. DHS has identified the following exceptions that may apply: 36 CFR 1194.3(b) Incidental to Contract, all EIT that is exclusively owned and used by the contractor to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any EIT deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those contractors assigned to fulfill the obligations of this work statement and for the purposes of this requirement, are not considered members of the public.

1.19.3 Section 508 Compliance Requirements 36 CFR 1194.2(b) (COTS/GOTS products).

When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a Government solicitation. Agencies cannot claim a product as a whole is not commercially available because no product in the marketplace meets all the standards. If products are commercially available that meets some but not all of the standards, the agency must procure the product that best meets the standards. When applying this standard, all procurements of EIT shall have documentation of market research that identify a list of products or services that first meet the agency business needs, and from that list of products or services, an analysis that the selected product met more of the accessibility requirements than the non-selected products as required by FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires authorization from the DHS Office of Accessible Systems and Technology (OAST) in accordance with DHS MD 4010.2.

All tasks for testing of functional and/or technical requirements must include specific testing for Section 508 compliance, and must use DHS Office of Accessible Systems and Technology approved testing methods and tools. For information about approved testing methods and tools send an email to accessibility@dhs.gov.

1.20 Enterprise Architecture Compliance.

All solutions and services shall meet DHS and USCG Enterprise Architecture policies, standards, and procedures. Specifically, the contractor shall comply with the following Homeland Security Enterprise Architecture (HLS EA) and Coast Guard Enterprise Architecture (CGEA) requirements:

All developed solutions and requirements shall be compliant with the HLS EA and CGEA.

All IT hardware or software shall be compliant with the HLS EA Technical Reference Model (TRM) Standards and Products Profile.

Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the DHS Enterprise Data Management Office (EDMO) for review and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository.

In compliance with Office of Management and Budget (OMB) mandates, all network hardware shall be IPv6 compatible without modification, upgrade, or replacement.

All Information Technology assets being developed, procured, or acquired shall be IPv6 capable.

2.0 Final Approval.

Final approval and acceptance of documentation required herein shall be by letter of approval and acceptance of the Contracting Officer. Any letter of acknowledgment of receipt of material shall not be construed as a waiver of review, or as an acknowledgment that the material is in conformance with this performance work statement. Any approval given during preparation of the documentation, or approval for shipment shall not guarantee the final acceptance of the completed documentation.

3.0 GOVERNMENT TERMS & DEFINITIONS

3.1 AIS - Automated Information System

3.2 CGDN - Coast Guard Data Network

3.3 CGCIRT- Coast Guard Computer Incident Response Team

3.4 COMDTINST - Commandant Instruction

3.4 COTR -Contracting Officer’s Technical Representative

3.5 COTS - Commercial off the shelf

3.6 DHS - Department of Homeland Security

3.7 ESU -Electronic Systems Support Unit

3.8 GOTS - Government Off the Shelf

3.9 IA - Information Assurance

3.10 INFOCON - Information Operations Condition

3.11 INFOSEC - Information Security

3.12 IS - Information System

3.13 ISS - Information Systems Security

3.14 ISSA - Information Systems Security Assistant

3.15 ISSO - Information Systems Security Officer

3.16 ISSP - Information Systems Security Program

3.17 KO – Contracting Officer

3.18 NIST - National Institute of Standards and Technology

3.19 C4IT -Command Control Computer and Communications

3.20 USCG - United States Coast Guard

4.0 GOVERNMENT FURNISHED PROPERTY.

The Government will provide the following property and information to the Contractor for work required under this contract:

4.1 The Government will provide the workspace, equipment and supplies necessary to perform the on-site services required in this contract.

4.2 Contractor shall use Government furnished property only for the performance of work under this contract, and shall be responsible for returning all Government furnished property in good working condition, subject to normal wear and tear.

4.3 Contractor may use Government furnished procedures, tools, databases from the Computer Emergency Response Team (CERT) and Computer Incident Response Team (CIRT) programs with minimal or no modifications.

5.0 CONTRACTOR FURNISHED PROPERTY.

The Contractor shall not furnish property to fulfill the requirements of this PWS due to all services being provided at Government facilities.

6.0 REQUIREMENTS.

The Contractor shall provide support to the United States Coast Guard (USCG) C4IT Service Center in one or more of the areas of CGCIRT, C&A, Secure Communications, and IA related training to the C4IT Information Assurance (IA) Division. A Point Of Contact (POC) will be assigned to each of the areas of C&A, CGCIRT and SECCOMS.

6.1 CGCIRT

The Contractor shall provide technical, administrative, and security management services to the CGCIRT.

The services shall include providing network administration, information systems security, and systems security analysis.

6.1.1 TECHNICAL

6.1.1.1 Information Systems Security

The Contractor shall provide support as an Information System Security Assistant (ISSA) to the ISSOs at the following but not limited to the primary places of performance;TISCOM, C2CEN, OSC, and Electronic Support Unit facilities located throughout the United States. Additionally, support to other facilities and vessels (air and sea) both CONUS and OCONUS may be required.

The Contractor shall analyze and implement the Information Operations Condition (INFOCON) levels in order to maintain the USCG’s connectivity to the Global Information Grid (GIG).

The Contractor shall provide support to the USCG in the coordination and implementation of Information Assurance (IA) policies, procedures and training programs. The Contractor shall also identify and report gaps in the existing IA policy and provide recommendations.

The Contractor shall provide support to the Government in the review of draft IA policy compliance procedures.

The Contractor shall utilize tools and tracking mechanisms that shall automate reporting and data collection of Information Security (INFOSEC) associated vulnerabilities. The Contractor shall submit findings and recommendations to CGCIRT.

The Contractor shall provide support to the CGCIRT in the ongoing improvement of procedures for detecting, reporting, and responding to security incidents that are classified and unclassified.

The Contractor shall provide support in drafting an Information Systems Security Plan (ISSP).

The Contractor shall provide support to the CGCIRT in obtaining information from USCG units on new vulnerability alerts and assign security risk levels as they are released.

The Contractor employee(s) providing support as an ISSO shall coordinate and maintain the DHS’ and DOD’s vulnerability database accounts.

6.1.1.2 Network Administration

The Contractor shall configure, install, manage, and support the Information Assurance (IA) network systems.

The Contractor shall determine system security vulnerabilities and recommend fixes, patches, or workarounds for applications including; but not limited to, Microsoft Office, Microsoft Outlook, DOS batch files, Oracle, Access, UNIX, Red Hat Linux, Windows NT, Windows 2000, Windows XP, Windows 2003 Server as well as other windows programs and applications.

The Contractor shall support, populate, and maintain various USCG network data in Oracle, MS Access, MS SQL and MySQL databases.

The Contractor shall develop tool sets to support various CGCIRT functions such as; vulnerability assessments, incident analysis, remote scanning, and incident clean up.

The Contractor shall install and debug current and future software applications in the USCG’s standard operating system environment.

6.1.1.3 Web Site Maintenance

The Contractor shall provide web site maintenance to the CGCIRT intranet web pages. Examples of maintenance are: updating web content; fixing broken links; fixing HTML code errors, etc.

6.1.2 ADMINISTRATIVE

6.1.2.1 Computer Incident Support

The Contractor shall provide support with Information Systems Security (ISS) incidents and coordinate reporting and tracking of incidents with the CGCIRT.

The Contractor shall document each computer incident in the Government provided database when the incident occurs.

6.1.2.2 Administrative Support

The Contractor shall provide findings and supporting documentation to complete the security certification and security accreditation packages (PWS 7.1.2)

The Contractor shall provide support to the USCG in planning, organizing, implementing, and executing the IA and INFOSEC programs.

The Contractor shall coordinate with the field unit’s ISSOs to advise and facilitate resolution of all IA and INFOSEC issues.

The Contractor shall provide support in interpreting the Department Of Defense (DOD) and Intelligence Community directives, regulations, instructions, and procedures.

The Contractor shall review system audit records and intrusion detection data in support of ISSOs in identifying security incidents.

The Contractor may be required to support the USCG by participating in a multi-agency working group (USCG, DOD or DHS) to identify, address and provide recommendations for IA and INFOSEC improvements.

The Contractor shall attend technical exchange meetings as requested by the COTR.

The Contractor shall provide meeting support, including generating meeting summaries and providing briefing materials.

6.1.2.3 Documentation Support

The Contractor employees providing support as ISSAs to the ISSOs shall assist in the preparation and maintenance of contingency plans, disaster recovery plans and similar plans that support the Continuity of Operations (COOP).

6.1.3 SECURITY MANAGEMENT

6.1.3.1 CGCIRT Watch Support:

The Contractor shall provide support to the CGCIRT in the development of work schedule to ensure there is full coverage of watchstanders.

The Contractor shall provide continuous monitoring of the firewall logs, IntruVert, and other USCG intrusion detection systems.

The Contractor shall monitor the Coast Guard Data Network (CGDN) for network intrusions and anomalies.

The Contractor shall provide 24x7x365 operational support for CGCIRT, Monday through Sunday, including weekends and holidays. The watch will be supported by a junior level and mid level security analyst. Protection of the CGDN is the number one priority of the CGCIRT watch. No other assignment will take priority unless directed by the Chief of CGCIRT.

6.1.3.2 System Security Analysis

The Contractor shall maintain the USCG network, respond to and resolve system intrusions and breaches.

The Contractor shall install and maintain advance application technology that includes but is not limited to: firewall technology, secure World Wide Web application technologies, advanced authentication (e.g.

PKI; bio-metrics), and Data Management Systems (DMS) to facilitate secure information exchange between CGCIRT and other CIRT/CERT organizations.

The Contractor shall administer and maintain classified and unclassified LAN and enterprise firewall systems.

The Contractor shall maintain virus detection, elimination, and prevention applications (e.g. Symantec).

The Contractor shall support and troubleshoot various Government-off-the-Shelf (GOTS) and Commercial-off-the-shelf (COTS) intrusion detection systems.

The Contractor shall provide support in administering, and maintaining Information Assurance (IA) incident documentation for dissemination to various government agencies and organizations.

The Contractor shall perform computer security risk assessments on a variety of USCG Information Systems when requested by the COTR.

6.2 C&A

The Contractor shall provide Information Systems Security Certification and Accreditation support to USCG facilities, conduct evaluations and assessments, and perform documentation support services.

6.2.1 Information System Security.

The Contractor shall perform NIST SP 800-37, DIACAP, and NIACAP system certification and accreditation services in support of C4IT to include the following:

The Contractor shall perform certification and re-certification of all SBU and Classified USCG Standard Workstation Image, major applications, stand-alone systems, and general support systems within the local area network (LAN) of all USCG districts up to and including the CGDN+ wide area network (WAN) for accreditation approval.

Depending on the classification of a system the Contractor shall use either the NIST SP-800-37, DIACAP, or NIACAP as the primary guideline for conducting information system certifications. In addition, the Contractor shall use the COMDTINST5500.13B and USCG Guide to the Certification and Accreditation Process as guidance for the USCG certification methodology.

In accordance with NIST SP 800-37, DIACAP and NIACAP, the Contractor shall use a three-phased process to establish a Certification and Accreditation Package. The three-phased process includes the following:

o Phase 1 – Pre-Assessment/Initiation: Consists of but not limited to the following; (i) preparation; (ii) reevaluate project plan and resource identification; and (iii) system security plan analysis, update and acceptance. The Contractor shall ensure that the Designated Authorizing Official and Information Systems Owner are in agreement with contents of the system security plan.

o Phase 2 – Security Certification: Consists of but not limited to the following (i) security control assessment, and (ii) security certification documentation. The Contractor shall determine the extent to which the security controls in the information system are implemented correctly, operating as intended, and producing the desire outcome with respect to meeting the security requirements of the system.

o Phase 3 – Security Accreditation: Consists of but not limited to the following (i) security accreditation decision, and (ii) security accreditation documentation. The Contractor shall provide support to the Government in determining if the remaining known vulnerabilities in the information system pose an acceptable level of risk to agency operations, agency assets, or individuals.

The Contractor shall provide support/conduct a Risk Assessment (RA) using NIST SP 800-53 Self Assessment Checklist.

The Contractor shall provide support/conduct annual Self Assessment using the NIST SP 800-53 for systems accredited under the NIST SP 800-37, and assist/conduct annual IA Control Review for systems accredited under the DIACAP process. The Self Assessment shall be required no later than five (5) business days prior to the anniversary date of the Authority to Operate and no later than five (5) business days prior to the anniversary date of the C&A. Additional time to submit an annual Self Assessment may be authorized on an “as needed” basis.

The Contractor shall provide support/conduct at any time that a CG system SBU or Classified i.e., GSS, Maj App or Standalone systems accreditation is revoked by DAA, system security posture changes, or by normal expiration of the ATO this system shall go through the reaccreditation process. The reaccreditation process requires that all documents are updated with system changes and an ST&E is complete prior to submitting a request for an ATO to the system DAA.

The Contractor shall provide support/develop a Connection Approval Package (CAP) for systems that require connectivity to CGDN+ or to SIPRNET.

The Contractor shall determine the security requirements and provide a Requirements Traceability Matrix (RTM) to the COTR when requested.

The Contractor shall comply with a full Initiation Phase. The full Initiation Phase consists of (i) generating an information system initial risk assessment report; (ii) developing the system security plan (SSP); and, (iii) supporting the security testing and evaluation, independent verification and validation, independent audits. The SSP is updated in Phase 1 and updated in each Phase as the system development progresses and new information becomes available. The Contractor shall obtain, retrieve, compile, draft and prepare necessary documentation for inclusion to the SSP. The Contractor shall ensure that all drafts go thru Quality Assurance Review prior to delivery.

The Contractor shall verify the accuracy of the System Security Plan (SSP), system architectural diagrams, and, identity of the systems being accredited as SBU, Classified, or National Security System.

The Contractor shall perform System Architectural Analysis to include review of network connections and interfaces, review system application specification and requirements, specifically those relevant to system security, and review other pertinent system development life cycle documentation.

The Contractor shall determine if Personal Identifiable Information is stored, processed, or transmitted within the general support system. If applicable, the Contractor shall conduct a Privacy Threshold Analysis (PTA).

The Contractor shall assemble packages at the direction of the COTR, and provide two (2) copies of the package. A SBU package shall consist of 11 artifacts but not limited to: Certification memorandum;

Accreditation memorandum, MOA or ISA, Consent to Monitor memorandum, SSP, FIPS-199, Rules of Behavior, NIST 800-53, ST&E, Contingency Plan, Contingency test document, Security Assessment Report, and the POA&M. A Classified package shall consist of but not limited to: Network Topology, Consent to monitor, Statement of Residual Risk, SSP, Implementation Plan, Identification Profile, Scorecard, POA&M, Risk Assessment, and Contingency Plan. The Contractor shall prepare this package for deliver to management in order to obtain signature from the Certification Authority, who grants certification and the DAA or Authorizing Official, who grants the accreditation, which results in an approval to operate the system.

The Contractor shall monitor Trusted Agent FISMA dashboard to ensure that all security criteria and regulatory requirements are maintained, and that changes that affect the C&A documentation are denoted.

The Contractor shall use the Risk Management System (RMS) tool to input information or create a C&A package during the four phases of the C&A process.

The Contractor shall develop and maintain USCG Online C&A Web Site and C&A Tracking Tool.

6.2.2 Conduct Evaluations and Assessments

The Contractor shall perform technical evaluations and assessments, provide support in the development of resolutions to INFOSEC related problems, and assist in the resolution of technical security issues. This support shall include development of white papers exploring procedural or architectural alternatives, development of procedures or designs. Examples of analysis include, but are not limited to, commercial-off-the-shelve (COTS) products, support for Public Key Infrastructure (PKI) and Digital Signature solutions as well as the development of audit procedures and exploration of technical alternatives to resolve security related corrective action plans identified in previous security analysis efforts.

The Contractor shall conduct technical evaluations and assessments, as applicable, of local area network up to the wide area network router, software and/or hardware products and systems capabilities that have the potential for use in the USCG Enterprise-Wide Computer Security Program. The Contractor shall ensure that evaluation and/or assessment shall include interactive correspondence with other non-USCG agencies that may have experience with the product or capability. The Contractor shall ensure that the evaluation also includes information on the procurement, installation cost, training and staffing required to implement the product or capability. The Contractor shall deliver resulting reports, proposals, evaluations, and assessments to the COTR and Office of Information Assurance Management Staff. Final Reports may require Quality Assurance Review.

The Contractor shall conduct security related compliance reviews at the direction of the COTR within USCG office worldwide, utilizing checklists and other materials supplied by the COTR.

The Contractor shall participate in IT system and USCG facility compliance reviews. The Contractor shall provide a detailed report to the COTR for each review, within 10 days of completion. Final Reports may require Quality Assurance Review.

The Contractor shall perform research, analysis, review training materials, training aids and application software specifically designed for training.

6.2.3 Documentation Support.

The Contractor shall provide documentation services related to Certification and Accreditation activities.

The Contractor shall compile, develop and refine the standardized processes for developing IT system Accreditation.

The Contractor shall organize and maintain electronic libraries of all documents and task-associated documentation, deliverables, reference materials, memorandums, and relevant documentation through systems development life cycle to include: all drafts, versions, finals, updates, maintenance, and retirement to electronic archive.

The Contractor shall compile, draft, review, develop, and deliver recommendations on all aspects relevant to IA INFOSEC activities, processes and associated documentation to the COTR for review and approval.

The Contractor shall update Documentation Style guides upon COTR request, and implement standard style and formats for all C&A associated documentation, reports and task related elements.

Upon COTR request, the Contractor shall update the electronic C&A Reference library which includes, but is not limited to all existing and future, Office of Information Assurance C&A associated documentation.

The Contractor shall maintain and update USCG Templates and Procedures for standardized security related processes, to include but is not limited to, Certification and Accreditation (C&A), Signature Letters, and System Test and Evaluation ST&E.

The Contractor shall review security related work products (C&A packages) for compliance, content and adherence to the approved style and format guidelines. C&A Packages include but are not limited to reports, documents, test plans, procedures, evaluation criteria, analysis results and all security related documents.

The Contractor shall electronically apply and track all documents and written comments, as requested by the COTR. The Contractor shall ensure that all security related documentation is compliant with standards and requirements, in accordance with established guidelines and delivery schedules. The Contractor shall prepare, reproduce, and file all security related packages and related documentation, as defined by the USCG System Development Life Cycle requirements.

All documents are considered "drafts" until finalized and approved by COTR. All documents associated with this task are considered “living documents”. As such, documents shall evolve and progress through System Development Life Cycle.

The Contractor shall review all available system documentation, and in association with the client(s) assist in determining the C&A boundary.

The Contractor shall provide support in the development, revision, review, preparation and/or dissemination of INFOSEC policies, procedures, literature, handouts, guides, and/or graphical/visual presentations, as directed by the COTR.

6.3 Secure Communications

The Contractor shall provide TEMPEST Field Technical Authority (FTA) support for the area of Secure Communications Services.

6.3.1 Conduct baseline review of TEMPEST inspection reports. Provide comments for technical and/or engineering response as required to the COTR/TA.

6.3.2 Evaluate TEMPEST inspection reports, including ITS and VTI’s to insure compliance with

NSTISSAM TEMPEST 2-95 and IA-5239-31 (series).

6.3.3 Submit recommendations for mitigation of TEMPEST hazards regarding network devices (routers, switches, and computers).

6.3.4 Maintain TEMPEST files for all CG afloat, Ashore and aviation units.

6.3.5 Coordinate Field Technical Authority training and certification.

6.3.6 Conduct FTA Visual TEMPEST inspections of IT systems on behalf of the CG Certified TEMPEST

Technical Authority (CTTA) as directed.

6.3.7 Correct VTI discrepancies in accordance with NSTISSAM 2-95 and IA 5239-31 as directed by CG

CTTA. This shall include, but not be limited to legacy cutters, and Deepwater assets.

6.3.8 Maintain tool kit to include CG provided Digital Multi-meter, bond straps, hardware, disk sander, etc to facilitate repairs. Subject kit will be shipped in advance to the inspection site and recovered when required.

6.3.9 Perform IT infrastructure and cabling within Protected Distribution System (PDS) inspections as directed by the CG CTTA and TA.

6.3.10 Maintain PDS files for all applicable CG facilities.

6.3.11 Respond to external customer’s TEMPEST program inquiries /questions and conduct research relating to TEMPEST matters.

6.3.12 Maintain Classified TEMPEST countermeasure review files for facilities.

6.3.13 Preview IT cable and IT network equipment layout drawings and any TEMPEST control plans prior to any installation.

6.3.14 Attend meetings concerning TEMPEST matters as required in addition to providing notes/distributed materials to the TA.

6.3.15 Maintain TEMPEST reference library to include select publication updates.

6.4 IA Training Support.

The Contractor shall provide support with the preparation of the annual USCG ISSO Security Conference and training seminar.

The Contractor shall provide support in providing training support on the Information Systems Security (ISS) awareness and training program to the USCG Information Security personnel.

The Contractor shall provide training support on the IA standardized training program.

The Contractor shall provide training support on C&A processes.

The Contractor shall document all training provided to students and maintain training records.

7.0 REFERENCES.

7.1 COMDTINST 5200.16, Standard Workstation Configuration Management Policy

7.2 COMDTINST M5500.13B, Information Assurance Manual

7.3 COMDTINST M5216.4C Coast Guard Correspondence Manual

7.4 OMB Circular A -130, Management of Federal Information Resources

7.5 NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach

7.6 NIST Special Publication 800-53, Rev 3, Recommended Security Controls for Federal Information Systems and Organizations

7.7 NIST Special SP-30, Risk Management Guide for IT Systems

7.8 NIST Special SP-18, Guide for Developing Security Plans for Information Technology Systems

7.9 Coast Guard Computer Incident Response Team By-Laws (see Attachment 1)

7.101 Automated Information Systems (AIS) User Acknowledgement (see Attachment 2)

7.11 CJCSM 6510.01E, Chairman Joint Chiefs of Staff Instruction: Information Assurance (IA) and Computer Network Defense (CND)

7.12 DOD 5200.1R, DOD Information Security Program

7.13 DODI 8510.bb, Defense Information Assurance Certification and Accreditation Program (DIACAP)

7.14 DOD 8500.01E, Information Assurance (IA)

7.15 DOD 8500.2, Information Assurance Implementation

7.16 COMDTINST 2070.20, Secret Internet Protocol Router Network (SIPRNET), Management Policy

7.17 DHS Management Directives 4300A (Series) and 4300B (Series)

7.18 DHS Federal Information Security Management Act (FISMA) of 2002

Note: PWS Section 8.0 begins on the next page.

8.0 DELIVERABLES.

The Contractor shall consider the items below as having mandatory due dates. Items noted as “COTR Checkpoints” are deliverables or events that must be reviewed and approved by the COTR prior to proceeding to next deliverable or event in this PWS.

ITEM PWS DELIVERABLE / EVENT DUE BY

1 1.11 Kick-Off Meeting

No later than five (5) business days after the date of task order award

1.11;

1.12

Draft Contractor Project Plan

Task Order Kick-Off Meeting

1.11;

1.12

Final Contractor Project Plan

No later than five (5) business days after the Kick-Off Meeting

1.13 Progress Reports

The fifth (5th) of each month for the prior month

5 1.14 Meeting Minutes The fifth (5th) business day following the meeting

1.10 Trip Reports

No later than five (5) business days at the completion of the trip

6.2.1 Annual Information system security program self-assessment

No later than five (5) business days prior to the anniversary date of…