PWS6b-Assessment_and_Authorization_Support_v5.pdf

PROCUREMENT SENSITIVE

6B – Information Technology Security SOW

Assessment and Authorization Services

Statement of Work

Donna Bennett, FEMA CISO ii

INTENTIONALLY LEFT BLANK

i

Table of Contents

1.0 Introduction

1.1 Scope

1.2 Background/Current Contract Environment

1.3 Objectives

1.4 Applicable Documents

2.0 Specific Tasks

2.2 Task 2 – Agent of the Certifying Authority/Risk Executor Support Services

2.3 Task 3 – Documentation Management, Policy, Guidance and Publication Support .. 10

2.4 Task 4 – Audit and Assurance Services

2.5 Task 5 – Security Awareness, Training and Education Services

2.5.1 Mission/Operations/Goals ......................................... Error! Bookmark not defined.

2.6 Task 6 – System/Application Vulnerability and Penetration Testing Support (Internal and External)

2.7 Task 7 – A&A Support (Security Independent Verification and Validation)

2.8 Task 8 – A&A Support (Cyber Security Resiliency)

2.9 Task 9 – Privacy Support

2.10 Task 10 – Security Control Assessor

2.11 Task 11 - Senior Technical Writer Support

2.12 Task 12 – Adhoc and Surge Requirements

3.0 Deliverables

4.0 Work Schedule

5.0 Place of Performance

5.1 Project Management

5.2 Information System Security Officer

6.0 Contractor Experience Requirements – Key Personnel

7.0 Government Furnished Information And Equipment

8.0 Contractor Furnished Equipment

9.0 Safeguarding of Sensitive Information

10.0 Information Technology Security and PRIVACY TRAINING

ii

11.0 Accessibility Requirements (Section 508)

11.1 Section 508 Applicable EIT Accessibility Standards

11.2 Section 508 Applicable Exceptions

11.3 Section 508 Compliance Requirements

12.0 Other Considerations

12.1 Travel Requirements

12.2 Inspection and Acceptance

12.3 Operating Constraints

Appenix A. Performance Based Matrix iii

INTENTIONALLY LEFT BLANK

1.0 INTRODUCTION

FEMA’s Chief Information System Officer (CISO) and staff is responsible for developing a comprehensive management approach for ensuring compliance with the Federal legislation, regulation and guidelines, departmental policies and procedures as well as ensuring information systems operate at an acceptable risk based on the required mode of operations.

The CISO serves Division Chief of the Office of Cyber Security (OCS) and reports directly to the FEMA Chief Information Officer (CIO).

The OCS functions as FEMA’s principal office for cyber security management, oversight, and issue resolution. The office oversees FEMA’s Cyber Security Program by managing and controlling all aspects of security vulnerabilities, including conducting incident investigation, diagnosis, resolution, recovery, and closure, as well as establishing and maintaining security education and training programs.

1.1 Scope

OCS will utilize this contract vehicle to obtain experienced, talented, and highly skilled certified technical cyber security professionals to augment the OCS staff and assist with delivering OCS services and support –

• Assessment and Authorization (A&A) Project and Program Management provides project management services for OCS tasks and activities

• Certification Agent/Risk Executor Support the will perform A&A Package Reviews, briefing to the Chief Information Officer (CIO)/Authorizing Official, and Chief Information Security Officers, prepare and finalized for signature and submission, and recommend authorization decisions.

• Policy, Guidance and Publication Support develops Cyber Security-related policies and procedures. In addition, provides customized security-specific brochures and publications.

• Audit and Assurance Services provides qualified cyber security professional to assist with the remediation of internal and external audit findings.

• Security Awareness, Training and Education Services which includes basic and advanced security training and workshops to be offered every quarter, customized security awareness programs, annual Cyber Security Awareness month activities, a comprehensive Cyber Security web site, security-specific brochures and publications, and many other awareness and compliance programs.

• System/Application Vulnerability and Penetration Testing Support (Internal and External) perform infrastructure, application, network, database, and mobile vulnerability services as well as Secure Code Reviews on FEMA information systems. In consort, utilize the latest tools and techniques to simulate the way a hacker or disgruntled employee might use gain-unauthorized access to an information system.

• Threat Management provides services to Program and Regional Offices concentrating on threat intelligence information and operational support.

• A&A Support (Security Independent Verification and Validation) will provide an in-depth extremely technical Independent Verification and Validation (IV&V) of the management, operational and technical security controls on a system to determine if the controls were properly implemented in support of initial, reauthorization, or continuous authorization.

• A&A Support (Cyber Security Resiliency) will provide accurate identification, documentation, and testing of security controls.

• Adhoc and Surge Requirement provide responses to OCS adhoc cyber security requests.

• Privacy Support will provide for the FEMA Chief Privacy Officer with the creation, development and disposition of system Privacy Threshold Analysis and Privacy Impact Analysis.

• Security Control Assessor will provide comprehensive assessment to the Certification Agents (CA).

The Offeror shall provide the expertise, technical knowledge, staff support, and other related resources necessary to:

• Perform analysis to ensure security controls are consistently implemented.

• Integrate new technology with Cyber Security standards.

• Develop and execute plans for monitoring, assessing, and verifying security controls across all major information systems.

• Develop, evaluate, and exercise IT survivability and contingency plans.

1.2 Background/Current Contract Environment

OCS provides cyber support to FEMA’s emergency management and continuity mission by utilizing the Federal Cyber Security Framework, in order to

• Identify risks to systems, assets, data, and capabilities;

• Protect mission essential and critical services;

• Detect cybersecurity events;

• Respond to detected cybersecurity events; and

• Recover capabilities or services that were impaired due to a cybersecurity event.

OCS plans, coordinates, integrates, synchronizes, and conducts activities that lead day-to-day safeguarding and protection of FEMA information systems (directly and indirectly connected to the FEMA infrastructure). At a minimum, OCS supports information within the continental United States (CONUS) and outside the continental United States (OCONUS). These information systems may reside at, but not limited to, the FEMA Headquarters (within the National Capital Region); the 10 Regional Offices (Boston, New York, Philadelphia, Atlanta, Chicago, Denton, Kansas City, Denver, Oakland, and Seattle); 8 Distribution Centers [Moffett, Guam, Hawaii, http://en.wiktionary.org/wiki/continental_United_States http://en.wiktionary.org/wiki/continental_United_States http://en.wiktionary.org/wiki/continental_United_States

Fort Worth, Caribbean, Atlanta, Disaster Information System Clearinghouse (DISC), Fredrick]; various Disaster Emergency Communications facilities; and Contractor Owned and Contractor Operated (COCO) facilities.

The Top Technology challenges are face by OCS are:

1. Resiliency – Resilient Architecture and Operations

2. Automated Risk Detection-monitoring Heuristic/Behavioral - Large scale/Real-time/Multi-domain

3. Automated Risk Mitigation

4. Usability – Transparent Security

5. Cloud - Store Sensitive Government Data Searchable and Usable on Public Clouds

6. Detection and Response Mechanisms for Insiders (Timely, Fine-grained)

7. Leverage Classified Knowledge/Signatures in a Host-based System

8. Mobility - Hardware RoT, SEAndroid, Secure boot, Secure Baseband

9. Security for Cloud User Environments – Thick/Thin Client, Virtualization

10. Engineering, Testing, and Operating Secure Composite Systems

11. Establishing and Maintaining Assurance in Heterogeneous, Mobile and Cloud

Environments

FEMA’s mission is to reduce the loss of life and property and protect communities nationwide from all hazards, including natural disasters, acts of terrorism, and other manmade disasters.

FEMA leads and supports the nation in a risk-based, comprehensive emergency management system of preparedness, response, recovery, assistance, and mitigation. In support of this mission, FEMA uses a wide variety of information systems and information technology (IT) solutions and services. These systems, solutions, and services must be operated and maintained at the highest level of confidentiality, availability, and integrity.

OCS will provide oversight and management of the work and tasks orders under this Statement of Work. The mission of the FEMA OCIO is “to enhance and maintain IT infrastructure; develop and enhance key systems to support operating programs; increase efficiencies and cooperation across FEMA’s divisional and regional lines.” The vision and strategy of the OCIO is to modernize FEMA IT systems and services and to “deliver world-class secure IT guidance, products, and services to meet the needs of FEMA’s emergency managers and stakeholders nationwide.” The environment must be implemented with the flexibility required to support the evolving mission of FEMA and to support the surge requirements necessary to support emergency situations as they occur.

Currently, FEMA’s IT environment is an amalgam of new and legacy technologies, architectures, platforms, and tools that includes a wide variety of PC-based, client-server, web-based, mobile technology, and service-oriented components. The IT systems supporting FEMA’s are implemented using a variety of service providers under both mature and immature oversight and governance conditions. As stated above, the current goals are to continue the evolution and improvement of all IT services and support. The OCIO goal will be achieved by utilizing an approach and strategy that is consistent with both the Department of Homeland Security (DHS) and FEMA strategy.

1.3 Objectives

The following are objectives of FEMA’s Cyber Security Program:

• Perform gap analysis on current security infrastructure

• Ensure consistent application of information security standards across all agency information systems.

• Meet all regulatory and agency documented standards and guidance.

• Integrate these regulations and standards into a fully implementable security program.

• Ensure preparation for internal and external audits through management of all infrastructure artifacts required to pass audits.

• Ensure all new information technology (IT) projects meet or integrate security standards into their development.

• Develop a culture of security-mindful professionals across the community.

• Strive to be more flexible and responsive to new regulatory directives.

• Serve as the central authority for all Cyber Security-related activities across the agency.

• Ensure information system survivability and integrity.

• Optimize processes to meet Cyber Security-related goals and strategies

1.4 Applicable Documents

This section contains a list, but not limted to, applicable references utilized by OCS –

• National Institute of Standards and Technology (NIST), Special Publication (SP) 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems— A Security Life Cycle Approach, February 2010

• NIST SP 800-39, Managing Information Security Risk—Organization, Mission, and Information System View, March 2011

• NIST SP 500-53, Security and Privacy Controls for Federal Information Systems and Organizations

• NIST SP 500-53, Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans

• NIST SP 800-65, Integrating Cyber Security into the Capital Planning and Investment Control Process, dated January 2005

• 4300A Sensitive Systems Policy -- Version 11.0

• 4300A Sensitive Systems Policy Handbook -- Version 9.1 o Attachment B - Waivers Request Form -- Version 11 o Attachment C - ISSO Letter -- Version 11 o Attachment D - Type Accreditation -- Version 11 http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300A%20Sensitive%20Systems%20Policy.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300A%20Sensitive%20Systems%20Handbook.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20B%5d%20Waiver%20Request%20Form.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20C%5d%20ISSO%20Letter.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20D%5d%20%20Type%20Accreditation.docx o Attachment E - FISMA Reporting -- Version11 o Attachment F - Incident Response -- Version 9.1 o Attachment G - Rules of Behavior -- Version 11 o Attachment H - POAM Process Guide -- UNDER REVISIONS -- Version 9.1 o Attachment I - Workstation Logon o Attachment K - IT Contingency Plan Template -- Version 11 o Attachment L - Password Management o Attachment M - 800-53 Controls -- Version11 o Attachment N - Interconnection Security Agreements -- Version 11 o Attachment O - Vulnerability Management -- Version 9.1 o Attachment P - Document Change Requests -- Version 11 o Attachment Q1 - Wireless Systems --Version 11 o Attachment Q2 - Mobile Devices -- Version 11 o Attachment Q3 - Tactical Systems o Attachment Q4 - RFID Systems -- Version 11 o Attachment R - Compliance Framework Guide -- Version 9.1 o Attachment S - Compliance Framework for Privacy Systems -- UNDER REVISIONS

-- Version 9.1 o Attachment S1 - Managing CREs containing SPII -- UNDER REVISIONS -- Version

9.1 o Attachment T - Acronyms o Attachment X - Social Media -- UNDER REVISIONS

• 4300B National Security System Policy Cover Page - Version 9.0

• 4300B National Security Systems Table of Contents - Version 9.0

• 4300B.100: Safeguarding and Risk Management for NSS

• 4300B.101 Risk Management for NSS

• 4300B.102 National Security System Security Control Guidance

• 4300B.103 Template Guidance o 4300B.103-1 Template for System Security Plans o 4300B.103-2 Template for Risk Assessment Reports o 4300B.103-3 Template for Security Assessment Reports o 4300B.103-4 Template for Plans of Action and Milestones

• 4300B.106 DHS NSS General and Privilege User Account Request Minimum Requirements

• 4300B.107 Decommissioning Strategy Minimum Requirements

• 4300B.108-1 National Security System References

• 4300B.108-2 National Security System Policy Change Request

• 4300B.200 Communication Security (COMSEC) - Version 2.0

• DHS Ongoing Authorization Methodology

• DHS CISO NIST SP 800-53 Security Controls tri-fold

• DHS FISMA System Inventory Methodology

• DHS Information Security Performance Plan http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20E%5d%20FISMA%20Reporting.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20F%5dIncident%20Response.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20G%5d%20%20Rules%20of%20Behavior.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20H%5dPOAM%20Guide.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20I%5dWorkstation%20Logon.doc http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20K%5d%20%20IT%20Contingency%20Plan%20Template.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20L%5dPassword%20Management.doc http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20M%5d%20Tailoring%20NIST%20800-53%20Security%20Ctrls.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20N%5d%20Interconnection%20Security%20Agreements.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20O%5dVulnerability%20Management.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20P%5d%20Document%20Change%20Requests.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20Q1%5d%20Sensitive%20Wireless%20Systems.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20Q2%5d%20Mobile%20Devices-CLEAN%20DRAFT.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20Q3%5dTactical%20Systems.doc http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20Q4%5d%20Sensitive%20RFID%20Systems.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20R%5dCompli%20Fmwk%20CFO-designated%20Systems.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20S%5dCompliance%20Framework%20for%20Privacy%20Systems.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20S1%5dManaging%20CREs%20Containing%20SPII.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20T%5dAcronyms.doc http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.000%20National%20Security%20Systems%20Policy%20Coverpage.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.000_TOC_4300B_05102013.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.100%20-%20Safeguarding%20and%20Risk%20Mgmt%20for%20NSS.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.100%20-%20Safeguarding%20and%20Risk%20Mgmt%20for%20NSS.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.101%20-%20Risk%20Management%20Framework.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.101%20-%20Risk%20Management%20Framework.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.102%20-%20NSS%20Security%20Control%20Guidance%20FINAL.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.102%20-%20NSS%20Security%20Control%20Guidance%20FINAL.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103-1%20-%20System%20Security%20Plans%20FINAL.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103-1%20-%20System%20Security%20Plans%20FINAL.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103.2%20-%20Risk%20Assessment%20Reports.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103.2%20-%20Risk%20Assessment%20Reports.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103-3%20-%20Security%20Assessment%20Reports.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103-3%20-%20Security%20Assessment%20Reports.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103-4%20-%20Plans%20of%20Action%20and%20Milestones.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103-4%20-%20Plans%20of%20Action%20and%20Milestones.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.106%20-%20User%20Minimum%20Requirements.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.106%20-%20User%20Minimum%20Requirements.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.106%20-%20User%20Minimum%20Requirements.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.106%20-%20User%20Minimum%20Requirements.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.107%20-%20Decommissioning%20Strategy.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.107%20-%20Decommissioning%20Strategy.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.108-1%20-%20NSS%20References.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.108.2%20-%20NSS%20Policy%20Change%20Request.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.200%20COMSEC.pdf

• DHS Security Authorization Process Guide

• DHS Document Review Methodology

• Document Review Checklists

• Security Authorization Document Templates

• FIPS-199 Workbook and Instructions

• Privacy Threshold Analysis (PTA) Template

2.0 SPECIFIC TASKS

A project is a temporary group activity designed to produce a unique product, service or result.

Tasks and activities executed within the OCS are treated as projects. Offeror shall provide project management services for Cyber Security Consultants tasks and activities. Cyber Security Consultants Project Management services shall adhere to the PMI Project Management framework for project planning, scheduling, communications, reporting, and contractual activity and to ensure that any technical issues are addressed quickly and professionally.

The Offeror’s Project Manager shall be responsible for the Project Planning and Project Management aspects of this task. This task continues for the entire duration of the project.

This task includes the regularly scheduled meetings and specified documentation; i.e., Weekly Status Meeting, Weekly Status Reports, Weekly Work, Plan Review, Schedule Review, and Oversight/Stakeholder Reporting.

The Offeror shall develop a Project Management Plan (PMP) successful execution of the tasks within this SOW. The PMP shall to manage, schedule, and track progress using Microsoft (MS) Project or agreed upon medium (e.g., SharePoint). The current progress information shall be provided to the Government through contractor management meetings, monthly activity reports, and MS Project files. The PMP shall –

• Provide leadership, management, and administrative support for contractor work in support of Cyber Operations. Specific activities include but are not limited to the following:

• Provide overall management and oversight of contract staff and activities to ensure all work comply with applicable DHS, FEMA, and OCIO policies and regulations; ensure contractor performance is timely and meets OCIO/CISO program goals and performance standards

• Provide overall technical leadership and oversight; recommend and oversee the implementation of proactive and leading edge technical and technological approaches and solutions to address emerging cyber security trends; report on an annual basis

• Provide administrative support for contract work activities to include support Cyber Operations; prepare memorandums and correspondence; perform filing, passing of clearances, meeting and conference coordination, and other office administration duties

• Provide and finalize the Program Management Plan within 20 business days of contract start date.

• Provide and finalize individual Task Management Plan that addresses at a minimum, performance schedule, milestones, deliverables, and approaches to problem resolution and communication and coordination with Government personnel within 20 business days of contract start

• Provide and finalize GFE Inventory Management Procedures within 20 business days of contract start

• Monitor and track program and task performance to ensure on time service delivery within established cost estimates

• Identify, recommend, and implement (upon Government approval) cost-saving measures

• Provide monthly Task Status Report for each task (to the designated Government Technical Monitor) by the 15th of each month, presenting:

o Activities and milestones completed and deliverables submitted for each task for the past month o Indication of potential schedule variance, mitigation strategies, and actions taken o Issues encountered and resolution applied o Issues unresolved and current status and actions o Milestones and activities planned for the next reporting period

• Provide monthly Program Status Report (to the Contracting Officer’s Representative) by the 15th of each month, incorporating the Task Status Reports and the following for the overall program:

o Updated of the SOW Plan of Action and Milestones (POA&M) schedule (originally delivered as part of the PMP) including milestones achieved and schedule changes o Funding expended and funding remaining o A copy of deliverables submitted to the government for acceptance o Program risks identified and mitigation action taken and planned o A narrative of management or technical problems o Suggestions and Recommendations o A projected schedule for next month’s activities o A report of all activities during travel, in a format specified by the Contracting

Officer’s Representative (COR).

o Total cost incurred in the past month and fiscal year-to-date o Indication of potential cost and/or schedule variance, mitigation strategies, and actions taken o Funding and expenditure status o Staffing status to include current staffing level (%); positions open/unfilled and number of days open/unfilled o Cost saving measures implementation status including activities and milestones completed and planned

• Conduct Program and individual Task Status Review monthly, as requested by the Program Manager and/or COR, to provide opportunity for report clarification and issue resolution

• Prepare and conduct quarterly Program Performance Reviews (IAW Quality Assurance Surveillance Plan) to include identification of potential cost saving measures in each task area and related implementation plans and status

• Support acquisition of materials and services incidental to contractor work activities

The Offeror shall develop and submit the following management controls reports:

• Contract Management Meetings,

• Use of Automated Tools, and

• Quality Control (QC) and Quality Assurance (QA) Procedures.

2.1.1.1 Regular Contractor Management Meetings

The Offeror and FEMA shall hold regularly scheduled monthly Contractor Management Meetings. The meeting shall provide the government and the Offeror an opportunity to discuss current tasking, provide additional guidance to the technical task management of the contract, and give the Offeror an opportunity to ask questions pertinent to the successful completion of the task.

2.1.1.2 Quality Control and Quality Assurance Procedures

Quality of data is paramount importance to the FEMA. The Offeror plays a critical role in establishing and maintaining the quality of the program. The Offeror shall perform the following:

• Data Collection Quality Control (QC) – The Offeror shall develop and implement a written QC program for data collection to ensure compliance with DHS and FEMA processes and procedures.

• Data Quality Assurance (QA) – The Offeror shall support and participate in the DHS QA review program as defined by the requirements of Contractors QA Procedures. The Offeror shall provide propose corrective actions to the COR to address any minor deficiencies identified in the review within five working days of receiving the QA report.

If the Offeror receives an unacceptable QA rating, FEMA may suspend the Offeror’s activities, by written notice from the Contracting Officer (CO) until acceptable adjustments have been implemented and an acceptable QA is earned by the Offeror.Regular Contractor Management Meetings

2.2 Task 2 – Agent of the Certifying Authority/Risk Executor Support Services OCS serves as an Agent of the Certification Authority (ACA) that performs validation services under NIST guidance that includes approximately twenty-five (25) on-site assessments annually, across both CONUS (80%) and OCONUS (20%) sites, and up to twenty-five (25) annual remote assessments. Both on-site and remote assessments include validations under the NIST/DHS Security Authorization, site assistances, audits, and reviews (i.e., Documentation Review, Critical Controls Review, etc.). The current OCS Security Authorization program is expected to double in size over the next three years. These auditors will also play a key role by providing feedback to developers for incorporation into the OCS outreach program, a new OCS program that will consolidate Cyber Security checklists reducing duplication of effort and improving inspection efficiency through electronic communication.

The Offeror shall provide support services for those Programs seeking assistance in obtaining an authority to operate. Capabilities include both testing and validating functions of implemented security controls. These functions may potentially overlap with existing ISSM/ISSO personnel functions assigned to Information Systems (ISs).

Agent of the Certifying Authority (ACA) /Risk Executor Support Services with ISSM/ISSO functions seeking an authority independent of the program to perform both testing and validating of any existing IS security controls put in place by the IS developers. If mitigations to remaining IS vulnerabilities are required, the ACA possesses the necessary skills to recommend additional security controls for program personnel to implement so that the ACA could subsequently re-test and validate.

ACA support without ISSM/ISSO functions seeking an authority independent of the program to perform validation of security controls implemented and tested by ISSM/ISSO personnel before the OVS can certify the IS for accreditation at the appropriate Authorizing Official (AO).

The Offeror shall provide a Certification (CA) Manual to update, test, implement and validate the most efficient and effective methods for conducting Cyber Vulnerability Assessments

The OCS program is responsible for ensuring compatibility and compliance with the DHS and FEMA’s Cyber Security Programs outlined in applicable policies for all OCS operational network systems located across the US. Knowledge and extensive experience in networking, systems management, programming and tool development, the UNIX (primarily LINUX and SOLARIS) operating system, the Microsoft Windows (all variants) operating system, security analyst tools and techniques, and data base design and management is necessary to identify required modifications and determine innovative solutions.

The Offeror shall provide the Cyber Security with accreditation and certification requirements for the Enterprise.

The Offeror shall provide a CA Manual to update, test, implement and validate efficient and effective methods for managing a Cyber Security program. The Offeror shall be expected to identify issues within operational systems in regard to Cyber Security and suggest procedures to optimize network activity.

The Offeror shall provide consulting services for this task to the government.

2.2.1.1 Collaboration Meeting

The Offeror shall host regular Collaboration Meeting with all system stakeholders (System Owner, ISSO, AISSO, etc.). Through the meeting OCS shall:

• Build relationships

• Create transparency BI and

• Promote the of vision OCS

The Offeror shall develop a standard operating procedure guide for the collaboration meetings.

The guide shall outline but limited to the following items:

• Development of a Meeting Planning Checklist

• Creation of Agenda/Meeting Minutes

• Creation of Schedule

• Clarify roles and responsibility (prior to meeting, during the meeting and after the meeting)

• Address how Meeting Minutes will be distributed to all system stakeholders

2.3 Task 3 – Documentation Management, Policy, Guidance and Publication Support

The Offeror shall establish, maintain, and administer an integrated data management system for collection, control, publishing, and delivery of all program documents. The data management system shall include but not be limited to the following types of documents:

CDRLs, White Papers, Status Reports, Audit Reports, Agendas, Presentation Materials, Minutes, Contract Letters, and Task Order Proposals. The Offeror shall provide the Government with electronic access to this data, including access to printable reports.

The Offeror shall develop new security documentation as required by the Government and maintain existing NIST/DHS Security Authorization -required documentation for each the Cyber Security programs. Each of the programs identified in Appendix 1 are at different phases in the security life cycle; therefore, the security documentation status of each program is also at various stages.

The Offeror shall request, gather and formalize inputs to various NIST/DHS Security Authorization -required documentation from other organizations (i.e. program management offices, system management offices, system administrators, functional managers, etc.) to fully complete all NIST/DHS Security Authorization requirements.

The Offeror shall complete or assist in the coordination of all NIST/DHS Security Authorization -required documentation for each system prior to a program’s submission for an Authorization to Operate (ATO) and an Authorization to Connect (ATC). The Offeror will monitor the status of the NIST/DHS Security Authorization package through the ATO/ATC phases and will keep the ISSM, COR, and program manager abreast of current status.

The Offeror shall accomplish updates to maintain the currency of each program’s security documentation. Each security document must always reflect the most current status of the associated information system, which may require daily or weekly updates.

The Offeror shall provide Program Certification Status Reports by the 15th calendar day of each month. The reports must be organized by program. The reports will include (1) most current certification dates for each server and network device, (2) system accreditation expiration date,

(3) most current dates and types of Authorization to Operate (ATO(s)), as well as expiration dates, (4) most current dates and types of Authorization to Connect (ATC(s)), as well as expiration dates, and (5) explanation for any expired ATOs and/or ATCs.

The Offeror shall provide a Plan of Action and Milestones (POA&M) Report by the 1st calendar day of each month identifying all POA&M items that are due within the next 60 days.

• Evaluate and recommend an enterprise-wide security document management solution and methodology. If implemented, support and maintain the document management solution.

• Provide expert analysis of new federal guidance and/or changes to the security environment as it impacts security documentation.

• Support and maintain the confidentiality, integrity, and availability of security documentation.

• Optimize the content and usability of policy- and procedure-related security documentation

• Perform annual review and recommend updates of the Manual 6680 policy section

• Perform annual review and recommend updates of up to 125 enterprise-wide OCS procedures within 11 months of last government approval date

• Perform periodic testing and evaluation of the effectiveness of information security policies, procedures, practices, and security controls to be performed with a frequency depending on risk, but no less than annually

2.3.1.1 Records, Files, and Documents

All physical records, files, documents, and work papers, provided and/or generated by the Government and/or generated for the Government in performance of this SOW, maintained by the Offeror which are to be transferred or released to the Government or successor contractor, shall become and remain Government property and shall be maintained and disposed of Records Disposition – Procedures and Responsibilities; the Federal Acquisition Regulation,.

Nothing in this section alters the rights of the Government or the Offeror with respect to patents, data rights, copyrights, or any other intellectual property or proprietary information as set forth in any other part of this SOW (including all clauses that are or shall be included or incorporated by reference into that contract).

The Offeror shall provide technical writing capabilities for their own internally generated documents as part of the contractors QA plan. The Offeror will additionally provide technical writing services to the OCS for materials generated by OCS staff.

The Offeror shall provide consulting services for this task to the government.

2.4 Task 4 – Audit and Assurance Services

The Offeror shall perform independent validation of OCFO information systems following generally accepted audit protocols to ensure full compliance to FISMA, FISCAM, and A-123 requirements. The audit work shall remain separate of the other tasks to ensure segregation of duties and independence. The Offeror shall record findings into IACS as an independent validator. The Offeror shall support OCFO OFS during the annual Office of Inspector General (OIG) audits for FISMA and/or FISCAM. The Offeror shall support OFS A-123 internal review and audit program as well. The Offeror shall record findings for other sources such FedRAMP, SSAE16, or OIG into the IACS tool. The Offeror for this task shall be certified information system auditor with substantial experience in IT compliance auditing. The Offeror shall support the OFS Director for Performance Management and Quality Assurance for this task.

The Offeror shall provide consulting services for this task to the government.

2.4.1.1 A-123 Compliance

DHS is required to provide assurances over the adequacy of its internal controls over financial reporting in accordance with the DHS Financial Accountability Act and OMB Circular A-123.

FEMA coordinates with DHS to comply with these provisions on a phased implementation basis.

Contractor support will supplement Federal resources with technical expertise not currently available in-house to fulfill responsibilities for documenting and testing internal controls over business processes, financial reporting and for documenting and testing information technology general controls.

2.4.1.2 Financial Action Plan (FAP)

The Offeror will provide direct support and assistance in the development, implementation, and maintenance of a FAP. The FAP will provide an overall blueprint for remediation plans and monitoring for the following business processes: Procure to Pay, Grants Management, Budgetary Resources Management, Charge Cards, Entity Level Controls, Financial Reporting, and Logistics Management. This task will include the development of reports, tools and templates to implement and monitor the plan and reflect the Project Sponsor’s communications and control tools. The FAP will identify all key remediation elements, including the roles and responsibilities of key stakeholders, program objectives, program scope and communication. Also, the Offeror will assist in strategic planning and development and provide programmatic advice on regulations that may have an impact upon FAP sustainment.

The FAP tasking will include support for developing Mission Action Plans to remediate control deficiencies identified within the Assurance Statement, annual Risk Assessment, OMB Circular A-123 Assessments; Independent Auditors report; and other relevant control deficiencies.

2.4.1.3 Improper Payments Information Act (IPIA) and Improper Payments Elimination and Recovery Act (IPERA)

FEMA’s OCFO is committed to complying with the internal control provisions of OMB Circular A- 123 Appendix C, Requirements for Effective Measurement and Remediation of Improper Payments and developing a culture to minimize improper payments.

The Offeror will provide support to improve internal controls related to the prevention and reporting of improper payments by:

• Providing support for FEMA in assessing all programs/program activities to identify those programs susceptible to significant improper payments.

• Designing statistically-valid sample tests and extrapolating error rates for disbursement populations to identify programs susceptible to improper payments;

• Updating the data capture tool and providing support, as needed, to conduct oversight and review of FEMA test plan results questionnaire and data capture tool to ensure that they are accurately identifying improper payments; and

• Assist FEMA in implementing process improvements, including changes directed by

OMB.

• Providing support related to updating and improving data reporting tools.

FEMA and the contractor agree that the Offeror will not conduct any testing of payments, and will not have access to the proprietary information of other vendors.

2.4.1.4 Assurance Statement Development and Verification and Validation (V&V) The Offeror will provide support by assisting with the development, compilation, and review of the annual Assurance Statement. Further, the Offeror will support FEMA in executing V&V of select control deficiencies noted in the Assurance Statement and other sources. V&V facilitates FEMA’s remediation of control deficiencies to ensure that the fundamental issues are resolved and progress is substantiated. The execution of V&V will include, but not be limited to:

• Analyzing whether the project plans address the core issues and provide a viable basis to remediate the control deficiencies identified;

• Reviewing completed milestones and discussing actions taken with the relevant process owners;

http://www.whitehouse.gov/sites/default/files/omb/financial/_improper/PL_111-204.pdf http://www.whitehouse.gov/sites/default/files/omb/financial/_improper/PL_111-204.pdf

• Executing a customized Test of Design (TOD) to determine whether milestone and other work completed were designed and implemented to remediate deficiencies identified;

• Executing a Test of Operational Effectiveness (TOE) to evaluate whether the milestones and other work completed is executed as designed. The focus of the TOE assessment will be on re-performing key controls using statistical sampling where appropriate; and

• Concluding on the overall results of the TOD and TOE.

This workstream will require follow on tasking specifically related but not limited to remediation of identified risk areas and/or design and execution of control deficiencies identified through V&V. The Offeror will execute remediation in accordance with guidance issued by OMB, DHS, and OCFO. The Offeror will develop the remediation strategy with clearly defined out-puts and deliverables and provide a written weekly status report on contract execution to RMC. These efforts will be ongoing throughout the year.

2.4.1.5 Information Technology Remediation

The Offeror will assist FEMA in responding to Information Technology (IT) Notice of Findings and Recommendations (NFR) and other identified IT control deficiencies with the ultimate objective of audit readiness and control enhancements. This will be achieved primarily through the development, technical support, and V&V of work plans designed to remediate audit findings and control deficiencies. In addition, the Offeror will support control reviews and control monitoring of significant financial systems. The value to FEMA management for this project will be a single, efficient process for responding to, correcting, and validating IT control weaknesses related to financial data processing.

Contractor support will included, but not be limited to:

• Assisting FEMA in the management of the overall remediation program.

• Working with key financial systems stakeholders to drive sustainable, auditable enhancements to the control environment.

• Developing detailed remediation work plans, which will detail the milestones and artifacts necessary to fully remediate the control weaknesses identified by the corresponding NFR or other identified control deficiency.

• Creating detailed test plans for each control defined in remediation work plans.

• Testing controls using test plans previously approved by FEMA management. Test templates will be completed along with references to supporting documentation.

Detailed and summary results will be reviewed by FEMA management.

• Providing financial statement IT audit support.

2.4.1.6 Status Reporting

The Offeror will provide and maintain a Task Order Management Plan that identifies the task and subtask requirements of this Task Order. The Plan will be in a work breakdown structure (WBS) format. The Plan will include the proposed schedule and resource allocation for meeting these requirements. The Offeror will use this Plan to manage and report on the progress of all work.

Additionally, the Offeror will provide a written weekly status report on contract execution to the Contracting Officer’s Representative (COR). This report will reflect work accomplished and work planned for the near future, funding status, and critical issues pending, as well as newly identified. With the consent of the COR, status reporting on contract execution may be combined with progress meetings. The Offeror will promptly notify the COR and FEMA Management when an issue that may violate a law or regulation is detected during the course of work performed under this tasking.

2.5 Task 5 – Security Awareness, Training and Education Services The Offeror shall perform a Security Awareness Analysis of the OCS Training Program using current DHS, FEMA, NIST, and industry best practice standards. The results of the security training shall be delivered to the government within a formal report.

After the security awareness results are delivered to government, The Offeror shall work at the direction of the government to develop comprehensive security training course (to include training material) and provide advance information security training as required for FEMA designated personnel with significant OCS responsibility to include but not limited to:

• Authorizing Official/Designated Authorizing Official

• Information System Security Manager

• Information System Security Officer

• Network/System Administrators

• Web/Database Administrators.

• System Owners

• Approving Officials

The Offeror will work on specific deliverable for IT security awareness month. The Offeror will provide recommendations on the best way to engage the FEMA audience utilizing specialized targeted security awareness month activities.

The Offeror will develop basic and advanced security training workshops to be offered every quarter.

The Offeror will develop a comprehensive Cyber Security web site and Content Manager. The website shall track all training activities and notify users of new training requirements.

The Offeror will develop security-specific training brochures and publications. The Offeror will develop with leadership from the government a comprehensive Information Security Awareness Program.

The Offeror shall deliver all work products associated with this task electronically to the COR, CISO or OCS designee.

The Offeror shall provide certification training to be ordered through task orders awarded under this contract. Current certification training to include:

COMPTCyber Security

A+ Network+ Security+ Advanced Security Practitioner (CASP) A+ Continuing Education (CE) Security+ Continuing Education (CE) Network+ Continuing Education (CE) Advanced Security Practitioner Continuing Education (CE)

ISC2 Certified Information System Security Professional (CISSP) Certified Authorization Official (CAP) Systems Security Certified Practitioner (SSCP) Information Systems Security Management Professional (CISSP-ISSMP) Information System Security Architecture Professional (ISAP) Information System Security Engineering Professional (ISSEP) Information System Security Management Professional (ISSMP)

EC Council Certified Ethical Hacker (CEH) ISACA Certified Information Security Manager (CISM)

Certified Information Systems Auditor (CISA) GIAC GIAC Certified Incident Handler (GCIH)

GIAC Security Leadership (GSLC) N/A GIAC Security Essentials (GSEC) GIAC Certified Intrusion Analyst (GCCyber Security) GIAC Certified Enterprise Defender (GCED) GIAC System and Network Auditor (GSNA) GIAC Network Penetration Testing and Ethical Hacking (GPEN) GIAC Web App Penetration Testing and Ethical Hacking (GWAPT) GIAC Mobile Device Security and Ethical Hacking (GMOB) GIAC Wireless Ethical Hacking, Penetration Testing, and Defenses

(GAWN)

GIAC Hacker Tools, Techniques, Exploits and Incident Handling

The Offeror shall provide consulting services for this task to the government.

http://www.sans.org/course/network-penetration-testing-ethical-hacking http://www.sans.org/course/web-app-penetration-testing-ethical-hacking http://www.sans.org/course/mobile-device-security-ethical-hacking http://www.sans.org/course/wireless-ethical-hacking-penetration-testing-defenses http://www.sans.org/course/hacker-techniques-exploits-incident-handling

2.6 Task 6 – System/Application Vulnerability and Penetration Testing Support (Internal and External)

This optional task provides the ability to increase the Tier 1 and/or Tier 2 capability to meet changes and expansion to the mission requirements. Specifically, this task provides the ability to perform analyses and studies to implement or integrate new capabilities or enhance existing processes and procedures to meet emerging MIRD requirements or improve operational efficiency. Specific activities include but are not limited to the following:

• Evaluate, test, recommend, integrate, implement, and/or support new methods, techniques, technologies, and products to improve operational efficiency and/or enable enhanced capabilities for FEMA SOC/EDCIRC, IV&V and Vulnerability Management to include capabilities for performing web and database scanning and scanning of other IT assets, monitoring and trend analysis of attempted external attacks, and protection of Personal Identifiable Information (PII)

• Contribute technical expertise in the development and implementation of the modernized, state- of-the-art IT infrastructure, and implementation of enterprise-wide protection capabilities and safeguards

• Interact and coordinate security monitoring and network defense and protection activities with other organizations and Department entities to support compliance with new and emerging national security and homeland security requirements

• Provide monthly project status report as part of the MIRD Task Status Report by the 15th of each month, containing details as described in paragraph 7.2, Program Management and Administration

• Report on quality performance measures quarterly as part of the overall Program performance review

This task will have multiple incremental increases in capacity, above the baseline identified in previous tasks, allowing the Government the flexibility to meet the mission requirements.

If/when executed the period of performance will be from the date of the contract action to the end of the current base period of performance and then will be rolled into the…