PWS6d-Emerging_Technology_and_Modernization_Support_v5.pdf

PROCUREMENT SENSITIVE

6D – Information Technology Security SOW

Emerging Technology and Modernization Support

Statement of Work ii

INTENTIONALLY LEFT BLANK

i

Table of Contents

1.0 Introduction

1.1 Scope

1.2 Background/Current Contract Environment

1.3 Objectives

1.4 Applicable Documents

2.0 Specific Tasks

2.1 Task 1 – Project and Program Management

2.2 Task 2 - Senior Technical Writer Support

2.3 Task 3 - Security Engineering Support

2.4 Task 4 - Emerging Technology and Modernization Support

2.4.1 Tools Infrastructure Operational Support

2.4.2 Procurement of Hardware, Software, and Services

3.0 Deliverables

4.0 Work Schedule

5.0 Place of Performance

5.1 Project Management

5.2 Technical Writer Support

5.3 Security Engineering Support

5.4 Emerging Technology and Modernization Support

6.0 Contractor Experience Requirements – Key Personnel

7.0 Government Furnished Information And Equipment

8.0 Contractor Furnished Equipment

9.0 Safeguarding of Sensitive Information

10.0 Information Technology Security and PRIVACY TRAINING

11.0 Accessibility Requirements (Section 508)

11.1 Section 508 Applicable EIT Accessibility Standards

11.2 Section 508 Applicable Exceptions

11.3 Section 508 Compliance Requirements

12.0 Other Considerations

ii

12.1 Travel Requirements

12.2 Inspection and Acceptance

12.3 Operating Constraints

Appenix A. Performance Based Matrix iii

INTENTIONALLY LEFT BLANK

1.0 INTRODUCTION

FEMA’s Chief Information System Officer (CISO) and staff is responsible for developing a comprehensive management approach for ensuring compliance with the Federal legislation, regulation and guidelines, departmental policies and procedures as well as ensuring information systems operate at an acceptable risk based on the required mode of operations.

The CISO serves Division Chief of the Office of Cyber Security (OCS) and reports directly to the FEMA Chief Information Officer (CIO).

The OCS functions as FEMA’s principal office for cyber security management, oversight, and issue resolution. The office oversees FEMA’s Cyber Security Program by managing and controlling all aspects of security vulnerabilities, including conducting incident investigation, diagnosis, resolution, recovery, and closure, as well as establishing and maintaining security education and training programs.

1.1 Scope

OCS will utilize this contract vehicle to obtain experienced, talented, and highly skilled certified technical cyber security professionals to serve as Security Engineerss and subject matter experts (SMEs) for various FEMA systems. This contract contains –

• Project Management provides project management services for OCS tasks and activities

• Security Engineering Support provides full Security Engineering life cycle support. This includes the development of security requirements, architecture and security designs, product analysis and recommendations, implementation support, to include acceptance testing, and incremental functionality testing.

• Emerging Technology and Modernization Support will provide FEMA service that broker the development of processes and modernization of the conventional technology. The service will allow for Laboratory research that solves complex problems in areas of computer science, information technology, communications, networking, and socio-technical systems

The Offeror shall provide expertise, technical knowledge, staff support, and other related resources necessary to:

• Perform analysis to ensure security controls are consistently implemented.

• Integrate new technology with Cyber Security standards.

• Develop and execute plans for monitoring, assessing, and verifying security controls across all major information systems.

• Develop, evaluate, and exercise IT survivability and contingency plans.

1.2 Background/Current Contract Environment

OCS provides cyber support to FEMA’s emergency management and continuity mission by utilizing the Federal Cyber Security Framework, in order to

• Identify risks to systems, assets, data, and capabilities;

• Protect mission essential and critical services;

• Detect cybersecurity events;

• Respond to detected cybersecurity events; and

• Recover capabilities or services that were impaired due to a cybersecurity event.

OCS plans, coordinates, integrates, synchronizes, and conducts activities that lead day-to-day safeguarding and protection of FEMA information systems (directly and indirectly connected to the FEMA infrastructure). At a minimum, OCS supports information within the continental United States (CONUS) and outside the continental United States (OCONUS). These information systems may reside at, but not limited to, the FEMA Headquarters (within the National Capital Region); the 10 Regional Offices (Boston, New York, Philadelphia, Atlanta, Chicago, Denton, Kansas City, Denver, Oakland, and Seattle); 8 Distribution Centers [Moffett, Guam, Hawaii, Fort Worth, Caribbean, Atlanta, Disaster Information System Clearinghouse (DISC), Fredrick]; various Disaster Emergency Communications facilities; and Contractor Owned and Contractor Operated (COCO) facilities.

The Top Technology challenges are face by OCS are:

1. Resiliency – Resilient Architecture and Operations

2. Automated Risk Detection-monitoring Heuristic/Behavioral - Large scale/Real-time/Multi-domain

3. Automated Risk Mitigation

4. Usability – Transparent Security

5. Cloud - Store Sensitive Government Data Searchable and Usable on Public Clouds

6. Detection and Response Mechanisms for Insiders (Timely, Fine-grained)

7. Leverage Classified Knowledge/Signatures in a Host-based System

8. Mobility - Hardware RoT, SEAndroid, Secure boot, Secure Baseband

9. Security for Cloud User Environments – Thick/Thin Client, Virtualization

10. Engineering, Testing, and Operating Secure Composite Systems

11. Establishing and Maintaining Assurance in Heterogeneous, Mobile and Cloud

Environments

FEMA’s mission is to reduce the loss of life and property and protect communities nationwide from all hazards, including natural disasters, acts of terrorism, and other manmade disasters.

FEMA leads and supports the nation in a risk-based, comprehensive emergency management system of preparedness, response, recovery, assistance, and mitigation. In support of this mission, FEMA uses a wide variety of information systems and information technology (IT) solutions and services. These systems, solutions, and services must be operated and maintained at the highest level of confidentiality, availability, and integrity.

http://en.wiktionary.org/wiki/continental_United_States

OCS will provide oversight and management of the work and tasks orders under this Statement of Work. The mission of the FEMA OCIO is “to enhance and maintain IT infrastructure; develop and enhance key systems to support operating programs; increase efficiencies and cooperation across FEMA’s divisional and regional lines.” The vision and strategy of the OCIO is to modernize FEMA IT systems and services and to “deliver world-class secure IT guidance, products, and services to meet the needs of FEMA’s emergency managers and stakeholders nationwide.” The environment must be implemented with the flexibility required to support the evolving mission of FEMA and to support the surge requirements necessary to support emergency situations as they occur.

Currently, FEMA’s IT environment is an amalgam of new and legacy technologies, architectures, platforms, and tools that includes a wide variety of PC-based, client-server, web-based, mobile technology, and service-oriented components. The IT systems supporting FEMA’s are implemented using a variety of service providers under both mature and immature oversight and governance conditions. As stated above, the current goals are to continue the evolution and improvement of all IT services and support. The OCIO goal will be achieved by utilizing an approach and strategy that is consistent with both the Department of Homeland Security (DHS) and FEMA strategy.

1.3 Objectives

The following are objectives of FEMA’s Cyber Security Program:

• Perform gap analysis on current security infrastructure

• Ensure consistent application of information security standards across all agency information systems.

• Meet all regulatory and agency documented standards and guidance.

• Integrate these regulations and standards into a fully implementable security program.

• Ensure preparation for internal and external audits through management of all infrastructure artifacts required to pass audits.

• Ensure all new information technology (IT) projects meet or integrate security standards into their development.

• Develop a culture of security-mindful professionals across the community.

• Strive to be more flexible and responsive to new regulatory directives.

• Serve as the central authority for all Cyber Security-related activities across the agency.

• Ensure information system survivability and integrity.

• Optimize processes to meet Cyber Security-related goals and strategies

1.4 Applicable Documents

This section contains a list, but not limted to, applicable references utilized by OCS –

• National Institute of Standards and Technology (NIST), Special Publication (SP) 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems— A Security Life Cycle Approach, February 2010

• NIST SP 800-39, Managing Information Security Risk—Organization, Mission, and Information System View, March 2011

• NIST SP 500-53, Security and Privacy Controls for Federal Information Systems and Organizations

• NIST SP 500-53, Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans

• NIST SP 800-65, Integrating Cyber Security into the Capital Planning and Investment Control Process, dated January 2005

• 4300A Sensitive Systems Policy -- Version 11.0

• 4300A Sensitive Systems Policy Handbook -- Version 9.1 o Attachment B - Waivers Request Form -- Version 11 o Attachment C - ISSO Letter -- Version 11 o Attachment D - Type Accreditation -- Version 11 o Attachment E - FISMA Reporting -- Version11 o Attachment F - Incident Response -- Version 9.1 o Attachment G - Rules of Behavior -- Version 11 o Attachment H - POAM Process Guide -- UNDER REVISIONS -- Version 9.1 o Attachment I - Workstation Logon o Attachment K - IT Contingency Plan Template -- Version 11 o Attachment L - Password Management o Attachment M - 800-53 Controls -- Version11 o Attachment N - Interconnection Security Agreements -- Version 11 o Attachment O - Vulnerability Management -- Version 9.1 o Attachment P - Document Change Requests -- Version 11 o Attachment Q1 - Wireless Systems --Version 11 o Attachment Q2 - Mobile Devices -- Version 11 o Attachment Q3 - Tactical Systems o Attachment Q4 - RFID Systems -- Version 11 o Attachment R - Compliance Framework Guide -- Version 9.1 o Attachment S - Compliance Framework for Privacy Systems -- UNDER REVISIONS

-- Version 9.1 o Attachment S1 - Managing CREs containing SPII -- UNDER REVISIONS -- Version

9.1 o Attachment T - Acronyms o Attachment X - Social Media -- UNDER REVISIONS

• 4300B National Security System Policy Cover Page - Version 9.0

• 4300B National Security Systems Table of Contents - Version 9.0

• 4300B.100: Safeguarding and Risk Management for NSS

• 4300B.101 Risk Management for NSS

• 4300B.102 National Security System Security Control Guidance

• 4300B.103 Template Guidance o 4300B.103-1 Template for System Security Plans http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300A%20Sensitive%20Systems%20Policy.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300A%20Sensitive%20Systems%20Handbook.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20B%5d%20Waiver%20Request%20Form.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20C%5d%20ISSO%20Letter.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20D%5d%20%20Type%20Accreditation.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20E%5d%20FISMA%20Reporting.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20F%5dIncident%20Response.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20G%5d%20%20Rules%20of%20Behavior.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20H%5dPOAM%20Guide.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20I%5dWorkstation%20Logon.doc http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20K%5d%20%20IT%20Contingency%20Plan%20Template.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20L%5dPassword%20Management.doc http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20M%5d%20Tailoring%20NIST%20800-53%20Security%20Ctrls.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20N%5d%20Interconnection%20Security%20Agreements.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20O%5dVulnerability%20Management.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20P%5d%20Document%20Change%20Requests.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20Q1%5d%20Sensitive%20Wireless%20Systems.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20Q2%5d%20Mobile%20Devices-CLEAN%20DRAFT.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20Q3%5dTactical%20Systems.doc http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20Q4%5d%20Sensitive%20RFID%20Systems.docx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20R%5dCompli%20Fmwk%20CFO-designated%20Systems.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20S%5dCompliance%20Framework%20for%20Privacy%20Systems.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20S1%5dManaging%20CREs%20Containing%20SPII.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/%5b4300A%20HB%20Att%20T%5dAcronyms.doc http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.000%20National%20Security%20Systems%20Policy%20Coverpage.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.000_TOC_4300B_05102013.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.100%20-%20Safeguarding%20and%20Risk%20Mgmt%20for%20NSS.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.100%20-%20Safeguarding%20and%20Risk%20Mgmt%20for%20NSS.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.101%20-%20Risk%20Management%20Framework.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.101%20-%20Risk%20Management%20Framework.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.102%20-%20NSS%20Security%20Control%20Guidance%20FINAL.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.102%20-%20NSS%20Security%20Control%20Guidance%20FINAL.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103-1%20-%20System%20Security%20Plans%20FINAL.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103-1%20-%20System%20Security%20Plans%20FINAL.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103.2%20-%20Risk%20Assessment%20Reports.pdf o 4300B.103-2 Template for Risk Assessment Reports o 4300B.103-3 Template for Security Assessment Reports o 4300B.103-4 Template for Plans of Action and Milestones

• 4300B.106 DHS NSS General and Privilege User Account Request Minimum Requirements

• 4300B.107 Decommissioning Strategy Minimum Requirements

• 4300B.108-1 National Security System References

• 4300B.108-2 National Security System Policy Change Request

• 4300B.200 Communication Security (COMSEC) - Version 2.0

• DHS Ongoing Authorization Methodology

• DHS CISO NIST SP 800-53 Security Controls tri-fold

• DHS FISMA System Inventory Methodology

• DHS Information Security Performance Plan

• DHS Security Authorization Process Guide

• DHS Document Review Methodology

• Document Review Checklists

• Security Authorization Document Templates

• FIPS-199 Workbook and Instructions

• Privacy Threshold Analysis (PTA) Template

2.0 SPECIFIC TASKS

2.1 Task 1 – Project and Program Management

A project is a temporary group activity designed to produce a unique product, service, or result.

Tasks and activities executed within the OCS are treated as projects. Offeror shall provide project management services for Security Engineering tasks and activities. Security Engineering Project Management services shall adhere to the PMI Project Management framework for project planning, scheduling, communications, reporting, and contractual activity and to ensure that any technical issues are addressed quickly and professionally.

The Offeror’s Project Manager shall be responsible for the Project Planning and Project Management aspects of this task. This task continues for the entire duration of the project.

This task includes the regularly scheduled meetings and specified documentation; i.e., Weekly Status Meeting, Weekly Status Reports, Weekly Work, Plan Review, Schedule Review, and Oversight/Stakeholder Reporting.

The Offeror shall develop a Project Management Plan (PMP) successful execution of the tasks within this SOW. The PMP shall to manage, schedule, and track progress using Microsoft (MS) Project or agreed upon medium (e.g., SharePoint). The current progress information shall be provided to the Government through contractor management meetings, monthly activity reports, and MS Project files. The PMP shall – http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103.2%20-%20Risk%20Assessment%20Reports.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103.2%20-%20Risk%20Assessment%20Reports.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103-3%20-%20Security%20Assessment%20Reports.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103-3%20-%20Security%20Assessment%20Reports.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103-4%20-%20Plans%20of%20Action%20and%20Milestones.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.103-4%20-%20Plans%20of%20Action%20and%20Milestones.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.106%20-%20User%20Minimum%20Requirements.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.106%20-%20User%20Minimum%20Requirements.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.107%20-%20Decommissioning%20Strategy.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.107%20-%20Decommissioning%20Strategy.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.108-1%20-%20NSS%20References.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.108-1%20-%20NSS%20References.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.108.2%20-%20NSS%20Policy%20Change%20Request.pdf http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Documents/4300B.200%20COMSEC.pdf

• Provide leadership, management, and administrative support for contractor work in support of Cyber Operations. Specific activities include but are not limited to the following:

• Provide overall management and oversight of contract staff and activities to ensure all work comply with applicable DHS, FEMA, and OCIO policies and regulations; ensure contractor performance is timely and meets OCIO/CISO program goals and performance standards

• Provide overall technical leadership and oversight; recommend and oversee the implementation of proactive and leading edge technical and technological approaches and solutions to address emerging cyber security trends; report on an annual basis

• Provide administrative support for contract work activities to include support Cyber Operations; prepare memorandums and correspondence; perform filing, passing of clearances, meeting and conference coordination, and other office administration duties

• Provide and finalize the Program Management Plan within 20 business days of contract start date.

• Provide and finalize individual Task Management Plan that addresses at a minimum, performance schedule, milestones, deliverables, and approaches to problem resolution and communication and coordination with Government personnel within 20 business days of contract start

• Provide and finalize GFE Inventory Management Procedures within 20 business days of contract start

• Monitor and track program and task performance to ensure on time service delivery within established cost estimates

• Identify, recommend, and implement (upon Government approval) cost-saving measures

• Provide monthly Task Status Report for each task (to the designated Government Technical Monitor) by the 15th of each month, presenting:

o Activities and milestones completed and deliverables submitted for each task for the past month o Indication of potential schedule variance, mitigation strategies, and actions taken o Issues encountered and resolution applied o Issues unresolved and current status and actions o Milestones and activities planned for the next reporting period

• Provide monthly Program Status Report (to the Contracting Officer’s Representative) by the 15th of each month, incorporating the Task Status Reports and the following for the overall program:

o Updated of the SOW Plan of Action and Milestones (POA&M) schedule (originally delivered as part of the PMP) including milestones achieved and schedule changes o Funding expended and funding remaining o A copy of deliverables submitted to the government for acceptance o Program risks identified and mitigation action taken and planned o A narrative of management or technical problems o Suggestions and Recommendations o A projected schedule for next month’s activities o A report of all activities during travel, in a format specified by the Contracting

Officer’s Representative (COR).

o Total cost incurred in the past month and fiscal year-to-date o Indication of potential cost and/or schedule variance, mitigation strategies, and actions taken o Funding and expenditure status o Staffing status to include current staffing level (%); positions open/unfilled and number of days open/unfilled o Cost saving measures implementation status including activities and milestones completed and planned

• Conduct Program and individual Task Status Review monthly, as requested by the

Program Manager and/or COR, to provide opportunity for report clarification and issue resolution

• Prepare and conduct quarterly Program Performance Reviews (IAW Quality Assurance Surveillance Plan) to include identification of potential cost saving measures in each task area and related implementation plans and status

• Support acquisition of materials and services incidental to contractor work activities

The Offeror shall develop and submit the following management controls reports:

• Contract Management Meetings,

• Use of Automated Tools, and

• Quality Control (QC) and Quality Assurance (QA) Procedures.

2.1.1.1 Regular Contractor Management Meetings

The Offeror and FEMA shall hold regularly scheduled monthly Contractor Management Meetings. The meeting shall provide the government and the Offeror an opportunity to discuss current tasking, provide additional guidance to the technical task management of the contract, and give the Offeror an opportunity to ask questions pertinent to the successful completion of the task.

2.1.1.2 Quality Control and Quality Assurance Procedures

Quality of data is paramount importance to the FEMA. The Offeror plays a critical role in establishing and maintaining the quality of the program. The Offeror shall perform the following:

• Data Collection Quality Control (QC) – The Offeror shall develop and implement a written QC program for data collection to ensure compliance with DHS and FEMA processes and procedures.

• Data Quality Assurance (QA) – The Offeror shall support and participate in the DHS QA review program as defined by the requirements of Contractors QA Procedures. The Offeror shall provide propose corrective actions to the COR to address any minor deficiencies identified in the review within five working days of receiving the QA report.

If the Offeror receives an unacceptable QA rating, FEMA may suspend the Offeror’s activities, by written notice from the Contracting Officer (CO) until acceptable adjustments have been implemented and an acceptable QA is earned by the Offeror.

2.2 Task 2 - Senior Technical Writer Support

The Technical Writer will be tasks by the CISO or designee to review documentation as required for submittal to internal, external customers. Ensure documentation meets FEMA Correspondence Policy, and Branding Standards if required. Ensure documents are reviewed in a timeline that is acceptable to Management including weekly status as a minimum. Maintain and update as required all Cyber Security documentation as directed by COR, or designee.

The Offeror shall provide consulting services for this task to the government.

2.3 Task 3 - Security Engineering Support

The Offeror shall assist OCS with security architecture planning by ensuring its strategic goals and development of IT infrastructure supports the mission as well as its security objectives.

Cyber Security shall provide detailed, risk-based security reviews of products in support of requests for additions to the DHS approved products inventory. The documentation shall be sufficient to support the FEMA Enterprise Architecture Team in creating a Technical Insertion Package (TIP) as required by DHS. Support shall include, but not limited to:

• Ensuring Capital Planning and Investment Control (CPIC) processes with incorporated security controls described in IT investments are mapped to the security architecture;

communication with customer advocates to ensure Mission Need Statements are in compliance with IT Investment requirements;

• Attending all Engineering Review Boards; provide technical expertise, review of documentation, and providing recommendations to assist the FEMA CISO in approving configuration changes to systems being present at the Weekly Technical Review Changes (TRC) meeting;

• Developing a methodology for selecting security solutions; submit to the FEMA CISO for approval in compliance with approved DHS/FEMA Technical Requirements Matrix (TRM) and Technical Insertion Package (TIP);

• Identifying/assessing security controls and technologies that will enforce FEMA’s security policies as mandated during security reviews and product evaluations;

• Documenting the security architecture to provide recommendations of improvements to the FEMA CISO for review and approval.

2.3.1.1 Information Assurance

The Offeror shall ensure that all system or application deliverables meet the requirements of DHS and FEMA policy. Furthermore, the Offeror shall ensure that personnel performing Cyber Security activities obtain, and remain current with, required technical and/or management certifications.

2.3.1.2 System Cyber Security

For those solutions that will not inherit existing network security controls, and thus integrate an entirely new application system consisting of a combination of hardware, firmware and software, system security assurance is required at all layers of the Transmission Control Protocol/Internet Protocol (TCP/IP) Model. The Offeror shall ensure that all system deliverables comply with DHS and FEMA policy

The Offeror shall also support activities and meet the requirements of Public Key Infrastructure (PKI) and Public Key (PK) Enabling, in order to achieve standardized, PKI-supported capabilities for biometrics, digital signatures, encryption, identification, and authentication.

OCS requires security documentation and engineering/security testing/auditing/intrusion detection services to support and maintain Security Authorization of the program systems.

These services span a variety of Cyber Security activities necessary to complete a comprehensive evaluation of the technical and non-technical security features of the Financial information systems, Government-Off-The Shelf (GOTS) applications, and network devices.

Support required includes development and maintenance of required security documentation, validation and evaluation of security requirements, vulnerabilities and residual risks, as well as effective continuous security auditing and monitoring for suspicious activity of the information systems. The Offeror shall provide the Cyber Security services listed below.

The Offeror shall accomplish thorough security testing for all systems servers, applications, and network devices as part of the validation phase of NIST/DHS Security Authorization. Testing shall be accomplished IAW Government guidance, Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG), and established timelines to meet specific program needs. The Offeror shall stay abreast of the content of the security hardening guides and the updates to the security hardening guides.

In the case where a security hardening guides is not available, the Offeror shall research and develop Trusted Facility Manuals and Security Test and Evaluation (ST&E) Plans for all information systems servers, applications, and network devices.

The Offeror shall prepare Plan of Action and Milestones (POA&Ms) to identify security weaknesses for the all information systems.

The Offeror shall assist the Government with identifying security requirements and implementing security mechanisms. The Offeror shall stay abreast of current security vulnerabilities and potential implications to inform the Government of potential security threats to the systems and provide recommendations about how to avoid, minimize, correct, or recover from possible damage.

The Offeror shall provide engineering and technical expertise to include research or updates on new or upgraded operating systems, patches, hotfixes, applications, commercially available off-the-shelf (COTS) products, issue resolution, vulnerability evaluations, countermeasure implementation, ST&E, auditing/intrusion detection tools and all other security-relevant areas as required.

The Offeror must meet the following auditing requirements on all information systems.

• Ensure the security posture of the servers and network devices is maintained.

• Perform daily automated/continuous on-line monitoring of all information systems servers and network devices.

• Ensure audit trail creation capability is deployed.

• Ensure audit records are backed up not less than weekly onto a different system or media other than the system being audited.

• Ensure audit data is collected and retained to support technical analysis relating to misuse, penetration reconstruction, or other investigations. Upon request, provide this data to the Government or Contracting Officer Representative (COR)/Alternate COR.

• Ensure tools are available for the review of audit records and for report generation from audit records.

• Ensure the content of the audit trails is protected against unauthorized access, modification, or deletion.

The Offeror shall monitor local and remote information systems for current security vulnerabilities and intrusion attempts on the all information system servers and network devices and immediately report findings to the Government or appropriate individual. If the current auditing tools being used cannot detect the most current vulnerabilities/intrusion signatures, contractor shall research means to meet this requirement and provide a recommendation to the Government on tools to purchase or produce tools that would provide the required capabilities.

Some tools currently in use are ISS Server Sensor, Anomaly Detection Tool, HBSS, and Splunk.

There may be other tools coming on board later. The Offeror must be qualified in the use of monitoring tools and shall have knowledge to analyze the events from those tools to provide the Government with the true picture of risk or possible attack.

Upon identification of unusual, inappropriate or suspicious activity with potential Cyber Security implications, immediately alert Government or COR/Alternate COR.

Upon request, the Offeror shall generate a report of audit activity based on Government provided format and required content.

The Offeror shall monitor local and remote all information systems system firewalls for patterns of activity that are indicative of an attack or a probe prior to an attack (e.g., port scan). All IP addresses showing successful unauthorized activity shall be reported to the Government or COR/Alternate COR.

2.4 Task 4 - Emerging Technology and Modernization Support

FEMA is constantly looking at ways to improve response and recovery activities. New technology enables FEMA’s program to expand services. The Offeror shall provide assistance with the review of IT security requirements and assist with how the Office of Cyber Security reviews evolving technology changes.

Offeror shall investigate and document emerging technologies that could impact the way in which FEMA operates within the cyber domain. The Offeror shall provide recommendations to the COR for improvements to the overall FEMA Cyber Security mission.

There are both identified and anticipated but not specified technology enhancements that will become operational responsibilities during the course of this contract. The Offeror will provide support to OCS for the planning and implementation of these efforts. The Offeror will provide operational support on behalf of OCS these technology enhancements have been implemented.

The Offeror shall investigate and document emerging technologies that could impact the way in which the Army operates within the cyber domain. The Offeror shall provide recommendations to the COR for improvements to the overall OCS Cyber mission. The Offeror shall conduct this effort in accordance with C.4.

The Offeror shall provide consulting services for this task to the government.

The Offeror shall maintain a testing / R&D lab environment where new technologies are prototyped and demonstrated.

2.4.1 Tools Infrastructure Operational Support

Perform technical and operational support for security tools, products, solutions, and the supporting infrastructure to include the IT equipment and tools for use in conducting security assessments. Specific activities include but are not limited to the following:

• Provide 24x7x365 on-call, 8x5 weekdays on-site, maintenance support for all cyber security tools

• Ensure system backups are completed successfully and tested for quality

• Participate in testing and evaluation of new tools, technology and solutions

• Monitor availability of all security tools

• Track and report monthly on system performance statistics (i.e., storage, memory, and

CPU utilization)

• Maintain a minimum 95% availability of all tools; report on the availability and status of security tools

• Support OMB and FISMA reporting; respond to other requests for information including information on post-specific activities

• Provide monthly project status report as part of the Task Status Report by the 15th of each month

• Report on quality performance measures quarterly as part of the overall Program performance review

2.4.2 Procurement of Hardware, Software, and Services

The Offeror shall procure hardware, software and services at the direction of the government that supports Cyber Security Services. The Offeror shall adhere to the FAR requirements and maintain a comprehensive inventory to include by not limited to – the products name, serial number, cost, location.

2.4.3 Emerging Technologies Lab

The intent of the Emerging Technologies Lab is to provide FEMA with independent analysis, verification, validation, and demonstration of emerging technologies that would improve the way FEMA operates within the cyber domain. The Contractor shall be free from any perceived or actual conflicts of interest with respect to the developmental, operational, and/or management chains of command associated with the Emerging Technologies Lab.

The Contractor shall analyze, verify, validate, and demonstrate emerging technologies at FEMA’s direction. FEMA will provide either the subject matter or the requirements to the Contractor for the technologies to be instantiated in the lab. The Contractor shall work with the FEMA CISO Security Engineering Team when assessing new and emergent technology to ensure that requirements are met and that integration into the FEMA IT environment is viable. The Contractor shall work with CISO Program Management to assist in building business cases for the inclusion of the technology under review. Inputs could include feasibility, impact, and rough orders of magnitude for employing such technology.

In the event that notional data is required for any of the testing, the data shall be generated and shall not be data from any production system. In the event that a database schema must be adhered to, FEMA will provide only the schema with no operational data. The Contractor shall obtain an Authorization to Operate (ATO) prior to the commencement of any type of testing.

Deliverables and outputs shall be determined in the task order.

2.4.3.1 Location

The lab shall be located within a 50-mile radius of the National Capital Region at a Contractor facility. The lab shall be provided on an “on demand” basis. The Contractor shall grant physical access to the building that hosts the lab and the lab itself on a 24x7 basis

2.4.3.2 Utilities and Environmental Controls

The Contractor shall provide the required utilities (power, telephone, etc.) and appropriate environmental controls in the lab. The Contractor shall protect the lab against environmental hazards.

2.4.3.3 Equipment

The Government will furnish equipment for the lab. In instances where the Government cannot furnish the equipment, the Contractor shall lease the equipment for the Government to use. The Contractor shall mount all hardware in racks. The Contractor shall develop a disposition plan in accordance with NIST Special Publication 80-88 and approved by the FEMA CISO Lead Engineer. In the event that the system or part of the system needs to be disposed of, the plan shall be followed.

2.4.3.4 IT Environment

The Contractor shall provide a virtual environment for various operating systems (Windows, *UX, and OS X). The environment shall accommodate cloud, mobile (Android, Bada, BlackBerry iOS, Embedded Linux, WebOS, Windows Mobile, Windows Phone) and various network architectures and protocols (client server, Web, etc.). FEMA will provide all standard images that are available for each platform. The Contractor shall provide Internet connectivity and satellite communication capability, and shall support the deployment of mobile tactical communications within the lab.

2.4.3.4.1.1 Infrastructure

• All capabilities will be hosted in lab facilities.

• FEMA will provide network connectivity from a designated demarc to “test.”

• The Contractor shall extend the circuit from the demarc to the designated lab facility.

• FEMA will provide configured edge routers.

• FEMA will provide other infrastructure devices and services unique to FEMA.

• The Contractor shall provide technical support, equipment, and service from third parties at no cost for the period.

2.4.3.4.1.2 Applications

• The Contractor shall host the following infrastructure services:

o Active Directory o DNS services o E-mail services o Web services (e.g., SharePoint, Web servers) o Share drives.

2.4.4 Desk and Collaborative Space

The Contractor shall provide meeting space, desk space, and lab space for the Government on an on demand basis. The Contractor shall provide meeting space to accommodate 10 people. The space must have a Polycom and Internet connectivity and power to support 10 laptop computers. The Contractor shall provide desk space for five co-located Government personnel when the lab is activated. The space shall have Internet connectivity with RJ-45 drops, an active land line phone, and lockable overhead storage.

2.4.5 Disaster Conditions

In the event of a disaster, if there is an emergent requirement to assess a product, the product assessment must be approved through the CIO / CISO / OSC approval chains prior to submission to the Contracting Officer (CO). Once the CO has approved the Purchase Request, the product shall be assessed by the Contractor.

3.0 DELIVERABLES

This section list deliverables identified within Section 2.

The Offer shall deliverables electronically using Microsoft Office suite of tools (for example, MS WORD, MS EXCEL, MS POWERPOINT, MS PROJECT, or MS ACCESS format), unless otherwise specified by the COR. Electronic submission shall be made via email, unless otherwise agreed to by the COR.

SOW

TASK # DELIVERABLE TITLE FORMAT DISTRIBUTION FREQUENCY REMARKS

2.1. TASK 1 - PROJECT MANAGEMENT

2.1 Task 1 – Project Management Plan Contractor-

Determined Format Standard Distribution

2.1 Task 1 – Weekly Activity Reports Contractor-

Determined Format

Standard Distribution

2.1 Task 1 – Monthly Activity Reports Contractor-

Determined Format

Standard Distribution

2.1 Task 1 – Program Status Reports Contractor-

Determined Format

Standard Distribution

2.1 Task 1 – Project Schedules Contractor-

Determined Format

Standard Distribution

2.1 Task 1 - GFE Inventory Management Procedures Contractor-

Determined Format

Standard Distribution

2.1 Task 1 - Program Performance Reviews Contractor-

Determined Format

Standard Distribution

2.1 Task 1 – Task POA&M Contractor-

Determined Format

Standard Distribution

2.1 Task 1 – Management Controls Reports Contractor-

Determined Format

Standard Distribution

2.1 Task 1 – Meeting Minutes Contractor-

Determined Format

Standard Distribution

2.1 Task 1 – Travel Reports Contractor-

Determined Format

Standard Distribution

Monthly Performance and Progress Report Standard Distribution NLT 10th of each reporting period.

Program management plan Standard Distribution NLT 15 calendar DACA and updates as requested by COR Quality Assurance Plan (QAP) Standard Distribution NLT 15 calendar DACA and updates as requested by COR

TASK # DELIVERABLE TITLE FORMAT DISTRIBUTION FREQUENCY REMARKS

Monthly Performance and Progress Report Standard Distribution NLT 10th of each reporting period.

Program management plan Standard Distribution NLT 15 calendar DACA and updates as requested by COR

Quality Assurance Plan (QAP) Standard Distribution NLT 15 calendar DACA and updates as requested by COR

In-briefs and Out-briefs

2.2 Task 2 – Security Engineering Contractor Support

2.2 Security Authorization documentation 60 days prior

going operational or the expiration of an authorization decision

Risk Assessment Report All changes and releases

Contingency Test Report Annually Non-Disclosure Agreement Annually Signed statements are due, from each employee assigned, prior to performing ANY work on this task.

Security Engineering Resumes ISSO Acknowledgement of Responsibilities Security C&A Phase 1 package reviews Standard Distribution Deliverables are provided within agreed upon project plan timeframe

C&A package revisions including required revisions in IACS or C-TAF

Standard Distribution Deliverables are provided within agreed upon project plan timeframe

IACS or C-TAF Compliance descriptions in IACS or C-TAF Standard Distribution Deliverables are provided within agreed upon project plan timeframe

TASK # DELIVERABLE TITLE FORMAT DISTRIBUTION FREQUENCY REMARKS

Security Metrics Recommendations Standard Distribution Final recommendation developed within 120 calendar DACA

Security Communications Plan Standard Distribution Final Plan developed within 90 calendar DACA

Procedure TRAINING Program Standard Distribution Final Program Plan developed within 180 calendar DACA

Vulnerability Testing and Scanning Report, Server configuration change report

Standard Distribution Report delivered by 15th of month

Project plan for Security Program Assessment Standard Distribution Final Plan developed within 60 calendar days of optional task order award

Security Program Improvement plan implementation Standard Distribution Implementation Plan developed within approved project plan timelines

Assessment of FS Centralized Account Management process Standard Distribution Final Plan developed within 60 calendar days of optional task order award recommendations for account management improvement Standard Distribution Final recommendations due within 120 calendar days of optional task award

Formal evaluation of Technical Approval requests Standard Distribution Evaluation submitted within 20 calendar days after receipt of technical approval request

Process improvement recommendations Standard Distribution Final recommendations due within 180 calendar days of optional task award

Wireless security assessments Standard Distribution Final assessment due within 120 calendar days of optional task award

TASK # DELIVERABLE TITLE FORMAT DISTRIBUTION FREQUENCY REMARKS

LAN security assessments Standard Distribution Final assessment due within 120 calendar days of optional task award

Weekly interim status reports Standard Distribution Report due COB Monday Self Help Documentation Standard Distribution Final documentation due within 60 days of request In-briefs and Out-briefs

2.3 Task 3 – 24x7 Security Operations Center Services

Cyber Security Briefing (CSB) Classified Cyber Security Briefing (CCSB) Daily Status Update on Significant Cases SPOT Report Daily Shift/Incident Log

2.4 Task 4 –Technical Writer Support FEMA

Mon Weekly interim status reports

2.5 Task 5 - Agent of the Certifying Authority/Risk Executor Support Services BIA Crosswalk Report Standard Distribution Report due August 31 ITCP and DRP analyses Standard Distribution Analysis due Mar 1

TASK # DELIVERABLE TITLE FORMAT DISTRIBUTION FREQUENCY REMARKS

Tabletop COOP exercises Standard Distribution Exercises due Feb 1 Functional COOP exercises Standard Distribution Exercises due Mar 1 Tabletop COOP after action report Standard Distribution Final report due 30 days after exercise date Functional COOP after action report Standard Distribution Final report due 30 days after exercise date

2.6 Task 6- Security Engineering Support

Formal evaluation of Technical Approval requests Process improvement recommendations Weekly interim status reports In-briefs and Out-briefs

2.7 – Task 7 - Documentation Management, Policy, Guidance and Publication Support Gap Analysis on procedures against policies and procedures Standard Distribution Analysis provided by January

Procedure Effectiveness Measurement Standard Distribution Report provided by August 1 Annual Procedure currency Review Standard Distribution Reviews submitted within 11 months of government's last procedure approval date

Updated Policy recommendations Standard Distribution Policy review submitted by November 1

TASK # DELIVERABLE TITLE FORMAT DISTRIBUTION FREQUENCY REMARKS

New regulation recommendations Standard Distribution

Recommendation within 60 days of issuance

Risk Management Strategy and CON-op recommendation Standard Distribution Final Strategy developed with 60 days of task order award and ConOps developed within 60 days of approved strategy

Risk Management Framework Strategy and Implementation Plan

Standard Distribution Plan developed within 60 days of approved ConOps, annual update due by September 30

Security Communications Plan Continuous Monitoring Plan Standard Distribution Plan developed, reviewed and implemented within 180 days of task order award

Corrective Action Plan Recommendation Standard Distribution Recommendation developed by June 15

Application Security Categorizations Standard Distribution Categorizations and results developed within 90 days after task order award for every lot of 25 migrations

Application Migration Status Reports Standard Distribution NLT 10th of each reporting period.

2.8 Task 8 – Audit and Assurance Services

TASK # DELIVERABLE TITLE FORMAT DISTRIBUTION FREQUENCY REMARKS

A-123 Test Plan Development Standard Distribution Plans, assessments, and reports developed, reviewed, completed and reported in IACS or C-TAF by May 1

A-123 Test control assessment documentation and compliance data entry in IACS or C-TAF

Standard Distribution Plans, assessments, and reports developed, reviewed, completed and reported in IACS or C-TAF by May 1

Weekly interim status reports In-briefs and Out-briefs

2.9 Task 9 – Security Awareness, Training and Education Services Security Communications Plan Procedure TRAINING Program Weekly interim status reports In-briefs and Out-briefs

2.10 Task 10 – System/Application Vulnerability and Penetration Testing Services Information System Security Plan / Update Standard Distribution

Final Program Plan developed within 120 calendar DACA, Update due by July 30

Vulnerability Testing and Scanning Report, Server configuration change report

Wireless security assessments LAN security assessments

TASK # DELIVERABLE TITLE FORMAT DISTRIBUTION FREQUENCY REMARKS

2.11 Task 11 – A&A Support (Security Independent Verification and Validation) Information System Security Plan / Update Standard Distribution

Final Program Plan developed within 120 calendar DACA, Update due by July 30

Security Metrics Recommendations Security Program Improvement plan implementation Project plan for Security Program Assessment

2.12 Task 12 – A&A Support (Cyber Security Resiliency)

Business Impact Assessments Standard Distribution

Final BIAs and physical security assessments provided within 90 days of onsite review

Program of Work for BIAs Standard Distribution POW for BIAs provided due Nov 1

Physical Security Assessments Standard Distribution Final BIAs and physical security assessments provided within 90 days of onsite review

Information System Security Plan / Update Standard Distribution

Final Program Plan developed within 120 calendar DACA, Update due by July 30

Weekly interim status reports In-briefs and Out-briefs

2.13 Task 13 – Emergency Technology and Modernization Support

TASK # DELIVERABLE TITLE FORMAT DISTRIBUTION FREQUENCY REMARKS

2.14 Task 14 – Adhoc and Surge…