Attachment A - ITSSS IDIQ SOW v1.pdf

HSTS03-11-R-CIO556 – version 14.0

Information Technology Security Support Services (ITSSS)

HSTS03-11-R-CIO556

Statement of Work

1.1 BACKGROUND

The Transportation Security Administration (TSA) was created to meet the nation‟s need for transportation security, including all modes of domestic and points of international interface.

Congress granted TSA wide latitude in acquiring and managing the Information Technology (IT)

Infrastructure necessary to support accomplishment of the TSA mission. The Information

Assurance Division, within the Office of Information Technology (OIT), is the IT security oversight arm for TSA. The Information Assurance Division (hereinafter IAD) provides focused and efficient management of the IT security activities necessary to protect the TSA IT

Infrastructure.

The Transportation Security Administration‟s OIT provides the administration‟s response to meeting the practical and statutory security requirements associated with the use of Information

Technology (IT) solutions to support administration assets. The IAD is the central office responsible for delivering security services in the form of program/project management, functional guidance, technical assistance, security operations, and compliance monitoring. The goal is to ensure that TSA is able to deliver the services mandated by law, and do so in a manner that fully complies with the law.

This means ensuring that information and information systems are protected in accordance with

Federal requirements. Further, it is important that the Administration is able to demonstrate adequate security when scrutinized by internal and external organizations. To ensure that TSA delivers the value-added services where vital information, systems, applications, and data are protected in accordance with Federal requirements, the IAD implements security programs for classified and SBU-level information technology systems, and communications security management. This includes IAD coordination with other TSA and DHS security organizations concerning physical, facility, personnel, industrial, and information security.

TSA currently has 83 operational TSA IT Systems and a minimum of 30 Development systems.

There is an annual 10% expectation of growth for operational systems.

1.2 OBJECTIVES

The objective of this procurement is to provide independent Information Technology Security

Support Services to the TSA IAD, and to other Program Offices within TSA in the area of IT

Security.

All solutions and services shall meet DHS Enterprise Architecture policies, standards, and procedures. Specifically, the contractor shall comply with the following Homeland Security

Enterprise Architecture (HLS EA) requirements:

All developed solutions and requirements shall be compliant with the HLS EA.

All IT hardware or software shall be compliant with the HLS EA Technical Reference

Model (TRM) Standards and Products Profile.

All data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the DHS Enterprise Data Management Office (EDMO) for review and insertion into the DHS Data Reference Model.

In compliance with Office of Management and Budget (OMB) mandates, all network hardware shall be IPv6 compatible without modification, upgrade, or replacement.

1.3 SCOPE

1.3.1 INFORMATION ASSURANCE COMPLIANCE & POLICY

1.3.1.1 Compliance Branch Support

Compliance branch contractor support spans several TSA Information Assurance Division areas to include supporting the IAD ISSO support, the Risk Management team support, and support of the Compliance team. The main interfaces are with the intersectional Certifier Services branch, system support personnel, and Information System Security Officers (ISSOs) throughout TSA.

1.3.1.1.1 Compliance Team Support

Compliance supports overall goals on a continual basis is to assist with ensuring that TSA achieves passing or better compliance ratings by the department by adhering to federal and DHS requirements. The contractor shall provide support services required to execute the day to day

FISMA operations, ensuring that all FISMA activities are prioritized correctly, completed on schedule, and are in accordance with DHS and TSA policies. The Contractor shall research major obstacles related to the DHS ever-changing FISMA requirements, which TSA will need to overcome on a weekly, monthly, and yearly basis. These issues consist of, but are not limited to, tracking whether TSA information systems have mitigated their weaknesses on time using the appropriate processes, ATO expirations, tracking completeness of annual requirements such as

800-53As and Contingency Plan Test Results, and validating the quality of TSA system artifacts.

FISMA activities are mandated by, and must be executed according to the DHS Information

Security Performance Plan for each fiscal year.

The Contractor shall:

Assist the Branch Chief in the day to day execution of the TSA FISMA Compliance program.

Assist in executing the department‟s annual Information Security Performance Plan.

Assist with managing the TSA official IT Systems inventory.

Utilize and manage the department enterprise wide applications Trusted Agent

FISMA (TAF) tool and Risk Management System (RMS) to assist in executing the department information security performance plan.

As requested by client, create briefings and reports pertaining to daily, weekly, monthly, or annual activities within the Compliance branch.

Assist with updating and executing the TSA FISMA Program.

Assist in executing the department‟s annual Information Security Performance Plan.

Assist in the managing of the TSA official IT Systems inventory.

Provide feedback to management on the functionality of the department enterprise.

wide applications: Trusted Agent FISMA Tool and Risk Management System (RMS).

Research the major obstacles related to DHS ever-changing FISMA requirements.

Review C&A documentation at an average of at least 1 C&A package per week.

Review and validate Phase I security artifacts uploaded to the Trusted Agent FISMA tool.

Provide feedback on monitoring duties for a workload of approximately 10 systems and assist in maintaining security compliance for 80+ operational TSA IT Systems.

Assist with conducting two inter-departmental/federal outreach efforts annually to assist other agencies with varying issues regarding their C&A programs.

Advise and assist with changes to the FISMA Inventory to include the addition, deletion, and modification of the 80+ TSA IT Systems, create/manage TAF/RMS accounts to include the addition and modification of 60+ user accounts.

Provide one-on-one training to TAF and RMS users as directed by branch chief.

Deliverable Date

Delivered

Recipient Performance

Standard

Provide accurate and timely departmental and agency specific

FISMA scorecards.

Government will review the document for accuracy.

Monthly Assistant

Director, Compliance

Branch

Chief, Compliance

96% of all C&A documentation must be provided within the date required.

96% of all C&A documentation must be accurate as

Recipient Performance

Standard

Report detailing the accuracy, quality, and timeliness of all artifacts uploaded in the FISMA tool.

Weekly Assistant

Director

Compliance

Branch

Chief, Compliance defined by the annual

DHS Information

Security Performance

Plan; measured monthly and annually.

Report detailing the mitigation progress for system weaknesses to include trending analysis and non-compliance issues for all information systems throughout

TSA.

Daily Assistant

Director

Compliance

Branch

Chief, Compliance

Per the DHS

Information Security

Performance Plan, POA&M management includes various benchmarks to include quality control and completion timeliness. Specific adherence expectations for weakness content and timeframes are defined annually by the department via the performance plan.

Prepare reports for the Office of

Information Technology (OIT) In

Progress Reports (IPRs) meetings;

report will be submitted prior to the meeting for Government review

Monthly Assistant

Director, Compliance

Branch

Chief, Compliance

These requirements are measured against the annual DHS

Information Security

Performance Plan.

FISMA activities are mandated by the

Recipient Performance

Standard

Prepare reports for the Information

Protection Oversight Board (IPOB) meetings for government review prior to the meeting

Monthly Assistant

Director, Compliance

Branch

Chief, Compliance

DHS Information

Performance Plan.

The FISMA activities are measure monthly and annually; in order to achieve a “Green” passing grade all objectives must have

96% completion and accuracy rate.

Support two inter-departmental/federal outreach efforts

Annually Assistant

Director, Compliance

Branch

Chief, Compliance

Create FISMA Metric Reports for all IT

Security TSA stakeholders

Weekly Assistant

Director, Compliance

Branch

Chief, Compliance

1.3.1.1.2 Information Systems Security Officer (ISSO) Support

The contract shall serve as the ISSO point of contact (“ISSO”) for information assurance activities at the IT system level, and will report directly to the Compliance Branch chief for general guidance and for assignments outside their typical ISSO duties. Each Information

System within TSA is required to have an ISSO per DHS and NIST policy. Depending on system complexity, an ISSO may be assigned more than one system.

The ISSO shall ensure that management, operational, and technical controls for securing either

National Security Systems or SBU level Information Systems are in place and are followed.

This includes ensuring that appropriate steps are taken to implement information security requirements for IT systems throughout their life cycle, from the requirements definition phase through disposal. The ISSO shall possess effective interpersonal and presentation skills as he/she operates in a client-facing role. The ISSO must possess experience with NIST 800 publications standards. The position requires experience with vulnerability scanning and assessments. The ISSO shall conduct Certification and Accreditation (C&A) activities in accordance with NIST 800-37 standards. All C&A deliverables must meet the metrics in the

DHS Information Security Performance Plan; this plan will be provided upon contract award.

The ISSO shall report IT Security events/incidents in the time prescribed by DHS MD 4300 IT

Policy depending on the severity of the incident. The ISSO shall also respond to Information

Security Vulnerability Management (ISVM) notifications and ensure all systems under their purview are in compliance with TSA and DHS IT Policies (these policies will be provided upon contract award) by the date prescribed. Per TSA and DHS policy, the ISSO shall be required to receive approval from the CISO for designation as the ISSO.

The ISSO shall manage single or multiple systems depending on the size and complexity. An example of a more complex system needing 120 days for Certification and Accreditation activities would be TSA‟s Secure Flight System, which is considered a General Support System.

The Secure Flight system is located in multiple locations and consists of many different components and is internet facing. An example of a less complex system would be TSA‟s LINK

System. LINKS is a major web application residing in one location. In the TSA environment today, there are typically over 80 TSA Information Systems and a minimum of 30 Development systems. There is an annual 10% expectation of growth for operational systems.

Of the 80+ operational TSA Information Systems and a minimum of 30 Development systems, IAD currently owns 4 in which ISSO support will need to be provided under Task Order #001. In the direct support and maintenance of these IAD systems with regard to C&A, the ISSO will support the IAD System Owner for their respective systems and provide C&A artifact maintenance, Continuous Monitoring and POA&M management support. This may include, but is not limited to, testing C&A tools, analyzing DHS requirements, editing pertinent trainings, and supporting the Risk Management with vulnerability management or other related duties.

The contractor shall execute the following activities:

Execute Certification & Accreditation activities program.

Assist in developing unified guidelines and procedures for conducting certifications and/or system-level evaluations of federal information systems and networks including the critical infrastructure of TSA.

Developing and present, both verbally and in writing, highly technical information and presentations to non-technical audiences at all levels of the organization. Audiences for this information include, but are not limited to, senior executives at TSA and other agencies.

Ensure IT systems have all security controls in place and functioning properly in accordance with NIST 800-53A publication.

Conduct and evaluate/analyze vulnerability results from the following set of tools to include but not limited to: NESSUS, AppDetective, WebInspect and ISS.

Assist with external/internal audits for designated systems.

Report incidents within the timeframe prescribed by DHS 4300 policy for incident response.

Recipient Performance Standards

Complete set of C&A documentation as required by

NIST-800-37 and DHS during the 90-120 day timeframe depending on system complexity. All documents will be provided for

Government review and acceptance.

Within the

90-120 days timeframe

Assistant

Director, Compliance

Branch

Chief, Compliance

The following requirements are measured against the DHS annual performance plan. The current plan calls for all C&A activities have a 96% completion rate in order to achieve a “Green” passing grade. C&A activities are completed in a 90 to 120 day schedule depending on system size and complexity. Successful

C&A activity is one which is executed on time and meets the

DHS passing standard of 96% accuracy.

Briefings and reports pertaining to daily activities within the assigned IT system or systems provided for

Government review.

Weekly Assistant

Director, Compliance

Branch

Chief, Compliance

See Section 1.6

Create a report detailing the compliance status of ISVMs

Monthly Assistant

Director, Compliance

Branch

Chief, See Section 1.6

Recipient Performance Standards

Submit Plan Of Action

&Milestones (POA&M) closure documentation as determined by the AO as required by the due date given when POA&M is created for

Government review.

As required Assistant

Director, Compliance

Branch

Chief,

1.3.1.1.3 Risk Management Support

The contractor shall provide support services required to execute the day to day Risk

Management operations, as well as assisting with researching emerging technologies and solutions to assist with IT risk management metrics and reporting. Contractor shall also coordinate with and solicit information from stakeholders and subject matter experts in order to support risk management efforts to comply with management directives, mandates, and guidance concerning security monitoring, compliance, and reporting.

The Contractor shall:

Maintain a current understanding of the TSA IT systems, TSA IT policies, and

TSA IT operational groups.

Maintain and archive records of all ISVM activities for each TSA IT system

Support ISVM process and respond with compliance information within specified timeframes to all ISVMs issued by DHS .

Report ISVM Compliance to affected users weekly.

Coordinate activities, collect data, and respond to ad-hoc requests.

Provide formal and informal training of Risk Management tools used by stakeholders for the tracking, managing, and reporting of data related to IT Risk.

Solicit information from stakeholders as needed in support of the Risk

Management process.

Prepare management-level presentations and briefings.

Respond to TSA and DHS data calls.

Deliverable Date Delivered Recipient Performance

Standard

ISVM Reports Weekly Chief, Compliance See Section 1.6

System Status reports Weekly Chief, Compliance See Section 1.6

Risk Management

Scorecards with official update provided to the government for review

Monthly Assistant Director

Compliance, ISSOs

See Section 1.6

Training material, presented in classroom format

Quarterly ISSOs and ISSO

Support Personnel

1.3.1.2 Policy Analyst (PA) Support

The contractor shall develop IT Security documentation that will include Policies, Standards, Processes and Procedures; these documents shall be submitted to the government for review, feedback and approval.

The contractor shall also assist in the development, implementation, update and management of

IT security management directives, handbook policies, a minimum of 40 technical standards and a minimum of 40 standard operating procedures unique to TSA. There is an annual 10% expectation of growth.

The contractor shall also assist in developing and/or maintaining the IT security policies, minimum of 40 technical standards, and minimum of 40 processes and procedures. PA personnel must have an understanding of detailed IT security requirements, technical security countermeasures, risk management methodologies, contingency planning, and data communications networking in an unclassified (SBU) and classified environment.

The Contractor shall:

Assist in the development, and present to the Government for approval, information assurance (IA)/IT security documentation that will include Directives, Policies, Standards, Processes and Procedures for governance use;

Assist in regular updates to the Management Directives and IT Security Handbooks addressing both unclassified and Classified environments;

Collaborate in the development of the TSA wide policies and procedures, DHS IT Security

Policies, and other Federal Mandates;

Identify the impact of new government laws/regulations and the implementation of new IT technologies on TSA IT security policy based on policy inquiry questions received and assist in the evolution of the policies accordingly;

Support the effective communication of IT Security Policies to TSA personnel;

Provide policy expertise and support in waiver/exception requests and policy inquiries;

Support IT Security outreach efforts to enhance TSA enterprise-wide awareness;

Assist in the development new TSA Classified Systems and COMSEC IT Security Policy;

Present policy related IT Security Topics at a variety of events;

Maintain the Policy branch mailbox, responding to requests within two business days;

Create, maintain, and continually update the IAD and Policy iShare websites per Government

COTR direction;

Provide system administrator iShare support, including user access management per

Government COTR direction;

Provide input for a monthly policy issue (Gotcha) report;

Provide technical expertise in the development and review of policy configurations guides;

Maintain familiarity with Government law and directives for conversion into useful TSA-level policy and other governance documentation;

Provide support to members of intelligence community, coordinating system security policy;

Provide input to new policy summaries and metric reports;

Assist in the creation and review, at a minimum, of (20) technical standards and route to IAD management for review on an annual basis;

Survey reports of historical policy impacts from incident logs, provide feedback to

Government COTR, and assist in the initiation of new policies and procedures accordingly;

Prepare weekly progress reports for submission to Government COTR; and

Support the development of miscellaneous policy letters, memorandums, and monthly briefings and associated documentation for distribution as required.

Deliverable Date Delivered Recipient Performance Standards

Review and respond to waiver/exception requests and policy inquiries

Within two working days of receipt

Policy Chief See Section 1.6

Establish a policy issue

(Gotcha) report detailing inconsistencies in policies and/or programmatic implementations

Monthly Policy Chief See Section 1.6

Deliverable Date Delivered Recipient Performance Standards

Support the development of

IT security related documentation that will include Directives, Policies, Standards, Processes and/or

Procedures for Government use.

Within one month of request

Assistant

Director, Compliance and Policy

See Section 1.6

Research and document technology or other security matters as requested.

Within two days of request or as directed

Policy Chief See Section 1.6

Provide input for policy metrics dashboard

Weekly Policy Chief See Section 1.6

Collaborate in the update

TSA IT Security Handbook

Quarterly Policy Chief See Section 1.6

Assist in the creation of 20

Technical Standards

Annually Policy Chief See Section 1.6

1.3.1.3 Primary Certifier Support

The contractor shall serve as the primary certifier main liaison and driving force for all C&A efforts to include ensuring ISSOs complete a FIPS-199, PTA, e-authentications, CPs, CPTRs, SSPs, and 800-53As, and personally delivering RAs, ST&E Plans, SARs, and ATO Letters.

While TSA engineers conduct the majority of the technical scans on TSA information systems, the contractor shall cipher through thousands of lines of scanning results in order to identify and create POA&Ms for the information systems under their responsibility.

TSA currently has 83 operational TSA IT Systems and a minimum of 30 Development systems.

There is an annual 10% expectation of growth for operational systems. The contractor shall be capable of managing between 7-10 systems per individual throughout the entire C&A lifecycle to include Continuous Monitoring. Continuous Monitoring includes, but is not limited to, POA&M management, waiver and exception support, and periodic recertification. In addition, the contractor shall serve as the focal point for all C&A activities to the ISSO, System Owner, and Program Official.

The Contractor shall:

Responsible for all phases of C&A to ensure compliance and provide guidance on IT

Security requirements to assigned stakeholders.

Assist in developing and executing the agency Certification & Accreditation Program

Assist in developing unified guidelines and procedures for conducting certifications and/or system-level evaluations of federal information systems and networks including the critical infrastructure of TSA.

Stay abreast of industry and Government standards to include DHS and TSA Security

Policies and Technical Standards

Advise the Government on new standards and make recommendations on new IT

Security technologies to improve efficiencies.

Conduct C&A Kick-off Meetings;

Prepare the Security Test & Evaluation (ST&E) Plan;

Conduct the ST&E Kick-off Meeting;

Conduct the ST&E Execution via document examination, interviews and manual assessments;

Analyze automated scan results;

Populate the Requirements Traceability Matrix (RTM) with results of ST&E;

Perform Risk Analysis;

Create a Security Accreditation Report (SAR);

Create a Plan of Action and Milestones (POA&M);

Conduct ST&E Findings Meeting with the System Owner, ISSO and other system personnel as required.

Communicate with ISSO on continuous monitoring activities related to Plan of Action and

Milestone closures, waivers and exceptions;

Coordinate courtesy scans with ISSOs and Security Engineers as requested by assigned systems;

Advise new system development teams on DHS and TSA Security Policies and Technical

Standards;

Track security activities of assigned systems and brief senior leadership on said activities;

Attend Security Training as requested by senior leadership;

Advise ISSOs on successful completion of System Security Plans, Contingency Plans, FIPS

199 and E-Authentication Workbooks.

Responsible for ensuring assigned systems are decommissioned according to DHS and TSA

Media Sanitization Policies.

Primary Certifiers shall meet the DHS monthly metric of a 96% success rate of ATOs completed basis.

Recipient Performance Standard

Recipient Performance Standard

Complete set of C&A documentation as required by

NIST-800-37 and DHS during the

90-120 day timeframe depending on system complexity. All documents will be provided for Government review and feedback.

Within the

90-120 days timeframe

Compliance

Assistant

Director

Deliverables shall meet the objectives of the annual DHS Information

Security Performance

Plan. The plan calls for all

C&A activities to have a

96% completion rate in order to achieve a “Green” passing grade. C&A activities are completed in a 90 to 120 days schedule depending on system size and complexity.

Successful C&A activity is one which is executed on time and meets the

DHS passing standard of

96% accuracy.

Provide briefings and reports pertaining to activities within the

Certifier Branch.

Weekly Compliance

Assistant

Director

1.3.1.4 Cyber Security Awareness and Outreach

The Cyber Security Awareness and Outreach Branch is responsible for enhancing the cyber security posture of the agency and its stakeholders within the Transportation community. Within this realm of responsibility, the team has two primary focus areas: an external partnership, with the Transportation Sector Network Management program, to promote Cyber Critical

Infrastructure Protection within the private sector and an internally-focused agency wide IT

Security Awareness and Training program.

1.3.1.4.1 Cyber Critical Infrastructure Protection

The contractor shall carry out the duties required to administer a Sector Specific Agency‟s program and responsibilities as outlined in HSPD -7 and the NIPP relating to cyber critical infrastructure protection. These duties will require the contractor to engage in multiple programs and projects at a time at varying lifecycle stages, which includes coordinating with the appropriate agency officials, and public and private stakeholders to assure proper responses to reports, comments, and questions, regarding TSA SSA cyber responsibilities for the TSS and

P&SS.

The Contractor shall:

Support the creation of briefings and reports pertaining to program and initiatives relating to TSA actions and responsibilities for securing our CIKR.

Draft, review, coordinate, track, and respond to TSA program management offices, DHS, OMB, Congress, and other public and private stakeholder‟s requirements and questions relating to securing our TSS and P&SS cyber infrastructure

Review and provide input as needed to national level reports that are accurate and timely to document TSA‟s progress and process in securing TSS and P&SS cyber critical infrastructure.

Assist in the development of strategic, tactical, and implementation plans, charters, roles and responsibilities, program plans and other documentation to promote accurate communication and facilitate responses, input, etc to securing CIKR.

Participate in comprehensive national and modal outreach efforts to assist TSA and other agencies with varying issues regarding their sector specific agency responsibilities.

Advise on and make changes to national level strategies, guidelines, legislation, and other critical documents relating to TSA‟s fulfilling its SSA responsibilities.

Provide group and/or one-on-one briefings to PMO‟s, BMO‟s and other internal and external sector stakeholders as needed to assure smooth and efficient operation of the

TSA cyber critical infrastructure program.

Attend meetings with OIT, TSA, DHS, OMB and others in the TSS and the P&SS stakeholder community.

Review national plans and reports related to increasing our nation‟s security posture

Load and maintain Sector portals and other online modes of communication

Reports detailing activities performed in support of Cyber

Critical Infrastructure goals and

TSNM requirements

Weekly Assistant

Director

1.3.1.4.2 IT Security Outreach and ISSO Administration

The core requirements for this position is to assist the Compliance & Policy Assistant Director in executing the day to day operations of the ISSO Administrator responsibilities within the branch and ensuring that all IT Security Outreach and ISSO Administration activities are prioritized correctly, completed on schedule, and meet DHS and TSA policies.

The Contractor shall:

Deliver training sessions and assist with development of course curriculum.

Produce and conduct a minimum of 12 ISSO Monthly professional development meetings covering at least three topics each

Execute the IT Security outreach program materials in accordance with the Instructional

Systems Development (ISD) model, which requires facility with MS PowerPoint, Word, Publisher, and Excel, as well as other software as needed to improve or enhance the training materials.

Collect and record metrics that reflect the data collected for IT Security completions, requiring knowledge of Excel and Access or similar software.

Supports the IAD-ISSO community by acting as the day-to-day liaison between IAD and all

ISSOs.

Assist in maintaining the IAD mailbox, shared drive, distribution lists, access lists, and

Online Learning Center (OLC) accounts.

Develop IT Security outreach flyers, broadcasts and other marketing material to support mission.

Draft clear and concise communications as needed to relay policies and requirements.

Locate external guest speakers from other TSA entities and industry to participate in the

ISSO Monthly professional development meetings.

Facilitate workshops on TAF, RMS, and C&A procedures.

Facilitate, as needed, IT Security specific development sessions for (but not limited to) the following groups: System Owner (SO), COTR, Account Manager (AM), and Authorizing

Official (AO).

Maintain an active presence in the DHS IT Security Working group and the Cyber

Communications Working Group which meets on a regular basis.

Update the ISSO Proficiency Assessment, in order to be compliant with policy changes.

Provide updates to the ISSO Certification Program and Curriculum, based in part on the

ISSO Proficiency Assessment.

Conduct IT Security outreach events at least semi-annually.

Produce quarterly updates to the ISSO Handbook.

Develop the ISSO training program.

Support current IT Security Awareness program to share information with targeted audiences.

Deliverable Date Delivered Recipient Performance Standard

Collect and record metrics that reflect the data collected for IT

Security completions for the

TSA workforce to meet DHS and

FISMA requirements.

Monthly Compliance

Assistant Director

See Section 1.6

Produce and conduct IT Security professional development sessions for (but not limited to) the following groups: System

Owner (SO), COTR, Account

Manager (AM), and Authorizing

Official (AO) training content to be provided for Government review and feedback prior to the training event.

Quarterly Compliance

Assistant Director

See Section 1.6

Conduct semi-annual IT Security

Outreach events; content to be provided for Government in advance for review and feedback.

Semi-

Annually

Compliance

Assistant Director

1.3.2 INFORMATION ASSURANCE TECHNICAL SERVICES

1.3.2.1 Focused Operations Branch

The Information Assurance Division, Focused Operations (FO) Branch is a tactical group composed of highly skilled IT Security experts specializing in the fields of cyber intrusion, cyber intelligence, and digital forensics. FO supports the overall TSA mission by protecting TSA‟s sensitive information assets through network intrusion detection, forensic investigations and cyber threat intelligence collection and analysis.. The FO team processes threat indicators on a daily basis to prevent network exploitation and the exfiltration of sensitive TSA data. In an effort to enhance TSA‟s security posture, FO continually researches and implements forensics and network investigative technologies.

1.3.2.1.1 Focused Operations Analysis Support

Advise of the day-to-day activities of the Forensics Laboratory; Develop and maintain the biweekly forensic activities report that identifies Forensic Team accomplishments and goals. Participate in IT security meetings and briefings; attend

Enterprise Architecture meetings and briefings as required.

Track evidence inventory for intake and release of all evidence items delivered to the forensics laboratory. This includes insuring proper handling and maintenance of evidence and chain of custody records.

Case intake and logging to include entries/updates to the Case Management System and coordination of case load.

Ensure completed requests for service for all requests are received by the forensic laboratory. This includes verification of all related deliverables.

Read and analyze packet traces and raw log dumps.

Provide support, reports and all related deliverables on „chain of custody‟ matters.

Create Digital forensics reports

Process a case from intake, processing, and reporting within 2 weeks.

Maintain requests for service for all requests received by the forensic laboratory.

Perform advanced forensics collection techniques using EnCase® software, read and analyze packet traces and raw log dumps.

Provide support, reports, and all related deliverables on „chain of custody‟ matters.

Attend weekly DHS Focused Operations meetings.

Participate in weekly TSA Network Intrusion Working Group meetings

Perform advanced reverse engineering techniques using debugging software, and behavioral analysis techniques

Digital

Forensics/Malicious

Code Analysis Reports

As produced Chief, Focused

Operations

See Section 1.6

Lab Readiness Reports Monthly Chief, Focused

Operations

See Section 1.6

Software licensing and equipment reports

Monthly Chief, Focused

Operations

Case status reports Weekly Focused Ops Chief See Section 1.6

1.3.2.1.2 E-Discovery Support

Track evidence inventory for intake and release of all evidence items delivered to the E-

Discovery team. This includes insuring proper handling and maintenance of evidence and chain of custody records.

Perform daily analytical actions in the performance of E-Discovery and reporting. Assist in developing, managing, communicating, and implementing an E-Discovery program.

Develop and maintain the biweekly recovery activities report that identifies recovery team accomplishments and goals.

Participate in IT security meetings and briefings tracking of evidence inventory for intake and release of all evidence items delivered to the E-Discovery team. This includes insuring proper handling and maintenance of evidence and chain of custody records.

Perform parsing and analysis of exchange, active directory, restored data; to include link analysis, filtering and file recovery. Provide reports of such data;

Categorize and manage large collections of tape backups to maintain file integrity and chain of custody.

Provide support, reports, and all related deliverables on „chain of custody‟ matters.

Create E-Discovery reports

Recover email files from 1 backup tape per day.

Perform case reviews to insure analysis reports meet acceptable standards as defined by policy.

Process and track requests for service for all requests received by the E-Discovery team, including verification of all related deliverables.

Perform restoration of tape backups for criminal and administrative investigations, utilizing

Linux and windows based solutions such as Symantec net back up and backupexec.

Provide reports of such data and categorize and manage large collections of tape backups to maintain file integrity and chain of custody.

Provide support, reports, and all related deliverables on „chain of custody‟ matters; and design and maintain all E-Discovery systems.

Testify as an expert witness and clearly articulate the circumstances with how a case was handled from an evidentiary perspective.

Lab readiness reports Monthly Chief, Focused

Operations

See Section 1.6

Software licensing and equipment reports

Monthly Chief, Focused

Operations

See Section 1.6

Case status reports Weekly Focused Ops Chief See Section 1.6

Recovery activities report that identifies recovery team accomplishments and goals

Bi-weekly Focused Ops Chief See Section 1.6

1.3.2.1.3 Cyber Intelligence (CI) Support

The contractor shall collect and analyze intelligence regarding cyber threats and vulnerabilities, and direct and coordinate the response to such threats and vulnerabilities. The contractor performs their duties under the direction and guidance of a Senior CI Analyst.

The Contractor shall:

Maintain a current understanding of the TSA IT systems, TSA IT policies, and TSA IT operational groups.

Monitor various information sources (including public, private, and classified sources) for threats and vulnerabilities.

Accept escalation of suspected threats and vulnerabilities from multiple sources, internal and external.

Analyze threats and vulnerabilities to determine their impact upon the TSA IT systems.

Identify the necessary actions required to proactively mitigate the risk posed by the threats and vulnerabilities.

Report procedures and requirements among the intelligence community.

Work with other agencies and organizations within the intelligence community.

Research and obtain pertinent cyber-intelligence within 1 day of issuance by intelligence agencies

Analyze threats and vulnerabilities to determine their impact upon the TSA IT systems.

Create Classified Intelligence Reports

Create Cyber Security Incident Reports

Report threat and vulnerability findings within 4 hours to the Threat and Vulnerability

Analysts for tracking and the deployment of proactive counter-measures.

Attend weekly DHS Focused Operations meetings and participate in weekly TSA Network

Intrusion Working Group meetings.

Intelligence Reports Daily Chief, Focused

Operations

See Section 1.6

Quarterly threat briefings

Quarterly Chief, Focused

Operations

1.3.2.2 Communication Security (COMSEC) Engineering Support

The contractor shall provide COMSEC technical and administrative support for COMSEC accounts. Engineering support is typically broken out among contractor staff by geographic region. The contractor is responsible for providing in-depth technical knowledge and maintenance of the COMSEC hardware and the procedures for maintaining the accounts.

The Contractor shall:

Assist with management of the TSA HQ Electronic Key Management System (EKMS) Local

Management Device/Key Processor (LMD/KP) System Manager for configuration management, software upgrades and system equipment certification; troubleshooting and daily operational status; key ordering/transfer to sub-account LMDs; and National Security

Agency (NSA) national policy and Department of Homeland Security procedural directives and training. Interfaces with the, EKMS Help Desk, and secure communications vendors, as required, for all COMSEC activities. Provides management personnel accurate and current evaluations of EKMS changes and trends.

Attend all training necessary to be in compliance with DHS Policies.

Conduct inspection of secure communication facilities within TSA, and those facilities within other federal and state agencies which operate within the framework of TSA-controlled COMSEC programs. Evaluate approval from a physical security standpoint for the operation, maintenance, and storage of COMSEC equipment and/or material in accordance with NSTISS 4005, Safeguarding COMSEC Facilities and Materials and DHS

Management Directive 11045, Protection of Classified National Security Information.

Prepares the Multi-Use Physical Security Checklist, Open/Closed Storage Approval Letter and then submits documentation for supervisory approval in a timely manner.

Assist in the establishment of new COMSEC accounts within TSA and other federal agencies having civil emergency communications interface with TSA. Review Continuity of

Operations (COOP) and exercise support requirements, and provide COMSEC support for these exercise and COOP requirements. Serve as the officially appointed courier for all categories and classifications of COMSEC material and equipment.

Attend national conferences and other professional forums with NSA, other Government or civil agencies, and the Department of Defense on Information Assurance, Information

Security, Cryptographic Modernization Programs and other COMSEC issues.

Interface with the EKMS Help Desk and secure communications vendors

Respond to customer inquiries or service calls.

Operate independently at remote facilities supporting Federal Security Directors (FSDs) and

Area Directors.

Troubleshooting and daily operational status.

Conduct key ordering/transfer to sub-account LMDs; and National Security Agency (NSA) national policy and Department of Homeland Security procedural directives and training.

Interface with the EKMS Help Desk and secure communications vendors, as required, for all

COMSEC activities.

Keep accurate COMSEC training records for OIT and assist with COMSEC inquiries and investigations on physical insecurities and incidents involving TSA COMSEC accounts or cryptographic keying material for which TSA COMSEC account has been designated the

Controlling Authority.

Provide technical guidance to all COMSEC custodians/officers in the reporting of insecurities involving COMSEC material or equipment; attend all training necessary to be in compliance with DHS Policies

COMSEC Inventory

Reports

Every 6 months Chief, COMSEC

Branch

See Section 1.6

COMSEC customer reports

Monthly Chief, COMSEC

Branch

See Section 1.6

COMSEC Destruction

Reports

Weekly Chief, COMSEC

Branch

1.3.2.3 IT Security Architecture Support

The contractor shall provide architecture guidance to TSA systems as needed, participate in IT security meetings and briefings, attend Enterprise Architecture meetings and briefings as required (i.e., TSA expects about 5 meetings per week).

Assist in the development and management of an Enterprise Security Architecture that meets the TSA mission, ensures compliance with enterprise-wide system IT Security Policies, and supports the TSA Enterprise Architecture.

Provide strategic planning, communicate the organization‟s vision and objectives, set priorities, assign tasks and responsibilities, and monitoring and evaluating TSA Security

Architecture that implement DHS Security Architecture for the protection of all TSA networks and systems.

Prepare Communication Plan briefing to upper management on all security architecture related issues.

Perform document reviews within one week of receipt and provide for Government review and feedback.

Develop white papers within one month of receipt and provide for Government review and feedback.

Develop memorandums within one week of receipt and provide for Government review and feedback.

Develop briefings within one week of receipt and provide for Government review and feedback.

Develop other studies within one month of tasking/receipt for Government review and feedback.

Develop and maintain approximately 12 IT security architecture models in the first year (e.g.

trust zone model or wireless model) of IT systems, e.g. as developed for the TSA

Certification & Accreditation process, and provide other architecture security support to TSA systems as needed.

Develop, review and comment on Functional Requirement Documents (FRD) as required and provide to the Government lead for review and acceptance.

Review and comment on SPPs as required and provide to the Government lead for review and acceptance.

Conduct IT Security product reviews, research and/or studies as directed and produce reports to the Government lead for review and acceptance.

Provide consultation in developing areas of critical infrastructure protection.

Review and comment on: architectural principles contained in internal & external security focused documents, on TSA and DHS management directives (MDs), Technical Reference

Model (TRM) within two days of request, and on other security related documents, as required.

Produce quarterly reports on IT security impact of changes to DHS/TSA Enterprise

Architecture for Government review and acceptance.

Review and comment on: architectural principles contained in internal & external security focused documents, on TSA and DHS management directives (MDs), Technical Reference

Model (TRM) within two days of request, and on other security related documents, as required and provide to Government for review and acceptance.

Prepare security architecture models as required and provide to Government lead for review and acceptance.

Conduct high-level ISO reviews within one month of request and conduct document reviews, research, and/or studies once a week.

Manage IT security governance and reviews of governance documents as directed.

Extract and allocate IT Security governance requirements of federal law and regulations.

Participate in IT security meetings and briefings on a weekly basis.

Manage TSA‟s portion of the DHS Technical Reference Model (TRM) inputs and reports, and assign appropriate DHS service categories and DHS standards profiles to the IT security products.

Review and comment on architectural principles contained in internal and external security focused documents.

Assess IT Security Programs per the ISO 27001 standard on a semi-annual basis, provide architecture guidance to TSA systems.

Report on the insertion of IT security related requirements within DHS SELC and TSA

SDLCM.

Research and document technology or other security matters.

FRD Development or

FRD Comments

Within 1 week of request

Architecture Chief See Section 1.6

SSP Comments Within 1 week of request

Architecture Chief See Section 1.6

Creation of security architectural models

Within 2 week of request

Architecture Chief See Section 1.6

Comments of TRM packages

Within 1 week of request

Architecture Chief See Section 1.6

Report on the impact of changes to

DHS/TSA Enterprise

Architecture

Quarterly Assistant Director, Compliance

See Section 1.6

Prepare communications plan briefing detailing all security architecture related issues.

Monthly IAD CISO, DCISO and Assistant

Directors

1.4 LABOR CATEGORIES

The contractor shall provide all services using the labor categories provided in Attachment D as called for on specific delivery orders.

1.5 APPLICABLE DOCUMENTS

The IAD is a federally mandated program that provides the direction and guidance necessary to ensure TSA enterprise-wide information security is compliant with federal information security legislation, policies, and mandates. The TSA is also an organizational element of the

Department of Homeland Security (DHS) and as such relies on the DHS to provide an initial interpretation of federal information security legislation, policies, and mandates through DHS

Management Directives, primarily the 4300 series and other DHS documentation listed below.

Therefore DHS policy, including handbook guidance, is accepted as baseline TSA policy.

The documents listed below are those which the contractor shall be expected to utilize during the course of their work, and those by which the contractor‟s performance will be assessed. .

All National Institute of Standards and Technology (NIST) Special Publications and Federal

Information Processing Standards (FIPS) may be obtained from the NIST website, http://www.nist.gov.

DHS Management Directives may be obtained from the assigned TSA Contracting Officer.

TSA Management Directives may be obtained from the assigned TSA Contracting Officer.

http://www.nist.gov/

1.6 GENERAL DELIVERABLES AND DELIVERY SCHEDULE

A master monthly report detailing past months accomplishments of each project shall be provided. The contractor shall provide the report to the Government designated COTR. This document shall be provided in plain English, on white office paper, and prepared using Microsoft

Office product software (e.g., Word, Excel, Project, PowerPoint), as applicable. The number of copies needed for a deliverable may vary, but shall include three (3) unless otherwise instructed.

In addition, deliverables and reports should be submitted in electronic format and shall be free of any known computer virus or defects. If a virus or defect is found, the deliverable will not be accepted. The replacement file shall be provided within two (2) business days after notification of the presence of a virus.

The report shall be delivered on the 7th calendar day of the following month by close of business

(COB) 4:30 pm local time (Washington DC), unless otherwise agreed upon by the COTR.

In addition, the contractor shall meet on a weekly and quarterly basis with the applicable: (1)

CISO, (2) Deputy CISO, and (3) Designated COTR. The quarterly meeting shall summarize the activities of the quarter and Service Level Agreement (SLA) performance.

1.6.1 Acceptance Criteria

Inspection and acceptance of all deliverables and or services performed as specified will be made in writing and acknowledge by the COTR. All deliverables and services will be inspected for content, completeness, accuracy, and conformance to the Statement of Work (SOW). Reports, documents and narrative type deliverables will be accepted when all discrepancies, errors or other deficiencies identified in writing by the Government have been corrected. The basis for acceptance of deliverables shall be in accordance with the requirements set forth in the contract and in the Statement of Work at the Task Order level.

1.6.2 Government Review

Upon delivery of a final deliverable, the Government shall have fifteen (15) calendar days to provide acceptance or rejection of the deliverable product. If the deliverable is rejected, the contractor will have seven (15) calendar days to correct the deficiencies and submit a final deliverable.

1.6.3 Standards and References

The contractor shall provide all work consistent with applicable agency rules, regulations, and verifiable industry best practices.

1.7 FACILITY AND PERSONNEL CLEARANCE

The Contractor and any subcontractor(s) shall provide special handling for TOP SECRET collateral classified and/or sensitive but unclassified (SBU) data. As such, the Contractor and any subcontractor(s) shall possess and maintain a current facility clearance at least at the TOP

SECRET level. The prime contractor is responsible for ensuring that they and any subcontractor(s) comply with the provisions of the National Industrial Security Program

Operating Manual (NISPOM).

All Contractor on-site personnel must hold a security clearance that is in accordance with the level specified in Attachment D Labor Category Descriptions.”

1.8 GOVERNMENT FURNISHED SUPPLIES AND INFORMATION

The Government shall provide office space and desktop automation equipment to connect to the

TSA network in order to accomplish the tasks contained within the Statement of Work. Under no circumstances shall contractor-company or its contractor-personally owned equipment be connected to the TSA computing environment.

The contractor shall be provided access to the following Government resources:

The TSA network

TSA Workstation

Copiers, fax machines,…