Amendment_0001.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to revise Paragraph 1.3.2.2 of the PWS (Attachment 1) to read "Extended (Height) Landing Gear".

1. CONTRACT ID CODE PAGE OF PAGES

J 1 11

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 26-Nov-2014

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X HTC711-15-R-R007

X 9B. DATED (SEE ITEM 11)

24-Nov-2014

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

26-Nov-2014

CODE

USTRANSCOM-AQ - HTC711

508 SCOTT DR

SCOTT AFB IL 62225-5357

HTC711 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

HTC711-15-R-R007

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

The following have been modified:

ATTACHMENT 1, PWS

PERFORMANCE WORK STATEMENT (PWS)

Ridge Runner Rotary Wing Air Transportation Service

Ft Irwin, CA

19 November 2014

1.0 DESCRIPTION OF SERVICES

1.1 Background. The National Training Center (NTC) at Ft Irwin, CA requires contractor furnished rotary wing air transportation of 5 passengers with baggage and/or occasional external slings loads from Bicycle Lake Army Air

Field at Ft Irwin, CA to destinations within a 200 mile radius. The aircraft is needed to transport technician and equipment to remote, austere locations to support the operation and maintenance of the NTC communications/instrumentation network, located on a mountain top.

1.2 Scope. Except as otherwise stated in this contract, the contractor shall provide all personnel, equipment, tools, facilities, supervision, and direct materials necessary for the performance of the air transportation services for rotary wing passenger and/or cargo air transportation as identified in this PWS. Contractor shall be required to base the aircraft at Bicycle Lake Army Air Field and an estimated 350 hours per year of airlift services will be required.

Services are to be performed within a 200 mile radius of Bicycle Lake Army Air Field as directed by the

Contracting Officer Representative (COR).

1.3 Specific Requirements/Tasks

1.3.1 Aircraft: As a minimum the aircraft must be capable of seating 5 passengers plus pilot, capable of carrying internal/external loads of at least 500 pounds in accordance with paragraph 1.3.2.5 and 1.3.2.6 below (excluding pilot and fuel weight), and/or combination thereof at 30 degrees Celsius at 6,500 feet out-of-ground effect (OGE); be fueled by Jet A government furnished fuel IAW paragraph 3.1 below.

1.3.2 Equipment required:

1.3.2.1 One flight meter to record flight time.

1.3.2.2 Extended (Height) Landing Gear.

1.3.2.3 A remote hook-operating switch shall be mounted on the collective control to avoid confusion with the aircraft cargo hook release.

1.3.2.4 “Barrel Slings” or lifters to transport two 55 gallon drums by external load.

1.3.2.5 Cargo net 10’ x 10’ capable of carrying of 500 pounds.

1.3.2.6 Cargo sling (tag) line at least 10” long with swivel attachment, rated at of 500 pounds.

1.3.2.7 Automatic portable or automatic fixed Emergency Locator Transmitter (ELT/AP or ELT/AF) as required by the FAA.

1.3.2.8 A uni-directional ELT shall be installed with the “arrow” aimed 45 degrees downward from the normal forward “direction-of-flight”. An omni-directional ELT may be mounted in any orientation. An external fixed type antenna will be used in all applications. The antenna will be mounted on the top or bottom in helicopter applications.

1.3.2.9 One 1360 channel VHF-AM (VHF-1) Aeronautical Transceiver shall be installed, operating in the 116.000

MHz to 149.975 MHz band on 25 kHz increments, and a minimum 10 watts carrier power output (AN/ARC-115, AN/ARC-186, or equal).

1.3.2.10 One 920-channel VHF-FM (FM-1) Aeronautical Transceiver shall be installed, operating in the 30.00MHz to 75.95 MHz band on 25kHz channel increments, transmitter deviation of +/- 8.0 kHz, with a minimum of 10 watts carrier power output (AN/ARC-114 or equal).

1.3.2.11 One VHF aeronautical navigation VOR/LOC receiver with indicator, minimum 100 navigation receiver channels.

1.3.2.12 Audio Control Systems Equipment:

1.3.2.12.1 One audio control system shall be installed for the pilot and the observer, which provide control, selection and operation of multiple radio transceivers. Audio system controls shall be provided for the pilot and the observer to select specific receiver audio outputs and transmitter microphone/PTT inputs of multiple radios. An intercom system shall also be provided for the pilot, observer, and passenger positions at each aft cabin exit. Audio level controls shall be provided for the pilot and observer to adjust the intercom and receiver audio outputs to their respective earphones. The controls of the audio control system shall be located conveniently for both pilot and observer. Labeling and marking of controls must be clear, understandable, and permanent.

1.3.2.12.2 The system shall be designed for operation with 600 ohm earphones and carbon equivalent, noise canceling boom type microphones (Gentex electret type Model 5060-2, military dynamic type M-87/AIC with CE-

100 TR preamplifier, or equivalent) with U-75/U type connector plug. The only exception to this is the pilot’s position, which may be a low impedance (dynamic) configuration.

1.3.2.12.3 All earphone/microphone jacks in the aircraft, except the pilot’s, shall be military type U-61 which will accept the U-75/U plugs specified above. Adapter cables and connectors may be used as necessary to provide U-

61/U jacks.

1.3.2.12.4 As a minimum, the audio control systems shall provide for selecting the following radios and systems:

VHF-AM Aeronautical Radio (VHF-1) and VHF-FM Aeronautical Radio (FM-1).

1.3.2.12.5 Separate Push to Talk (PTT) switches shall be provided for radio transmitter operation and intercom operation at the pilot and observer positions. The pilot’s switches shall be located on the cyclic stick. The observer’s shall be located on the cord to the earphone/microphone connector. The passenger positions will have a

PTT switch for intercom operation located on the cord to the earphone/microphone connector.

1.3.2.12.6 Transmitter Selection and Operation. A transmitter selection switch shall be provided for the microphone/PTT of the pilot and observer. The pilot or observer will be able to select a desired transmitter communicate using the respective microphone/PTT. When a transmitter is selected, the companion receiver audio shall automatically be selected for the associated earphone in use.

1.3.2.12.7 Receiver Audio Selection and Operation. Selector switches shall be provided for the pilot and observer earphones to permit selecting receiver audio from one or combination of all receivers. The passenger positions shall monitor the receiver(s) as selected by the observer. Performance specifications for receiver audio to all earphone connectors are as follows:

1.3.2.12.7.1 Audio Output: With an input of 10 mW (600 ohms) from any selected receiver, the audio output shall be capable of 100 mW (600 ohms) with less than 10% distortion.

1.3.2.12.7.2 Hum and Noise 40 dB below specified audio output (100 mW).

1.3.2.12.7.3 Crosstalk: 40 dB below specified audio output (100 Mw). NOTE: The audio input is an adjustable output from any of the selected receivers. This is typically an adjustment of the radio volume control, which can range from 0 to 100 mW (600 ohms).

1.3.2.12.8 An intercom system shall be provided to serve the pilot, observer, and passenger positions at each aft cabin exit. Intercom audio shall mix with, but not mute, selected receiver audio (override type). Adjustment of any station’s intercom audio level shall not affect the level at any other station. An intercom audio level control shall be provided on the pilot and observer audio control panel(s) and at each passenger position for adjusting the individual earphone audio to a comfortable listening level. Microphone operation on the intercom system shall be via PTT switches. A “hot-mike” capability shall be provided via an activation switch accessible by the pilot and observer or may be voice actuated (VOX). Side tone audio shall be provided to the earphone connector associated with the microphone in operation. Performance specifications for the intercom system are as follows:

1.3.2.12.8.1 Audio Output. With an audio input test tone level of 250mV at 1 kHz, the audio output shall be capable of 100 mW (600 ohms) with less than 10% distortion.

1.3.2.12.8.2 Hum and Noise. 40dB below specified audio output (100 mW).

1.3.2.12.8.3 Input Audio: As provided by station microphone or test tone input at microphone terminals.

1.3.2.13 The aircraft must be equipped with heating and ventilation/air conditioning, cabin storage for passenger hand carrier baggage, and clean air sickness bags.

1.3.3 Hazmat: The Government may require transportation of some hazardous materials. The carrier must be an approved HAZMAT carrier IAW 49 CFR and AR 95-27. Such transportation shall be IAW FAA regulations and

National Training Center (NTC) Regulation 200-2, 200-6 and the Hazardous Material Handbook.

1.3.4 Contractor requirements:

1.3.4.1 Contactor personnel shall comply with all pertinent military regulations and/or directives when in base flight patterns and on military installations.

1.3.4.2 Contractor shall be certified under Federal Aviation Regulation (FAR) Parts 133 and 135.

1.3.4.3 Contractor shall comply with FAR Part 135.117 for required passenger briefings prior to each take-off.

1.3.4.4 Contractor shall have personnel/pilots with Ft Irwin, CA experience, due to the nature of remote antenna site landing locations/conditions.

1.4 Scheduling

1.4.1 Corporate Liaison: Prior to the start of the contract, the contractor shall furnish the COR with the name, address, e-mail address, and phone number of an agent who will serve as a liaison between the contractor and the

COR. The agent must have authority to dispatch aircraft, adjust schedules, engage substitute airlift, and make decisions pertinent to the airlift service for the contractor. The agent will be available by telephone 24 hours per day, 7 days per week.

1.4.2 Availability: The contractor shall be available to provide service 7 days a week, including weekends and holidays. Mission scheduling will be limited daylight hours under Visual Flight Rules (VFR) conditions. Daylight hours are defined as 30 minutes before official sunrise to 30 minutes after official sunset. The contractor shall be positioned at the designated Ridge Runner pad on Bicycle Lake Airfield as directed by the COR. The contractor shall receive 24 hours advance notice and on occasion will have immediate notice for emergency repairs. A normal duty day shall not exceed 12 hours.

1.4.3 The contractor shall coordinate COR approved mission/flights with the Life Cycle Contractor Support (LCCS)

Operations Command Central (OCC). Prior to flight departure with LCCS personnel, the contractor shall notify the

LCCS OCC with, but not limited to, departure time, destination, number of personnel, anticipated return time, and arrival time upon mission completion.

1.4.4 Department of Defense (DoD) personnel shall not be scheduled to fly on helicopter during external load operations.

1.4.5 The contractor shall meet the scheduled time of pickup as ordered by the COR. One-thirtieth (1/30 th

) of the aircraft monthly rate offered will be deducted for each day the contractor fails to provide an aircraft to meet mission requirements.

1.5 Deliverables

1.5.1 Contractor shall provide written verification of insurance coverage to the Contracting Officer at

USTRANSCOM TCAQ-R, 508 Scott Dr, Scott AFB IL 62225 prior to the contract award.

1.5.2 At each departure airfield, contractor shall ensure that an accurate passenger manifest is left with appropriate airfield authorities, e.g. military air operations or civilian Fixed Base Operators (FBO) personnel. The contractor shall post a copy of manifests outside their government provide office for random COR inspections.

2.0 SERVICE DELIVERY SUMMARY

Performance Objective PWS Paragraph Performance Threshold

On-time performance 1.4 95% of monthly flights

Equipment is in working Condition 1.3.2 95% of monthly flights

Contractor shall leave an accurate passenger manifest at departure airfields.

1.5.2 100% of monthly flights

3.0 GOVERNMENT FURNISHED EQUIPMENT (GFE) AND SERVICES

3.1 The government will provide, at no cost to the contractor, Jet A fuel for direct contract flying. Fuel for positioning/repositioning, training, and maintenance flights is the responsibility of the contractor and will not be charged to the contract. The Aircraft shall not be refueled while engines are running, or rotor blades are turning, unless the aircraft refueling facility is equipped with an approved closed-circuit refueling system. Grounding and bonding cables shall be utilized. The contractor shall verify and certify Government fuel usage on the fuel worksheet provided.

3.2 Air traffic control and airfield safety protection: Ground handling of aircraft, ground support equipment units

(if available), aircraft parking space, and military flight planning charts and publications will be provided.

3.3 OCCS hand-held radios for dispatching and safety concerns while operating at the NTC shall be provided.

3.4 The government will provide a one-pilot office space at the Bicycle Lake Army Air Field.

Note: The contractor is responsible for providing support equipment unique to its aircraft.

4.0 GENERAL INFORMATION

4.1 DoD Approved Air Carrier by the closing date of the solicitation. The contractor must satisfy DoD quality and safety requirements as described in 32 Code of Federal Regulation (CFR) Part 861. All aircraft utilized must be licensed, operated, and maintained IAW all applicable rules and regulations of the Federal Aviation Administration

(FAA) and Department of Transportation (DOT), giving particular attention to the responsibility of the air carrier to perform air transportation with the highest degree of safety.

4.2 Aircraft performing missions under this contract shall not be considered public aircraft.

4.3 Contractor shall have a current FAA Authorization certificate to operate over routes and into airfields specified under both Instrument Flight Rules (IFR) and VFR conditions and rules. IFR capability authorization is not required for operations into airfields, which do not have published IFR approach procedures.

4.4 Insurance Requirements: Prior to performance of any services hereunder, the contractor shall, at its own expense, procure, from a financially and legally responsible insurance company, and maintain, for the life of this contract, at least the minimum coverage required by 14 C.F.R. §205.4.

4.4.1 The contractor will provide written verification of insurance coverage to the Contracting Officer at

USTRANSCOM, TCAQ-R, 508 Scott Dr, Scott AFB, IL 62225-5357 prior to the contract award. The contractor shall provide annual proof of insurance from the insurance provider to the Contracting Officer. In the event of a planned cancellation or material change in policy coverage, thirty (30) days prior written notice shall be given to the

Contracting Officer. In the event of an unplanned cancellation or material change in policy coverage, notice shall be given to the Contracting Officer as soon as possible.

4.5 Security Clearance: The contractor shall ensure all employees requiring security clearances have at least an interim clearance prior to start of work. Contractor shall be screened and vetted through the Ft Irwin, CA security clearance process before authorized access to the installation.

4.6 Information Assurance

4.6.1 Requirement for Contractor Information Assurance (IA) Report

The Contractor shall provide an Information Assurance Report to describe their environment that safeguards DOD non-public information resident on or transiting the contractor's unclassified information systems from unauthorized access and disclosure. Protection measures applied should consider the risks (i.e. consequences and their probability) of loss, misuse, unauthorized access, or modification of information. The report shall address the SANS

(SysAdmin, Audit, Network, Security) Institute's Twenty Critical Security Controls for Effective Cyber Defense:

Consensus Audit Guidelines (http://www.sans.org/critical-security-controls) and be provided in accordance with the attached template at Attachment 1 to the PWS. The contractor is encouraged to provide additional information above and beyond what is outlined in the SANS guidelines to enhance the government’s understanding of their information security posture. The report will be updated 30 days prior to exercise of an option period, if applicable.

4.6.2 Cyber Security Incidents

4.6.2.1 Reporting Requirements

The contractor shall report to the following two Government organizations as soon as possible upon discovery of any suspected cyber intrusion events that affect DOD information resident on or transiting the contractor's unclassified information systems.

1. USTRANSCOM Cyber Operations Center (CyOC)

E-mail: transcom.scott.tcj3.mbx.cyoc@mail.mil

Commercial Phone: 618-220-4222 mailto:transcom.scott.tcj3.mbx.cyoc@mail.mil

2. USTRANSCOM Deployment and Distribution Operation Center (DDOC)

E-mail: transcom.scott.tcj3.mbx.ddoc-chief@mail.mil

Commercial Phone: 618-220-7700

Initial report shall be provided even if some details are not yet available, with follow-on detailed reporting within 72 hours. Reportable cyber intrusion events include the following:

1. A cyber intrusion event appearing to be an advanced persistent threat

2. A cyber intrusion event involving data exfiltration or manipulation or other loss of any DOD information resident on or transiting the contractor's, or its subcontractors', unclassified information systems

3. Intrusion activities that allow unauthorized access to an unclassified information system on which DOD information is resident or transiting

Definition of advanced persistent threat: An extremely proficient, patient, determined, and capable adversary, including two or more of such adversaries working together.

4.6.2.2 Incident Report Content

The incident report shall include, at a minimum, the following information:

1. Applicable dates (date of suspected compromise and date of discovery)

2. Threat methodology (all known resources used such as Internet Protocol (IP) addresses, domain names, copies malware, etc.)

3. An account of what actions the threat(s) may have taken on the victim system/network and what information may have been accessed

4. A description of the roles and functions of the threat-accessed system

5. An initial list of potentially impacted government programs and each program’s classification

6. What information may have been exfiltrated that may impact government programs

7. A list of all employees and subcontracted employees who work or have worked with the victim system/network

8. A point of contact to coordinate damage assessment activities

4.6.2.3 Incident Report Submission

The contractor will submit unclassified network cyber incident reports to the USTRANSCOM Technical

Information Analysis Center (TIAC) and USTRANSCOM designated government personnel via encrypted email or another mutually agreed upon secure communications method. Copies of malware require special handling and pre-coordination must be accomplished prior to submission.

5.0 NOTICE OF ACCIDENT AND REPORTS.

5.1 Notice of Accidents - DoD Missions. When the contractor’s aircraft, in support of a DoD mission, is involved in an accident or incident, as defined in 49 CFR §830.2, in support of a DoD mission, the contractor shall transmit the information below by the most expeditious means available, to the HQ AMC Command Center at Scott AFB, IL

(618) 229-0360 and HQ AMC/A3B (618) 256-4801. On the next business day, notification must also be made to the Contracting Officer (CO), USTRANSCOM, TCAQ-R, Scott AFB, IL (618) 220-7036, or FAX (618) 220-7918.

5.1.1 Carrier and trip number.

5.1.2 Aircraft type and number.

5.1.3 Date and time of accident.

5.1.4 Last point of departure and point of intended landing of aircraft.

mailto:transcom.scott.tcj3.mbx.ddoc-chief@mail.mil

5.1.5 Location of accident.

5.1.6 Nature of the accident and the extent of damage to the aircraft so far as is known.

5.1.7 Total number of crewmembers and passengers on board.

5.1.8 Number of injured and fatalities aboard the aircraft.

5.1.9 Condition of baggage or government-owned material, if any, on board.

5.2 Notice of Accidents – Non-DoD Missions. When the contractor’s aircraft is involved in an aircraft accident as defined in 49 CFR §830.2, not associated with a DoD mission, the contractor shall transmit the information in paragraph 5.1 by the most expeditious means available and on the next business day notify HQ AMC/A3B, Scott IL

(618) 229-4801 or (618) 229-4343.

5.3 Aircraft Medical Incidents. Report all aircraft medical incidents in flight, or while passengers are under control of the aircraft captain, to the first available COR or CA, at the next en-route station for in flight incidents, or the station where the incident occurs.

5.4 DoD Casualties. In cases where a death occurs on a contractor’s aircraft, the following information shall be furnished via telephone to the phone numbers listed below: Name, Social Security Number (SSN), and component of service identified as Army-USA, Air Force-USAF, Navy-USN, Marine Corps-USMC, and Coast Guard-USCG.

US Army: (800) 626-3317 US Navy: (800) 368-3202

US Marines: (800) 847-1597 US Air Force: (800) 433-0048

US Coast Guard (USCG): Pacific Area Op’s Center: (510) 437-3701 (Accidents west of Mississippi)

5.4.1 An information copy shall be faxed to USTRANSCOM TCAQ-R (Fax (618) 220-7918 and HQ

AMC/Command Center Fax (618) 229-0153.

5.5 Safety and Financial Information. As required by the Air Safety Clause at TRANSFAR 5552.247-9000, the contractor must satisfy the requirements of 32 CFR, Part 861, Section 861.4. The DoD will conduct periodic evaluations to assess the contractor’s ability to perform safely. To complete the evaluation, the government may contact the contractor in order to obtain information bearing upon the contractor’s practices, resources, and capabilities. Upon request, the contractor shall provide data pertinent to such evaluations, including current audited financial statements, to HQ AMC A3B, 402 Scott Drive, Unit 3A1, Scott AFB IL 62225-5302.

ATTACHMENT 1 TO PWS

Vendor Assessment Guidelines for Twenty Critical Security Controls for Effective Cyber Defense: Consensus

Audit Guidelines (CAG)

General. Organizations should compare all 20 control areas against their current status.

The 20 Critical Controls are:

1. Critical Control 1: Inventory of Authorized and Unauthorized Devices

2. Critical Control 2: Inventory of Authorized and Unauthorized Software

3. Critical Control 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers

4. Critical Control 4: Continuous Vulnerability Assessment and Remediation

5. Critical Control 5: Malware Defenses

6. Critical Control 6: Application Software Security

7. Critical Control 7: Wireless Device Control

8. Critical Control 8: Data Recovery Capability

9. Critical Control 9: Security Skills Assessment and Appropriate Training to Fill Gaps

10. Critical Control 10: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches

11. Critical Control 11: Limitation and Control of Network Ports, Protocols, and Services

12. Critical Control 12: Controlled Use of Administrative Privileges

13. Critical Control 13: Boundary Defense

14. Critical Control 14: Maintenance, Monitoring, and Analysis of Audit Logs

15. Critical Control 15: Controlled Access Based on the Need to Know

16. Critical Control 16: Account Monitoring and Control

17. Critical Control 17: Data Loss Prevention

18. Critical Control 18: Incident Response and Management

19. Critical Control 19: Secure Network Engineering

20. Critical Control 20: Penetration Tests and Red Team Exercises

The entire text of the 20 Critical Security Controls is available for reference at:

http://www.sans.org/critical-security-controls/

Procedures:

1. Review each control.

2. Determine what procedures and tools exist within your organization to meet this control.

3. Document the result of 1-2 using the suggested template provided.

http://www.sans.org/cag/control/1.php http://www.sans.org/cag/control/2.php http://www.sans.org/cag/control/3.php http://www.sans.org/cag/control/3.php http://www.sans.org/cag/control/4.php http://www.sans.org/cag/control/5.php http://www.sans.org/cag/control/6.php http://www.sans.org/cag/control/7.php http://www.sans.org/cag/control/8.php http://www.sans.org/cag/control/9.php http://www.sans.org/cag/control/10.php http://www.sans.org/cag/control/11.php http://www.sans.org/cag/control/12.php http://www.sans.org/cag/control/13.php http://www.sans.org/cag/control/14.php http://www.sans.org/cag/control/15.php http://www.sans.org/cag/control/16.php http://www.sans.org/cag/control/17.php http://www.sans.org/cag/control/18.php http://www.sans.org/cag/control/19.php http://www.sans.org/cag/control/20.php http://www.sans.org/critical-security-controls/

4. Provide any additional information about your company’s cyber security posture.

Company (Name): Information Assurance Report

Executive Summary: (descriptive self-assessment of the company’s overall information security posture)

A. Assessment of Twenty Critical Security Controls for Effective Cyber Defense: Consensus Audit Guidelines

(CAG)

1. Control 1. Inventory of Authorized and Unauthorized Devices

a. Procedures and Tools supporting this control:

(List the procedures and tools used in your organization for this control)

b. Method to achieve control metric:

2. (Continue for remaining 19 controls).

If a particular control does not exist or is not used within your organization, please state this.

B. Assessment of Additional Security Measures for Effective Cyber Defense

1. Measure. (Title of additional measure/control)

a. Procedures and Tools supporting this measure/control:

(List the procedures and tools used in your organization)

b. Method to achieve measure/control metric:

2. (Continue for remaining measures/controls)

(End of Summary of Changes)