ID08200031 Solicitation Attachment 1 - Performance Work Statement.docx

Vulnerability Disclosure Policy Platform

Performance Work Statement (PWS) in support of:

Cybersecurity and Infrastructure Security Agency (CISA)

1 BACKGROUND

The Cybersecurity and Infrastructure Security Agency (CISA) is the Nation’s risk advisor, working with partners to defend against today’s threats and collaborating to build more secure and resilient infrastructure for the future. In this role, CISA builds the Nation’s capacity to defend against cyber attacks and works within the federal government to provide cybersecurity tools, incident response services, and assessment capabilities to safeguard the Federal civilian Executive Branch (FCEB) ‘.gov’ systems that support the essential operations of partner departments and agencies.

CISA recently released draft Binding Operative Directive (BOD) 20-01, which identifies the requirement that each FCEB agency develop and publish a vulnerability disclosure policy (VDP) and maintain supporting handling procedures for identified vulnerabilities. Vulnerability disclosure policies enhance the resiliency of the government’s online services by encouraging meaningful collaboration between federal agencies and the public. During development of draft BOD 20-01, CISA identified that many FCEB agencies currently lack a formal mechanism to receive information from third parties about potential security vulnerabilities on IT systems and have no defined strategy for handling such reports about issues shared by outside parties.

In support of FCEB agencies, CISA requires access to an existing, commercially available Software as a Service (SaaS) platform that will provide them a centralized vulnerability disclosure policy platform (”Platform”). The Platform will be managed by the CISA Cybersecurity Quality Services Management Office (QSMO) and is intended to support FCEB agencies by providing a standard approach to accept vulnerability submissions from a network of security researchers, validating submitted reports, and providing validated reports to FCEB agency stakeholders for resolution on-Platform.

CISA desires that through this contract, the Platform achieves wide participation by FCEB agencies, while providing the Government with advantageous cost and price discounting.

2 SCOPE

The scope of this contract is to provide CISA and participating FCEB agencies access to an existing, commercially available SaaS platform, which will to facilitate the submission and tracking of vulnerabilities discovered in internet-accessible information systems, termed FCEB systems, of the FCEB agencies, including Independent Agencies and all Boards, Commissions, and Committees (Chief Financial Officers (CFO) ACT and Non-CFO Act Agencies). In addition, as an optional functionality, the Platform shall provide agencies the ability to provide financial incentives (termed “bug bounties”) for valid submissions . Participation in the Platform will be voluntary for FCEB agencies, and therefore the platform needs to scale to support a potentially varying number of agencies at any time. FCEB agencies currently participating in the Platform are captured in the FCEB Agencies List (Attachment A). The FCEB Agencies List will be updated throughout the period of performance of this contract.

The Platform service provider, termed “Service Provider”, shall provide the Government with project management support services including robust platform reporting, effectively securing the platform, and managing the administration and operation of the platform, including its security. The service provider shall provide triage services that ensure submitted vulnerability reports are valid and provided to the impacted FCEB agency. The service provider shall assist agencies that desire a bug bounty program with the means to facilitate financial payment to vulnerability reporters who submit valid reports for FCEB agency systems.

Remediation of identified vulnerabilities on FCEB systems is the responsibility of the appropriate FCEB agency, and not the service provider or CISA.

3 PLATFORM TECHNICAL REQUIREMENTS

The Platform shall facilitate the management of vulnerabilities discovered in FCEB systems by security researchers. Figure 1: Platform Overview below presents a high-level overview of the reporting process and potential process flow for a reported vulnerability:

Figure 1: Platform Overview

The following subsections provide the Platform technical requirements for system functionality, system interfaces, bug bounty functionality, and platform user expectations.

3.1 PLATFORM FUNCTIONALITY

The Platform’s intended functionality shall, at a minimum, include the following:

· Key point of entry for vulnerability reporters to alert the government of potential issues on FCEB systems for those agencies that participate on platform.

· Clear way to track reported vulnerabilities and link reports that are related by reporter, vulnerability type, or other purpose.

· Web-based communication mechanism between the reporter and the agency.

· Allows agency users to create and manage role-based accounts for their organization or suborganizations.

· Allows stakeholders to view reported vulnerabilities and update their status as the issues are managed and resolved.

· Allows for vulnerability reports to be made public with agency approval.

· Provides ability to survey platform users.

· Offers an application programming interface (API) to take various actions on vulnerability reports or pull metrics.

· Metrics and reports to CISA and FCEB agencies.

· Alerts to the reporter and agency users on updates, as well as to CISA based on events of interest, metrics approaching or hitting defined thresholds, etc. These alerts should be configurable in the user interface and available via API.

· Permits participating FCEB agencies to add or remove FCEB systems at any time during the period of performance.

3.2 PLATFORM INTERFACES

The Platform shall provide the following interfaces:

Web application

· Provide users (vulnerability reporters, agencies, CISA) direct access to the platform feature set.

· Allow reporters to submit vulnerabilities, track submissions and their status, and maintain communication (as they choose).

· Allow agencies to manage submissions and view summary statistics.

· Allows CISA to adjudicate submissions where the agency is unknown (or has been unresponsive), view statistical data and trends, run reports, export data, and view agency submissions.

Email

· Notifications and alerts of submissions and updates can be emailed to the userbase from the platform (submission details are not included in the email). For example:

· Agencies are alerted on newly created tickets and updates, reporters are notified on ticket updates and closures.

· CISA is alerted when certain defined thresholds are met (ticket unresolved for X days, agency accumulating more than X reports without action, etc.).

API

· Allow automated application-level communications between the platform and an external application like an agency issue tracking system, via an API.

3.3 BUG BOUNTY FUNCTIONALITY

The Platform shall include the ability for agencies to provide bug bounties (financial incentives) for valid submissions. Agencies will be responsible for funding and operating their own bug bounty programs. CISA does not intend to fund a bug bounty program for FCEB agencies. The Platform shall, at a minimum, support public bug bounties that are continuous in nature. In support of the bug bounty functionality the Platform shall perform the following:

· Allow FCEB agencies to post bounty amounts, on specific systems or services, and share instructions on the bounty program,

· Facilitate payment to security researchers for valid vulnerability submission that is eligible for a bounty. Agencies would have ultimate authority to determine that a report is valid and meets criteria for payment.

3.4 PLATFORM USER EXPECTATIONS

Platform user expectations include the following::

Vulnerability Reporters

· Have a clear place to report vulnerabilities in FCEB systems without a requirement to need to know which specific agency or component manages the FCEB system.

· Can share updates and receive updates with an agency.

· Can create an account and profile.

· Can log into their account to track submissions and their status.

· Can be notified by e.g., email of a change in a report’s status (if desired).

· Allow reporters to earn recognition or “points” for the valid reports they have submitted.

Federal Civilian Executive Branch (FCEB) Agencies

· Each agency maintains a profile in the platform. FCEB agency superusers can manage their agency profile and their own users, granting and revoking access permissions (e.g. user can edit, user can only read). By logging into the platform interface, agency users can see an agency dashboard with the list of submissions (open/closed) and general statistics.

· The platform allows agencies to communicate with reporters to request more information or to verify that a vulnerability has been fixed.

· Upon reporter’s submission of a vulnerability/it being triaged, the agency is notified (e.g., via email or via the use of the platform API hooked into the agency’s own issue tracking system). The agency can update the submission’s status via the platform’s web interface or API. Once the vulnerability is addressed, the agency can update or close the submission, an action that triggers a notification to the reporter.

CISA

· Manages the administration of agency superuser credentialing to the system.

· Maintains insight into disclosure activities but does not actively participate in each disclosure remediation process. CISA at a minimum has read-only access to all agency reports and can view aggregate statistical data and reports.

· Obtains alerts when predefined thresholds are met (e.g. reports are not responded to, vulnerabilities are not remediated within a number of days, etc.).

Platform Service Provider

· Responsible for hosting and managing the platform, including reporting and administrative responsibilities, CISA and FCEB user management, technical support, and maintaining the security of the platform in alignment with Federal and Department of Homeland Security requirements that authorize the system to operate.

· Provide screening and initial triage of vulnerability submissions, validating that they appear to be a real weakness displayed in the system and routes to relevant FCEB agency.

· Assist agencies with establishing a bug bounty program and facilitating payments to security researchers’ payments

4 TASKS

The service provider shall perform the following tasks:

Task 1: Manage, Operate, and Administer the Platform Task 2: Triage, Route, and Track Vulnerability Reports Task 3: Facilitate Bug Bounty Program

4.1 TASK 1 – MANAGE, OPERATE, AND ADMINISTER THE PLATFORM

The service provider shall provide project management services under this contract that support the successful integration of the Platform with Federal requirements and objectives. This includes ensuring the platform achieves and maintains an Authorization to Operate (ATO), participating agencies are seamlessly onboarded/offboarded from the platform, and tailored operational reports are accurate and easily accessible through the Platform itself.

The service provider shall notify the General Services Administration (GSA) Contracting Officer (CO) and CISA Contracting Officer’s Representative (COR) of any technical, financial, personnel, Organizational Conflict of Interest (OCI), or general managerial problems encountered throughout the period of performance.

4.1.1 SUBTASK 1.1 – CONDUCT A PROJECT KICK-OFF MEETING

The service provider shall conduct a Kick-Off Meeting (Deliverable 01) following contract award. The meeting will provide an introduction between the service provider personnel and Government personnel. The meeting will provide the opportunity to discuss necessary technical and administrative activities associated with execution of the contract.

The Project Kick-Off Meeting Agenda shall include, at a minimum, the following topics/deliverables:

a. Introduction of team members:

1. Roles and responsibilities

2. Lines of communication overview between the service provider and Government.

b. Summary of technical approach:

1. Overview of the platform and its ability to meet technical requirements of Section 3.

2. Approach to satisfying requirements of Tasks 1-3.

c. Contract Administration:

1. Reporting requirements

2. Security requirements

3. Sensitivity and protection of information.

4. Invoice Requirements

5. Additional administrative items including press/news releases.

4.1.2 SUBTASK 1.2 – CONFIGURE, OPERATE AND ADMINISTER THE PLATFORM

The service provider shall initially configure, and then operate and administer the Platform, including providing the hosting and management for the platform, conducting all administrative responsibilities, provide account and user management for CISA and FCEB agencies, and providing all relevant technical support to ensure FCEB agencies are sufficiently supported during platform usage. During execution of the contract, the service provider shall ensure that any developed enhancements for the commercially available SaaS platform are implemented on thePlatform.

The service provider shall coordinate with CISA, as the Government POC for the Platform on all aspects of its operation. This shall include, but is not limited to the following:

· Assist CISA with establishing criteria for categorizing submitted vulnerabilities.

· Establish role-based user accounts for the CISA stakeholders

· Provide CISA with the ability to manage the administration of superuser credentials.

· Automate Platform system alerts for CISA when predefined thresholds are met (e.g., agency accumulates X number of unresolved submissions, submissions reach X number of days without agency update, etc.).

The Platform service provider shall provide onboarding support to FCEB agencies participating in the Platform. This support shall include at minimum the following:

· Providing training materials (Deliverable 02) to agencies that document vulnerability reporting process through the Platform, operational reports available through the Platform, and FCEB agency responsibilities

· Establish role-based user accounts for the FCEB agency.

· Assist agencies in establishing vulnerability report notification techniques (e.g. email or API).

· Create an agency-specific page that lists all FCEB system in scope of the agency’s VDP and clarifies an disclosure policies identified in an agency’s VDP.

· Ensure that the Platform is updated to account for inclusion of any new FCEB agency (or retiring thereof), and that service provider staff are versed in an agency’s VDP.

The service provider shall ensure all vulnerability reports and records related to them are available throughout the period of performance.

In some instances Agencies may elect to conduct its own triage and tracking of submitted vulnerabilities, and thus not utilize the service provider services under Task 2. Participating FCEB agencies that opt-out of triage services will be denoted in the FCEB Agencies List (Attachment A).

If during the period of performance an FCEB agency decides to no longer participate in the Platform, the COR will inform the service provider, and the service provider shall remove all references to the FCEB agency from the Platform and work with the agency to handle disposal of vulnerability records, unless otherwise directed. Any agency that no longer participates in the platform will be removed from the FCEB Agencies List (Attachment A).

4.1.3 SUBTASK 1.3 – MAINTAIN SECURITY OF THE PLATFORM

The service provider shall ensure that the Platform receives a CISA ATO, and then ensure that the ATO is maintained throughout any future system upgrades. The Platform’s anticipated initial Federal Information Processing Standard (FIPS) 199 rating is Low Confidentiality, Low Integrity, and Low Availability. This anticipated rating assumes the service provider is able to effectively segregate data in the platform to ensure that only the instantiation of the service attributed to this requirement is accredited, and that any vulnerability reporter data captured in this instantiation is minimized. In addition, this anticipated rating does not include the optional bug bounty functionality, and activation of the of the optional bug bounty functionality could potential revise the FIPS rating and result in changes to the ATO.

The service provider shall ensure the Platform maintains a system security authorization following the most recent revisions of the following:

a. National Institute of Science and Technology (NIST) Special Publication (SP) 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach

b. NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations

c. DHS Sensitive Systems Policy Directive 4300A and related DHS or CISA security policies and guidance.

The service provider shall support CISA in conducting a security assessment of the Platform through drafting of deliverables (e.g. System Security Plan (SSP)), providing artifacts and screenshots, and making system personnel available for interviews during the security assessment process. The Government desires that the ATO be completed as soon as possible after contract award.

In support of the security accreditation process of the Platform, the service provider shall perform the following:

a. Provide all the required documentation for the security authorization process (e.g., system description, system architecture, security control, POA&Ms, etc.) (Deliverable 03). This includes, but is not limited to the generation of additional security documentation to satisfy NIST 800-53 and DHS 4300A requirements.

b. Remediate all security findings and create Plans of Action and Milestones (POA&Ms) and/or waivers, as appropriate.

c. Ensure DHS and/or CISA security requirements are met including, but not limited to, regular delivery of vulnerability scans, asset management activities, POA&Ms, and/or waiver remediation activities.

d. Support Security Test and Evaluation/Security Assessment activities by ensuring availability of the system personnel for interviews and artifact collections as required.

For any updates to the Platform, the service provider shall update the Security Authorization Package (Deliverable 03) and deliver updates as necessary to maintain the system ATO.

The service provider shall support, as required, a Government provided Security Operation Center (SOC), and participate in incident response activities such as investigative, remediation, and removal tasks, as appropriate.

4.1.4 SUBTASK 1.4 – PROVIDE REPORTING ON THE PLATFORM

The service provider shall provide tailored Platform operational reports (Deliverable 04) through the Platform to CISA and FCEB agencies on a monthly basis. Platform operational reports shall be tailored to relevant stakeholders and include, at a minimum, the following:

· Number of vulnerability reports received

· Number of reported vulnerabilities determined to be valid (e.g., in scope and not false-positive)

· Number of currently open and valid reported vulnerabilities

· Number of currently open and valid reported vulnerabilities older than 90 days from the receipt of the report

· Median time to validate a submitted report (from the perspective of the agency)

· Median time to remediate/mitigate a valid report

· Median time to initially respond to the reporter

· Median age (in days from receipt of the report) of currently open and valid reported vulnerabilities

· Number of all reports older than 90 days by risk/priority level

· Median age of reports older than 90 days

· Bug bounty metrics for Agencies opting for a bug bounty program

· Reports specific to remediation activity

4.2 TASK 2 – TRIAGE, ROUTE, AND TRACK VULNERABILITY REPORTS

The service provider shall provide triage, routing, and tracking support of submitted vulnerabilities for FCEB agencies participating in the Platform that have elected to receive triaging services as noted in the FCEB Agencies List (Attachment A).

The service provider shall screen all submitted vulnerabilities and triage to ensure that only valid vulnerability reports are routed to the appropriate FCEB agency for resolution. As part of the triage services, the service provider shall, at a minimum, provide the following:

· Ensure that submitted vulnerability reports are consistent with FCEB agency VDP and are for a relevant FCEB system

· Screen submitted vulnerabilities for obvious errant reports (“noise filtering”) and false positives

· De-duplicate vulnerability reports submissions

· Evaluate potential severity to an organization and provide severity rating classification Following effective triaging of a submitted vulnerability report, the service provider shall route the valid vulnerability reports to the appropriate FCEB stakeholders. The Platform service provider should ensure the security researchers are notified of a valid vulnerability report and assist in facilitating communication between the FCEB agency and relevant security researcher. This communication may include the FCEB agency requesting that the security researcher validate that the agency implemented remediation actually resolves the identified vulnerability.

Throughout the submission, triage, and routing process, the service provider shall ensure that the Platform is positioned to report on the status of any vulnerability report to CISA and impacted FCEB agency.

4.3 TASK 3 – FACILITATE BUG BOUNTY PROGRAM (OPTIONAL)

As addressed in Section 3.4, the Platform shall include optional functionality for FCEB agencies to establish a bug bounty program to incentivize/reward security researchers for identifying valid vulnerabilities. FCEB agencies can elect to establish bug bounty programs by utilizing the optional CLINs on this contract.

For Agencies that elect to establish a bug bounty program, the service provider shall, at a minimum, provide the following:

· Guidance to an FCB agency on establishing a sufficient pool of funding to support bug bounty.

· Support to an FCEB agency in targeting certain systems for bug bounties

· Manage payment to security researchers for valid vulnerability reports following effective triage in Task 2.

· Report to FCEB agency on valid vulnerability reports that have resulted in a financial award, the amount of the award, and the name of the security researcher.

5. QUALITY ASSURANCE AND ACCEPTABLE CRITERIA

The Government has established and will maintain a Quality Assurance Surveillance Plan (QASP) for work accomplished under this contract. The QASP will be based under the following standards and acceptable quality levels (AQL)s:

6. CONTRACT DELIVERABLES

The following abbreviations are used in this schedule:

DEL: Deliverable All references to days: Government Workdays Deliverables are due the next Government workday if the due date falls on a holiday or weekend.

The service provider shall deliver the deliverables listed in the following table on the dates specified:

7. ROLES AND RESPONSIBILITIES

Identification of all government personnel, including their specific roles and responsibilities:

7.1 CONTRACTING OFFICER

xxxxxx GSA FAS Telephone Number:

Electronic Mail:

Responsibility for contracting activities rests solely with the Government Contracting Officer. No conversation, recommendations, or direction, whether given directly by, or implied by Government personnel, that will affect the scope, schedule, or price of the program covered by this solicitation or any resulting contract, shall be acted upon by the Contractor unless specifically approved by the Government Contracting Officer. In the absence of the assigned CO, any GSA Region 8 CO may fill in and has full authority to act on this task order.

7.2 CONTRACTING SPECIALIST

xxxxxx GSA FAS Telephone Number:

Electronic Mail:

As a member of the contract administration team, the contract specialist will be responsible for working in concert with the Contracting Officer while performing post award administrative functions and certain assigned pre-award functions.

7.3 CONTRACTING OFFICER’S REPRESENTATIVE (COR)

TBD, DHS

Telephone Number: TBD Electronic Mail: TBD

CONTRACTING OFFICER'S REPRESENTATIVE (DEC 1991)

(a) Definition. “Contracting officer's representative” means an individual designated in accordance with subsection 201.602-2 of the Defense Federal Acquisition Regulation Supplement and authorized in writing by the contracting officer to perform specific technical or administrative functions.

(b) If the Contracting Officer designates a contracting officer's representative (COR), the Contractor will receive a copy of the written designation. It will specify the extent of the COR's authority to act on behalf of the contracting officer. The COR is not authorized to make any commitments or changes that will affect price, quality, quantity, delivery, or any other term or condition of the contract.

8.0 LIST OF ATTACHMENTS

image1.png image2.png