J-0200000-12-01 FRCS Roles and Responsiblities.xlsx
XLSX spreadsheet 15 KB Posted
- Solicitation number
- N4008526R0033
About this file
This is a Roles and Responsibilities matrix for cybersecurity functions related to Facility-Related Control Systems (FRCS) at Naval Base Coronado Gulfport. The document delineates lead and supporting responsibilities between government and contractor personnel across multiple cybersecurity domains, including operational technology (OT) cybersecurity workforce management, cybersecurity training and education, vulnerability management, incident response, access controls, configuration management, and public key infrastructure.
Key contractor responsibilities include maintaining OT systems and networks (hardware and software), implementing cybersecurity controls such as patching and STIG compliance, monitoring OT performance and system recovery processes, establishing audit trails and system logs, conducting daily audits of system logs, managing configuration control and hardware/software disposition, and ensuring antivirus signatures remain current. The contractor must also support the government's lead role in cybersecurity program execution, assist with vulnerability scanning and remediation activities, participate in the Information Assurance Vulnerability Management (IAVM) program, comply with all security requirements while holding appropriate security clearances and privileged user agreements, and immediately inform the Contracting Officer's Representative (COR) of any operational issues unresolved within 24 hours. Government maintains lead responsibility for issuing IAVM notifications and formal tasking, implementing cybersecurity controls, conducting initial vulnerability assessments, and approving personnel access to OT systems.
View the file
Other files
Show 40 more
Latest 50 of 59 listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Roles and Responsibilities
| Attachment J-0200000-15-01 FRCS Cybersecurity Roles and Responsibilities | ||||
| Cybersecurity Areas | Resposibility | Government Role | Contractor Role | |
| OT Cyber-Scecurity Work Force R&R (Section 2) | ||||
| The Contractor shall support government execution of the Contrctor OT FRCS Cybersecurity Program for all control systems listed in J-150200-04 per the Cybersecurity Roles and Responsibilities for Facility-Related Control Systems at NCBC Gulfport contained in J-020000-17-1. | L | L = lead responsibility | ||
| Serve as principal advisor to the Contractor Official Representative (COR), PWD Government Personnel, and Contractor on all matters relating to the security and integrity | L | S = supporting role | ||
| Comply with all security requirements, and hold a security clearance, access approvals, and have a completed and signed privileged user agreement equal to the level of information processed by the OT | S | L | ||
| Maintain (i.e. Upgrades, Operation Changes etc.) OT system and networks, to include hardware and software. (Contractor) | L | |||
| Implement Cybersecurity controls (i.e. patching, STIGs, etc.) for OT system and networks to include hardware and software. (Government) | L | |||
| Monitor OT performance and system recovery processes to ensure security features and procedures are properly functioning. (Contractor) | L | |||
| Work closely with the ISSOs to ensure the OT System or network is used and administered securely. | L | |||
| Participate in the incident reporting program and conduct reporting. | L | S | ||
| Provide customer support and ensure that all users have the required security clearances, authorization, need to know, signed and approved privileged user agreement, and are aware of their security responsibilities before granting access to the OT. | S | L | ||
| Assist the ISSE in ensuring the system is operated, maintained, and disposed of in accordance with security policies and practices outlined in the accreditation and certification support documentation package. | L | |||
| Confirm software licenses and documentation are maintained by each User Representative or Program Manager (PM). Notify the ISSM and ISSO when changes occur that might affect accreditation and certification. | S | L | ||
| Assist the ISSM and ISSO in development and maintenance of the accreditation and certification support documentation package. | L | |||
| Establish audit trails, system logs, and conduct reviews periodically, and ensure audit records are archived for future reference as directed by the ISSO and ISSM. | L | |||
| Validate and/or define system performance, availability, and functionality requirements. |
| L | |||
| Assist in preparation of site Certification and Accreditation (C&A). | S | ||
| Support certification actions. | S | ||
| Continuously review threat, system vulnerabilities, and residual risk. | L | S | |
| Submit proposed changes for OT FRCS. | L | ||
| CYBER-SECURITY TRAINING, EDUCATION AND MANAGEMENT (Section 3) | |||
| Identify all Contractor CS functions and the corresponding training/certification requirement. | L | ||
| Identify all personnel performing authorized OT functions. | L | ||
| Ensure all authorized users accessing OT FRCS complete the DoD CS approved training. | L | S | |
| CYBER-SECURITY INFORMATION ASSURANCE VULNERABILITY MANAGEMENT (IAVM) PROGRAM, AND SCANS (SECTION 4) | |||
| Upon receipt of IAVA/IAVB/CTO messages, the government will issue notification for scheduling formal tasking of IAVA/IAVB compliance requirements. | L | ||
| Review all Alerts, Bulletins, and Task Orders via the U.S. Cyber Command (previously JTF-GNO) website located at https://www.cybercom.mil for a technical overview, and determine vulnerable applications/systems. | L | ||
| Determine reporting requirements. | L | ||
| Acknowledge IAVM messages. | L | ||
| Maintain up-to-date antivirus signatures | L | S | |
| Scans | L | S | |
| 1.a Initial ACAS scan conducted | L | ||
| 1.b Review scan results for applicable patches for vulnerabilities | L | ||
| 1.c Test system with latest government applicable patches | S | L | |
| 1.d Schedule maintenance cycle and remediate all applicable systems | L | S | |
| 1.e Re-scan systems after remediation | L | ||
| 1.f Upload weekly ACAS scan into VRAM | L | ||
| 1.g Review VRAM status | L | ||
| INTRUSION FORENSICS, INCIDENT RESPONSE PROCEDURES, AND REPORTING REQUIREMENTS (Section 5) | |||
| The Contractor shall immediately inform the COR of any operational issue that cannot be resolved within 24 hours of notification. | L | ||
| ACCESS CONTROLS, AUTHENTICATION, AND ACCOUNT MANAGEMENT (Section 6) | |||
| User Accounts and Password Policy | L | S | |
| Passwords | L | S | |
| User Login IDs | L | S | |
| 3.a Conduct daily audits of all system logs | L | ||
| 3.b Investigate any items as items as required | L | S |
| CONFIGURATION MANAGEMENT (Section 7) | |||
| Life Cycle Management Hardware/Software | L | ||
| Site Security Baseline Validation | L | S | |
| Ports, Protocols, Services Management (PPSM) | L | S | |
| Site System Topology (Wiring and Logical) (Diagram) | L | S | |
| Configuration Control Board (CCB) | L | S | |
| Disposition of Hardware/Software | L | S | |
| 5.a Conduct automated SCAP review when new benchmarks come out | L | ||
| 5.b Conduct manual STIG review when new benchmarks come out | L | ||
| 5.c Apply updated STIG requirements to devices | L | S | |
| 5.d Conduct final review for STIG compliance | L | S | |
| PUBLIC KEY INFRASTRUCTURE (PKI) (Section 9) | |||
| Tokens for BOSC | L | S | |
| POLICY AND GUIDANCE FOR USE OF THE INTERNET, ELECTRONIC MAIL (EMAIL) AND GOVERNMENT OT (Section 10) | |||
| Information Security Program | L | S | |
| Maintain password protection on their accounts. | L | S | |
| Passwords must be changed every 90 days and meet complexity requirements as required in this manual. | |||
| L | S | ||
| Passwords must be changed every 90 days and meet complexity requirements as required in this manual. | L | S | |
| Work stations may not be left unattended, if logged on. | S | L | |
| Immediately report all security incidents and potential threats and vulnerabilities to the government. | L | ||
| Ensure systems media and systems output are properly classified, marked, stored, and controlled. | S | L | |
| Inform the ISSM when access is no longer required. | L |
| PORTS, PROTOCOLS, AND SERVICES (PPS) (Section 11) | |||
| Ensure Authorized Ports Protocols and Sevvices are enabled | L | ||
| Ensure Non Approved Ports Protocols and Services are not enabled | L | S |
File details come from the government source that posted it. Updated .