J Attach J004 - DIDs _ FINAL SIR 693KA8-R-00017.pdf

FINAL SIR 693KA8-20-R-00017 (Cybersecurity and Penetration Testing)

ATTACHMENT J004– DATA ITEM DESCRIPTIONS

Table of Contents

CDRL 001 Program Management Plan CDRL 002a Meeting Agenda CDRL 002b Meeting Minutes CDRL 002c Program Management Review Presentation CDRL 003 Quality Control Plan CDRL 004 Monthly Status Report CDRL 005 Phase-In Transition Plan CDRL 006 Phase-In Inventory Report CDRL 007 Phase-Out Transition Plan CDRL 008 Phase-Out Inventory Report CDRL 009 Integrated Master Test Schedule CDRL 011 System Security Assessment Test Plan CDRL 011 System Security Assessment Report (SAR) CDRL 012 Plan of Action and Milestones (POAMs) CDRL 013 Penetration Test Plan CDRL 014 Penetration Testing Report

CDRL 001 Program Management Plan

DATA ITEM DESCRIPTION

1. CDRL TITLE

Program Management Plan (PMP)

2. CDRL NUMBER

CDRL-001

3. DESCRIPTION/PURPOSE

The Program Management Plan (PMP) must describe the Contractor’s comprehensive management approach to providing technical, management, schedule, and cost data. The plan provides current information used in describing the approach, resources and needs of the contractor to perform the effort.

The PMP is an all-inclusive management plan that provides the details of the specific procedures to be used for managing the performance of the contract including, but not limited to, risk management, schedule management, staffing management, and security management. Additionally, the PMP must include an organizational structure, including the roles and responsibilities of key personnel and teammates, a subcontractor management process, and staff training and certifications process.

4. DATA REQUIREMENTS

Reference: SOW paragraph 3.1

Contents: The Contractor’s Program Management Plan (PMP) must contain the following information at a minimum:

Introduction: This section must contain an overview of the Contractor’s Program Management approach to meeting all the requirements outlined in contract.

Indication of the relationship of the plan to the CWBS: This must include a description of each element and the cost associated with each element.

Milestone chart: A detailed program milestone chart covering the major activities of the program (system deliveries, tests, etc.) by CWBS, if applicable, and in linear time phasing.

Equipment/facilities chart: A chart depicting major government furnished equipment (GFE) and the date and duration that such GFE and facilities are required.

Cost chart: A cost chart depicting by month the estimated program spend forecast per fiscal year

(October thru September).

Purchase Chart: A chart depicting subcontractors and equipment or material purchases, the date and approximate amount of each.

Organizational data including:

Management Organization: This section must provide an organizational chart of the

Contractor’s Program Management Organization, including the key personnel and a narrative

Program Management Plan (PMP)

CDRL-001

describing how the Contractor will fully integrate the management of all elements of the contract.

A chart showing the relationship of the program functions to the functional organizations indicating lines of authority and communications. This section must describe working relationships the Contractor will establish with the FAA to ensure successful delivery of contract requirements.

Program Management: This section must describe the Contractor’s approach to managing the requirements and resources deployed at the FAA. This section must include the approach to delivering all requirements outlined in the contract.

Staffing and Recruitment: This section must describe the Contractor’s detailed approach to recruiting qualified personnel to perform the efforts required under this contract in accordance with the requirements outlined in the contract.

Resource Management: This section must describe the Contractor’s approach to resource management. The Contractor must provide a detailed approach to hiring, training, and maintaining quality resources to satisfy the requirements under this contract. The Contractor must provide a detailed approach to training and obtaining the Contractor certifications required.

Transition Coordination and Delivery: This section must describe the Contractor’s detailed approach to delivering transition (phase-in/out requirements) in accordance with the contract.

Subcontract Management: This section must describe the Contractor’s approach to managing subcontractor activities. This approach must include but is not limited to the organizational relationship the Contractor will maintain with subcontractors, the methods the Contractor will use to flow requirements down to subcontractors, and the methods the Contractor will use to monitor the performance of subcontracted requirements.

Risk Management: This section must describe the internal approach and method for the identification, assessment, and mitigation of program risks. The description must include, but is not limited to, provisions for identifying risk areas, assessing risk factors, assigning appropriate resources to reduce risk factors, identifying and analyzing alternative actions available. This section must also describe the approach for Integrated Risk Management.

Security: This section must describe the Contractor’s approach to implementation of security provisions, including security authorization and certification activities, personnel, and physical security.

CDRL 002a Meeting Agenda

Meeting Agenda

CDRL-002a

The meeting agenda provides information concerning purpose, location, and schedule of conferences, reviews, and audits.

4. DATA REQUIREMENTS

Reference: SOW paragraph 3.1.3

Format: Contractor format is acceptable.

Contents:

The agenda shall include as a minimum the following, where applicable:

a. The purpose and objective of the meeting.

b. The meeting location, date, and duration.

c. A daily chronological listing of each major topic or subtopic to be discussed and the time to be devoted to each topic.

d. A projected list of Contractor and Government attendees.

CDRL 002b Meeting Minutes

Meeting Minutes

CDRL-002b

Meeting Minutes are the official record of proceedings reported as a result of a meeting.

Reference: SOW paragraph 3.1.3

Contents:

Minutes shall address salient points of discussion recorded during meetings and include, but not be limited to, the following information:

Attendees including their organization and email address

Program Status

Scheduling Information

Problems

Problem Resolutions

Risks

Financial Data

Personnel Resource Allocation

Action item Status

CDRL 002c Program Management Review Presentation

1. CDRL TITLE

Program Management Review (PMR) Presentation

2. CDRL NUMBER

CDRL-002c

3. DESCRIPTION/PURPOSE

The Contractor's PMR Presentation serves to inform the Government of the Contractor’s assessment of contractual effort as of the date of the review/report. It covers achievements and areas of difficulty and provides the Contractor’s approach for correcting problems and maintaining baseline plans.

Reference: SOW paragraph 3.1.6

Format: Contractor format acceptable.

Contents: The Project Management Status Report (PMSR) must cover the Contractor's and all subcontractor(s) activities. The report must provide a synopsis of the project's activity over the period covered by the report. The report must include a summary of activity for each area of the contract, including discussion of issues and concerns within those areas.

Summary: A general summary of the project including work accomplished in each area of the contract, status and analysis of project schedule and budget, and issues and concerns affecting the project during the period must be reported.

Metrics: The report must include a discussion of each metric used for monitoring contract performance. Include a comparison of actual versus planned values for the current reporting period and a graphical representation of the current and, as a minimum, the last five (5) reporting periods.

Issues and Concerns: Each issue or concern must be identified and discussed separately. For each issue or concern identified, the Contractor must provide a description of the issue or concern, an assessment of the criticality and time sensitivity of the issue or concern, and actions planned to overcome them. For each action plan proposed, the report must indicate involvement by the Government or subcontractors.

Risk Analysis: The report must include a discussion of the technical, cost, or schedule risks encountered during the reporting period. The risks must be related to the issues or concerns addressed by this report and rated as high, moderate, or low, depending on impact of the risk. The report must include discussion of actions taken or planned and time frame to reduce identified risks. Risk analysis must conform to the risk management plans of the Contractor and the Government. The report must include a plan of action to mitigate risk when metrics show a deviation of 10 percent or greater between planned and actual indicators.

Program Management Review (PMR) Presentation

CDRL-002c

Technical Performance: The report must include a discussion of technical performance in each area of the contract, for efforts scheduled during the period, or in progress during the period.

Engineering: The report must summarize engineering activities performed during the period. Include status of each site activities in relation to planned milestone dates, status of open Problem Trouble Reports (PTRs), ECPs or configuration changes affected during the period.

Schedule: The report must contain an updated Program Schedule showing key project events, any delays incurred during the period covered by the report, and expected completion dates of these events. The report must include the cause of any schedule delays and identify the impact of those delays.

Schedule and Technical Performance: The report must include information that shows the relationship between schedules and technical performance. The report must provide the date and identify each of the technical accomplishments that occurred between the end of the reporting period and the submission of the PMR to the

Government.

60 Day Projection: The report must include a section that provides the Contractor's

60-day outlook on projected technical accomplishments.

Action Item Status: The report must include the status of action items resulting from all meetings held during the period. The status must indicate actions as opened or closed. If opened, the status must contain the planned actions necessary to close the action; if closed, the status must portray the actions taken to close the action. Actions remaining open between reporting periods must be reported.

Government Furnished Equipment (GFE) Status: The report must contain a status of GFE which has been provided to the Contractor for this contract.

Staffing Changes: The Contractor must identify in the PMSR, and staffing changes affecting key personnel that occurred over the period covered by the PMSR or planned in the next reporting period.

CDRL 003 Quality Control Plan

1. TITLE

Quality Control Plan (QCP)

2. NUMBER

CDRL-003

3. DESCRIPTION/PURPOSE

The purpose of the Quality Control Plan (QCP) is to document and describe the Contractor’s plan, procedures, and controls that will be used to: satisfy the requirements, substantiate the quality of service provided and delivered, and fulfill contract requirements throughout the period of performance of the contract.

Reference: SOW paragraph 3.1.4

Format: Contractor format acceptable.

Content: The QCP will contain the information required to identify how the contractor will satisfy the specific quality tasks within the contract and describe the contractor’s understanding of all documentation tasks required for meeting the contractual requirements. The QCP includes the technical and manufacturing aspects of production, raw materials, facilities involved, and personnel required. The QCP will cover the following:

Reference Documents: A complete list of compliance and reference documents (e.g. ISO

9100A, MIL-STD-1686) that are used to guide the writing and implementation of QCP.

Management: Provides the organizational structure, and their responsibilities that will influence the quality of the products. Examples of elements to be addressed include quality planning, implementation, control and monitoring; significant interfaces that affect products, contracts, sellers, problem reporting and resolution; review of audit results; authorization for deviation to quality policy; and control of corrective and preventive actions. Additional elements based on the program requirements will be agreed to prior to contract award.

Design Control: Identifies and describes the standards, practices, conventions and metrics that are to be applied to this project. Also identifies and describes how quality will monitor compliance to these standards and how conformance to requirements will be verified.

Purchasing: Provides details of all critical or key products that will be purchased and any relevant quality assurance requirements for these products. Depicts the method used to evaluate, select and control sellers.

Control of Customer Supplied Products: Provides specifics on how customer supplied products are identified and controlled and the method used to verify that these products meet the requirements.

Process Control: Give details of the method employed to verify process controls are in place and being used at the manufacture/assembly. Verification should include process documentation, monitor and control of characteristics, acceptable workmanship standards, use of qualified processes, equipment and personnel, adequate and appropriate tooling and test equipment. List all critical processes used on this project and the method or plan to use to control each of them.

Inspection and Testing: Delineates the required inspection and testing. Describing what characteristics will be verified at each step in the process, how customer or regulatory established witness points, and use of third-party verification. Provides a description of the type, quantity, and format of the test data, including any unique or specific requirements used in identifying inspection and test status of the products.

Problem Reporting and Preventive/Corrective Action: Identifies methods used to detect, report, track, and resolve product/process problems and trends. Provide a description on how the

U.S. Government will interface with this process.

Handling, Storage, Marking, Packaging, Preservation and Delivery: Describe the methodology used to verify that specific parts and product handling, storage, marking, packaging, and delivery requirements are met. Includes the method used to verify that the delivered products have not degraded beyond the requirements.

Control of Quality Records: Depicts what records are to be kept, for how long, where, by whom, and what form these records will exist. Provides a description of how the records will be stored, retrieved, disposition, confidentiality requirements, and the method used to implement them.

Quality Audits: Identifies the nature and extent of the quality audits to be performed (e.g.

internal, customer supplier, regulatory, seller and ISO registration), how the results will be used in the corrective and preventive action system, and to what extent the customer’s involvement in internal quality audits.

Statistical Techniques: Includes the statistical techniques to be used to evaluate and maintain consistent quality control.

CDRL 004 Monthly Status Report

Monthly Status Report (MSR)

CDRL-004

The Monthly Status Report (MSR) provides the Contractor’s assessment of overall contractual progress, risk identification and mitigation strategies, action item status, progress against schedule baseline (as applicable) and identification of variances, performance data, and cost reporting.

The MSR is intended to provide the FAA with an accurate, consistent, timely, and understandable summary assessment of contract performance.

Reference: SOW paragraph 3.1.5

Format:

The MSR may be submitted in Contractor format, subject to Government approval.

Content:

Summary. The summary shall include a brief statement of the overall project status, covering the accomplished technical activities and development, objectives of efforts, summary results of efforts, identification of major problems/deficiencies with impact, and recommended solutions.

Body of report. The Status Report shall contain the following items, where applicable:

Milestone/task status. The status of each milestone/task as defined by the statement of work or contract, as applicable

a. A statement as to whether or not the program/project/task is on schedule; if not, the effort planned to meet the schedule shall be indicated. Include an overall status of each milestone, task, or unit of work. Include update schedule sheets, milestone charts, or task synopsis sheets identifying phase of task and percentage of completion of each task, technical instruction, or order.

b. A comparison of achieved end-product performance capabilities projected against contract baseline values, requirements, or allocations.

c. Effort expended on each task to date, and a brief description of technical developments and accomplishments.

Monthly Status Report (MSR)

CDRL-004

d. Key dates in any testing including a description of tests performed and significant test results.

e. A list of all other work performed and a brief description of each item. For work in process, provide estimated dates for completion.

f. A narrative of outstanding problems existing as of the previous status report, and their resolution status.

CDRL 005 Phase-In Transition Plan

Phase-In Transition Plan

2. CDRL NUMBER

CDRL-005

3. DESCRIPTION/PURPOSE

The Contractor's Phase-In Transition Plan describes the Contractor’s approach to ensuring a smooth transition from the legacy program to the current contract. The transition plan also describes the

Contractor’s management organization to include interrelationships among the prime Contractor, major subcontractor(s), and the contracting activity. The transition plan is an all-inclusive management plan that provides the details of the specific techniques, tasks, and procedures to be used for transitioning the contract including, but not limited to, risk management, staffing, knowledge transfer, schedule, communication and operational readiness.

4. DATA REQUIREMENTS

Reference: SOW paragraph 3.1.7.1

Contents: The Contractor’s Transition-In Plan must contain the following information at a minimum:

Transition Approach: This section must contain a comprehensive description of how the

Contractor will transfer services to full performance under the contract.

Transition Schedule: This section must contain a detailed transition schedule, created in

Microsoft Project, and baselined at the kickoff of the transition period. The schedule must include a description of the sequence of activities from contract award through the full implementation of the contract services.

Program Management Plan: This section must contain the Contractor's detailed approach to establishing their PMO, as it pertains to the transition. This section must contain a list of designated key and essential personnel and staff assigned to support the transition.

Risk Management Plan: This section must describe the internal approach and method for the identification, assessment, and mitigation of transition risks. The description must include, but is not limited to, provisions for identifying risk areas, assessing risk factors, assigning appropriate resources to reduce risk factors, identifying and analyzing alternative actions available, identifying the most promising alternatives, and planning for implementation of risk reduction.

Staffing Ramp-up Plan: This section must describe the Contractor’s detailed approach to recruiting, hiring, and onboarding new staff.

Interim and Final Operational Readiness Review (ORR): This section must describe the

Contractor’s detailed approach to the Operational Readiness Review process. The purpose of the

ORR is to provide a formal process to assess the Contractor’s readiness to assume contract operational responsibilities at interim periods during the transition and then at the end of the

Phase-In Transition Plan

2. CDRL NUMBER

CDRL-005

transition.

Communication and Reporting Plan: This section must detail the Contractor’s communication and reporting plan, including proposed meetings and reporting deliverables to be provided to the

FAA during transition.

CDRL 006 Phase-In Inventory Report

Phase-In Inventory Report

2. CDRL NUMBER

CDRL-006

3. DESCRIPTION/PURPOSE

The Phase-In Inventory Report provides a record of Government property.

4. DATA REQUIREMENTS

Reference: SOW paragraph 3.1.7.1

Contents: The Contractor must maintain and accumulate data on all items in operations and spaces to track whether each was in transit during the reporting period for the purpose of providing the report.

The Contractor must physically inventory all items and documentation in Government stores

The Physical Inventory Report must be prepared in Contractor specified format as approved by the Government.

The Physical Inventory Report must include, but not be limited to, the following information:

o Title Block consisting the of the date, attendees, and actions and events covered in the report o Executive summary for the FAA o Identification of the (Name of Program) baseline in effect during the audit o Summary or model of the audit process / sample technique / population to be observed o Template Inventory Checklists for hardware, software, documentation, test equipment, piece parts including information of quantity, identity, type, version, status, and location.

o Filled-in checklists that represent the current inventory o Discrepancies/Shortfalls from last report o FAA system accounting of (Name of Program) inventory comparison/correlation with audit results o Waivers List o Equipment List with current / pending status o Observations o Recommendations

CDRL 007 Phase-Out Transition Plan

Phase-Out Transition Plan

CDRL-007

The Contractor's Transition-Out Plan describes the Contractor’s approach to a smooth transition from the current legacy program/contract to a future contract. The Phase-out Transition Plan is an all-inclusive management plan that provides the details of the specific tasks, and procedures to be used to assist the

Government in transitioning from the contract to a future contract.

Reference: SOW paragraph 3.1.7.2

Contents: Contractor must provide a Phase-Out Transition Plan no later than ninety (90) calendar days prior to the contract expiration. The Phase-Out Transition Plan must detail the activities that the

Contractor must undertake to ensure a smooth transition from Contractor to FAA operations, and the preparations, facilities, and personnel that the FAA will require to assume responsibility for the conduct of all services provided under the contract. The Phase-Out Transition Plan must recommend the time required to ensure a smooth transition with minimal interruption to required activities. The plan must be submitted in Contractor’s format and must include, but not be limited to:

Knowledge Transfer plan: This section must describe the Contractor’s high-level approach to knowledge transfer including but not limited to necessary personnel records, and all documentation developed or maintained under contract.

On-the Job training: Any formal/ /familiarization required to support the repair functions

Activities: procedures and schedules for any necessary refurbishment, calibration, and acceptance of GFE/GFP prior to return to the FAA

Detailed plan for shipment, installation, and checkout: of any GFE/GFP at the designated FAA facility

Duration and type of Contractor support required: if any, at the FAA facilities during

Disposition and physical inventory: stock, to include all accounting records

Operating methods: to be employed to assure services during the transition period

Method or procedure of transitioning management

Estimated cost (based on the Contractor’s prior experience) of managing vendor repair subcontracts for the life cycle of the system.

Recommendations for additional equipment, processes, and documentation which would be beneficial to the FAA operation.

Phase-Out Transition Plan

CDRL-007

Packaging, preservation, and marking

Software development system and related documentation; and

Implementation of any technology upgrades.

CDRL 008 Phase-Out Inventory Report

Phase-Out Inventory Report

CDRL-008

The Contractor's Phase-Out Inventory Report provides a record of Government property.

4. DATA REQUIREMENTS

Reference: SOW paragraph 3.1.7.2

Contents: The Contractor must maintain and accumulate data on all items in operations and spaces to track whether each was in transit during the reporting period for the purpose of providing the report.

The Contractor must document physically inventory all items and documentation in

Government storage

The Phase-Out Inventory Report must be prepared in Contractor specified format as approved by the Government.

The Phase-Out Inventory Report must include, but not be limited to, the following information:

Title Block consisting the of the date, attendees, and actions and events covered in the report

Executive summary for the FAA

Identification of the (Name of Program) baseline in effect during the audit

Summary or model of the audit process / sample technique / population to be observed

Template Inventory Checklists for hardware, software, documentation, test equipment, piece parts including information of quantity, identity, type, version, status, and location.

Filled-in checklists that represent the current inventory

Discrepancies/Shortfalls from last report

FAA system accounting of (Name of Program) inventory comparison/correlation with audit results

Waivers List

Equipment List with current / pending status

Observations

Recommendations

CDRL 009 Integrated Master Test Schedule

Integrated Master Test Schedule (IMTS)

2. CDRL NUMBER

CDRL-009

3. DESCRIPTION/PURPOSE

The Integrated Master Test Schedule (IMTS) details all required activities and resources to address the full scope of testing requirements to meet program objectives. The ITMS includes risk and vulnerability assessments, penetration testing, aircraft cyber testing, specialized assessments, and international assessments.

4. DATA REQUIREMENTS

Reference: SOW paragraph 3.1.2

The final format and content of the ITMS will be determined after contract award.

At a minimum, the IMTS must meet the following requirements:

o Developed using an FAA approved, commercially available software program.

o Integrates with the Contractor’s Project Management Plan and the Government’s master test schedule.

o Includes a hierarchical, tiered structure capable of rolling up to high-level summary representations of activities as well as breaking down to the lowest level of task details showing dependencies, resources, durations, and constraints.

o Includes all systems, test dates, and resources required to perform all testing o Identifies task level requirements o Includes measurable deliverables, milestones, or accomplishments (e.g. satisfactory completion of a test event, approval of a test plan, etc.)

CDRL 011 System Security Assessment Test Plan

System Security Assessment Test Plan

CDRL-010

The purpose of security assessment test plan is to verify each system’s compliance with security policy and guidelines, and to evaluate their effectiveness against anticipated threats against the baselined security controls. The implementation of security controls is described in the System Security Plan (SSP), and required by the FAA to meet Federal Information Security Management Act (FISMA) compliance mandate.

Reference: SOW paragraph 3.2

Format: The plan must be in an agreed upon format between the FAA and the contractor.

Contents:

a. Introduction

b. Purpose

c. Assumptions

d. Constraints

e. Scope

f. Web Application Scan Scope

g. System Database(s) Scan Scope

h. Test Team Composition

i. Schedule and Location

j. Security Control Assessment Requirements and Approach

k. Requirements

l. General Approach

m. Examination, Interview and Testing of Security Controls

n. System Impact Level

o. Specific Test Steps

CDRL 011 System Security Assessment Report (SAR)

System Security Assessment Report

CDRL-011

The System Safety Assessment Report (SAR) is described in detail in the FAA Safety Risk Management

Guidance for System Acquisitions (SRMGSA), Appendix I, Guidance for Conducting and Documenting a System Safety Assessment Report.

The SAR is a report that provides management with an overall assessment of the safety risk associated with a system prior to its fielding and must be signed by the Federal Aviation Administration prior to system operation. It consists of summaries of the safety analyses conducted, a status of all the existing and recommended safety requirements identified, and the results of any testing performed to verify/validate those requirements.

Reference: SOW paragraph 3.2

ATO Safety Management System (SMS) Manual

SRMGSA

Format: The report must be prepared as a Safety Risk Management (SRM) document using the guidelines contained in the SMS Manual.

Contents: The SAR includes a summary of the analyses performed and their results, the tests conducted and their results, and a compliance assessment. The SAR must contain those elements prescribed in

SRMGSA Appendix I.

https://my.faa.gov/content/dam/myfaa/org/linebusiness/ato/safety/sms/documents/SRMGSA/SRMGSA_I.pdf https://my.faa.gov/content/dam/myfaa/org/linebusiness/ato/safety/sms/documents/SRMGSA/SRMGSA_I.pdf https://my.faa.gov/content/dam/myfaa/org/linebusiness/ato/safety/sms/documents/SRMGSA/SRMGSA_I.pdf https://my.faa.gov/content/dam/myfaa/org/linebusiness/ato/safety/sms/documents/ATO-SMS-Manual/201607-SMS-Manual.pdf https://my.faa.gov/content/dam/myfaa/org/linebusiness/ato/safety/sms/documents/SRMGSA/SRMGSA.pdf

CDRL 012 Plan of Action and Milestones (POAMs)

Plan of Action and Milestones (POAM)

2. CDRL NUMBER

CDRL-012

1. DESCRIPTION/PURPOSE

The Plan of Actions & Milestones (POA&M) is a key document in the security authorization package and for continuous monitoring activities. The POA&M facilitates a disciplined and structured approach to tracking risk mitigation activities. The POA&M includes security findings for the system from continuous monitoring activities and periodic security assessments such as the Annual Assessment. A POA&M describes the current disposition of any discovered vulnerabilities and system findings and includes a

CSP’s intended corrective actions for those findings. Agency AOs or designees are responsible for reviewing and approving POA&Ms, making their own risk-based decision both at the time of the initial assessment and during ConMon.

4. DATA REQUIREMENTS

References: SOW paragraph 3.2

Contents: The plan must include the following items:

a. POAM ID. Unique identifier for each POAM Item

b. Controls. Applicable 800-53 Control(s)

c. Weakness Name. Name of the weakness as provided by the scanner or otherwise summarizing the weakness

d. Weakness Description. Description of the weakness and other information

e. Weakness Detector Source. The scanner name or other source that detected the vulnerability

f. Weakness Source Identifier. Vulnerability identifier (Plugin ID) as provided by scanner

(plugin ID/None)

g. Asset Identifier. Identifier Specified in the Inventory This is a unique string associated with the asset, it could just be IP, or any arbitrary naming scheme This Field should include the complete identifier (no short hand), along with the port and protocol when provided by the scanner. Each Asset should be separated by a new line (Alt+Enter)

h. Point of Contact. Person Responsible for implementing this task

i. Resources Required. Specify resources needed beyond current resources to mitigate task.

j. Overall Remediation Plan. General overview of the remediation plan

Plan of Action and Milestones (POAM)

CDRL-012

k. Original Detection Date. Date the weakness was first identified (aka Discovery Date)

l. Scheduled Completion Date. Permanent Column Date of intended completion

m. Planned Milestones. Permanent Column List of proposed Milestones, separated with a blank line

n. Milestone Changes. Milestone Changes (Milestone Number) [Type of update] [milestone date] : How and why the date changed, or the milestone was altered Create a new Milestone

Number for new Milestones

o. Status Date. Date POA&M item was last changed or closed

p. Vendor Dependency. Whether or not this item is vendor dependent.

q. Last Vendor Check-in Date. Date of last vendor check-in, if applicable

r. Vendor Dependent Product Name. Name of the product that is dependent upon the vendor.

s. Original Risk Rating. Provide the Original Risk Rating from the scanner

t. Adjusted Risk Rating. Provide the Adjusted Risk Rating as approved by the CIO

u. Risk Adjustment. Whether there was a Risk Adjustment

v. False Positive. Whether this weakness should be considered a False Positive

w. Operational Requirement. Whether this weakness should be considered an Operational

Requirement

x. Deviation Rationale. Information about the Deviation

y. Supporting Documents. List any supporting documents that are associated with this item

(e.g. Deviation Request, Evidence of Remediation, Evidence of Vendor Dependency, etc)

z. Comments. This column is for additional information, not specified in another column

aa. Auto-Approve. Whether the deviation request was auto-approved or manually approved

CDRL 013 Penetration Test Plan

Penetration Testing Plan

2. CDRL NUMBER

CDRL-013

3. DESCRIPTION/PURPOSE

The Test Plan outlines the plans and performance objectives at every level of testing on systems or equipment. It provides the procuring activity with the test concept, objectives and requirements to be satisfied, test methods, elements, responsible activities associated with the testing, measures required and recording procedures to be used.

All Penetration Test Plans must be marked as Security Sensitive Information (SSI) or above.

References: SOW paragraph 3.4

Format: The plan must be in contractor’s format.

Contents: The test plan must document in detail the contractor’s plan for conducting penetration tests and analyzing the penetration test results to show how the identified vulnerabilities expose the system, network, or web application tested and describing how they can be exploited to gain access to NAS assets. The plan must contain the following:

1. Title page. The title page must include the following:

a. Title of the penetration test to be conducted.

b. Identification of system being tested.

c. Contractor’s name.

d. Contractor number.

e. Security classification.

f. Distribution statement.

2. Introduction. Consists of an overview of the objectives of the penetration test plan, including flow diagrams, milestones, personnel participation, locations, schedules, and security measures to be observed. The plan must include the following:

Penetration Testing Plan

2. CDRL NUMBER

CDRL-013

3. Rules of Engagement (ROE). The ROE is developed with the system owner and ACG to ensure that all parties understand and agree with the scope of the penetration test effort as documented in this penetration test plan. The ROE must be a couple of pages long and at a minimum must contain the following:

Points of contact

Daily Debriefings and their frequency

Location or locations of where testing will be conducted at and from

Start and End dates or the Pen Test

Time frames of the Pen Test

Announcement to Target Personnel

Identify if IP address will be shunned

Range of IP addresses that are in play

Range(s) of IP Addresses out of play

Black Box, Grey Box, or White Box Testing

Define policy regarding data on compromised hosts

Will target personnel be witnessing the Pen Test Team

Signatures of all authorizing personnel, test team, and target personnel if target personnel will be witnessing.

4. Scope. The scope of the penetration test must minimum identify the following:

Threats, risks, and already-known vulnerabilities

What will be tested

Specific domain names

Network address ranges

Individual host

Applications

What must be explicitly avoided

Will third parties be under test (i.e. ISP or network providers, web hosting companies, etc.)

Cloud services

Production or Test Environments

Internal, pseudo-internal, external access to the environment under test

How should the target system be tested?

DOS and Dangerous exploits?

5. Flow diagrams. The flow diagrams will reflect a functional description of the test program using a block diagram portrayal of the functions that must be met to satisfy the total test program. Functions must be numbered 1.0, 2.0, 3.0, etc.

6. Schedule. States when testing will be performed, whether testing is on schedule, and if not, what

Penetration Testing Plan

2. CDRL NUMBER

CDRL-013

procedures will be taken to meet the schedule.

7. Security. Identify and state briefly any security measures of guidelines to be observed.

8. Parameters. The number of cycles the test will be performed and selected parameters to be observed.

9. Test classification category. State the functional area of each test performed.

10. Test objectives. Describes the objectives of each test performed, including the criteria, baseline, duration, and number of times each test should be performed.

a. Success/failure criteria.

b. Baseline.

11. Duration.

c. Quantity of test.

11. Test equipment. List all equipment to be used in the test and identify as follows:

a. Description.

b. Nomenclature

c. Serial number.

13. Support equipment. List all support equipment that will be used to perform the tests and identify as follows:

b. Nomenclature.

c. Serial number.

d. Calibration constants.

e. Calibration procedures.

Penetration Testing Plan

CDRL-013

f. Operating instructions.

14. Special test equipment. List all special test equipment required to be designed or fabricated for use on the program as follows:

b. Nomenclature.

c. Data required.

15. Approach. Describe the steps used to perform each test.

16. Instrumentation. Indicates the type and recording devices that will be used and the number and types of parameters to be recorded.

17. Data reduction and analysis. Describes data to be recorded and the data reduction and analysis techniques that will be used to interpret the data.

18. Government test facilities. Identifies applicable facility and includes a reference to the appropriate facility requirements documents.

19. Validation procedure. An overview of the procedures that the contractor will use to validate the test results.

CDRL 014 Penetration Testing Report

Penetration Testing Report

2. CDRL NUMBER

CDRL-014

3. DESCRIPTION/PURPOSE

The Test Report documents the results of a test and the subsequent data analysis. It is used to identify and evaluate discrepancies between expected and actual test results.

References: SOW paragraph 3.2

Contents: The Test Report must be prepared in Contractor-specified format. The Test Report must include the following:

The identification of the specific test.

The scope of the report in terms of time and activities covered.

The purpose and scope of the test:

o The reference to the applicable Test Plan and Test Procedure.

o The description of the test article including test configuration. Reference may be made to the applicable test procedure sections.

o A list of all test equipment, including manufacturer, model, calibration status, and serial number. Reference may be made to the applicable test procedure sections or the official Test Log, Log Entry #s, and Log pages.

o A list of all system, test, and DR&A software utilized identifying title, release level, and release date.

A summary of test results. Include a test matrix identifying test plan and procedure sections, the applicable “raw” and reduced results obtained from them/

Relative to the test matrix, provide a complete description of any recommended, planned, or actual regression test activities, which purpose is to mitigate the identified vulnerabilities.

Identify any item remaining open after completion of test conduct and analysis from:

o Log Book Entries; test de-briefing minutes; test matrix deficiencies (above).

Detailed Test Results. List the results of the test based on the data collected during the test.

Amplifying information (e.g., diagrams) should be included.

Detail Data Analysis. Detailed data analysis results and a complete description of post-test

Penetration Testing Report

2. CDRL NUMBER

CDRL-014

data analysis activities must be provided and linked with the plan and procedure sections which generated the identified vulnerability.

The test report must contain a certification that the test results are authentic, accurate, current, and in accordance with related requirements and test plans. Include names of Contractor and

Government personnel present during the test.