JCDC Cyber Collaboration Support Services SOW.pdf

DEPARTMENT OF HOMELAND SECURITY

Cybersecurity and Infrastructure Security Agency Cybersecurity Division

Joint Cyber Defense Collaborative

STATEMENT OF WORK

CYBER COLLABORATION SUPPORT SERVICES

1.0 GENERAL

1.1 Background

1.1.1 The mission of the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) is to enhance the resilience of the nation’s physical and cyber infrastructure. Within CISA, the Joint Cyber Defense Collaborative (JCDC) facilitates operational activities across multiple offices and external partnerships to enhance cybersecurity measures and response strategies. This statement of work (SOW) outlines the support required to execute a broad range of services across five core functions: Program Management, Stakeholder Engagement, Technical Messaging, Incident Management and Coordination, and Technology Development.

1.2 Scope

1.2.1 The Contractor will support JCDC in the following areas:

1. Program Management Support

2. Stakeholder Engagement

3. Technical Messaging Support

4. Incident Management and Coordination

5. Technology Support

1.3 Objective

1.3.1 The primary objective is to support JCDC in elevating its cybersecurity mission through strategic collaboration, incident response, technological advancement, and improved stakeholder engagement.

The key goals are to:

• Strengthen collaboration between federal, state, local, tribal, international, and private sector partners.

• Enhance the operational effectiveness of JCDC by modernizing processes and technologies.

• Develop communication and outreach strategies to raise awareness of the JCDC mission and initiatives.

• Support the development of operational and technical documentation, ensuring consistency and adherence to federal guidelines, and a unified voice of government.

1.4 Applicable Documents

1. DHS Sensitive Compartmented Information (SCI) Systems 4300C Instruction Manual, Version 2.1, March 24, 2017 (for Top Secret [TS]-SCI/C-LAN)

2. National Cybersecurity Protection Act of 2014

3. Office of Management and Budget (OMB) Memorandum M-15-01, Fiscal

Year 2014-2015 Guidance on Improving Federal Information Security and Privacy Management Practices

4. Homeland Security Act of 2002 (Public Law 107-296)

5. National Cybersecurity Strategy (March 2023)

6. OMB Memorandum M-10-28, Clarifying Cybersecurity Responsibilities and Activities of the Executive Office of the President and the Department of Homeland Security

7. DHS Management Directive (MD) 4300 Pub, Homeland Security Information Technology Security Program Publication

8. DHS MD 4010.2 Pub, Section 508 Program Management Office and Electronic and Information Technology Accessibility

1.4.1 Compliance Documents

Compliance documents are not required.

1.4.2 Reference Documents

1. Title II of the Homeland Security Act of 2002 (Public Law 107-296) as amended

2. Cybersecurity and Infrastructure Security Agency Act of 2018

3. Presidential Policy Directive 21, Critical Infrastructure Security and Resilience

4. Presidential Policy Directive 41, United States Cyber Incident Coordination

5. Executive Order 13636, Improving Critical Infrastructure Cybersecurity

6. National Cyber Incident Response Plan

7. National Infrastructure Protection Plan

8. DHS MD 140-01, Information Technology System Security Program, Sensitive Systems

9. DHS 4300A Policy Directive (Version 13.3, February 13, 2023)

10. DHS National Security Systems (NSS) Policy Directive 4300B, Version 10.1, November 21, 2018 for NSS Collateral (Unclassified, Secret, or TS Collateral)

2.0 SPECIFIC REQUIREMENTS/TASKS

2.1 Task 1: Program Management Support

The primary focus of the Program Management Support task is to provide comprehensive, continuous support across all operational and administrative facets of JCDC. The Contractor will be responsible for facilitating the efficient and effective execution of JCDC’s mission by ensuring that the necessary administrative and programmatic structures are in place. The Program Management Support function encompasses a wide range of activities, including daily office management, process improvement, and internal/external communications. The function also includes support for budget/procurement, human capital/workforce engagement, strategic planning, and logistics activities to enable JCDC operations.

Key activities within this task include assisting in the development and maintenance of standard operating procedures, work instructions, policies, and documentation that govern mission and administrative functions. The Contractor will help to streamline operational processes, ensuring that internal and external communications are managed smoothly and consistently. This will involve supporting meeting coordination, including scheduling and follow-ups, ensuring all meetings are productive and outcome-oriented. As part of this task, the Contractor may be asked to prepare detailed meeting agendas, document action items, leverage a task management system, and follow up on the completion of action items and tasks to ensure they are executed efficiently.

Another crucial aspect of Program Management Support is knowledge management.

The Contractor will be responsible for developing and maintaining collaboration environments such as Microsoft SharePoint, which will act as central hubs for document management, process workflows, and communication. This includes ensuring that these tools are effectively utilized by JCDC staff for document sharing, task tracking, and communication with both internal and external stakeholders. A robust knowledge management system will ensure that institutional knowledge is preserved, and JCDC’s operations are not disrupted by personnel turnover.

Additionally, the Contractor will implement performance management tools and metrics to track the progress of key JCDC initiatives. This will involve developing key performance indicators that align with JCDC’s strategic goals and conducting regular performance reviews to ensure that JCDC meets its programmatic and operational objectives. Reporting is a critical function within Program Management Support, and the Contractor will be expected to compile weekly, monthly, quarterly, and annual reports that outline the status of ongoing projects, potential risks, and proposed mitigations.

Under this task, the Contractor may also be asked to:

• Work with federal staff to unify recruitment, hiring, onboarding, training, and workforce development efforts.

• Assist in the development and implementation of strategies for integrating liaisons from partner agencies into the JCDC operating environment.

• Support JCDC’s participation in the DHS/CISA Planning, Programming, Budgeting, and Execution process to ensure resources requested match valid mission requirements, resources are distributed where the need is greatest, and resource expenditure and utilization is tracked against the planned and optimal strategy to ensure maximum utilization and effectiveness.

• Help create and refine JCDC’s goals and objectives based on authoritative internal and external requirements and priorities, and develop, implement, and operationalize plans to enable the subdivision to achieve them.

• Provide support to JCDC’s Executive Secretariat, event coordination, and continuous improvement processes to ensure maximum efficiency and effectiveness.

2.2 Task 2: Stakeholder Engagement And Management Support

Stakeholder Engagement plays a critical role in the success of JCDC’s mission, as it depends on strong relationships with federal, state, local, tribal, international, and private sector partners. The Contractor will support the ongoing development of these partnerships, ensuring that JCDC maintains productive collaboration with a diverse set of stakeholders who are essential to the national cybersecurity mission. This task focuses on building a cohesive strategy for engaging with stakeholders, managing communications, and facilitating collaboration in cybersecurity operations and policy development.

A key function under this task is the facilitation of working groups and collaboration technical discussions. The Contractor will coordinate and lead meetings and workshops that bring together diverse stakeholders to discuss pressing cybersecurity issues, share information on emerging threats, and develop responsive outcomes (plans, products, relationships) to address threats and risks. These engagements will often serve as forums for discussing lessons learned from previous incidents, exploring future collaboration opportunities, and fostering the joint development of cyber defense strategies. In addition to the logistical coordination of these events, the Contractor will provide subject matter expertise in facilitating discussions and ensuring that meetings lead to actionable outcomes.

Communication is a central component of stakeholder engagement. The Contractor will be responsible for ensuring consistent, timely, and accurate communications between JCDC and its stakeholders. This includes developing communication materials such as email updates, reports, and presentations that summarize JCDC activities, emerging cybersecurity threats, and other relevant information. Furthermore, the Contractor will manage stakeholder feedback mechanisms, collecting data on the effectiveness of JCDC’s outreach efforts and making adjustments to improve the quality of engagement.

The Contractor will begin by developing a comprehensive stakeholder engagement plan, which will include stakeholder mapping using business intelligence tools and commercial databases to identify stakeholders with relevant capabilities, relationship management strategies, and a communication framework tailored to different partner categories. For example, federal partners such as other DHS components may require formalized, process-driven engagement, while private sector partners may need more agile, responsive interactions based on evolving cyber threats. The plan will detail how JCDC will interact with stakeholders at various levels – from high-level policy coordination to operational collaboration during cyber incidents.

Under this task, the Contractor may also be asked to:

• Identify relevant partners, build partner profiles detailing relevant capabilities, cultivate relationships, and execute the CISA/JCDC mission by partnering with international, federal, state, local, tribal, territorial, and private sector entities in order to prevent, stop, and counter attacks and other malicious cyber activity and coordinate joint actions to address risks through deliberate cyber defense planning efforts.

• Facilitate JCDC efforts to engage its public and private sector partners in the development of plans for cyber defense operations, leveraging the capabilities, authorities, and unique expertise of the partners involved to drive substantive reduction in the risk to national critical infrastructure.

2.3 Task 3: Technical Messaging Support

The Contractor will provide critical support to JCDC’s efforts to professionalize its external communications through the production of high-quality technical and operational publications. These publications are the voice of CISA Cyber and are essential for disseminating accurate, timely, and actionable cybersecurity information to

JCDC’s stakeholders, including federal agencies, state and local governments, private sector entities, and international partners. The Contractor will focus on ensuring that all JCDC publications adhere to established guidelines and best practices while addressing the specific needs of the cybersecurity community.

A significant portion of this task will involve technical writing and editing. The Contractor will be responsible for drafting, editing, and publishing a range of materials, including cybersecurity alerts, technical advisories, reports, and analysis documents. These publications must adhere to DHS style guidelines and ensure compliance with Section 508, which mandates accessibility standards for government publications. The Contractor will work closely with CISA’s internal teams—such as threat analysts and incident response coordinators—as well as interagency, private sector, and international partners, to gather the necessary technical information and translate it into clear, concise, and understandable content for various audiences.

The Contractor will also oversee the end-to-end publication process, ensuring that all publications are reviewed, approved, and disseminated promptly. This will involve coordinating input from subject matter experts, fact-checking content, and ensuring consistency across different publication platforms. Moreover, the Contractor will be responsible for maintaining a repository of published content, ensuring that all materials are easily accessible and organized for future reference. The Contractor will also support coordinating functions to ensure CISA’s voice is consistently and coherently reflected in its publications.

As cybersecurity threats evolve rapidly, timely communication is crucial. The Contractor will assist JCDC in improving the agility of its publication process, enabling quicker turnaround times for urgent advisories and updates. This may include developing templates, automation processes, and workflows that streamline the content creation and approval process. In addition to technical publications, the Contractor will also assist with the creation of internal documentation such as standard operating procedures, operational guides, and knowledge-sharing materials to support JCDC’s internal functions. To enable the success of publications, the Contractor will also provide essential support in graphic/multimedia design, web design and content architecture, social media coordination and management, and other critical but ancillary functional areas.

Under this task, the Contractor may also be asked to:

• Support engagement with publication partners and help coordinate the development of joint-sealed products.

• Serve as the publisher of CISA products posted on the CISA.gov website.

• Provide mission support and administration for multiple CISA publication mediums and share cybersecurity information with partners across government and industry.

• Collect and manage stakeholder feedback and develop content, messaging, and strategies to enhance communications—including those across CISA’s cybersecurity-focused web and social media platforms—and products for internal and external stakeholders.

2.4 Task 4: Incident Management and Coordination Support

The Contractor will play a pivotal role in supporting JCDC’s efforts to help the broader cybersecurity community prepare for, respond to, and recover from cyber incidents, vulnerabilities, and threats by coordinating with various stakeholders, including federal agencies, private sector partners, and state and local governments. The focus of this task is to ensure that response activities are aligned with national policies and that JCDC can quickly mobilize its resources to mitigate the impact of cyber incidents, fully leverage its intelligence capabilities, and counter adversary campaigns.

The Contractor will assist in the development and refinement of cyber defensive playbooks, which provide step-by-step guidance on how to respond to different types of cyber incidents, vulnerabilities and threats. These playbooks will be tailored to specific types of threats, such as ransomware attacks or malicious cyber activity conducted by nation-state actors and will incorporate lessons learned from previous incidents. In addition to developing these playbooks, the Contractor will also help coordinate tabletop exercises and simulations to test the effectiveness of JCDC’s incident response strategies and maximize its capability to perform operational integration and information exchange.

Another key activity in this task is managing communications during an incident. The Contractor will work closely with JCDC’s incident response team to ensure that stakeholders are kept informed of the status of the incident, the actions being taken, and any necessary guidance for mitigating risks. This will involve drafting situation reports, coordinating meetings with stakeholders, and managing communication channels such as email distribution lists, secure portals, and collaboration platforms.

The Contractor will also play a role after an incident occurs and response efforts are winding down, helping JCDC compile after-action reports that document key observations, lessons learned, and recommendations for improving future incident management and coordination activities. These reports will be shared with stakeholders and used to update JCDC’s incident response procedures. Additionally, the Contractor will maintain tracking systems to ensure that all incident response actions are documented, and follow-up activities are completed in a timely manner.

Under this task, the Contractor may also be asked to:

• Serve as a trusted and knowledgeable point of contact (POC) with the Intelligence Community, United States Cyber Command, and other key stakeholders to counter malicious cyber activities conducted by priority advanced persistent threat actors against U.S. critical infrastructure.

• Support the execution of JCDC cyber operations through technical analysis/support and help refine the subdivision’s processes and policies for responding to incidents.

• Aggregate operational inputs and help align the resulting actions to unify JCDC’s efforts with broader Cybersecurity Division operations and collaborative activities across CISA Cyber.

2.5 Task 5: Technology Support

The Technology Support task focuses on enhancing JCDC’s technical capabilities and ensuring that the organization remains at the forefront of cybersecurity innovation. The Contractor will support the design, development, and maintenance of JCDC’s digital infrastructure, ensuring that it meets the needs of both internal staff and external stakeholders. The primary goal of this task is to enable JCDC to operate more efficiently and effectively through the integration of advanced technologies, such as artificial intelligence (AI), data visualization tools, and collaboration platforms.

Key activities under this task include conducting business process analysis to identify areas where technology can improve operational workflows. The Contractor will assess JCDC’s current technology environment, identify bottlenecks, and propose solutions that leverage modern tools and platforms. For example, the Contractor may recommend the adoption of AI-driven tools to automate routine tasks such as data analysis, incident triage, and reporting, thereby freeing up resources to focus on more strategic and higher impact activities.

Additionally, the Contractor will support the development of dashboards and visual tools that provide real-time visibility into JCDC’s operations. These tools will enable JCDC leadership and stakeholders to monitor key performance indicators, track the progress of cybersecurity initiatives, and quickly respond to emerging threats. The Contractor will also assist in the design and configuration of secure environments for piloting new technological solutions, ensuring that these solutions meet the security requirements of federal agencies.

Collaboration is a central theme of this task, as JCDC depends on seamless communication and coordination between its internal teams and with external partners.

The Contractor will manage and maintain collaboration platforms such as Microsoft Teams, Slack, and SharePoint, ensuring that they are optimized for both Classified and Unclassified communications. In addition to supporting current technologies, the Contractor will also work to identify new tools and platforms that can enhance JCDC’s mission, providing recommendations based on emerging trends and technologies in the cybersecurity domain.