MITRE ATTCK Assessment Sole Source JA Redacted.pdf

Requirement 1 (ATT&CK Assessment):

o Delivery of the ATT&CK Rapid Assessment survey tool. This survey is to be completed by the sponsor and will provide a high-level overview that will be used to guide the rest of the assessment.

o defensive capabilities. This assessment will be performed by a MITRE team and will include:

-the-ground experiences;

Analyzing and synthesizing the information gained through documentation and interviews to create an ATT&CK coverage map; and that should be considered as high-priority threats as well as recommendations to remediate these techniques. As part of this effort, MITRE will:

- Identify high-priority techniques that the SOC should focus efforts toward detecting; and

- Provide guidance on sensing, data collection, analytics, and tooling to improve coverage.

Requirement 2 (Cyber Threat Intelligence (CTI) Analysis):

o ATT&CK evaluation support

Use open-source (and/or classified, if needed) CTI to identify cyber threat actors that are relevant to

Map the cyber tactics, techniques, and procedures (TTPs) used by these relevant threat actors to the ATT&CK framework.

o CTI SOC Assessment support Review existing CTI team procedures, integrations, policy, and technology.

Provide actionable improvement recommendations to integrate CTI function with SOC operations.

o CTI support to emulation plan development Support AE during the pre op planning to align validation with threat actor and detection mapping.

Provide reach back support for AE ops.

Requirement 3 (Adversary Emulation and Validation Testing):

o Use adversary emulation tools (e.g., Mandiant MSV and other publicly available tools commonly detection abilities.

o the strengths (and gaps) in detection.

o Train red or blue to conduct low effort/high-impact emulations to exercise and assess defensive posture

(people, processes, technology).

o adversary emulation assessments.

Per FAR 5.202(a)(10) this proposed contract action does not need to be publicized, as the action is being made under the conditions described in FAR 6.302-3.

SECTION 11. STATEMENT OF THE ACTIONS, IF ANY, THE AGENCY MAY TAKE TO REMOVE OR OVERCOME ANY BARRIERS TO COMPETITION BEFORE ANY SUBSEQUENT ACQUISITION FOR THE SUPPLIES OR SERVICES

REQUIRED

This justification supports a sole source contract with MITRE for the specific project identified. The Department of State will continue to assess cyber security requirements to identify all requirements that are suitable for competitive acquisitions.

AQM and DS/CTS/CMO will continue to keep abreast of the market to understand when it will be in the best interest of the Department to compete and or change this requirement in the future.

This justification will be made publicly available within 14 days after contract award at GPE (https://www.sam.gov).

SECTION 12. CERTIFICATIONS

All reviews and approvals should be completed in the order listed unless otherwise authorized or required.

TECHNICAL AND REQUIREMENTS CERTIFICATION (FAR 6.303-2(c))

I certify that the facts and representations under my cognizance which are included in this Justification and its supporting acquisition planning documents, except as noted herein, are complete and accurate to the best of my knowledge and belief.

Technical Cognizance:

SIGNATURE:

CONTRACTING OFFICER CERTIFICATION (FAR 6.303-2(a)(12)) I certify that this submission is accurate to the best of my knowledge, and that it contains complete information necessary to enable other officials to make an informed recommendation for approval or disapproval.