N6945022R0002_J-0200000-17-02 Amend0003.xlsx
XLSX spreadsheet 16 KB Posted
- Solicitation number
- N6945022R0002
About this file
This document outlines roles and responsibilities for cybersecurity at Naval Construction Battalion Center Gulfport and associated facilities. The contractor will support cybersecurity execution and comply with all security requirements, maintaining systems and implementing controls. The government will validate requirements and implement patching. Both parties will monitor performance, support incident response, ensure training is completed, manage vulnerabilities, and conduct scans. The contractor must report issues immediately and the government will oversee access controls, configuration management, and ensure authorized network services are enabled.
The associated federal contract opportunity is a solicitation for Base Operations Support services at NCBC Gulfport and surrounding areas. Services required include facility management, facility investment, custodial, grounds maintenance, landscaping, and wastewater. The solicitation number is N6945022R0002 issued by the Naval Facilities Engineering Command.
View the file
Other files
Show 40 more
Latest 50 of 77 listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Roles and Responsibilities
| Attachment J-0200000-17-2 FRCS Cybersecurity Roles and Responsibilities Amendment 3 | ||||
| Cybersecurity Areas | Resposibility | Government Role | Contractor Role | |
| OT Cyber-Scecurity Work Force R&R (Section 2) | ||||
| The Contractor shall support government execution of the Contrctor OT FRCS Cybersecurity Program for all control systems listed in J-150200-04 per the Cybersecurity Roles and Responsibilities for Facility-Related Control Systems at NCBC Gulfport contained in J-020000-17-1. | L | L = lead responsibility | ||
| Serve as principal advisor to the Contractor Official Representative (COR), PWD Government Personnel, and Contractor on all matters relating to the security and integrity | L | S = supporting role | ||
| Comply with all security requirements, and hold a security clearance, access approvals, and have a completed and signed privileged user agreement equal to the level of information processed by the OT | S | L | ||
| Maintain (i.e. Upgrades, Operation Changes etc.) OT system and networks, to include hardware and software. (Contractor) | L | |||
| Implement Cybersecurity controls (i.e. patching, STIGs, etc.) for OT system and networks to include hardware and software. (Government) | L | |||
| Monitor OT performance and system recovery processes to ensure security features and procedures are properly functioning. (Contractor) | L | |||
| Work closely with the ISSOs to ensure the OT System or network is used and administered securely. | L | |||
| Participate in the incident reporting program and conduct reporting. | L | S | ||
| Provide customer support and ensure that all users have the required security clearances, authorization, need to know, signed and approved privileged user agreement, and are aware of their security responsibilities before granting access to the OT. | S | L | ||
| Assist the ISSE in ensuring the system is operated, maintained, and disposed of in accordance with security policies and practices outlined in the accreditation and certification support documentation package. | L | |||
| Confirm software licenses and documentation are maintained by each User Representative or Program Manager (PM). Notify the ISSM and ISSO when changes occur that might affect accreditation and certification. | S | L | ||
| Assist the ISSM and ISSO in development and maintenance of the accreditation and certification support documentation package. | L | |||
| Establish audit trails, system logs, and conduct reviews periodically, and ensure audit records are archived for future reference as directed by the ISSO and ISSM. | L | |||
| Validate and/or define system performance, availability, and functionality requirements. |
| L | |||
| Assist in preparation of site Certification and Accreditation (C&A). | S | ||
| Support certification actions. | S | ||
| Continuously review threat, system vulnerabilities, and residual risk. | L | S | |
| Submit proposed changes for OT FRCS. | L | ||
| CYBER-SECURITY TRAINING, EDUCATION AND MANAGEMENT (Section 3) | |||
| Identify all Contractor CS functions and the corresponding training/certification requirement. | L | ||
| Identify all personnel performing authorized OT functions. | L | ||
| Ensure all authorized users accessing OT FRCS complete the DoD CS approved training. | L | S | |
| CYBER-SECURITY INFORMATION ASSURANCE VULNERABILITY MANAGEMENT (IAVM) PROGRAM, AND SCANS (SECTION 4) | |||
| Upon receipt of IAVA/IAVB/CTO messages, the government will issue notification for scheduling formal tasking of IAVA/IAVB compliance requirements. | L | ||
| Review all Alerts, Bulletins, and Task Orders via the U.S. Cyber Command (previously JTF-GNO) website located at https://www.cybercom.mil for a technical overview, and determine vulnerable applications/systems. | L | ||
| Determine reporting requirements. | L | ||
| Acknowledge IAVM messages. | L | ||
| Maintain up-to-date antivirus signatures | L | S | |
| Scans | L | S | |
| 1.a Initial ACAS scan conducted | L | ||
| 1.b Review scan results for applicable patches for vulnerabilities | L | ||
| 1.c Test system with latest government applicable patches | S | L | |
| 1.d Schedule maintenance cycle and remediate all applicable systems | L | S | |
| 1.e Re-scan systems after remediation | L | ||
| 1.f Upload weekly ACAS scan into VRAM | L | ||
| 1.g Review VRAM status | L | ||
| INTRUSION FORENSICS, INCIDENT RESPONSE PROCEDURES, AND REPORTING REQUIREMENTS (Section 5) | |||
| The Contractor shall immediately inform the COR of any operational issue that cannot be resolved within 24 hours of notification. | L | ||
| ACCESS CONTROLS, AUTHENTICATION, AND ACCOUNT MANAGEMENT (Section 6) | |||
| User Accounts and Password Policy | L | S | |
| Passwords | L | S | |
| User Login IDs | L | S | |
| 3.a Conduct daily audits of all system logs | L | ||
| 3.b Investigate any items as items as required | L | S |
| CONFIGURATION MANAGEMENT (Section 7) | |||
| Life Cycle Management Hardware/Software | L | ||
| Site Security Baseline Validation | L | S | |
| Ports, Protocols, Services Management (PPSM) | L | S | |
| Site System Topology (Wiring and Logical) (Diagram) | L | S | |
| Configuration Control Board (CCB) | L | S | |
| Disposition of Hardware/Software | L | S | |
| 5.a Conduct automated SCAP review when new benchmarks come out | L | ||
| 5.b Conduct manual STIG review when new benchmarks come out | L | ||
| 5.c Apply updated STIG requirements to devices | L | S | |
| 5.d Conduct final review for STIG compliance | L | S | |
| PUBLIC KEY INFRASTRUCTURE (PKI) (Section 9) | |||
| Tokens for BOSC | L | S | |
| POLICY AND GUIDANCE FOR USE OF THE INTERNET, ELECTRONIC MAIL (EMAIL) AND GOVERNMENT OT (Section 10) | |||
| Information Security Program | L | S | |
| Maintain password protection on their accounts. | L | S | |
| Passwords must be changed every 90 days and meet complexity requirements as required in this manual. | |||
| L | S | ||
| Passwords must be changed every 90 days and meet complexity requirements as required in this manual. | L | S | |
| Work stations may not be left unattended, if logged on. | S | L | |
| Immediately report all security incidents and potential threats and vulnerabilities to the government. | L | ||
| Ensure systems media and systems output are properly classified, marked, stored, and controlled. | S | L | |
| Inform the ISSM when access is no longer required. | L |
| PORTS, PROTOCOLS, AND SERVICES (PPS) (Section 11) | |||
| Ensure Authorized Ports Protocols and Sevvices are enabled | L | ||
| Ensure Non Approved Ports Protocols and Services are not enabled | L | S |
File details come from the government source that posted it. Updated .