PTT IT Security Verification_n_Validation (SVV) PWS_Draft.pdf

General Services Administration (GSA) Information Technology (IT)

Performance Work Statement

Security, Verification and Validation (SVV) Services for the Presidential Transition Team (PTT)

October 31, 2023

PERFORMANCE WORK STATEMENT

DRAFT

Table of Contents

1. INTRODUCTION 4

2. BACKGROUND 4

3. OBJECTIVES AND OUTCOMES 5

3.1. Business Objectives 5

3.2. Technical Objectives 5

3.3. Management Objectives 6

4. ASSUMPTIONS AND CONSTRAINTS 7

4.1. Access Control & Authentication 7

4.2. HSPD-12 Personnel Security Clearances 8

4.3. Non-Disclosure Agreements 8

4.4. Accessibility 9

4.5. Data 9

4.6. Confidentiality, Security, and Privacy 9

4.7. Cyber Supply Chain Risk Management 10

4.8. References 10

5. SCOPE 12

6. TASKS & SUBTASKS 13

6.1. TASK 1: Task Order (TO) Management 13

6.1.1. Subtask 1: TO Planning and Management Services 13

6.1.2. Subtask 2 Program, Project Management, Meetings & Reports 14

6.1.3. Subtask 3: Project Management Plan 17

6.1.4. Subtask 5: Vendor Onboarding and Transition-Out Plan 19

6.1.5. Subtask 6: Quality Assurance Surveillance Plan (QASP) 20

6.2. Task 2: Assess Security Controls 21

6.2.1. Subtask 1: Security Assessment Planning 21

6.2.2. Subtask 2: Execute Security Validation and Verification Assessment 22

6.2.3. Subtask 3: Findings, Reporting, and Recommendations 23

7. CONTRACT TYPE 23

7.1. PLACE AND PERIOD OF PERFORMANCE 24

7.2. HOURS OF PERFORMANCE 24

8. DELIVERABLES/DELIVERY SCHEDULE 24

9. CONTRACTOR ROLES AND RESPONSIBILITIES 26

9.1. Key Personnel 27DRAFT

1. INTRODUCTION

The constitutional transfer of power and authority from an incumbent American President to a successor is a momentous occasion in American government and Information Technology and Cybersecurity play a critical role in ensuring a successful transition. The transfer of authority is complex and multifaceted, and the ever-changing threat landscape in the world of technology and cybersecurity continue to add to that complexity. Preparation and operation of the technology solution and services that support the transition starts well before the election year;

beginning operations after candidates have been nominated, accelerating quickly after the election. The President-elect and Vice President-elect and their teams have approximately 11 weeks between Election Day and Inauguration Day to organize the new Administration. The technology infrastructure allowing them to securely go from campaigning to governing, must be innovative, high performing, flexible, scalable, reliable, secure and impenetrable.

2. BACKGROUND

The Presidential Transition Act of 1963 (Act), as amended, 3 U.S.C. 102 note, authorizes the Administrator of GSA (Administrator) to provide to each President-elect and each Vice President-elect Information Technology (IT) services for use in preparing to assume their Official duties as President and Vice President. The Pre-Election Presidential Transition Act of 2010 amended the PTA and included several other provisions to provide additional support to eligible candidates for pre-election transition planning before the 2024 general election on one of the first 3 business days following the last Presidential nominating convention. The transition period for the President-elect and Vice President-elect begins when the Administrator ascertains the apparent winners of the election, typically the day following the election and ends 60 days after the inauguration. The Act contains a similar provision regarding the IT services provided to the outgoing President and Vice President. The transition period for the outgoing President and Vice President begins 30 days before the inauguration and lasts for seven months. To implement and deliver these IT services GSA established the Presidential Transition Team (PTT) IT Program to provide services to the PTT. The PTT IT Program exists only for the purpose of supporting the qualifying eligible candidates (Pre-Election Services); the incoming administration (Post-Election Services); the Presidential Inaugural Committee (PIC) and other inaugural customers (Inaugural Support); and outgoing administration (Outgoing Support). For the 2024 transition, the PTT IT Program (PTT IT) is responsible for the IT services and infrastructure to be installed and operational in the respective transition sites within Washington, DC. This effort cannot sustain any delays in functionality, security, or support as the federal law mandates the dates for the Pre-Election Office and General Election (November 5, 2024) to ensure a smooth transition of power between Administrations or to sustain the current Administration. This PWS requires a comprehensive security assessment be conducted on the final PTT IT solution, including all aspects of the technology solutions put in place to support the PTT Program, including the IT network and security infrastructure, collaboration services, desktop and mobile devices services, and the ICAM solution.

The vision for the PTT IT Program is to provide superior secure service delivery; executing modern technical solutions, by deploying proficient high performing teams that anticipate needs; while providing innovative, seamless services that facilitate exceptional user performance. The primary customers for this contract is the PTT IT Director, GSA IT Chief Information Officer (CISO), and the PTT IT Team Leads/Government Technical Managers (GTMs).

3. OBJECTIVES AND OUTCOMES

3.1. Business Objectives

PTT IT Program has a critical responsibility to ensure that the major technology components, necessary to support the PTT Program, are in place, secure, and operating at a superior performance level for a very distinct and limited period. For the purpose of this PWS the term “Contractor” will be used to reference the vendor whose services PTT IT is soliciting. The PTT IT business objectives for this effort are:

● Innovation: Designing an innovative platform to accommodate PTT users wherever they reside and however they choose to connect.

● Superior Customer Experience: The customers that the PTT IT Program will support may ultimately be our nation’s leaders and it is imperative that we deliver exceptional IT service that allows them to operate at their very best, during both pre-elect and post-elect activities.

● Operational Excellence: Providing operational efficiency to all PTT users by ensuring consistent reliability, security, availability, and confidentiality.

● Cost Efficiency: Simplifying complexities by leveraging cloud platforms that drive down cost while improving security and reducing overall management and operations cost.

● Agility: The ability to rapidly adapt to changing business needs, responding to requirement changes and priorities, including changes to the operating environments.

● One Contact Resolution (OCR): Creating a one contact culture that ensures PTT users get solutions and services based on a single interaction with PTT IT, removing all call backs for the same issue.

3.2. Technical Objectives

Our most critical technical objective is for the Design Services and Support (DSS) team to design and implement a modern zero trust platform that integrates various cloud services, minimizing the need for physical hardware, creating a seamless environment that allows a PTT User/Customer to perform all their duties regardless of their physical location. Additional PTT IT technical objectives for this effort include:

● Performance: Superior network and system performance throughout the life of the service.

● Cloud First: Leveraging modern solutions that move away from the heavy hardware-based platforms, limiting on-premises footprint, focusing on FedRamp approved cloud services for as many aspects as possible.

● Enhanced Cybersecurity: Leveraging Zero Trust Architecture (ZTA) including a Secure Access Secure Edge (SASE) architecture and a high performing Security Operations Center (SOC); to ensure confidentiality, integrity, and availability of all communication and information within a distinct PTT environment.

● Advance Modern Design: Providing a technical infrastructure that minimizes technical barriers and provides timely, efficient, effective, and reliable provisioning of services.

The Contractor shall operate as the Security Verification and Validation (SVV) team by performing an independent security controls assessment of the solution implemented by the DSS team to ensure that they implemented the controls needed to protect against potential security threats and cyber-attacks in compliance with the National Institute of Standards and Technology (NIST) SP 800-53 rev 5. By leveraging NIST SP 800-30, NIST 800-115, and NIST SP 800-171A, the Contractor shall support the successful execution of the PTT IT Program by completing a comprehensive assessment prior to Pre-Elect Go Live.

3.3. Management Objectives

The PTT IT Program operates for a very distinct period, so it is critical that the management of this effort be exceptional from the start. The Contractor shall promote a trusted collaborative partnership with the Government and the DSS vendor to ensure effective management and execution of the following objectives:

● Advance Situational Awareness & Continuous Improvement: Expansive and frequent reporting that ensures situational awareness of all infrastructure, cyber and operational daily events. Producing advanced daily reports that drive continuous improvement.

● Educated and Informed Support Personnel: Ensuring that the PTT IT teams are given the information and documentation needed to effectively resolve all findings so that they can securely support and serve all PTT users. Providing all solutions and services by using simple, common-use terms, without technical jargon.

● Establishing a rigorous, robust, yet simplistic approach to IT Security by creating a clear assessment plan and seamlessly executing the approach. Establishing superior testing an evaluation processes that eliminate all adverse effects and unintended consequences to the infrastructure and services.

PTT IT is led by the PTT IT Director, and it is organized into four high performing teams with four federal team leads/GTMs, established to deliver streamlined exceptional IT service over the course of this contract. The four teams include:

● The Administrative Team

● The Customer Experience Team

● The Design & Implementation Team

● The Infrastructure & Operations (I&O) Team

● Security Verification & Validation (SVV) Team

Figure 1

4. ASSUMPTIONS AND CONSTRAINTS

This section defines the broad assumptions and constraints that the Contractor shall consider when assessing the PTT-IT solution. Task-specific assumptions and constraints are included within each functional task as applicable.

● The Contractor shall ensure a backup is identified for each key personnel.

● The Contractor shall provide anytime, anywhere access to IT support in accordance with the mission requirements.

● The Contractor shall follow all current applicable Federal Mandates, Executive Orders, Emergency Directives, and Binding Operational Directives, to include, but not limited to NIST SP 800-53, NIST SP 800-171A, NIST SP 800-115, NIST IR 8011, M-22-09, M-21-31, M-22-01, M-19-26, HSPD-12, EO 14028, BOD 23-01, BOD 18-01.

4.1. Access Control & Authentication

Contractors entering into an agreement for services to the General Services Administration (GSA) and/or its Federal customers shall be contractually subject to all GSA and Federal IT Security standards, policies, and reporting requirements. The Contractor shall meet and comply with all GSA IT Security Policies and all applicable GSA and NIST standards and guidelines, other Government-wide laws and regulations for protection and security of Information Technology.

Additional information regarding requirements for this PWS, specific to different types of information systems/IT solutions, is available in the Appendix A GSA IT Security Requirements.

4.2. HSPD-12 Personnel Security Clearances

The Contractor shall comply with agency personal identity verification procedures identified in the task order that implement Homeland Security Presidential Directive 12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

For any Contractor personnel performing work under this task who will require access to GSA IT applications, systems or data, the Contractor shall comply with the HSPD-12 security clearance process. This means first obtaining a fingerprint clearance, which typically takes 3-4 weeks. At that point the Authorizing Official (AO) can grant limited access on a case-by-case basis. Next, a preliminary favorable adjudication of their National Agency Check with Inquiries (NACI) clearance level must be received. This process can take 1 to 2 months. Only when a full NACI adjudication is received will full access be granted. This process usually takes 4 to 8 months, though it could take as many as 12 months. Higher levels of clearance may also be required depending on the level of trust required to perform specific duties or perform a specific task.

Contractors shall not be granted access to a GSA facility or to any GSA IT system prior to a favorable response to the fingerprint portion of this background investigation. An individual Contractor’s failure to return satisfactory results from the background investigation shall result in immediate removal of that Contractor.

The Contracting Officer, through the Contracting Officer’s Technical Representative or GSA Program Manager will ensure that a completed Contractor Information Worksheet (CIW) for each Applicant is forwarded to the Federal Protective Service (FPS) in accordance with the GSA/FPS Contractor Suitability and Adjudication Program Implementation Plan dated 20 February 2007. FPS will then contact each Applicant with instructions for completing required forms and releases for the particular type of personnel investigation requested.

Applicants will not be reinvestigated if a prior favorable adjudication is on file with FPS or GSA, there has been less than a one-year break in service, and the position is identified at the same or lower risk level.

Once a favorable FBI Criminal History Check (Fingerprint Check) has been returned, Applicants may receive a GSA identity credential (if required) and initial access to GSA information systems.

The HSPD-12 Handbook contains procedures for obtaining identity credentials and access to GSA information systems as well as procedures to be followed in case of unfavorable adjudications.

HSPD-12 requirements do not apply to contractor IT applications, systems or data.

4.3. Non-Disclosure Agreements

Each Contractor/Sub-Contractor who may have access to government data and who performs work on this contract is required to sign a Standard Non-Disclosure Agreement.

The Contractor shall submit to the COR a completed confidentiality and non-disclosure agreement form for each Contractor/Sub-Contractor.

4.4. Accessibility

Requirements for accessibility based on Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) are determined to be relevant. In accordance with Federal Register, 25 APR 01, FAC 97-27, Executive Order 12866, Part 2.101, FAR Part 7.103, FAR Part 10.001, FAR Part 11.002, FAR Part 12.202, FAR Part 39.000 & 39.2, access to electronic and information technology (EIT) by individuals with disabilities must be compliant with the accessibility standards at 36 CFR 1194, unless it falls under one of the exceptions noted in FAR 39.204.

Additional information and requirements related to 508 Compliance can be located http://www.section508.gov.

4.5. Data

The Government shall have unlimited use rights, at no additional cost to the Government, for all intellectual property developed or delivered in accordance with a task order. This right does not abrogate any other Government rights. Anything produced belongs to the Government with no restrictions. Anything that is licensed, copyrighted to be used in deliverables to the Government must be identified prior to award of each task order and approval made by GSA.

Government data rights of software deliverables shall be in accordance with FAR 52.227-19 Commercial Computer Software License and/or FAR 52.227-14 Rights in Data – General.

Ownership of data entered into any and all systems, system documentation, all deliverables produced in the performance of this contract, and other related system information shall reside with the Government.

4.6. Confidentiality, Security, and Privacy

Per the Federal Acquisition Regulations (FAR) clause 52.239-1, the Contractor shall be responsible for the following privacy and security safeguards:

The Contractor shall not publish or disclose in any manner, without the Contracting Officer’s written consent, the details of any safeguards used by the Contractor under the resulting contract or otherwise provided by or for the government. The Government has determined that the information/data that the Contractor will be provided during the performance of this effort is of a sensitive nature and cannot be disclosed in any manner.

To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public government data http://www.section508.gov collected and stored by the Contractor, the Contractor shall afford the government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

If new or unanticipated threats or hazards are discovered by either the government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

Work on this project may require or allow Contractor personnel access to Privacy Information. Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a, and applicable agency rules and regulations.

The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all Government data, equipment, etc. by treating the information in accordance with its FISMA system categorization.

4.7. Cyber Supply Chain Risk Management

The Government is concerned about the risks associated with information and communications technology (ICT) products and services that may contain potentially malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices within the ICT supply chain. These risks are associated with the Government’s decreased visibility into, understanding of, and control over how the technology that they acquire is developed, integrated and deployed, as well as the processes, procedures, and practices used to assure the integrity, security, resilience, and quality of the products and services.

Offerors must fill out and submit the (Basic Safeguarding/C-SCRM) Questionnaire (Appendix B) as a part of their proposal, which addresses the offeror’s baseline ability to identify, manage and mitigate supply chain and cybersecurity risk. The assessment addresses how hardware, software, firmware/embedded components, and information systems are protected from component substitution, functionality alteration, and malware insertion while in the supply chain; and identifies how the offeror will maintain a high level of cybersecurity and C-SCRM readiness for performance of IT services to federal customers.

4.8. References

The contractor shall be familiar with Federal policies, program standards, and guidelines such as, but not limited to, those listed below or later versions as applicable:

REFERENCE DESCRIPTION / TITLE

FISMA Federal Information System Modernization Act (FISMA) (2014)

REFERENCE DESCRIPTION / TITLE

FIPS 199 Federal Information Processing Standards (FIPS) Publication 199 - Standards for Security

Categorization of Federal Information and Information Systems

FIPS 200 Minimum Security Requirements for Federal Information and Information Systems

NIST SP 800-30 Rev 1 National Institute of Standards and Technology (NIST) Guide for Conducting Risk

Assessments

NIST SP 800-35 Guide to Information Technology Security Services

NIST SP 800-37 Rev 2 Risk Management Framework for Information Systems and Organizations: A System Life

Cycle Approach for Security and Privacy

NIST SP 800-39 Managing Information Security Risk: Organization, Mission, and Information System

View

NIST SP 800-44 Version 2 Guidelines on Securing Public Web Servers

NIST SP 800-53 Rev 4 Security and Privacy Controls for Federal Information Systems and Organizations

NIST SP 800-53A Rev 4 Assessing Security and Privacy Controls in Federal Information Systems and

Organizations: Building Effective Assessment Plans

NIST SP 800-61 Rev 2 Computer Security Incident Handling Guide

NIST SP 800-83 Rev 1 Guide to Malware Incident Prevention and Handling for Desktops and Laptops

NIST SP 800-86 Guide to Integrating Forensic Techniques into Incident Response

NIST SP 800-101 Rev 1 Guidelines on Mobile Device Forensics

NIST SP 800-115 Technical Guide to Information Security Testing and Assessment

NIST SP 800-128 Guide for Security-Focused Configuration Management of Information Systems

NIST SP 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems and

Organizations

NIST SP 800-150 Guide to Cyber Threat Information Sharing

NIST SP 800-153 Guidelines for Securing Wireless Local Area Networks (WLANs)

NIST SP 800-160 Vol 1 Systems Security Engineering: Considerations for a Multidisciplinary Approach in the

Engineering of Trustworthy Secure Systems

NIST SP 800-171 Rev 1 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

NIST SP 800-171A Assessing Security Requirements for Controlled Unclassified Information

NIST SP 800-181 National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce

Framework

REFERENCE DESCRIPTION / TITLE

P.L. 93-579 Public Law 93-579 Privacy Act, December 1974 (Privacy Act)

40 U.S.C. 11331 Responsibilities for Federal Information Systems Standards

OMB M-19-03 Office of Management and Budget (OMB) Memorandum 19-03, Strengthening the

Cybersecurity of Federal Agencies by enhancing the High Value Asset Program

OMB A-130 OMB Circular A-130, Managing Information as a Strategic Resource

BOD 18-02 Department of Homeland Security’s Binding Operational Directive 18-02, Securing High

Value Assets

5. SCOPE

The PTT IT Program Director is looking for a high performing Cyber Security leader that can perform a comprehensive Third-Party IT Security Controls Assessment, providing verification and validation that all moderate level security and privacy controls have been implemented throughout the PTT IT Program. The contractor shall operate as the independent third-party, validating the security and privacy controls that have been put in place for the system(s). The

Contractor shall review and analyze the Security Authorization package, and report on technical, operational, and management level deficiencies as outlined in NIST SP 800-53. The contractor shall collaborate with the DSS Vendor to address all “high and moderate” deficiencies before the final package is submitted for full authorization. The Contractor shall conduct the testing and/or evaluation of the management, operational, and technical security controls in the PTT IT

Program solution to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system. The objective is to identify any potential cybersecurity risks and recommend changes.

The Contractor is encouraged to identify alternative approaches that will ensure that the Government meets our stated objectives. The scope includes both external and internal vulnerability and penetration testing for network infrastructure devices (include but not limited to routers, switches, and firewalls), servers and user workstations, and open ports/services associated with security vulnerabilities and perform active exploits on systems and applications.

The PTT IT Solution will consist of three new networks implemented to support the presidential transition. This assessment will be conducted prior to Go-Live.

Ultimately, the Contractor will conduct a full review and analysis of wireless network system components for security vulnerabilities, validating system-specific configurations and known exploits and provide a concise and complete report, detailing the PTT IT Program Cybersecurity position, including a comparative scorecard of findings; the results of the testing performed;

identifying any vulnerabilities, gaps, and necessary mitigation plans; a prioritized road map of activities, developed in conjunction with the PTT IT Program staff, to enhance the PTT IT Program’s future cybersecurity position.

The Contractor will work closely with other government entities (GSA IT, DSS Vendors) to ensure the integrity and security of the network and IT assets. The location of PTT will be the GSA Central Office at 1800 F St NW, Washington DC. The assessment will need to cover the deployment of the infrastructure to the floors: Basement, Ground, 1st, 2nd, 3rd, 4th floors of Wing 1 of the building including the in-fill area of the 1st floor and an additional location for the Presidential Inaugural Committee (PIC).

6. TASKS & SUBTASKS

6.1. TASK 1: Task Order (TO) Management

6.1.1. Subtask 1: TO Planning and Management Services

The Contractor shall plan, control, and execute all tasks in this PWS. The Contractor’s Program and Project Manager(s) shall be responsible for developing all task planning materials, maintaining effective communication with PTT IT Director and Contracting Officer Representative (COR) for all tasks associated with delivery of services described in this PWS.

The Contractor shall ensure that Program and Project Managers adhere to standard project management best practices as defined by industry and the current Project Management Book of Knowledge (PMBOK).

The Contractor shall participate in a contract kick-off meeting with the Contracting Officer (CO), COR, PTT IT Director, and GTMs within five (5) days of TO Award (TOA).

The Contractor shall submit a roster, leveraging the Contract Personnel Tracker (CPT) template to the COR and/or CO within five (5) business days of the effective date of this contract, providing an updated version weekly. The first CPT shall be provided at the Contract Kick-off meeting, then weekly with the submission of the weekly status report. The COR will notify the Contractor of the appropriate level of clearance investigation required for each staff member. If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level. All Contractor staff must be fully badged and cleared through GSA security before they may begin billable work on this TO.

All key personnel must be able to be cleared within three weeks of the first day of the period of performance.

The Contractor shall recommend, document, analyze, assess, and implement requirements in a flexible manner, in accordance with current laws, regulations, policies, operational directives, and rules, while executing a state-of-the-art assessment approach. Additionally, the Contractor shall consistently:

● Respond to inquiries from the PTT IT Director, COR and Team Leads/GTMs, coordinating to ensure that all tasks and subtasks are executed according to program direction, priorities, and processes.

● Prepare and track meeting agendas, minutes, issues, risks, and action items for all meetings;

including both scheduled and ad hoc meetings.

● Track daily, weekly, and monthly cumulative performance metrics, as applicable.

● Create all required status reports.

● Facilitate and participate in recurring and ad hoc meetings, as needed.

● Track and manage cost expenditures.

● Ensure all staff come to meetings prepared, with the appropriate briefings and knowledge necessary to have productive and effective sessions.

6.1.2. Subtask 2 Program, Project Management, Meetings &

Reports

The Contractor shall provide an experienced full-time Program Manager to oversee the entire contract. The Program manager shall facilitate the assessment process. The Program Manager shall be a single on-site individual with the responsibility and authority to commit company resources in support of this task order. The Program Manager will provide overall leadership and guidance for all Contractor personnel, ensuring that all PTT products and services are completed on time in a cost-effective manner, with exceptional quality; ensuring the objectives of the program are met.

As with all Key Personnel, the Program Manager must be active and onboard upon award. The Program Manager is ultimately responsible for the quality and efficiency of work performed on this contract. The Program Manager shall be readily available to respond to Government questions, concerns, and comments; proactively alerting the Government to potential contractual or programmatic issues. This includes issues or situations that may compromise the Contractor’s ability to provide service.

The Program and/or Project Manager shall maintain a comprehensive schedule for the full assessment from planning, execution, and post-execution; maintaining daily updates and producing reports as needed.

The Contractor shall facilitate and participate in a set of standard management and status meetings, and various ad hoc meetings as directed by the COR. The Contractor shall prepare, track, and document meeting agendas, minutes, issues, action items, and decisions.

The Contractor shall provide meeting minutes within three (3) business days following the meeting to parties as directed by the COR and GTMS. The Contractor shall provide meeting minutes after all meetings. Minutes shall be accurate and reflect sufficient detail, containing at a minimum, meeting date and location, meeting purpose, items discussed, decisions made, attendees, and action items. The Contractor shall provide the appropriate resources to successfully communicate, facilitate, coordinate, and participate in all meetings.

Contract Kick-off Meeting Within five (5) business days of contract award, the Contractor shall coordinate with the COR to schedule a Contract Kick-off Meeting at a location approved by the Government or virtually.

The resulting meeting invite should be addressed to the CO and the COR. The meeting will provide an introduction between the Contractor personnel and Government personnel who will be involved with the TO. At least one (1) business day prior to the kick-off meeting, the Contractor shall prepare an agenda indicating who will attend on behalf of the Contractor, and provide a list of questions that require a decision by the COR and/or CO. The meeting will provide the opportunity to discuss technical approach, management plans, security issues, reporting procedures, and travel authorizations if applicable. The meeting will also include a discussion of plans for all deliverables and management meetings, including the Technical Kick-off meeting agenda, date, and time. At a minimum, the attendees shall include vital Contractor personnel, the CO, COR, and other relevant Government personnel. The Contractor shall present a contract kick-off briefing with the following at the kick-off meeting:

● Vision, Goals, and Objectives

● Roles and Responsibilities

● Points of contact (POC)

● Work Breakdown Structure (WBS)

● Draft Schedule

● Employee status (Contract Personnel Tracker)

● Initial Risk Register

The output of the meeting will include:

● Prioritized list of objectives

● Draft Schedule

● Onboarding Contractor staff procedures

● Agenda Structure, Date and Time for the Daily Scrum

● Agenda, Date, and Time for Technical Kick-off meeting

● Date and Time for the Weekly Status Review

● Date and Time for the Monthly Contract Status Review

Daily Scrum The Contractor shall facilitate a 30-minute daily scrum meeting to review priorities, work through issues, continually plan and review the plans, synchronize on activities, provide progress status on critical items (in progress or done), updates on items worked on the previous day, what they have planned for today (to do) and what (if any) impediments or issues exists.

The Contractor shall define a structure and agenda for the daily scrum based on the program phase, ensuring all relevant information is reviewed, all pertinent information/issues are addressed, and continual communication is maintained.

Weekly Status Review The Contractor shall submit a Weekly Status Report (WSR) using the designated template provided by the government the Friday before the weekly status review meeting. The Contractor shall schedule and facilitate the weekly status review meeting with the COR, PTT IT Director and GTMs; and ensure a timely standardized, and transparent mechanism for discussing current task and activities, planned tasks and activities, and any risks and potential mitigations to avoid or limit any negative consequences to the program, schedule, or resources.

In addition, the Contractor shall organize, attend, and facilitate weekly ad hoc meetings, as needed, via teleconference, virtually, or in-person as mutually agreed. The WSR should contain the following information for each task and subtask defined in this Task Order:

● Activities and Accomplishments for the reporting period

● Deliverables/Work Products Awaiting Government Review/Approval

● Planned Activities for the Upcoming Reporting Week

● Schedule and estimate to complete – planned and actual completion dates for project milestones when they occur, along with any changes to estimated future milestone dates, including any relevant assumptions.

● Risk, Issues, and mitigations Note: Financial updates are not specifically required each week, unless it is necessary to communicate a risk, funding concern, or other notable financial update.

Monthly Contract Status Review The monthly contract status review is an opportunity for the Contractor senior leadership and the Government leadership to come together to discuss the overall performance of the contract and ensure the Contractor continues to have everything that is needed from the Government to be successful. The Contractor shall provide to the COR, by the 20th of each month, a Contract Status Report (CSR) using the CSR Template provided by the Government. The Contractor Program Manager shall establish monthly meetings with the COR to review the CSR. Monthly CSRs should be submitted regardless of whether a contract status review meeting is held. The CSR should provide information on work completed and address any issues or concerns. At the contract status review meeting the Contractor will propose corrective action and mitigations for contract risks, issues, and performance challenges.

Using the CSR template provided by the government the Contractor will provide the following type of information per reporting period for each task and subtask defined in this Task Order:

● Contract Details: Including the Scope, Prime & Subcontractor information, Invoices, Vendor Organizational Chart, Other Direct Cost (ODCs), Staffing Levels, Staff Changes

● Financial Overview for the reporting period and cumulative

● Activities and Accomplishments for the reporting period

● Contract Deliverable Status

● Monthly Budget

● Contract Base and Modification History

● Issues, Risks, and Mitigation Plan

The Contractor shall complete all areas of the CSR. The Contractor shall submit the CSR to the CO, PTT IT Director, COR, GTMs and others as identified; ensuring all are invited to the recurring monthly meeting. The monthly contract status review meetings will be facilitated by the Contractor and include the following structure:

● Review of action items from previous monthly meeting and their status if any

● Presentation of the CSR – the Contractor shall report all tasks at the CLIN number and

Task level to include all hours expended and financials. The COR may require further decomposition to the Subtask.

● Review new action items that came up during the presentation of the CSR, providing an estimated time to address them.

Design Review Session(s) and SVV Discovery Meetings The Contractor shall participate in a design review session scheduled by the COR, as needed by the Contractor, to gain a full understanding of the solution implemented by the DSS Vendor.

The DSS Vendor will provide the Contractor with an in-depth understanding of the multi-cloud infrastructure design approved by PTT IT leadership for implementation. The Design Review Session can be scheduled as recurring daily sessions or as adhoc sessions, based on the Contractors needs. The design review session will be discontinued when no longer required by the Contractor.

The Contractor shall facilitate discovery meetings with the Design Services and Support (DSS) team to understand PTT IT Program requirements to build assessment plans, define rules of engagement and report findings. The Contractor shall create a Security Verification and Validation questionnaire to guide the discovery meeting once design review sessions are complete.

This meeting shall also serve to establish a recurring mechanism between the PTT IT Program and the assessors and/or assessment teams to minimize ambiguities or misunderstandings about the implementation of security and privacy controls and related weaknesses or deficiencies identified during the assessments.

6.1.3. Subtask 3: Project Management Plan

The security assessment should be treated as any other project, with a project management plan (PMP) to address goals and objectives, scope, requirements, team roles and responsibilities, limitations, success factors, assumptions, resources, timeline, and deliverables.

The Contractor shall develop, maintain, and update a PMP for all tasks identified in this PWS.

The PMP shall serve as the basis for performing and controlling the scope of work and project’s activities described in this PWS. A draft version of the PMP is due no later than 20 business days after the contract kick-off meeting. The Contractor shall maintain the PMP throughout the life of the tasks covered, modifying, and updating the plan as necessary. The PMP will be developed in accordance with the Project Management Body of Knowledge (PMBOK). The PMP shall describe, at a minimum, the technical approach, organizational resources, deliverables, documentation, and management controls to be employed to meet the cost, performance, schedule, and technical requirements throughout the period of performance.

These activities shall establish control, management, monitoring, and notification mechanisms and shall include working with and reporting to the COR and GTMs to ensure that tasks and their subtasks stay on track and that important milestones are met. Activities shall include, how the Contractor will define:

● Goals – describing a reliable and cost-effective approach to management of the TO

● Scope – clearly defining the organization and requirements being met.

● Task management strategy – how the Contractor will plan, organize, secure, and manage resources with appropriate knowledge and skills to perform ongoing activities.

● Operations management strategy – how the Contractor will create, manage, and control work plans, day to day activities, staff hours, and staff output.

● Work Breakdown Structure (WBS) – how the Contractor will create, manage, and control work plans, project schedules, and/or WBS providing workstream and activity detail that is traceable to a schedule.

● Schedules – presenting a timeline describing developmental and operational activities and duration with start and end dates for completion, as applicable.

● Project Management (Agile) Approach & Tools - how the Contractor will leverage automated tools and technology to provide sprint, task, schedule and dashboards that provide the ability to track progress real-time.

● Assumptions and constraints.

● List of stakeholders – clearly identifying the list of organizations, processes, and people that depend on the services covered by the TO

● Quality Control Plan (QCP) – describing the actions the Contractor will take to maintain high quality performance, maintaining quality control through repeatable, managed processes and quality assurance through audit and testing processes, including:

o Change control management – Ensuring the change control process is documented and approved. This includes, system/infrastructure changes, process, and procedure changes, as well as changes to all deliverables.

o Documentation management – Ensuring that all PTT IT deliverables and artifacts, this includes working copies, drafts, and final artifacts are stored in the approved document repositories. No documents shall be stored or routed on the vendor devices, network, or email system.

o Risk Management – Describing how the Contractor will define and maintain a comprehensive risk management plan and risk register, tracking program, project, technical, and contract level risks. Recommending mitigations and defining timely escalation and resolution of risk.

o Issue management – Describing how the Contractor will identify, track, analyze, assign, estimate resolution, and resolve issues; ultimately preventing future issues from occurring.

6.1.4. Subtask 5: Vendor Onboarding and Transition-Out Plan

Vendor Onboarding The purpose of vendor onboarding is to ensure the Contractor has met all requirements to begin working, to provide the Contractor with any historical knowledge that the Government may have that would be beneficial to success, and to address any challenges or concerns that may have arisen since award. In addition, the Contractor shall assume any current functions that are within their scope. The vendor onboarding period is the first 30 days after TOA. The Contractor shall notify the COR immediately if major concerns are identified that require immediate attention or correction. All concerns shall be documented and discussed during the weekly status review meetings. Vendor onboarding activities include:

● Establishment of 2 one-hour onboarding meetings, inviting the relevant participants that are needed. The Contractor shall prepare and submit an agenda two (2) business days prior to each meeting and prepare meeting minutes within 24 hours after the meeting.

● Conducting and coordinating all on-boarding activities with the Government, including obtaining security badges for Contractor staff and ensuring all required training is completed.

o Security Awareness Training o Records Management Training o Rules of Behavior

● Ensure Non-Disclosure Agreements (NDA) are reviewed, signed, and delivered to the

COR.

● Ensuring staff identified as key personnel are available to work with the GTMs immediately after TOA.

● All activities that will result in the Contractor gaining an understanding of the business objectives, processes, and procedures necessary to execute actions across GSA.

All personnel who work on this project will hold at least a Minimum Background investigation (T2) active clearance. The Contractor shall comply with GSA administrative, physical, and technical security controls to ensure that all Government’s security requirements are met. In addition, all Contractor personnel must adhere to the GSA Public Building Service’s rules and regulations.

Contractor shall comply with all current and future GSA and federal Government system security policy and regulations. In the event classified data may be required, the Contractor shall be required to complete and submit a DD Form 254, "Contract Security Classification Specification."

Throughout the performance of this task the Contractor shall follow and maintain compliance with GSA Order CIO P 2181. Contractors who design, operate, test, maintain, and/or monitor GSA systems must have as a minimum the National Agencies Check with Inquiries (NACI) investigation. Contractors accessing and/or handling sensitive but unclassified data must obtain the Moderate Background Investigation (MBI).

Transition-Out The Contractor shall develop and submit a transition out plan within 30 business days of the end of the base period. The Contractor shall provide a transition out plan to track all off-boarding activities, including the transition of all reports/artifacts, access removal, and the return of GFE. The Contractor’s transition-out plan shall be approved by the COR and PTT IT Director. The plan shall account for and provide:

● A comprehensive inventory of all hardware assets to be collected and returned to the Government.

● Inventory and location of all deliverables.

● All artifacts in a draft or final state, including figures, charts, or graphics.

● All templates created or used throughout the TO.

● A milestone chart detailing the timelines and stages of transition.

● Identification of individuals (at all levels) responsible for the transition and their respective roles and contact information.

6.1.5. Subtask 6: Quality Assurance Surveillance Plan (QASP)

The QASP establishes the methodology the government will use to monitor and evaluate the Contractor performance and ensure the objectives of the contract are met. The Contractor shall submit a proposed QASP for consideration, incorporating the major items that are directly tied to full performance of the contract; ensuring that the QASP focuses on the quality and timeliness of the outcomes to be delivered. Performance measures should be objective, cost-effective to implement and understandable. Additionally, the Contractor should ensure that the proposed QASP contains the following components:

● Methods of Surveillance: The applicable mix of contractor metrics, random sampling, periodic inspection, 100% inspection, customer feedback and third-party audits, as appropriate, that are specified to properly monitor performance and quality.

● Sampling Guide: A sampling guide is a written procedure which states what will be checked, the Acceptable Quality Level (AQL), and how the checking will be done. Using the sampling guide, the COR can accept or reject the service, based on the AQL. AQL defines the maximum allowable leeway or variance from a standard before the Government will reject a service. The AQL can be expressed as a number, a percentage, or a quantity per number of units inspected.

● Decision Tables: When a service has failed to meet AQL, a decision must be made as to who is at fault (contractor or Government). A decision table is used for this purpose. The decision table identifies different kinds of unsatisfactory performance, probable cause factors, and the things from which these factors could result.

● Checklists: Used to record what has been checked by a sampling guide and to record information on contract items not covered by sampling.

6.2. Task 2: Assess Security Controls

6.2.1. Subtask 1: Security Assessment Planning

The Contractor shall define the technical and non-technical testing and examination techniques needed to achieve an in-depth security assessment. The planning phase will be used to gather information needed for assessment execution—such as the assets to be assessed, the identification of threats of interest against the assets, and the security controls that have been implemented to mitigate those threats—and develop the assessment approach and plans. The assessors’ viewpoint will be both internal and external so the Contractor will define/recommend the techniques best for each viewpoint.

The Contractor shall provide, the Security Assessment Verification and Validation Plan outlining the objectives for the security and privacy control assessments, respectively, as well as a detailed roadmap of how to conduct such assessments. The assessment plans may be developed as one integrated plan or as distinct plans. The plan must include at a minimum, the following:

● Assessment techniques to be used during the assessments based on the security or privacy controls to be assessed.

● Tailored assessment procedures (e.g., select appropriate assessment methods and objects, and assign depth and coverage attribute values).

● Optimize processes to reduce duplication of effort as much as possible (e.g., sequencing and consolidating assessment procedures) providing cost-effective assessment solutions.

● Resources required for conducting the assessment, such as accounts or specific network and application access.

● The environment upon which the test will be conducted from, for both internal and external tests.

● Hardware and software testing tools that will be used.

● Physical and network access needs for each type of test.

The Contractor shall meet with PTT IT Program to review their initial assessment plan to include documentation and review approach, to ensure common understanding and agreement on the assessment objectives, plans, and the proposed rigor and scope of the effort.

The Contractor shall provide time frames, established scope and key milestones for completing the assessments, providing a detailed Rules of Engagement (ROE).

The contractor shall collaborate with staff across the PTT IT Program to identify all artifacts required for the assessment (e.g., policies, procedures, plans, specifications, designs, records, administrator/operator manuals, system documentation, system security plans, etc.).

6.2.2. Subtask 2: Execute Security Validation and Verification Assessment

Upon approval of the Assessment Plan and ROE, the Contractor will conduct the Security Controls Assessment to verify and validate the independent controls (National Institute of Standards and Technology [NIST] 800-53 Rev 4 and NIST 800-53A), using interviews, examination, and testing, in accordance with the agreed upon plan and ROE, additionally the Contractor shall:

● Identify security weaknesses identified with a mitigation approach, daily so that the DSS Team can take immediate steps to mitigate them.

● Conduct…