PWS_Draft_CSOC.docx

VA Cybersecurity Operations Center Next Generation II (CSOC NG II) Support

VA-23-00009911

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Office of Information Security (OIS) VA Cybersecurity Operations Center (VA CSOC)

VA Cybersecurity Operations Center Next Generation II (CSOC NG II) Support

Date: May 10, 2023

VA-23-00009911

PWS Version Number: 4.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Office of Information Security (OIS) delivers available, adaptable, secure, and cost-effective technology services to VA, transforming the Department into an innovative, 21st century organization, and acts as a steward for all VA’s IT assets and resources. OIT delivers the necessary technology and expertise that supports Veterans and their families through effective communication and management of people, technology, business requirements, and financial processes. To meet these goals, OIT strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/ Information Technology (IM/IT) systems to meet mission goals.

It is important that Veterans’ most sensitive information about their personal identity and medical records be protected. VA systems contain sensitive but unclassified data, personally identifiable information (PII), and protected health information (PHI) that, if compromised, may have a negative impact on Veterans, VA, and the Federal Government. The challenge is to ensure that VA safeguards this information in a way that minimizes any interference with the business processes and technologies that are used to deliver services to our nation’s Veterans. To meet this challenge and comply with Federal legislation, VA established an enterprise-wide information security program with a mission promising to “serve our Veterans, their beneficiaries, employees, and all VA stakeholders by ensuring the confidentiality, integrity, and availability of VA sensitive information and information systems.”

The business of VA, the second largest cabinet Department, is a massive, far-reaching, and complex effort that truly exemplifies direct public service to very special United States (U.S.) citizens. There are 20 million living Veterans, and about a quarter of the nation's population is potentially eligible for VA benefits and services because they are Veterans or beneficiaries of Veterans.

To serve that constituency, VA operates a network of more than 1,500 facilities, and has over 350,000 employees. Among the many professions represented in the vast VA workforce are physicians, nurses, counselors, statisticians, architects, engineers, computer specialists, and attorneys.

VA computer networks encounter over 45 million weekly security related events and have over 500,000 workstations, 350,000 users, 500 network security appliances, and 25,000 servers. The requirement for network security support is mainly derived from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 series, Incident Response (IR) Control Families. VA requires the capability to identify, detect, protect, and rapidly respond to assure containment and remediation (recover) of any security attacks against our systems. Any security incidents such as computer viruses, malicious software (malware), and other suspicious activity must be detected, contained, and removed from VA systems, and must also be analyzed using advanced digital media analytics capabilities to fully determine the root cause details for how these incidents occurred and to determine if the viruses and malware may have spread to other VA computers and networks. Success in achieving effective enterprise network defense capabilities at VA involves the ability to leverage Intelligence collected, the Information Security Continuous Monitoring (ISCM) capabilities deployed across the enterprise, and Advanced Persistent Threat hunting abilities of security experts.

VA’s direction of the information protection efforts expresses what and where information security controls need to be implemented in order to help further VA IT goals and objectives and achieve the VA mission. This builds on the VA information protection mission by providing direction and describing the future state of enterprise-wide security. VA’s Cybersecurity Strategy Goals outline our approach to countering the cybersecurity threat, while continuing to innovate and adapt to a rapidly changing IT landscape:

Goal 1. Secure and protect VA and Veteran information

Goal 2. Protect information systems and assets

Goal 3. Leverage innovation to strengthen cybersecurity

Goal 4. Enhance cybersecurity through partnerships and information sharing

Goal 5. Empower VA mission through cybersecurity risk management

VA Cybersecurity Operations Center (VA CSOC) performs a number of key functions to help ensure that these five goals are achieved and to provide enterprise-wide information security services as required by the Federal Information Security Management Act of 2002 (FISMA), as well as comply with many other Federal information security and privacy requirements. However, compliance only sets the minimum standard that a VA information security program must achieve. The vision of the program is to “provide world class information security for VA and Veteran information and information systems,” a vision that far exceeds compliance and strives for excellence. VA CSOC is responsible for the protection and resilience of the VA infrastructure on a 24x7 basis – by identifying, protecting, detecting, responding to and recovering from cyber threats and vulnerabilities and providing value-added security management services as requested. To achieve these goals, the VA CSOC continues to pioneer development of cyber security operations and capabilities.

The VA CSOC is responsible for identifying indicators of adversarial presence on the VA network on a 24/7/365 basis via maintaining an understanding of the motivations, tactics, techniques, and procedures of cyber adversaries. If a loss of confidentiality, integrity, or availability has occurred we move to disrupt the adversary's activities through containment, mitigation, and eradication. The VA CSOC performs independent verification and validation of VA's cyber security posture, performs cyber-related reporting to outside Agencies, and leads Departmental efforts to prepare for and defend against emerging and imminent threats. There are 6 functional areas that support the VA CSOC with Cyber Threat Intelligence (CTI) being the core of our operations. These core functions listed below directly map to the NIST Cybersecurity Framework:

1. Cybersecurity Incident Response (CIR)

2. Cybersecurity Technical Services (CTS)

3. Cybersecurity Analysis (CSA)

4. Vulnerability Scanning Service (VSS)

5. Cybersecurity Execution Management Services (CEMS)

6. Cyber Threat Intelligence (CTI)

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. Memorandum For Heads of Executive Departments and Agencies *, Fiscal Year 2015- 2016 Guidance on Federal Information Security and Privacy Management Requirements, M-16-03

2. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

3. “Federal Information Security Modernization Act of 2014”

4. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

5. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

6. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

7. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

8. 10 U.S.C. § 2224, "Defense Information Assurance Program"

9. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

10. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

11. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

12. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

13. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

14. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

15. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

16. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

17. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

18. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

21. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

22. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

23. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

24. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

25. VA Handbook 6500.6, “Contract Security,” March 12, 2010

26. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

27. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

28. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

29. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

30. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

31. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

32. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

33. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

34. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

35. VA Directive 6300, “Records and Information Management,” September 21, 2018

36. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

37. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

38. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

39. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

40. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

41. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

42. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

43. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

44. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

45. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

46. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

47. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

48. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

49. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

50. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

52. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

53. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

54. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

55. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

56. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

57. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

58. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

59. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

60. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

61. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

62. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

63. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

64. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

65. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

66. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

67. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

68. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

69. Social Security Number (SSN) Fraud Prevention Act of 2017

70. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

71. Attachment A: Service Level Agreements

SCOPE OF WORK

The Contractor shall provide comprehensive information and cybersecurity support services to the VA CSOC to assist in developing and providing enterprise-wide information and cybersecurity and network defense services, as aligned with the VA OIT, security configuration and interoperability of VA CSOC managed tools/devices and information security and goals. The Contractor shall perform the tasks outlined in Section 5.0 including all subparagraphs while utilizing the information provided throughout this PWS.

ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis, including optional tasks.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be a base period of nine months from award, with four 12- month option period(s) and seven Optional Tasks. The PoP for each Optional Task shall not exceed 12-months per exercise. The total PoP for this contract shall not exceed 60 months, inclusive of all options.

Any work, excluding tasks that require 24x7x365 support, at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed primarily onsite at VA facilities. Work may be performed at remote locations with prior concurrence of the Contracting Officer’s Representative (COR). Performance shall occur at the following locations:

Martinsburg, WV or Hines, IL will serve as the VA CSOC locations with primary responsibility to manage and coordinate the functions and tasks performed at the other VA CSOC locations.

1. US Department of Veterans Affairs (currently nine seats available) 811 Vermont Ave, NW Washington, DC 20420

2. Atlanta, GA (currently one seat available). This is a Government leased facility that provides space for accessing classified national security information up to the Department of Defense (DoD) SECRET level.

Executive Park Dr., Ste. 350 Atlanta, GA 30319

3. Berkley County, WV (currently 45 seats available) VA CSOC – Capital Region Readiness Center (CRRC) 221 Butler Avenue, Bldg. 511 Martinsburg, WV 25405

4. VA CSOC Offices in Hines, IL (currently 25 seats available) Hines Information Technology Center (ITC) Bldg. 215, Rm 147, 1st Ave. North of 22nd St.

Hines, IL 60141

5. VA Austin Information Technology Center (AITC) (currently five seats available) 1615 Woodward St Austin, TX 78741 The core and primary duty hours of operation for each location shall be Monday through Friday, 0630 – 1900 Local Time. Work hours shall be a standard five-day – eight-hour structure. The Contractor may be required to work outside of core duty hours (flextime hours) with VA team lead/ COR/ PM concurrence. For any task that requires 24/7/365 coverage will be noted within the individual task sections.

TRAVEL

At the Government’s request, there may be anticipated travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is four trips per year. Possible locations include the following, each trip estimated at five business days in duration, estimated of persons per trip is two:

1. Washington, DC

1. Hines, IL

1. Martinsburg, WV

1. Austin, TX

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall utilize personnel that have the existing requisite experience and credentials prior to onboarding for this effort, unless expressly identified in a particular subtask. The Government will not bear the expense of training to gain certification or experience.

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this TO effort. The purpose of this plan is to ensure that the Government and the Contractor understand and manage risk, communications, schedules, deliverables, quality, and human resources. The Contractor shall provide a draft CPMP at the Kickoff Meeting. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

The CPMP shall include subsidiary plans which further detail the approach to be used for each aspect of the PWS.

The CPMP shall include the following:

1. Schedule Management Plan: Shall include a schedule of all deliverables planned.

2. Scope Management Plan: Shall describe how the contractor will control the activities and deliverables and the roles and responsibilities of everyone involved; shall also address:

a. Who has authority and responsibility for scope management.

b. How the scope is measured and verified (i.e., Quality Checklists, Scope Baseline, Work Performance Measurements, etc.).

c. Who is responsible for final acceptance of project scope and deliverables.

3. Staffing Management Plan: Shall illustrate and detail the arrangement of Management, Key and Support personnel assigned to the contract, as well as corporate reach-back for staff augmentation.

4. Quality Control Plan: Shall detail plan to establish a program to ensure all work products and deliverables submitted to the Government are accurate, free of errors or defects.

5. Communications Plan: Shall list the roles and contact information of all Management and key personnel both for the Contractor and Government, tasks and functional area assignments and associations.

6. Risk Management Plan: Shall detail all risks that actually or potentially impact contract success, to include a common name or title, probability, impact, risk score, origin, explanation, planned or recommended mitigation.

VA may provide templates/shells for each plan and the VA PM will provide guidance to the Contractor on the necessary inputs/ information that are required to develop the outputs for each one of the subsidiary plans. The above list may be updated by VA to include additional subsidiary plans.

Deliverable:

A. Contractor Project Management Plan

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The technical kickoff meeting shall be onsite at a VA facility (location to be determined, some attendees may be virtual). The Contractor shall coordinate the date, time, and location with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM (Co-Chairperson), the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Cybersecurity Operations Center Next Generation (CSOC-NG) Support effort.” The Contractor shall submit the final updated presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS and the Government’s designated note taker, to prepare and distribute the Meeting Minutes of the kickoff meeting to the CO, COR and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the Meeting Minutes prior to distribution of the document.

Deliverable:

A. Summary Report Presentation B. Meeting Minutes

TRANSITION IN

The Contractor shall begin transitioning in task support immediately after completion of the kickoff meeting and remain in effect for 45 days. The Contractor shall participate in any Phase-In Transition Plan meetings scheduled by the outgoing Contractor or with the VA COR, or VA organizations identified by the COR.

The incoming Contractor shall perform the following activities:

a. Participate in reviews of program documentation

b. Participate, as an observer, such as desk side knowledge sharing in the day-to-day tasks performed by the outgoing contractor for the purpose of knowledge sharing, understanding all standard operating procedures, VA stakeholders, meeting attendance, report training, and business workflows and processes

c. Acquire knowledge of all details on accessing and assessment of applicable tools and repositories

d. Provide VA COR with ongoing status of Government-required (on-boarding) training, clearances, access, and certification processes

e. Provide VA COR and CSOC Management with daily status updates on hiring and staffing until such time that full staffing is reached

QUARTERLY PROGRAM REVIEW MEETINGS

The Contractor shall hold Quarterly Program Review meetings and provide an oral presentation, PowerPoint briefing, along with written supporting documentation in the form of a Quarterly Program Status Report that summarizes the delivery of services for previous quarter as required by this PWS. The Contractor shall identify issues encountered and any future upgrade projects. The Contractor shall address key issues, to include the elements included in the CPMP, to include TO and security performance measure reporting. The information in the Quarterly Program Status Report will be used as the basis for evaluating VA CSOC security goal achievement, and whether any projects have adequately demonstrated through testing to meet its functional and performance requirements, and whether project output is adequately supported by documentation, training, etc. The Contractor shall give this briefing and submit the supporting Quarterly Program Status Report to VA Team Leads, COR, and PM. The meetings may be conducted in-person, in Washington, DC, Martinsburg WV, or Hines, IL., at the Government’s request.

The Contractor shall create and provide a Monthly Status Executive Briefing on the current status of the Program summarizing the achievements, functional and performance requirements status, project output quality, staffing, and items of concern to be provided to the Government at least once a month, with the expectation that the approved Executive Briefing, upon their request, will then be provided to OIS Executive Leadership.

Deliverable:

A. Quarterly Program Status Report B. Monthly Status Executive Briefing

CONTINGENCY PLAN

The Contractor shall submit a Contingency Plan within 60 days from award for all locations to account for how the Contractor shall continue to support VA CSOC when weather or other events prevent the Contractor from working on site. This plan shall describe the specific plans to be implemented for outages, remote access outages, or surges in demand for each of the tasks in this PWS. The Contractor shall continue uninterrupted services, as described in the PWS, throughout the PoP.

Deliverable:

A. Contingency Plan

VA TRAINING

The Contractor shall ensure all VA CSOC Contract Personnel engaged on this effort complete VA required and provided training. The current core requirements include VA Privacy and Information Security Awareness Training and Rules of Behavior Status. Role based specific training of equivalent complexity may also be required. VA has the right to modify the training requirements. Completion of these training requirements are required during the on-boarding of personnel and required to begin individual performance.

The Contractor shall submit VA Privacy and Information Security Training Certificates for each Contractor employee in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”. The training referenced above is required to be renewed annually.

The Contractor shall provide VA COR with progress and completion status of VA Privacy and Information Security Awareness Training and Rules of Behavior in the form of a Training Status Report. The Training Status Report shall convey the following: first and last name of all Contractor personnel engaged on the effort, their initial training completion date(s), next required training date. The training status report and completion certificates shall be maintained by the Contractor in a VA provided central location.

The Contractor shall provide a Quarterly Staff Certification Report that track and report all industry certifications held and obtained by Contractor staff on a quarterly basis, the first business day of each quarter, and upon new hire onboarding.

Deliverable:

A. Training Status Report B. Quarterly Staff Certification Report

CONTRACTOR PERSONNEL MANAGEMENT

In support of more efficient onboarding, the Contractor shall provide dedicated support for VA Onboarding/Offboarding Service Portal for all personnel working under this TO. This portal is part of the VA Access and Identity Management Program Office.

As part of this support, the Contractor shall ensure that all personnel who require privilege level access to network devices, servers, security devices and/ or desktop systems shall possess industry standard knowledge and skill sets specific to the technology to be accessed with the prescribed experience defined in the below sections of the PWS. Where qualifications are not specifically called out, the Contractor shall provide resources adequately qualified to successfully perform the described functions.

STAFFING PLAN

The Contractor shall provide a Staffing Plan within three business days after award, following the requirements provided for each Section in the table below. The Contractor shall develop and present the Government with a Staffing Plan that includes; the Labor Category (LCAT), resource function/role, resource name, PWS Task Section affiliation, requirements (experience and/or certifications) met, physical location, and onboarding/offboarding status as well as any positions that do not yet have a candidate selected. The ability to sort and filter on all categories will be reflected in the Staffing Plan. This shall also include Key Personnel Positions (See PWS Section 5.1.8.1).

Table 1 Staffing Plan Experience and Certification Requirements

Microsoft SQL Server Oracle MySQL PostgreSQL MongoDB AzureSQ

AWS RDS

Other Cloud PaaS Databases

Prior to onboarding, 40% of staff possess 5 years’ experience with:

Microsoft SQL Server Oracle MySQL PostgreSQL MongoDB AzureSQ

AWS RDS

Other Cloud PaaS Databases

a. Computer networking concepts and protocols, and network security methodologies.

b. Risk management processes (e.g., methods for assessing and mitigating risk).

c. Laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.

d. Cybersecurity and privacy principles.

e. Cyber threats and vulnerabilities.

f. Communication methods, principles, and concepts that support the network infrastructure.

g. Capabilities and applications of network equipment including routers, switches, bridges, servers, transmission media, and related hardware.

h. Cybersecurity and privacy principles used to manage risks related to the use, processing, storage, and transmission of information or data.

i. Information Technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).

j. Measures or indicators of system performance and availability.

k. How traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).

l. Remote access technology concepts.

m. Server administration and systems engineering theories, concepts, and methods.

n. Telecommunications concepts (e.g., Communications channel, Systems Link Budgeting, Spectral efficiency, Multiplexing).

o. Network tools (e.g., ping, traceroute, nslookup)

p. Different types of network communication (e.g., LAN, WAN, MAN, WLAN, WWAN).

q. Web filtering technologies.

r. Network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

s. Network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.

t. Service management concepts for networks and related standards (e.g., Information Technology Infrastructure Library, current version [ITIL]).

u. Symmetric key rotation techniques and concepts.

v. Security models (e.g., Bell-LaPadula model, Biba integrity model, Clark-Wilson integrity model).

w. Personally Identifiable Information (PII) data security standards.

x. Personal Health Information (PHI) data security standards.

y. Network protocols such as TCP/IP, Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), and directory services.

z. Controls related to the use, processing, storage, and transmission of data

1. GIAC Certified Incident Handler

2. EC-Council’s Certified Incident Handler (E|CIH)

3. GIAC Certified Incident Handler (GCIH)

4. Incident Handling & Response Professional (IHRP)

5. Certified Computer Security Incident Handler (CSIH)

6. Certified Incident Handling Engineer (CIHE)

Within 30 days of onboarding the remaining 20% of staff possess the below certification (or equivalent):

1. EC-Council’s Certified Ethical Hacker

Experience performing digital forensics analysis in support of cybersecurity incident response

Prior to onboarding 100% of staff possess 3 years’ experience in the following:

Significant experience with tools utilized by DMMA (5.6) Significant experience performing malware analysis and reverse engineering

Prior to onboarding 100% of staff possess both of the following certifications:

OpenText EnCase Certified Examiner (EnCE) Certificate GIAC Certified Forensics Examiner (GCFE) certificate

Global information Assurance Certification (GIAC) Reverse Engineering Malware (GREM)

1. Experience performing cyber defense analysis

2. Significant Cyber Threat Hunting

Prior to onboarding 100% of staff possess one of the following certifications:

1. GIAC Certified Incident Handler (GCIH)

2. GIAC Network Forensic Analyst (GNFA)

3. GIAC Defending Advanced Threats (GDAT)

Prior to onboarding 100% of staff possess one of the following certifications:

1. Offensive Security Certified Professional (OSCP)

2. GIAC Penetration Tester (GPEN)

1. GIAC Public Cloud Security (GPCS)

2. GIAC Cloud Security Essentials (GCLD)

3. AWS Certified Security – Specialty

4. Azure Security Engineer Associate

1. GIAC Public Cloud Security (GPCS)

2. Identity and Access Administrator Associate

1. GIAC Certified Incident Handler (GCIH)

2. GIAC Certified Forensic Examiner (GCFE)

3. GIAC Certified Forensic Analyst (GCFA)

1. SPLUNK – Power user with Advanced Dashboard user training

2. Splunk ES Admin

1. GIAC Certified Incident Handler (GCIH)

2. GIAC Network Forensic Analyst (GNFA)

Developing and implementing cybersecurity networking analytics for large enterprise networks

1. Experience with web API integrations and scripting

2. Experience in creating cybersecurity detections through CASB solutions (inline, agent based, API connection etc.)

1. Offensive Security Certified Professional (OSCP)

2. GIAC Penetration Tester (GPEN)

1. Knowledge of NITTF Insider Threat Framework

2. Knowledge of Counterintelligence

3. MITRE ATT&CK Framework (Insider Threat)

4. Identifying Foreign Threats

5. Identifying Cyber Threats

6. Knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy

7. Knowledge of operations security

8. Knowledge of authentication, authorization, and access control methods.

9. Knowledge of Virtual Private Network (VPN) security.

10. Knowledge of Insider Threat investigations, reporting, investigative tools, and laws/regulations.

11. Knowledge of insider tactics, techniques, and procedures.

12. Knowledge of collection management processes, capabilities, and limitations.

13. Knowledge of cyber attackers (e.g., script kiddies, insider threat, non-nation state sponsored, and nation sponsored).

14. Knowledge of applicable laws, statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures.

15. Knowledge of Personally Identifiable Information (PII) data security standards.

16. Knowledge of Personal Health Information (PHI) data security standards.

17. Skill in conducting trend analysis.

18. Skill in using incident handling methodologies.

19. Skill to apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).

Prior to onboarding all staff have expert level experience in the following:

1. Network Access Control (NAC)

2. Network Traffic Analysis (NTA)

3. Artificial Intelligence/Machine Learning Behavioral Analysis (AI/ML BA)

4. CS product research, identification, procurement, pilot, and implementation support

5. Anti-malware appliances (software)

6. Anti-spam

7. E-mail filtering

8. Intrusion Detection System (IDS)/ Intrusion Prevention System (IPS)

9. Firewalls (packet filtering/ stateful inspection, application, proxy)

10. Virtual Private Network (VPN) Gateways

11. Endpoint Security Products (anti-virus, Data Loss Prevention (DLP) Agent, EDR (Endpoint Detection and Response)

12. Web filtering appliances/ software

13. Audit log correlation software/ servers

14. Advanced persistent threat detection functionality

15. Application allow listing (aka Application execution control, (previously known as Application control/whitelisting)

16. Encryption (data at rest, data in motion, data in use)

17. Segmentation/ Micro-segmentation

18. Internet of Things (IoT) and Bring Your Own Device (BYOD) Mitigation

19. Medical Device Mitigation

20. Phishing/ Whaling/ Voice Phishing (vishing) Mitigation

21. Data Protection

22. Wireless Local Area Network (WLAN) Security

23. Continuous Diagnostics and Mitigation (The CDM program is a Department of Homeland Security initiative)

24. Cloud Security (to include Cloud Access Security Broker (CASB))

25. Data Loss Prevention - McAfee/Trellix DLP Endpoint, McAfee/Trellix Device Control, Varonis, Imperva Data Security Fabric, Microsoft AIP, Microsoft Defender for Endpoint, Cisco E-mail Security Appliance (ESA), Netskope DLP, McAfee/Trellix Application Control, AWS Lambda, M365 Intune, MDM Airwatch

26. User and Entity Behavior Analytics (UEBA) - Heuristic Behavior Analytics (FP HBA) and User Activity Monitoring (UAM)

27. Security Orchestration and Response (SOAR)

1. Support Windows and Linux operating systems

2. Virtualized Systems

3. Automated Web Scanning Tools (DAST)

4. Burp Proxy Suite

5. Burp Enterprise

6. Kali Linux Suite

7. Nessus Scanner

8. NMAP

Prior to onboarding 50% of staff possess expert level experience in the following:

Database Management Systems; SQL, Oracle, Mongo, MySQL

Prior to onboarding 75% of staff have expert level experience in the following:

Web languages and technologies; including: PHP, Python, JavaScript, Java, Ruby, PERL, ASP, .NET, HTML, CSS, Web API’s, Rust, Web Services

1. C|EH

2. PenTest+

1. Windows, Macintosh, and Linux virtualized operating systems

2. Burp Proxy Suite

3. Kali Linux Suite

4. Web languages and technologies including: PHP, Python, JavaScript, Java, Ruby, PERL, ASP, .NET, HTML, CSS

5. iOS:

a. MobSF Static Testing

b. Frida

c. Needle - Static/ Dynamic Testing

d. XCode iOS Developer Tools

e. Various tools (Cycript, Clutch2, otool, SSL Kill switch)

f. AltStore

6. Android:

a. MobSF Static/ Dynamic Testing

b. AndroidBugs Static Testing

c. Drozer Security Testing Framework/ Dynamic Testing

d. Android Emulators

e. apktool, Dex2Jar, JD-GUI

Prior to onboarding 100% of staff possess 5+ years’ experience in or one of the follow certifications:

1. C|EH

2. PenTest+

1. Support Windows and Linux operating systems

2. VMWare

3. Cobalt Strike

4. Kali Linux Suite

5. Cofense PhishMe or comparable enterprise anti-phishing solution

1. Rust

2. Swift

3. Kotlin

4. TypeScript

5. Visual Studio/C#/C++

6. Python

7. Java/JavaScript

8. HTML

9. CSS

10. SQL/NoSQL

Prior to onboarding 80% of staff possess 5 years’ experience with the following tools:

1. Rust

2. Swift

3. Kotlin

4. TypeScript

5. Visual Studio/C#/C++

6. Python

7. Java/JavaScript

8. HTML

9. CSS

10. SQL/NoSQL

1. Support Windows, and Linux operating systems

2. VMWare

3. Cobalt Strike

4. Kali Linux Suite

5. RedHat Enterprise Linux

6. Nessus Scanner

7. NMAP

2. CEH

1. Support Windows and Linux operating systems

2. VMWare

3. Kali Linux Suite

4. RedHat Enterprise Linux

5. Nessus Scanner

6. NMAP

7. Cobalt Strike

8. Cain and Abel

9. Wireshark

10. Burp Suite

11. Programming languages and technologies; including but not limited to experience with Powershell, C++, Visual Basic

12. Knowledge of Database Management Systems; SQL, Oracle, Mongo, MySQLWeb languages and technologies; including but not limited to PHP, Python, JavaScript, Java, Ruby, PERL, ASP, .NET, HTML, CSS

13. WiFi Penetration tools:

a. Aircrack-ng

b. AirSnort

c. Kismet

d. Netstumbler

Prior to onboarding 100% of staff possess 5 years’ experience commensurate with at least one of the below certifications:

1. Kali Linux Certified Professional (KLCP)

2. Offensive Security Certified Professional (OSCP)

1. Support Windows and Linux virtual operating systems

2. Cobalt Strike

3. Kali Linux Suite

4. Burp Suite

5. Nessus Scanner

6. NMAP

7. Maltego

8. Postman

9. SoapUI

Prior to onboarding 100% of staff possess 5 years’ experience commensurate with at least one of the below certifications:

1. C|EH

2. PenTest+

The Contractor shall perform the efforts required for “In-Processing” Contractor Personnel assigned to this effort as defined in the OIS CSOC CRRC and VACO…