PWS_UEBA Host Based Solution.docx

UEBA Host Based Solution VA-26-000xxxxx

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Office of Information Security (OIS) Cyber Security Operations Center (CSOC) Heuristic Behavior Analytics (HBA) Recompete Date: Janurary 19, 2026 PWS Version Number: 1.1

Contents

BACKGROUND

The mission of the VA is to provide benefits and services to Veterans of the United States. In meeting these goals, VA Office of Information & Technology (OIT) and the Office of Information Security (OIS) strive to provide high quality, effective, efficient, and secure Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care, as well as throughout all the points of the Veterans’ health care environment in an effective, timely and compassionate manner.

In order to support this mission, OIT and OIS are chartered to provide robust cybersecurity protections for Veterans, VA information, and VA information systems, and infrastructure. OIS ensures the resiliency of VA’s cybersecurity infrastructure through proactive monitoring, adaptive response, adherence to federal requirements and best practices. OIS must continue to evolve its information security program to address existing deficiencies, match the growing and evolving cybersecurity threat landscape, minimize risks from the use of new technologies, address existing deficiencies, and align with federal cybersecurity strategies and direction.

Heuristic Behavior Analytics (HBA) is a significant part of VA’s overall defensive security strategy which provides comprehensive visibility into user account activity, data, and cyber traffic as it enters, exits, and moves throughout the network. The VA seeks continual analysis of heuristic behaviors by defining normal baselining behavior and traffic patterns which will provide a baseline for identifying anomalies. Alerts generated by anomalies to solution defined patterns and algorithms are forwarded to the appropriate security devices such as Security Orchestration Automation and Response (SOAR) and Security Information and Event Management (SIEM) or Cyber Security Operations Center (CSOC) analyst for investigation

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. National Institute of Standards and Technology. (n.d.). NIST Special Publication 800- 53 (Rev. 4) AU-2 AUDIT EVENTS – Retrieved August 06, 2019, from https://nvd.nist.gov/800-53/Rev4/control/AU-2

38. MITRE ATT&CK Framework – https://attack.mitre.org/

39. The White House - Office of the Press Secretary. (2016, July 26). Presidential Policy Directive - United States Cyber Incident Coordination – Retrieved August 15, 2019, from https://obamawhitehouse.archives.gov/the-press-office/2016/07/26/presidential-policy-directive-united-states-cyber-incident.

40. VA Handbook 6500.3, “Assessment, Authorization, and Continuous Monitoring of VA Information Systems,” February 3, 2014 and NIST Special Publication 800- 37, Revision 1

41. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

42. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

43. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

44. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

45. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

46. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

47. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

48. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

49. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

50. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

51. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

52. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

53. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

54. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

55. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

56. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

57. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

58. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

59. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

60. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

61. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

62. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

63. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

64. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

65. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

66. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

67. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

68. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

69. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

70. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

71. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

72. Social Security Number (SSN) Fraud Prevention Act of 2017

73. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

SCOPE OF WORK

The Contractor shall provide a Host-Based UEBA solution and comprehensive support to include project management, technical services, implementation, and ongoing maintenance of an Entity Behavior Analytics (UEBA) Solution. This UEBA solution encompasses hardware, maintenance, software licenses, installation, and follow-on support services.

ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be one (1) 12-month Base Period and two (2) 12-month option periods, if exercised. The PoP shall also include seven (7) optional tasks. The total PoP shall not exceed 36 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). If required, the CO may designate the Contractor to work during holidays and weekends.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five (5) are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six (6) are set by a day of the week and month:

PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities located in the Contiguous United States (CONUS). The Government reserves the right to require any and/or all personnel to work at a government facility with 30 days notice. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

Travel The Government does not anticipate travel will be required to complete the effort associated with this TO.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

The CPMP shall include a methodology for implementation of the additional software (SW) and hardware (HW) & Maintenance for optional implementations.

The CPMP shall take the approach that this will be a phased implementation during the course of the entire period of performance. Implementation targets to be considered specifically are:

1. VA Financial Services; Austin TX

2. VA CRRC, Martinsburg WV,

3. VA CSOC, Hines IL

4. High Value Assets, VACO Washington DC

5. High Potential Risk Assets

6. High Network Visibility locations

The CPMP shall include subsidiary plans which further detail the approach to be used for each aspect of the task order. The Contractor may, as it deems appropriate, expand on the minimum subsidiary plans.

The CPMP Subsidiary plans shall include the following (at a minimum):

1. Implementation Schedule Plan as new candidates (hosts or accounts) for UEBA monitoring and new locations for NTAR sensors are identified.

2. Staffing Management Plan: shall illustrate and detail the arrangement of Management, Key, and Support personnel assigned to the TO, as well as corporate reach-back for staff augmentation.

3. Communications Plan: shall list the roles and contact information of all Management and Key personnel both for the Contractor and Government, tasks and functional area assignments and associations.

4. Risk Management Plan: shall detail all risks that actually or potentially impact contract success, to include a common name or title, probability, impact, risk score, origin, explanation, planned or recommended mitigation.

VA can provide templates for each plan and the VA PM will provide guidance to the Contractor on the necessary input/information that is required to develop the outputs for each one of the subsidiary plans.

Deliverable:

A. Contractor Project Management Plan (CPMP)

REPORTING REQUIREMENTS

The Contractor shall provide a Weekly Activity Report (WAR), a Weekly Work Breakout Schedule (WBS), and Weekly Integrated Master Schedule (IMS) updates to the Contracting Officer’s Representative (COR) and VA PM addressing all work completed during the preceding reporting period and shall present the work to be accomplished during the subsequent period(s) for each task as described in Section 5.0.

The Contractor shall attend weekly teleconference meetings with the VA PM or as requested. The Contractor shall discuss and document any issues, pending deliverables, or other pertinent topics concerning the task areas. Each report shall include the work schedule by name for everyone assigned to this TO. Each report shall identify any issues that arose and identify any issues that have arisen but have not been completely resolved with an explanation.

The Contractor shall establish and attend quarterly meetings with the VA stakeholders, contractor project Subject Matter Experts (SME), and other points of contact (POC) to include solution provider POCs. The Contractor shall discuss and document any issues, pending deliverables, or other pertinent topics concerning the task areas. The Contractor shall provide a Quarterly Status Report. Each report shall include assigned action items with designated POCs, schedule, and plan for resolution(s). Each report shall include a quarterly rollup of the issues and resolutions discussed during the weekly teleconference meetings.

The Contractor shall define and report on key issues and metrics, to include performance, cyber resiliency, time to detect, time to investigate, time to mitigate, false positive, and false negative metrics as the basis to evaluate goal achievement.

Deliverables:

A. Weekly Activity Report (WAR) B. Weekly Work Breakout Schedule (WBS) C. Weekly Integrated Master Schedule (IMS) D. Quarterly Status Reports

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Heuristic Behavior Analytics effort.” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with government PM/Technical Lead to prepare and submit meeting minutes to VA for approval. Once the meeting minutes are approved the contractor shall distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three (3) calendar days after the meeting.

Deliverables:

A. Draft Agenda B. Kickoff Meeting Presentation C. Meeting Minutes

UEBA olution Salient Characteristics

The Host-Based UEBA solution must deliver real-time and near-real-time cybersecurity detection, monitoring, and alert capabilities. It is a sophisticated security solution that leverages artificial intelligence (AI), machine learning (ML), and advanced analytics to identify and mitigate cyber threats and high-risk behaviors within the VA's network.

The required solution must analyze user, account, and host behaviors to detect anomalies and suspicious activities that may signify malicious intent or unauthorized access. The UEBA solution tracks and monitors actions to establish a baseline of normal behavior for all users, accounts, and hosts. It then employs AI/ML algorithms to identify deviations from this baseline that could indicate potential threats, such as data exfiltration, privilege abuse, or compromised accounts.

This comprehensive approach will enable the VA to proactively safeguard its network against cyber threats by continuously analyzing and responding to behavioral patterns indicative of security risks

Governing Policies This section states the applicable policy, guidelines, Federal regulations, directives, etc. that provides the direction for the process being followed, the guidelines being implemented, or the authority for the action to take place.

Table 1: Policy References

<hyperlinked URL to document>

1.1.1 Compliance Requirements

Compliance Requirements are general requirements that broadly apply to all systems from a CSOC perspective.

Table 2: VA Compliance Requirements

1.1.2 Visibility Requirements

These solution requirements are the capabilities determined to be necessary for the CSOC to complete its incident response mission. The requirements are divided into 2 sections: the first, General, are those requirements that all systems must adhere to, the second, Specific, are those requirements that the specific technologies must meet.

Table 3: Visibility Requirements

1.1.3 Host UEBA Requirements

Table 4: Host-based UEBA Requirements

1.1.4 Reporting Requirements

Table 5: Reporting Requirements

1.1.5 Integration Requirements

Table 6: Integration Requirements

UEBA IMPLEMENTATION, CONFIGURATION, AND CHANGE MANAGEMENT

The Contractor shall provide implementation, configuration and change management services that are consistent with VA’s standard implementation and deployment methodology and configure the HBA solution to meet all VA’s requirements as stipulated in this PWS. The Contractor shall also provide guidance on alternative approaches to minimize future customizations of the solution and provide all configuration and testing of the systems prior to deployment. All accepted guidance will require an update to the HBA Implementation Plan.

The Contractor shall provide a comprehensive UEBA Implementation Plan that encompasses all necessary requirements to establish and maintain a fully operational UEBA solution environment. This plan must support project management and cover all aspects of UEBA installation and support, including policy development, planning, testing, implementation, installation, and training at an enterprise level. Specific tasks include, but are not limited to, the deployment of User Activity Monitoring (UAM) agents across the enterprise and ensuring network interconnectivity to supporting systems.

The Implementation Plan shall include a detailed timeline for each phase, enabling effective monitoring of progress. The initial Implementation Plan is to be submitted within 30 days of the Task Order award. Any updates to the plan must be submitted within 30 days of a change and must receive approval from the COR/PM before any changes take effect.

The Contractor shall prepare a Change and Configuration Management Plan in accordance with all applicable regulatory policy and guidance. The Change and Configuration Management Plan shall contain all information relevant to defining and modifying the solution from the initial baseline configuration and subsequent re-baselining activities, all risks, potential or real, must be identified. The Change and Configuration Management Plan shall be delivered within 30 days of Task Order award and updated monthly thereafter.

The Solution shall be be deployed and implemented in three phasses with the following milestones:

a. Phase I - Implemented and Agents deployed to Test Organization (1000 agents) within 90 days of Task Order Award

b. Phase II -Validation of test Agents and Data; Rool Out to (50,000 agents) with 120 days of Task Order award

c. Phase III - Enterprise Rollout III Approximately 600,000 Agents (Enterprise) with 150 days of Task Order Award.

Deliverables:

A. Enterprise Implementation of UAM Agents B. UEBA Implementation Plan C. Change and Configuration Management Plan

ENGINEERING SUPPORT

The Contractor shall provide engineering support to the CSOC and assist the CSOC in establishing processes to provide continual analysis of heuristic behaviors by defining and providing normal baselining behavior of UEBA solutions and traffic patterns of NTAR solutions. The Contractor shall assist the CSOC in understanding the Alerts generated by anomalies to solution defined patterns and algorithms and ensure they are forwarded to the appropriate security devices such as SOAR and SIEM or analyst. The contractor shall provide direct engineering support for capacity expansion as required. The contractor must support and ensure that the solution operation and future implemented deployments continue to meet at a minimum all the requirements established in Appendix B.

CUSTOMER SERVICE SUPPORT

The Contractor shall provide 24/7/365 customer service phone support, Internet accessible Operating System (OS)/application patch update support, and 24-hour appliance Return Merchandise Authorization (RMA) support. Any telephone support provided by the Contractor shall be at no additional cost. Unresolved support issues will be elevated to the VA Enterprise Service Desk for submission of a service ticket. The Contractor shall also provide input and technical support to VA help/service desks on all layers until resolution.

TESTING

The Contractor shall provide pre-deployment testing. The Contractor shall be responsible for performing all testing activities related to the deployment and use of the HBA solution. The testing must ensure that all changes associated with a patch or upgrade are validated as safe against the entirety of the HBA system, VA, and Governance Requirements. The Contractor shall deliver testing results to the Government for approval that demonstrate that the any hardware and software changes compliant with all PWS requirements as outlined in section 5.2 and Appendix B. The Contractor shall perform the following testing to include functional, accessibility, system, reliability, usability, interoperability, regression, security, and performance of the system. The Contractor shall provide the Test Report prior to deployment in the production environment. Deployment to production environment will commence after government review of test results.

Deliverable:

A. Test Report

DISASTER RECOVERY

The Contractor shall provide a Comprehensive Disaster Recovery Plan (DRP) to include Recovery of Data, Recovery of Application, Recovery of Connections, and Recovery to full operational status post failure or validate the existing DRP. The plan must define and ensure capabilities exist to recover local, multi-site, muti-cloud. Identify techniques to ensure full data recovery post failure and establish how continuous data protection will be achieved.