RFI 47QFRA23K0012 Attachment B - Initial Capability Deployment Plan.pdf

Attachment B – Initial Capability Deployment Plan

Introduction

The CDM capabilities initially targeted for implementation via the Deployment Services contract base year are listed below. This list is a snapshot at the time of this Request for Information (RFI) and is anticipated to evolve prior to contract solicitation as agency environments and their needs are dynamic. Capabilities are anticipated to be net new to some agencies and an expansion of existing capabilities at other agencies.

For further information regarding each CDM capability / capability area, please reference the latest CDM Technical Capabilities, Volume 2 document.

Capabilities

A. Asset Management

Description:

Perform planning, design, procurement, implementation, and/or transition activities as necessary to achieve a complete, functional Asset Management capability(s) across all agency in-scope assets. Targeted data from new Asset Management capabilities will need to be integrated into an agency’s CDM solution reporting, specifically for its Master Device Record (MDR).

The CDM Asset Management capability area addresses “What is on the Network?” and focuses on identifying and monitoring agency devices, ensuring that they are properly configured, and that vulnerabilities have been identified and remediated. The Asset Management capability area consists of the Hardware Asset Management (HWAM), Software Asset Management (SWAM), Configuration Settings Management (CSM), Vulnerability Management (VUL), and Enterprise Mobility Management (EMM) capabilities. Note: EMM is covered in “Mobile Tool Deployment” below.

Each Asset Management capability is summarized as follows:

1. HWAM discovers and manages Internet Protocol (IP) addressable devices on the network.

2. SWAM discovers and manages the software installed on devices on the network.

3. CSM identifies and manages the security configuration settings for devices (and the associated installed software) on the network.

4. VUL discovers and supports remediation of the vulnerabilities in software installed on devices on the network.

5. EMM secures the use of agency mobile devices.

Agency Sizing Parameters:

Size FISMA 1.2 Endpoint Count Extra Large (XL) >200,000 Large (L) 80,000-199,000 https://www.cisa.gov/sites/default/files/2023-01/cdm-technical-capabilities-vol2-v24.pdf

Medium (M) 25,000-79,999 Small (S) <25,000

Commonly Relevant Tool Suites: Forescout, BigFix, Tenable, Carbon Black, Tanium, McAfee, ServiceNow, Microsoft

Requesting Agencies:

1. Extra Large: 2

2. Large: 3

3. Medium: 1

4. Small: 3

B. Mobile Tool Deployment

Description:

Perform planning, design, procurement, implementation, and/or transition activities as necessary to achieve a complete, functional EMM capability across all agency in-scope assets. Targeted data from new EMM capabilities will need to be integrated into an agency’s CDM solution reporting, specifically for its MDR.

EMM is a suite of services and technologies that enables an agency to secure the use of mobile devices (such as tablets, smartphones and E-readers), per an agency's policies. The mobile device management component of the EMM enforces agency security policies. The mobile application management component of the EMM provides the capability to manage software and services required for the provisioning and control of mobile applications, which are commercially available through public application stores or internally through an application catalog. The mobile identity management component of the EMM supports, depending on an agency's policy, the issuance and life cycle management of credentials provisioned on mobile devices.

Additionally, EMM needs to integrate with the Mobile Application Vetting (MAV) and Mobile Threat Defense (MTD) capabilities.

Agency Sizing Parameters for Mobile Deployments:

Size Mobile GFE Extra Large (XL) >80,000 Large (L) 20,000-79,999 Medium (M) 3,000-19,999 Small <3,000

Commonly Relevant Tool Suites: Microsoft Intune, Workspace ONE, AirWatch, MobileIron, IBM Security MaaS360

Requesting Agencies:

1. Extra Large: 0

2. Large: 2

3. Medium: 4

4. Small: 1

C. Mobile Threat Detection (MTD) Deployment

Description:

Perform planning, design, procurement, implementation, and/or transition activities as necessary to achieve a complete, functional MTD capability across all agency in-scope assets.

MTD is a sub-capability of EMM that enables an agency to detect and address malicious mobile applications, network-based attacks, improper configurations and known vulnerabilities in mobile applications or the mobile devices to protect an agency. The MTD sub-capability is scoped to provide functionality applicable to mobile devices that are in scope for CDM and have an EMM capability implemented.

Agency Sizing Parameters for Mobile Deployments:

Size Mobile GFE Extra Large (XL) >80,000 Large (L) 20,000-79,999 Medium (M) 3,000-19,999 Small <3,000

Commonly Relevant Tool Suites: CrowdStrike Falcon, Lookout, Microsoft Defender for Endpoint, Zimperium MTD

Requesting Agencies:

1. Extra Large: 2

2. Large: 0

3. Medium: 4

4. Small: 4

D. Identity and Access Management (IDAM) Work

Perform planning, design, procurement, implementation, and/or transition activities as necessary to achieve a complete, functional IdAM capability across all agency in-scope users and accounts.

Targeted data from new IdAM capabilities will need to be integrated into an agency’s CDM solution reporting, specifically for its Master User Record (MUR).

The IdAM capability area addresses “Who is on the Network?” to strengthen management of users and accounts on agency networks, in particular those with elevated privilege. IdAM capabilities focus on identifying agency users and ensuring that they have been properly vetted, trained, and authenticated. Capabilities targeted for deployment include PAM, ILM, IDaaS.

Agency Sizing Parameters:

Size FISMA 1.2 Endpoint Count Extra Large (XL) >200,000

Commonly Relevant Tool Suites: SailPoint, CyberArk, Radiant Logic, Okta, BeyondTrust

Requesting Agencies:

1. Extra Large: 3

2. Large: 2

3. Medium: 0

4. Small: 3

E. Endpoint Detection and Response (EDR) Work

Perform planning, design, procurement, implementation, and/or transition activities as necessary to achieve a complete, functional EDR capability across all agency in-scope endpoints.

The EDR capability provides cybersecurity monitoring and control of endpoint devices. EDR spans the full cybersecurity lifecycle, from the detection of events (observable occurrences in a network or system) and incidents (events that have been determined to have an impact on the organization, prompting the need for response and recovery) on endpoint devices (e.g., workstations, servers, laptops, thin clients, and virtual desktops) and users, to attack responses and incident follow-up and analysis. EDR will also enforce the agency’s EDR administrator access policy based on user attributes and provide for delegation of administrative tasks.

The EDR capability is expected to conform with MITRE’s adversary tactics, techniques, and common knowledge model (MITRE ATT&CK® matrix for enterprise) when producing alerts, reports, and/or any feedback to the administrator pertaining to observables events or artifacts on agency networks that provide Indicators of Compromise (IoCs) or Indicators of Attack (IoAs).

Some of the functionality needed by EDR may be provided by other CDM capabilities with which EDR will interface. The CDM HWAM and SWAM capabilities are complementary to the EDR capability to identify devices and installed software. Additionally, EDR may provide information to Security Information & Event Management (SIEM) and Security, Orchestration, Automation, & Response (SOAR) technology platforms, if implemented at an agency.

The following are functions of the EDR capability: configure EDR security policy; collect and manage cybersecurity-relevant endpoint events; maintain endpoint visibility; support incident analysis and response; threat hunting; maintain and report EDR data; and maintain access control.

Agency Sizing Parameters:

Size FISMA 1.2 Endpoint Count Extra Large (XL) >200,000

Commonly Relevant Tool Suites: Microsoft Defender for Endpoint, CrowdStrike Falcon, Palo Alto Cortex XDR, SentinelOne Singularity XDR, Tanium Threat Response, Trellix EDR

Requesting Agencies:

1. Extra Large: 1

2. Large: 2

F. Cloud Asset Coverage

The Cloud Security Posture Management System (CSPM) capability monitors an agency's cloud implementation, periodically checking for security and policy misconfigurations and remediating any that are found. CSPM enforces the protection of data by assuring that native (cloud-provided) and other data security controls (e.g., system hardening) are in place. CSPM maintains an updated inventory, provides location services for assets, manages the lifecycle of assets, optimizes the use of assets, tracks cloud-specific data, and performs detect/protect functionality for assets. This capability also includes integrating CSPM data feeds to the CDM dashboard where supported by the current data-target.

The objectives are to:

1. Ensure Federal Civilian Executive Branch (FCEB) agencies have a CSPM capability to effectively support early detection and remediation of misconfigurations of cloud assets that could lead to unauthorized access to sensitive information.

2. Assist in identifying the inventory of cloud assets in use by FCEB agencies.

Agency Sizing Parameters:

Size FISMA 1.2 Endpoint Count Extra Large (XL) >200,000 Large (L) 80,000-199,000

Commonly Relevant Tool Suites: Microsoft Azure, Amazon Web Services, Google Cloud

Requesting Agencies:

1. Extra Large: 2

2. Large: 1