RFI Attachment 1 - Draft PWS.docx

Performance Work Statement (PWS) for Procurement Security Platform

GENERAL

INTRODUCTION

The mission of the Office of Personnel Management (OPM) is to be a champion of talent for the Federal government, and we endeavor to position the Federal government as a model employer that empowers our workforce to solve our nation's toughest challenges. The mission of the Office of the Chief Information Officer (OCIO), Cybersecurity Division’s (CSD) mission is to achieve full visibility of OPM’s systems and processes to ensure compliance and risk reduction activities to meet OPM’s risk tolerance. CSD oversees the implementation of The Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST) Risk Management Framework, Cybersecurity and Infrastructure Security Agency’s (CISA) Binding Operational and Emergency Directives, and Office of Management and Budget (OMB) Directives and memos. Operations support provides critical day-to-day operations and maintenance of services used by our customers routinely, from cloud Microsoft 365 to application support, to on-premises server maintenance. The organization is geographically dispersed across primary locations in Washington DC, Boyers, Pennsylvania, and Macon, Georgia.

This requirement is for the acquisition of a Procurement Security Platform tool for cyber supply chain, that will allow OPM/OCIO/CSD to continue to protect, monitor and safeguard OPM’s data, mission, and people.

PURPOSE

The purpose of this requirement is to obtain a cyber supply chain Software As A Service (SAAS) tool with service applications that perform real time sharing of system vulnerabilities in order to improve the overall security posture of the Agency. The software and support services will provide for continuous vulnerability discovery and assessment of OPM systems and applications for both existing and new vulnerabilities. It will be in support of Enterprise Network, Security Operations Center (SOC) and Enterprise Monitoring Solutions.

OBJECTIVES

OPM OCIO/CSD’s overall goal is to provide world-class vulnerability protection that guard OPM’s mission and data by providing real time management of operational security controls that protect all OPM users, applications, and mission critical data from potential threats with real time incident response processes which challenge constantly evolving cybersecurity threats.

SCOPE OF WORK

This acquisition will assist the Cybersecurity Division to develop and deploy world-class vulnerability protection, that guards the mission and data to manage and operate the cyber supply chain. The contractor will provide the tool to the government in a method that can be easily deployed and/or implemented by the government.

The Cybersecurity Division is the customer and/or end user of the product. OCIO will be using this tool within the OPM environment to safeguard our networks. The customer is currently using federally provided and private sector vulnerability announcements, given via opensource and through agency channels, which is currently not real time, which can result in delayed responses to incidents. This acquisition will increase the timeliness of patching vulnerabilities, through real time notifications and will result in a lower chance of exfiltration of data from OPM’s environment. Under Strategic Goal 2.5, OPM seeks to modernize IT by establishing an enterprise-wide approach, eliminating fragmentation, and aligning IT investments with core mission requirements.

OPM requires a FEDRAMP Certified, Software As A Service (SAAS) research and management platform that with reasonable confidence validates vendors’ supply chains utilized by OPM are not developed or have parts developed or manufactured in adversarial nations and or in non-compliant countries. The product will provide world-class vulnerability protection for operational security controls with continuous real time updates.

TYPE OF CONTRACT CONTEMPLATED

The Contract will be Firm-Fixed-Price.

PERIOD OF PERFORMANCE

The period of performance of this contract is for 12-months from date of award.

The Period of Performance for this contract is expected to begin around August 31, 2024 –August 30, 2025.

PLACE OF PERFORMANCE

The tool will be deployed in the cloud and kept in a method that can be easily deployed and/or implemented by the government.

SPECIFIC REQUIREMENTS/TASKS

The SAAS security platform must be compliant with the following features:

· Vendor risk assessments: Evaluate and assess the cybersecurity risks associated with each vendor in the supply chain.

· Supply Chain Visibility: Provide real-time visibility into the entire supply chain, including suppliers, manufacturers, distributors, and partners.

· Threat Detection and Monitoring: Continuously monitor the supply chain for potential cybersecurity threats and anomalies

· Data Encryption: Encrypt sensitive data transmitted across the supply chain to protect it from unauthorized access.

· Authentication and Access Control: Implement strong authentication measures and access controls to ensure that only authorized individuals can access critical supply chain data and systems.

· Compliance Management: Ensure compliance with relevant cybersecurity regulations and standards, such as GDPR, HIPAA, or ISO 27001.

· Incident Response: Have protocols in place to respond quickly and effectively to cybersecurity incidents or breaches within the supply chain.

· Auditing and Reporting: Generate reports and conduct audits to track and monitor cybersecurity practices within the supply chain.

· Supplier Performance Monitoring: Monitor the cybersecurity performance of suppliers and vendors to ensure they meet security standards and requirements.

· Supply Chain Risk Management: Identify, assess, and mitigate cybersecurity risks throughout the supply chain to minimize potential disruptions or vulnerabilities.

· FEDRAMP Certified

· 508 Compliant

DELIVERABLES

Procurement Security Platform Deliverables

Kickoff Meeting All identified personnel, as well as a representative from the Contractor's contracts organization, are required to attend. The intent of the kickoff is for all key personnel to meet to discuss the tool’s overall technical and contractual requirements.

Within 7 calendar days following award or as agreed to by the COR.

Planning and Management This task will result in the creation of a comprehensive project plan, outlining the timeline, resources, and stages for the implementation of the Procurement Security Platform

Initial Draft due 2 weeks after the procurement.

Status Reports The Contactor shall provide a comprehensive monthly status report. The monthly status report shall include at a minimum the following: Risks and issues (technical, management, contractual) and corresponding mitigations or remedies

Monthly report - No later than the 7th of each month.

Monitoring and Scaling The deliverable for this task will be a comprehensive monitoring report, detailing the performance of the tool and the adjustments made to meet demands.

This report will be delivered at the end of each month of project initiation.

Training and Upskilling The deliverable for this task will be a series of training sessions and best practices guides related to Procurement Security Platform

Training sessions provided to the program office by the end of the first month, in the first year of contract.

Post-Implementation Support This task will result in ongoing maintenance, troubleshooting, and optimization of the tool, from PoC, to Pilot, to Production use. The deliverable will be a detailed report on the support provided, as well as responses to user queries and issues.

This report will be delivered at the end of the third month of project initiation.

Documentation The deliverable for this task will be detailed documentation of the solutions, including architecture designs, implementation guides, and user manuals as necessary for the tool

These documents will be delivered at the end of the first month of procurement

OPERATING CONSTRAINTS

FEDERAL INFORMATION SECURITY MODERIZATION ACT (FISMA)

The solution should comply with the Federal Information Security Modernization Act (FISMA) of 2014, with fundamental security controls implemented at the Moderate Categorization Level as defined by National Institute of Science and Technology (NIST) Special Publication (SP) 800-53 Revision 4, “Security and Privacy Controls for Federal Information Systems and Organizations”, April 2013.

FEDERAL RISK AND AUTHORIZATION MANAGEMENT PROGRAM (FEDRAMP)

If the proposed solution is cloud-based the provider should assure that all compliance measures of the Federal Risk and Authorization Management Program (FedRAMP) are met. If the solution (or portion of the solution) is already FedRAMP Authorized please provide the Service Model, Impact Level, and Status of the FedRAMP Authorization.

ATTACHMENTS

1. Products Requirements Checklist