RFI-CFPB-23-037.pdf

RFI-CFPB-23-037

REQUEST FOR INFORMATION

CYBERSECURITY SUPPORT SERVICES BPA

This Request for Information (RFI) is issued by Fiscal Service Procurement on behalf of the Consumer Financial Protection Bureau (CFPB) to find a viable vendor pool for Cybersecurity Support Services. VENDORS MUST

REVIEW THE ENTIRE REQUIREMENT AND SHALL ONLY RESPOND IF FULLY CAPABLE OF

SATISFYING ALL ASPECTS OF THE REQUIREMENT.

I. SCOPE SUMMARY (see PWS for full requirement)

The Contractor shall perform all task areas as required in support of planning, development, documentation, scheduling, and implementation of an Information Systems Security Program as directed by the Government.

Working in conjunction with members of the CFPB staff and other Contractor personnel, the Contractor may be required to assist in the following:

(1) Maintaining and operating a comprehensive information system security program and supporting technologies;

(2) Analyzing the posture of information security across the CFPB enterprise and providing recommendations for improvements;

(3) Providing operational monitoring, technical analysis, timely incident response, and effective remediation; and,

(4) Adapting to changes in the technology as well as risk and compliance requirements.

The Contractor shall provide support to the CFPB Cybersecurity team as directed by the Government. These modes include participation in team meetings and teleconferences, informal and formal briefings supported with appropriate audio-visual aids, written briefs and point papers, technical analyses and comparative studies, and formal documents delivered in CFPB-prescribed format. In addition, the Contractor shall provide operational security monitoring of CFPB systems. The Contractor shall demonstrate knowledge of US federal information security legislation, policies, directives, and practices and use that knowledge to systematically apply expertise and experience to inform, promote, and enhance the CFPB’s Cybersecurity program.

The purpose of this acquisition is to obtain Cybersecurity support to satisfy new and existing needs for Cybersecurity program management, risk management, engineering, architecture, and operational monitoring/analysis/response. The Contractor shall assist in the maintenance, operation and improvement of a Cybersecurity program consisting of all the following component task areas:

• CISO-COR Support

• Cybersecurity Program Management (CPM) Support

• Cybersecurity Safeguards and Risk Management (SRM) Support

• Security Architecture and Engineering (SAE) Support

• Cybersecurity Operations Support

The BPA(s) to be established shall be for non-personal services to provide Cybersecurity Services to the CFPB.

The contractor shall provide all personnel and items necessary to perform the functional and technical support described in this PWS. The contractor shall perform all tasks identified in the PWS.

II. ANTICIPATED PERIOD OF PERFORMANCE

The anticipated Period of Performance will include one (1) 12-month base year and four (4) 12-month option years.

III. ADDITIONAL DETAILS

NO SOLICITATION IS AVAILABLE. A request for more information, or a copy of the solicitation, will not be considered an affirmative response to this Sources Sought notice. Telephone responses or inquiries to this Sources Sought notice will NOT be accepted.

It is anticipated that Small Business Participations Plans will be requested of the interested offerors as part of the solicitation. Prior to issuance of an award, Small Business Participation plans will be reviewed as part of the technical evaluation process.

Fiscal Service will consider written responses received no later than 10:00 AM EST, Monday, February 27, 2023.

Responses must be submitted electronically to purchasing@fiscal.treasury.gov, Attn: Sanner/White Ref, RFI- CFPB-23-037. Vendor responses must include sufficient evidence that clearly shows the proposed services are capable of meeting all the aspects of the requirement as described within this RFI.

Qualified contractors must provide the following:

1. The name and location of your company, contact information, and identify your business size and socioeconomic category (Large Business, Small Business, Disadvantaged Business, 8(a), Service Disabled Veteran Owned Small Business, HubZone, etc.). Please ensure contact information includes the name of the point of contact, email address, and telephone number should the Government have questions regarding individual responses.

2. Whether your services are available through a Government contract vehicle or Open Market.

3. A brief capabilities statement (not to exceed 5 pages) that includes a description of your company's standard line of business, as well as a list of customers for which your company currently provides these services.

4. UEI Number.

The following file extensions are not allowable and application materials/data submitted with these extensions cannot be considered: .bat, .cmd, .com, .exe, .pif, .rar, .scr, .vbs, .hta,, .cpl, and .zip files.

Microsoft Office compatible documents are acceptable.

No other information regarding this Sources Sought notice will be provided at this time.

This notice does not restrict the Government to an ultimate acquisition approach. All firms responding to this notice are advised that their response is not a request that will be considered for contract award. All interested parties will be required to respond to any resultant solicitation separately from their response to this notice, should one be issued.

CFPB CYBERSECURITY SUPPORT SERVICES III

Blanket Purchase Agreement (BPA) Performance Work Statement

1.0 OVERVIEW/BACKGROUND

On July 21, 2010, President Obama signed the Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Act"), which created the Bureau of Consumer Financial Protection (CFPB).

Under the Act, part of CFPB’s mission is to establish and enforce clear, consistent rules for the financial marketplace, protect American families from unfair financial practices, and develop and implement a strategy to improve the financial literacy of consumers. For more background on the CFPB, please see http://www.consumerfinance.gov/the-bureau/.

In July 2011, the CFPB became operationally independent as a Bureau. To assist CFPB in sustaining and maturing business and Information Technology (IT) processes, continued Contractor support is warranted to leverage industry leading practices and innovations to meet the growing demands from internal and external customers for secure, reliable, and timely customer-centric solutions.

The E-Government Act (Public Law 107-347) passed by the 107th Congress, and signed into law by the President in December 2002, recognized the importance of information security to the economic and national security interests of the United States. Title III of the E-Government Act entitled the Federal Information Security Modernization Act of 2014 (FISMA) which requires each federal agency to develop, document, and implement an agency-wide information technology security program to provide safeguards for the information and systems supporting agency assets and operations, including those provided or managed by another agency, Contractor, or other source. To meet FISMA requirements, several special publications, standards, and guidelines were created by the National Institute of Standards and Technology (NIST) detailing risk management methodologies for security assessment, continuous monitoring, and security authorization.

As a steward of sensitive information, the CFPB has fiduciary responsibility and requirements under applicable laws and regulations to protect and safeguard the information by instituting an information security program. The CFPB seeks Contractor support to establish, manage, and operate a CFPB Cybersecurity program. This Performance Work Statement (PWS) is being issued to establish one or multiple Blanket Purchase Agreements (BPAs) awards to assist the CFPB in satisfying the demand for Cybersecurity services to secure cloud services, infrastructure, and applications; and to achieve and maintain information security compliance for the Bureau.

http://www.consumerfinance.gov/the-bureau/

2.0 SCOPE

The Contractor shall perform all task areas listed in this PWS in support of planning, development, documentation, scheduling, and implementation of an Information Systems Security Program as directed by the Government.

Working in conjunction with members of the CFPB staff and other Contractor personnel, the Contractor may be required to assist in the following:

(5) Maintaining and operating a comprehensive information system security program and supporting technologies;

(6) Analyzing the posture of information security across the CFPB enterprise and providing recommendations for improvements;

(7) Providing operational monitoring, technical analysis, timely incident response, and effective remediation; and,

(8) Adapting to changes in the technology as well as risk and compliance requirements.

The Contractor shall provide support to the CFPB Cybersecurity team as directed by the Government. These modes include participation in team meetings and teleconferences, informal and formal briefings supported with appropriate audio-visual aids, written briefs and point papers, technical analyses and comparative studies, and formal documents delivered in CFPB-prescribed format. In addition, the Contractor shall provide operational security monitoring of CFPB systems. The Contractor shall demonstrate knowledge of US federal information security legislation, policies, directives, and practices and use that knowledge to systematically apply expertise and experience to inform, promote, and enhance the CFPB’s Cybersecurity program.

The purpose of this acquisition is to obtain Cybersecurity support to satisfy new and existing needs for Cybersecurity program management, risk management, engineering, architecture, and operational monitoring/analysis/response. The Contractor shall assist in the maintenance, operation and improvement of a Cybersecurity program consisting of all the component task areas outlined in Section 3.0 below.

3.0 TASK AREAS

The Contractor shall provide high quality technical, engineering, analytical, and planning support to achieve the requirements of this PWS. As determined by the CFPB, the Contractor may be required to interface with system integration Contractors, equipment manufacturers, business units within CFPB and other U.S. Government organizations.

3.1 CISO-COR Support

3.1.1 Program Management Support

The Contractor shall provide program management support. This support may be through a stand-alone Program Manager (PM) or a Task Lead supporting other tasks on this Order/Call. The PM shall oversee all active tasks awarded under this Order/Call and shall also perform the following functions:

• Serve as the primary point of contact for collaboration with the Chief Information Security Officer (CISO) and Contracting Officer’s Representative (COR) or Alternate COR (ACOR);

• Ensure CFPB goals are communicated to the task area supporting personnel; and,

• Provide guidance, support, and supervision to their Contractor task area leads to ensure:

o Personnel are properly prioritizing tasks and responsibilities, o Proper allocation and scheduling of tasks, o Quality verification/validation of deliverables prior to submission to the CFPB;

and, o Compliance with CFPB timelines and deadlines for deliverables.

The PM shall electronically submit a monthly status report that summarizes all activities related to management of this Order/Call to the COR and ACOR. The Contractor should also be prepared at the COR’s request to provide a verbal briefing to the Government on the subject matter contained within the report. The written report shall contain:

1) a list of deliverables submitted during that reporting period to include their expected and actual delivery dates (the Contractor may summarize the daily deliverables into a single line item but must identify any instances of late delivery);

2) a financial overview of the Order/Call including invoiced and remaining obligated funding amounts to date;

3) list the status of all positions including vacancies, start dates, and end dates of departing personnel, and any relevant notes;

4) a table of travel requests, approvals/denials, and relevant details (traveler name, location, purpose, dates, total cost, etc.); and

5) a description of any substantive risks/challenges and recommended resolutions.

The Contractor shall ensure that qualified personnel are available to perform work under all awarded task orders. For key personnel who leave the program, to include those outside of the Contractor’s control (e.g., resignations), the Contractor shall provide one or more qualified replacement candidate resumes within 15 business days of departure.

Contractor will ensure key positions are filled within 30 business days from date of CFPB Personnel Security approval.

Deliverable(s):

• Monthly Contract Status Report

• Key Personnel Availability

3.1.2 Strategic Cybersecurity Planning Support

The Contractor shall provide support to the CISO and Federal Cybersecurity Team Leads to facilitate a multi-year view of emerging cybersecurity developments. This includes but is not limited to analysis of Federal cybersecurity legislation, Executive Orders, CISA Directives, OMB Memoranda, and cross-agency initiatives. This also includes thought leadership, corporate reach-back, subject matter expert briefings, benchmarking, strategy workshop facilitation, and other information sharing engagements to assist the Bureau in ensuring our long-term capabilities to protect consumers remain secure as they evolve.

Based on the analysis of the industry and federal cybersecurity space, the Contractor shall prepare recommendations for the Bureau’s consideration that estimates the cyber landscape for a two-year, five-year, and ten-year horizon (such as the McKinsey three-horizon approach). The Contractor shall provide input into the refinement of Cybersecurity Objectives and Key Results (OKRs) that align with the high-level objectives of

Cybersecurity’s parent organization and the Bureau at large. The Contractor should also provide recommendations for strategic Cybersecurity metrics that accurately measure the successful implementation of key areas of the program and provide analysis of the results to further enhance the program. These metrics are intended to support the aspirational objectives of the organization, inform security architecture and operations decisions, and refocus effort on specific thematic elements that promote security in executing the CFPB’s mission.

Deliverable(s):

• Semi-Annual Cybersecurity Strategic Planning Report

• Recommended Objectives and Key Results (OKRs)

• Recommended Cybersecurity Metrics

3.1.3 CISO Support (OPTIONAL)

The Contractor shall compile the Cybersecurity Executive Status Report, including data collection from other teams within the office of Cybersecurity and final report production/delivery. The Contractor shall provide specialized support to the CISO and develop artifacts for several key activities intended to coordinate the various functions of subordinate teams reporting to the CISO. The Contractor shall provide the following services:

1) Coordination of administrative functions necessary to serve and support the Office of Cybersecurity, primarily the CISO and Cybersecurity Team Leads; (OPTIONAL)

2) Providing personnel tracking for on-boarding all employees, including, but not limited to, participating in on-boarding Human Capital activities, coordinating requests to issue equipment to contractor personnel, and arranging for badging; (OPTIONAL)

3) Serving in an administrative support capacity for the Office of Cybersecurity using a wide variety of technologies and platforms, including, but not limited to, Microsoft Office Suites. Proficiency is required in Adobe Activate, Tableau, JIRA, Outlook, Teams, SharePoint, Word, Excel, Power Point, Power BI, Planner; (OPTIONAL)

4) Provide documentation to support CISO and team leads to include but not limited to slides, graphics, and recognition/certificates (OPTIONAL)

Deliverable(s):

• Cybersecurity Executive Status Report

• Cybersecurity Executive Briefings

• Cybersecurity Meeting Minutes

3.2 Cybersecurity Program Management (CPM) Support

The Contractor shall provide information security support to the CFPB Cybersecurity Program Management (CPM) team. In providing this support, the Contractor may participate as a member of a Government-led team or act independently in an advisory capacity as information security Subject Matter Expert (SME). Cybersecurity program support that the Contractor shall provide includes, but is not limited to the subtasks described below.

The Contractor shall provide meeting minutes for all meetings that they are in attendance that document attendees, purpose, discussion, and actions from the meeting to be delivered one business day after the meeting and saved to a centralized location. The

Contractor shall ensure meeting minutes are provided for all meetings that occurred for each subtask in support of CPM.

The Contractor shall develop applicable communication for each subtask below and deliver in accordance with the CPM Communication Plan that the Contactor shall develop. The Contractor shall ensure communications are relevant, accurate, and, free from major grammatical and formatting errors.

• Key Personnel Availability

• Cybersecurity Meeting Minutes

• Cybersecurity Communications

3.2.1 Cybersecurity Project Management Support

The Contractor shall provide project management support to Cybersecurity projects and major initiatives to ensure the Office of Cybersecurity functions as a single unified organization supporting the direction provided by the CISO and Cybersecurity Team Leads. The Contractor shall work independently and collaboratively in a dynamic, deadline-driven environment to perform day-to-day coordination of overall support functions collaboratively with the other task managers, possibly involving multiple projects and groups of personnel at multiple locations.

The Contractor shall effectively handle multiple projects and business partners simultaneously while maintaining important particulars and details. The Contractor shall organize, direct, and coordinate the planning and production of all support activities; demonstrate strong written and oral communication skills; establish and adjust (as necessary) structure to align with Order/Call support activities. The Contractor PM/Task Lead may also participate as a member of a Government-led team or act independently in an advisory capacity as information security SME with regards to project management. The Contractor shall prepare requisite review documentation and presentations as well as conduct briefings on behalf of the Cybersecurity team.

The Contractor shall assist with special projects assigned to the Office of Cybersecurity. The Contractor shall research, analyze, lead, and implement efforts across various stakeholders to comply with existing or emerging requirements. The Contractor shall report the status of the special projects regularly and timely. The Contractor shall coordinate Cybersecurity activities related to Chief Information Officer (CIO) metrics. The Contractor shall develop reports, dashboards, and other briefs to ensure stakeholders are aware of the status of the special project and documentation is consistent with CFPB styles, professional, and clear to all intended users. The Contractor shall ensure all work products produced by the Office of Cybersecurity are accurate, complete, concise, and professionally presented.

The Contractor shall implement changes to existing or emerging federal requirements and CFPB process improvements to include but is not limited to cybersecurity supply chain risk management, Executive Orders, Binding Operational Directives, etc. When the Cybersecurity team is called on to respond to newly proposed information security directives and similar policy documents, the Contractor shall assess the impact of these changes on a respective program and draft responses for review, approval, and submission by appropriate Government personnel.

The Contractor shall facilitate external reporting within the Office of Cybersecurity. This may include but is not limited to Office of Management and Budget (OMB) Data Calls, Department of Homeland Security (DHS) Binding Operational Directives, DHS Cybersecurity and Infrastructure Security Agency (CISA) Emergency Directives, CIO and CISO Council data requests and others. The Contractor shall facilitate external reporting through Technology & Innovation (T&I) Clearance processes.

The Contractor shall provide information security subject matter expert liaison to clarify and promote identification and implementation of the best value solutions to security related requirements and risks. The Contractor shall participate as directed in formal and ad hoc meetings and working groups representing the Cybersecurity team and/or coordinate specialized expertise within the Office of Cybersecurity as needed to adequately address the subject matter.

The Contractor shall provide Cybersecurity program-level analysis and planning strategies to improve resource planning, efficiency, and costs by clarifying priorities while supporting integrated projects and enterprise solutions. The Contractor shall support efforts to improve information security practices and actively coordinate within T&I project management and governance processes to participate in planning to assure security related requirements (personnel, equipment, networks/services, and data) and risks are identified and planned for in a comprehensive and cost-effective manner.

• Cybersecurity Communication Plan

• CIO Cybersecurity Scorecard

• Executive Order Status Reports

• Cybersecurity Status Reports

• Cybersecurity Metric Reports

• Cybersecurity Project Dashboards and Briefs

• CPM Project Management Standard Operating Procedures

• OMB, CISA, and other Data Call Responses

3.2.2 Cybersecurity Project Management Surge Support

The Contractor shall provide additional personnel for future periods of unknown duration requiring a surge in work under this subtask. The COR will notify the Contractor if such services are needed and will provide relevant information as available to inform the Contractor of approximate scope and duration of the work. This surge support will be predicated by an increased need. Deliverables will be the same as 3.2.1 subtask.

3.2.3 Cybersecurity Policy, Directive, Process, Procedure and Communication Development Support

The Contractor shall follow CFPB and T&I document development and management templates and processes to assist in the development, review, and/or updating of Cybersecurity business writings such as, but not limited to, policies, directives, processes, procedures, and communications documents. The Contractor shall facilitate the review of Cybersecurity business writings and adjudicate comments in a timely manner. The Contractor shall develop and coordinate communication plans for new publications, their reviews, and updates. In addition, the Contractor shall support the Cybersecurity team in aligning and maintaining consistency of information security requirements defined in or derived from program policies and other business writings.

The Contractor shall recommend and implement document management processes for storing, tracking, posting, and managing the flow of electronic files (e.g., MS Word, MS Excel, MS PowerPoint, PDF, electronic images of paper-based information captured using a document scanner, SharePoint, etc.) through their lifecycles. The Contractor shall also provide technical writing and editing support to ensure all Program-level documentation is consistent with CFPB styles, professional, and clear to all intended audiences. The Contractor shall ensure all work products produced by the Office of Cybersecurity are accurate, complete, concise, professionally presented, and complies with federal, CFPB, and T&I business writing requirements. The Contractor shall develop presentations and deliver briefs on new policy requirements or updates to existing policies to CFPB leadership. The Contractor shall maintain or create new CPM policy management standard operating procedures.

Deliverable(s):

• Cybersecurity Policies, Directives, Processes, Procedures, and Communications

• Cybersecurity Document Management Schedule

• Cybersecurity Document Management Tracker

• CPM Policy Management Standard Operating Procedures

• Cybersecurity Policy Briefs and Presentations

3.2.4 Cybersecurity Policy, Directive, Process, Procedure and Communication Development Surge Support

The Contractor shall provide additional personnel for future periods of unknown duration requiring a surge in work under this subtask. The COR will notify the Contractor if such services are needed and will provide relevant information as available to inform the Contractor of approximate scope and duration of the work. This surge support will be predicated by an increased need. Deliverables will be the same as 3.2.3 subtask.

3.2.5 Cybersecurity Audit and Compliance Support

The Contractor shall support the Cybersecurity team with audit and oversight related activities to include but not limited to requesting and responding to inquiries and requests for artifacts or interviews in a timely manner, tracking audit responses and artifacts, facilitating and leading audit related meetings with stakeholders, coordinating technical scanning efforts, drafting audit-related responses on behalf of the CFPB, analyzing findings and reports, and providing input to CFPB responses, tracking recommendations and findings, and contributing analysis and support to resolution of findings. The Contractor shall track for audit responses in a timely manner.

The Contractor shall collaborate with various personnel as needed to produce effective Corrective Action Plans (CAPs) and Notice of Findings and Recommendations (NOFRs) related to Cybersecurity efforts, collect input as needed to update those CAPs/NOFRs, and ensure their timely delivery. The Contractor shall also provide analysis of Audit recommendations to determine systemic issues or other trends that may require additional leadership attention.

The Contractor shall facilitate external reporting within the Office of Cybersecurity. This may include but is not limited to CyberScope data collection and reporting, FISMA Report submissions, drafting business writing for FISMA reporting , and facilitating FISMA vulnerability scanning effort.

The Contractor shall also advise the Cybersecurity team on pertinent developments in federal information security policy as it pertains to CFPB to include monitoring and staying abreast of applicable Cybersecurity statues, regulations, and federal doctrine. When the Cybersecurity team is called on to respond to newly proposed information security directives and similar policy documents, the Contractor shall assess the impact of these changes on a respective program and draft responses for review, approval, and submission by appropriate Government personnel. The Contractor shall advise the Cybersecurity team on relevant changes and updates that affect the CFPB’s information system policies and enterprise. In addition, the Contractor shall raise such developments to the attention of the COR/ACOR and designees within the Cybersecurity team and promote sufficient detail such that the change and potential impacts are understood to assure they are properly addressed. The Contractor shall maintain or create new CPM audit management standard operating procedures.

Deliverable(s):

• Audit Responses

• Corrective Action Plans (CAPs)

• Notice of Findings and Recommendations (NOFRs)

• Audit Activities Trackers

• FISMA Reporting

• Audit Analysis and Summaries

• CPM Audit Management Standard Operating Procedures

3.2.6 Cybersecurity Policy, Directive, Process, Procedure and Communication Development Support Surge Support

The Contractor shall provide additional personnel for future periods of unknown duration requiring a surge in work under this subtask. The COR will notify the Contractor if such services are needed and will provide relevant information as available to inform the Contractor of approximate scope and duration of the work. This surge support will be predicated by an increased need. Deliverables will be the same as 3.2.5 subtask.

3.2.7 Technology & Innovation Audit and Compliance Support

Contractor shall support the Technology & Innovation (T&I) Office with audit and oversight related activities to include, but not limited to responding to inquiries and requests for artifacts in a timely manner, tracking of communications and artifacts, analyzing findings and reports, and providing input to Bureau responses, tracking recommendations and findings, and contributing analysis and support to resolution of findings. The Contractor shall collaborate with various internal and external personnel as needed to produce effective CAPs and NOFRs related to T&I operations and collect input as needed to update those CAPs/NOFRs and ensure their timely delivery. The status of the CAPs and NOFR should be presented in the Governance, Risk, and Compliance Committee meetings.

Contractor shall also advise T&I Leadership on pertinent developments in applicable Federal Laws, Policies, and Regulations federal as it pertains to CFPB to include monitoring and staying abreast of applicable Cybersecurity statues, regulations, and federal doctrine.

When the T&I is called on to respond to newly proposed information security directives and similar policy documents, the Contractor shall assess the impact of these changes on a respective program and draft responses for review, approval, and submission by appropriate Government personnel. The Contractor shall advise the T&I Leadership on relevant changes and updates that affect the Bureau’s information system policies and enterprise. In addition, the Contractor shall raise such developments to the attention of the COR/ACOR and designees within the T&I Operations Team and promote sufficient detail such that the change and potential impacts are understood to assure they are properly addressed.

• Audit Report Responses

• Corrective Action Plans (CAPs) and Notice of Findings and Recommendations

(NOFRs) Updates

• Audit Activity Tracker (Internal Controls (IC), OIG, GAO, etc.)

• Governance, Risk, and Compliance Committee Report

• Audit After Action Review (AAR) Summaries

3.2.8 Technology & Innovation Audit and Compliance Surge Support

The Contractor shall provide additional personnel for future periods of unknown duration requiring a surge in work under this subtask. The COR will notify the Contractor if such services are needed and will provide relevant information as available to inform the Contractor of approximate scope and duration of the work. This surge support will be predicated by an increased need. Deliverables will be the same as 3.2.7 subtasks.

3.2.9 Cybersecurity Workforce Development

The Contractor shall maintain, provide recommendations, and further develop a Cybersecurity Workforce Development program consistent with agency requirements. The Contractor shall perform activities that include but is not limited to planning and implementing cybersecurity events (e.g., all-hands, CyberStar), initiatives, conferences, workshops and logistics, developing content, surveys, briefs, and communications, developing campaigns and conducting training sessions, tracking and monitoring progress of employee and Contractor staff completion of New Hire Training, Annual Cybersecurity Awareness Training, and blocking users due to noncompliance, updating Cybersecurity wiki pages, and report metrics as required. The Contractor shall have skills in KnowBe4, Adobe Activate, MS Power BI, SharePoint, MS Excel, MS PowerPoint, and Tableau.

In addition, the Contractor shall support efforts by the CFPB to raise general awareness of information security concerns, survey progress of the workforce development programs, and promote good information security practices. This includes but is not limited to briefing new hire employees orientation regularly, designing and administering phishing exercises, administrating and reporting metrics for the Cybersecurity incentive program (CyberStar) in a timely manner; planning, preparing, and implementing activities in support of Cybersecurity Awareness Month, and preparing content for the Cybersecurity Tip of the Week.

The Contractor shall develop a strategy and deliver a specialized training program (Cybersecurity Role-based Training) consistent with CFPB and federal requirements. The Contractor shall perform activities that include but is not limited to developing or identifying relevant training curriculum, mapping the applicable CFPB population to the applicable NICE work role, facilitate and deliver instructor-led training, develop, distribute, and analyze results from a skills gap survey in a timely manner, track and block users who are non-compliant, provide reports as needed, and make recommendations to improve the facilitation of this program. The Contractor shall maintain or create new workforce development management standard operating procedures and process documents.

• Cybersecurity Workforce Development Presentations and Materials

• Cybersecurity Workforce Development Metrics and Status Reports

• Cybersecurity Events and Conferences

• Cybersecurity Tips of the Week

• Cybersecurity Workforce Development Programs Customer Feedback and Skills Gap Surveys

• Cybersecurity Mandatory Compliance Training Campaigns

• Cybersecurity Role-Based Training Fiscal Year Strategy

• Cybersecurity Role-Based Training Curriculum and Population Mapping Plan

• Cybersecurity Role-Based Training Knowledge and Skills Gap Survey Briefing

• Cybersecurity Phishing Campaigns

• CyberStar Results Dashboards

• Cybersecurity Awareness Month

• New Hire Orientation Brief

• Cybersecurity Wiki Pages

• CPM Workforce Development Standard Operating Procedures

3.2.10 Cybersecurity Workforce Development Surge Support

The Contractor shall provide additional personnel for future periods of unknown duration requiring a surge in work under this subtask. The COR will notify the Contractor if such services are needed and will provide relevant information as available to inform the Contractor of approximate scope and duration of the work. This surge support will be predicated by an increased need. Deliverables will be the same as 3.2.9 subtasks.

3.3 Cybersecurity Safeguards and Risk Management (SRM)

Support

The CFPB has adopted a secure strategy in acquiring IT infrastructure and applications as realized through Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) arrangements1. The Bureau also contributes to and consumes from the Open-Source software community. To effectively manage Cybersecurity risk to the Bureau, the Contractor shall assist the CFPB in refining and implementing the processes and methodologies to assess internal and external/third-party systems and provide an accurate accounting and tracking for shortcomings and weaknesses. The weaknesses shall be tracked, monitored, and reported in Plans of Action and Milestones (POA&Ms). Findings discovered through risk assessments, Security Controls Assessments (SCA) and continuous monitoring activities shall be collected, analyzed, and used to provide continuous reporting and support informed, risk-based decision making

In addition to the personnel required to directly perform the subtasks listed in this section, the Contractor shall provide one Subtask Lead for each of the Security Management Support/Information System Security Officers (ISSOs), Security Controls Assessment (SCA), and Continuous Monitoring subtasks. Each Subtask Lead shall support the effective implementation of their assigned subtask. Responsibilities include but are not limited to:

• Serving as the principal liaison between the CFPB and supporting personnel for the specific subtask area (e.g., Security Controls Assessors, ISSOs, Continuous Monitoring);

• Ensuring CFPB goals are communicated to the task area supporting personnel;

• Providing guidance, support, and supervision to the subtask area supporting personnel;

• Ensuring supporting personnel are properly prioritizing tasks and responsibilities;

• Ensuring proper allocation of tasks among supporting personnel, as applicable;

1 https://cloud.cio.gov/strategy/ https://cloud.cio.gov/strategy/

• Ensuring proper scheduling of tasks among supporting personnel, as applicable;

• Providing the final quality verification/validation of deliverables prior to submission to the CFPB; and,

• Ensuring compliance with CFPB timelines and deadlines for deliverables and associated subtask completion dates.

3.3.1 Security Risk Management Support

The Contractor shall provide Information System Security Officer (ISSO) support staff to work in conjunction with multi-teams in support of security risk management activities. The ISSO provides primary support to the CFPB Information System Security Manager (ISSM) Team in performing the responsibilities as prescribed in the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF). ISSOs provide guidance to System Owner (SO), Application Owner, SRM Director, and the Chief Information Security Officer (CISO) on matters involving the security of an assigned information system. ISSOs are responsible for assisting in ensuring the implementation and maintenance of security controls in accordance with the System Security Plan (SSP) and CFPB policies.

While ISSOs will not actually perform all functions, they will have to coordinate, facilitate, or otherwise ensure certain activities are being performed or as directed by the ISSM. As a result, it is important for ISSOs to build relationships with the SO, technical staff, and other stakeholders as described in this PWS. The ISSO shall have the knowledge, skills, and abilities to complete all tasks in Section 3.3.1 and its subsections of this PWS. The ISSO shall have excellent verbal and written communication skills and be able to communicate with Cybersecurity practitioners as well as technical teams. Core task areas are outlined in the subsequent subsections.

Deliverable(s):

• Weekly Status Reports

• Meeting Minutes

• Meeting Notes

3.3.1.1 Assessment & Authorization (A&A) Support

In support of the Federal Information Security Modernization Act (FISMA) of 2014 requirement, all CFPB systems and applications must follow National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) Special Publication (SP) 800-37 as the standard for Assessment and Authorization (A&A) process before being put into production. Table below provides a summary of required tasks for each RMF step to be performed by the ISSO.

RMF

Process Step

ISSO shall perform the following tasks

Prepare • Complete Initial Change Determination (ICD)

• Complete Electronic-Authentication(E-Auth) forms

• Register the system in CFPB’s A&A repository (e.g., CSAM)

• Provide input to the Cyber Review Form (CRF)

• Draft and perform initial review of Business Impact

Assessment

• Prepare, format and upload artifacts for each specific system in CSAM (i.e., signed documents, SCA artifacts and outputs)

• Submit FedRAMP Request Package (FRP) for all ISSO

Process Step

ISSO shall perform the following tasks assigned systems.

Categorize • Prepare FIPS-199 for review and coordinate for signatures

• Draft initial Security Implementation Plan (SIP)

Select • Prepare final SIP (tailored) for ISSM review

Implement • Draft initial System Security Plan (SSP)

• Coordinate with SO on SIP and SCB for evidence collection to support Security Control Assessment (SCA)

• Gather information or prepare initial drafts of risk-based decision memos

Assess • Review and ensure artifact quality in preparation for SCA

• Schedule SCA

• Review and update security controls and control implementation language in CSAM System Security Plans (SSPs)

• Review FedRAMP Customer Controls and CFPB security control implementations in CSAM and highlight changes.

Authorize • Perform tasks identified in Section 3.3.1.2.

• Finalize SSP and coordinate for signatures

• Complete BIA and coordinate for signatures (See Section

3.3.1.3)

• Complete ITCP Annex and coordinate for signatures (See

Section 3.3.1.3)

Monitor • Keep ISSM and system owners informed of system security posture as well any issues and concerns

• Review and keep CSAM security controls current; update controls and implementation statements as needed

• Respond to project teams and SO inquiries related to Cybersecurity processes

• Support System Owner (SO)/POA&M meetings o Prepare agenda based on meeting cadence o Facilitate SO meetings o Capture action items and meeting minutes (Update ISSM

Tracker) o Follow up action items o Review open POA&Ms and update milestones with information specific to the POA&M

• Support Information System Continuous Monitoring (ISCM) activities o Coordinate with SO for assessment evidence collection o Verify SIP is tailored prior to ISCM submission o Keep SO and stakeholders informed of ISCM schedule o Initial review of submitted artifacts for ISCM

• Initial Change Determination (ICD)

• E-Auth forms

• FIPS 199 Categorizations

• System Security Plans

• Input to Cyber Review Forms

• Security Implementation Plans

• POA&M documentation input

3.3.1.2 Plan of Action and Milestones (POA&M) Support

The Contractor shall prepare and maintain a current POA&M that identifies enterprise and system level weaknesses, vulnerabilities, and proposed mitigation activities, estimated costs to implement the recommendations, mitigation schedules based on the availability of resources required, points-of-contact that are responsible for mitigation activities, and status of the mitigation/remediation activities. The mitigation actions shall address system vulnerabilities identified in Security Assessment Reports (SAR) and SAR Executive Summary (SAR ES) Reports. The POA&M shall be formatted in accordance with the instruction provided by the CFPB Cybersecurity Program. Additional tasks related POA&M support include the following, but are not limited to:

a. Initiating POA&M process for review and entry into A&A repository;

b. Maintaining POA&M dashboard;

c. Producing POA&M metrics and reports for CFPB leadership (CFPB leadership and cross-team reviews);

d. Ensuring data quality of POA&M entries in the CFPB A&A repository;

e. Reviewing artifacts thoroughly prior to submitting for closure requests;

f. Updating POA&M milestones timely

Deliverable(s):

• POA&M Metrics and Reports

• Tableau POA&M Dashboard

3.3.1.3 Information Technology Contingency Planning Support

Supporting the Information Technology Contingency Plan (ITCP) (See Section 3.4.5) is one of the responsibilities of an ISSO. ISSOs shall complete an ITCP Annex for each authorized system using CFPB-approved templates. The annexes should include recovery time Objectives (RTO), Recovery Point Objectives (RPOs), and other appropriate program measures. Contingency planning cannot be conducted effectively without information derived from a Business Impact Analysis (BIA). Therefore, the ISSO shall also complete a BIA for each corresponding ITCP Annex.

Deliverable(s):

• ITCP Annexes

• Business Impact Analysis (BIA)

3.3.1.4 Other ISSO Activities and Services Support

The Contractor shall support other Security Risk Management program activities and services.

These activities include, but are not limited to:

a. Performing management of ISSO staff by providing guidance and supervision to the subtask areas;

b. Ensuring work products comply with CFPB templates and due dates as well as conducting a quality review prior to submission to CFPB;

c. Advising CFPB on new security policies/mandates and recommending course of actions (or options) for implementation (where applicable);

d. Providing outreach support by providing initial consultation, educating, and driving the awareness of Security A&A Process at internal meetings (e.g., project meetings);

e. Assessing and completing CCB change requests as required for work assigned to

SRM;

f. Developing or updating existing Standard Operating Procedure (SOP) related to key ISSO process and procedures;

g. Training ISSOs on new or existing processes and procedures;

h. Staying abreast on systems and technologies pertinent to CFPB;

i. Ensuring timely support is provided to audit requests, both internal and external audits, to CFPB;

j. Reviewing draft versions of Security Configuration Baselines (SCB) and provide feedback to SAE (e.g., requirements, ‘Check Text’ procedures) for completeness and clarity;

k. Researching information or preparing initial drafts of risk-based decisions and Risk Acceptance Memos for ISSM review and processing;

l. Ensuring data quality and information current for all systems in the CFPB A&A repository (e.g., CSAM);

m. Coordinating with CFPB’s Privacy Team on related artifacts for A&A support;

n. Attending project status meetings as needed and provide pertinent information and statuses related to ATO effort;

o. Identifying task areas, existing processes and procedures and making recommendations for improvement

Deliverable(s):

• Standard Operating Procedure (SOP)

• Input to draft Security Configuration Baselines (SCB)

• Risk-Based Decision (RBD) drafts

• Risk Acceptance Memo (RAM) drafts

3.3.1.5 ISSO Surge Support

• The Contractor shall be prepared to provide additional personnel for future periods of unknown duration requiring a surge in work under this subtask. The COR will notify the Contractor if such services are needed and will provide relevant information as available to inform the Contractor of approximate scope and duration of the work. This surge support will be predicated by an increased need in the number or turnaround time required to assess and authorize new systems. These new systems are likely to be Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), Software-as-a- Service (SaaS), Commercial Managed Services, or Federal Shared Services. The deliverables for ISSO surge support will be the same as 3.3.1.1 to 3.3.1.4.

3.3.2 Security Controls Assessment (SCA) Support

3.3.2.1 Security Control Assessments

The Contractor shall provide Security Controls Assessment (SCA) support staff to work in conjunction with multi-teams in support of security assessment activities. The SCA shall be a thorough assessment and evaluation of the security controls for an information system conducted in accordance with current versions of NIST Special Publications (SP), including the RMF, for assessments and risk management. The assessments may require travel.

The Contractor shall have the knowledge, skills, and abilities to complete all tasks in Section

3.3.2 and its subsections of this PWS. The Contractor shall have excellent verbal and written communication skills and be able to communicate with Cybersecurity practitioners as well as technical teams. Core task areas are outlined in the subsequent subsections.

3.3.2.2 Assessment & Authorization (A&A) Support

In support of the Federal Information Security Modernization Act (FISMA) of 2014 requirement, all CFPB systems and applications must follow National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) Special Publication (SP) 800-37 as the standard for Assessment and Authorization (A&A) process before being put into production. The Contractor shall use the most current version of relevant NIST publications and facilitate transition to new revisions within one year of their publication. Table below provides a summary of required tasks for each RMF step to be performed by the Contractor.

Process Step 5

- Assess

SCA Contractor shall perform the following tasks

Assessment Plan

• Review documentation within CSAM and other collaborations tools as needed to conduct the assessments.

• Develop and document security and privacy assessment plans to establish the expectations for the control assessments and the level of effort required.

Control Assessments

• Conduct control assessments in accordance with the security and privacy assessment plans.

• Review prior assessment and other opportunities to reuse assessment results from to make the risk management process timely and cost-effective.

• As available, automate control assessments to increase speed, effectiveness, and efficiency of assessments.

Assessment Reports

• Develop and document security and privacy assessment reports that provide findings and recommendations.

The Contractor shall provide management of SCA staff by providing guidance and supervision to the task and subtask areas. This includes ensuring work products comply with CFPB standards and due dates as well as conducting a quality review prior to submission to CFPB.

The Contractor shall advise CFPB on new security policies/mandates and recommending course of actions (or options) for implementation (where applicable). The Contractor shall ensure data quality and information current for all systems in any CFPB A&A repository (e.g., CSAM).

The Contractor shall provide the CFPB with the Security Controls Assessment Schedule, which shall include any security related activities included, but not limited to, assessments, reporting, etc. This deliverable shall be due within one month of Order/Call award and maintained current throughout the period of performance.

The Contractor shall provide a Security Assessment Plan, in accordance with CFPB policy and procedures, at the initiation of an assessment. The Contractor shall provide ongoing updates to all assessment activities as described in such procedures, and in accordance with NIST publications and the Risk Management Framework Assessment Phase.

The Contractor shall develop or update existing Standard Operating Procedure (SOP) related to key SCA process and procedures. This includes updates to the Security Controls Assessment Report (SAR) and Executive Summary/SAR Templates.

The Contractor shall…