RFI_Requirements Document_TIES Final_47QFRA23K0002_09062023.pdf

Threat Intelligence Enterprise Services (TIES)

Table of Contents

C.1. BACKGROUND 3

C.2. SCOPE 4

C.3. OVERVIEW OF TECHNICAL REQUIREMENTS 6

C.3.1 THREAT FEED DATA 6

C.3.2 CTI EXCHANGE PLATFORM 6

C.3.3 INTEGRATIONS 7

C.3.4 CTI SERVICES 7

C.3.4.1 7

EMBEDDED ANALYST AND DATA SCIENTIST SUPPORT 7

C.3.4.2 THREAT INTELLIGENCE RESEARCH AND ANALYSIS SUPPORT SERVICE 7

C.3.4.3 OTHER CTI RELATED SERVICES 7

C.4. FUNCTIONAL TASKING AREAS 7

C.4.1 TASK 1 – PROJECT MANAGEMENT SERVICES 8

C.4.1.1 CONDUCT A KICKOFF MEETING 8

C.4.1.2 PREPARE A MONTHLY STATUS REPORT 8

C.4.1.3 PROCUREMENT SERVICES, ASSET TRACKING AND LOGISTICS 9

C.4.1.4 PROVIDE QUALITY MANAGEMENT 9

C.4.1.5 PROVIDE FINANCIAL REPORTING 9

C.4.1.6 TRANSITION OUT 10

C.4.2 TASK 2 – ENGINEERING, TEST AND SECURING THE PLATFORM 10

C.4.2.1 SUBTASK 2.1 – PERFORM TECHNICAL PLANNING 10

C.4.2.2 SUBTASK 2.2 – PERFORM CONFIGURATION 10

C.4.2.3 SUBTASK 2.3 – PERFORM TESTING 10

C.4.2.4 SUBTASK 2.4 – SECURING THE PLATFORM 11

C.4.2.5 SUBTASK 2.5 – PROVIDE INTEGRATION SUPPORT 12

C.4.3 TASK 3 – OPERATIONS AND MAINTENANCE 12

C.4.3.1 SUBTASK 3.1 – MANAGEMENT OF THE OPERATIONAL SOLUTION 12

C.4.3.2 SUBTASK 3.2 – PERFORM ONBOARDING OF USER ORGANIZATIONS 13

C.4.3.3 SUBTASK 3.3 – PROVIDE HELP DESK SUPPORT 14

C.4.3.4 SUBTASK 3.4 – THREAT INTELLIGENCE DATA SETS 14

C.4.4 TASK 4 – ANALYST SUPPORT 15

C.4.4.1 SUBTASK 4.1 THREAT INTELLIGENCE ANALYSIS AND RESEARCH 15

C.4.4.2 SUBTASK 4.2 – DATA MANAGEMENT AND EMBEDDED ANALYSIS 15

C.4.5 TASK 5 – CYBERSECURITY INTELLIGENCE SERVICES SURGE SUPPORT

(OPTIONAL) 16

C.5. CONSTRAINTS 16

C.6. COMMERCIAL PRODUCT PROCUREMENT 16

C.7. PLACE OF PERFORMANCE 16

C.8. PERIOD OF PERFORMANCE 17

C.9. PERFORMANCE STANDARDS 17

C.10. INFORMATION OWNERSHIP AND USE REQUIREMENTS 17

C.11. ELIGIBLE ENTITIES AND ORGANIZATIONS 17

C.12. ROLES AND RESPONSIBILITIES 18

C.13. KEY PERSONNEL 18

C.13.1 PROGRAM MANAGER 18

C.13.2 DATA COLLECTIONS MANAGER 19

C.13.3 KEY PERSONNEL SUBSTITUTION 19

C.14. REQUIRED SKILLS AND QUALIFICATIONS 19

C.15. DELIVERABLES AND MILESTONES 20

Threat Intelligence Enterprise Services (TIES)

C.1. BACKGROUND

The Cybersecurity and Infrastructure Security Agency (CISA) is the Nation’s risk advisor, working with partners to defend against today’s threats and collaborating to build a more secure and resilient infrastructure for the future. In this role, CISA builds the Nation’s capacity to defend against cyber attacks: the Agency works to provide cybersecurity tools, incident response capabilities, and assessment services, to safeguard the Federal Civilian Executive Branch (FCEB) ‘.gov’ systems and systems that support national critical functions.

Capacity Building (CB) serves as CISA’s enterprise cybersecurity services management arm for national stakeholders and the lead for federal enterprise cybersecurity governance. CB enables its customers to manage cybersecurity risk by building their capacity to implement effective cybersecurity policies, tools, and procedures. CB helps stakeholders better manage cybersecurity risk by defining expectations for stakeholder cybersecurity; leading implementation and enforcement of cybersecurity requirements;

managing CISA’s cybersecurity services portfolio; building capacity; and enhancing collective defense and readiness.

Within CB, the Cybersecurity Shared Services Office (CSSO) (formerly the Quality Services Management Office) was established to serve as a single shared services office for managing the United States Government’s many cybersecurity solutions. The CSSO identifies, prioritizes and delivers a robust marketplace of cybersecurity shared service solutions and provides cybersecurity service thought leadership and expertise across CSD and its customers. Specifically, CSSO enhances stakeholder cybersecurity readiness, bolsters enterprise capabilities and protections, and increases the community’s capacity to adequately manage cyber risk by:

1. Defining critical requirements, needs, and performance expectations.

2. Overseeing and guiding the implementation of key cybersecurity initiatives and urgent actions, including federal cybersecurity policy, leading practices, cyber directives, and operational guidance.

3. Managing CISA’s cybersecurity services portfolio; evolving shared services, capabilities, and delivery models; and delivering tailored services and assistance based on customer needs.

Over 10 years of experience offering enterprise Cyber Threat Intelligence (CTI) services through the Shared Cybersecurity Services (SCS) model has given CISA unique insights into the barriers that members of the Federal cyber ecosystem face through all stages of the CTI lifecycle. Fragmented information about critical cyber threats reduces analysts’ abilities to effectively generate, use, and share CTI to make timely and informed decisions to support their missions. Critical CTI is spread across disparate feeds and exists in inconsistent data formats, which limits the collaboration needed to develop an accurate, shared threat picture. Further, the cyber maturity levels of participants in the CTI ecosystem vary widely. Specifically, the Federal cyber ecosystem lacks:

• Efficient procurement of CTI and CTI tools and services;

• Effective tools, services, and capabilities for CTI collaboration and processing;

• Assessments to evaluate maturity or create a roadmap to build and grow CTI capabilities;

• Guidance to effectively use purchased CTI services and tools for network defense; and

• Awareness and centralization of CTI requirements

To solve this, CISA, through its CSSO, seeks to offer Threat Intelligence Enterprise Services (TIES), which includes CTI services and tools which improve:

• CTI Generation: collection, processing, and analysis

• CTI Use: supports organizational cybersecurity decisions and analyst action

• CTI Sharing: collaboration with partners and the broader security ecosystem

Figure 1. TIES Evolution

C.2. SCOPE

The scope of this effort is to develop and establish a threat intelligence platform and data feeds for use initially by FCEB agencies for the TIES Minimum Viable Product (MVP). Authorities and resources permitting, coverage requirements may expand to include State Fusion Centers (listed here: Fusion Center Locations and Contact Information | Homeland Security (dhs.gov)), Information Sharing and Analysis Centers and election and National Special Security Event organizations, state and local governments, Legislative and Judicial branch entities and other critical infrastructure organizations. The TIES MVP coverage list is detailed in section C.11. The TIES CTI exchange platform shall be a one stop integration point for analysts and infrastructure to receive, share and collaborate on relevant and timely CTI, enabling teams to protect their environments and others. This platform shall support integrations with government systems (such as AIS, CDM, agency run TIPs/SIEMS/SOARs, etc.) as well as commercial threat feeds.

Additionally, the platform must foster, at minimum, bi-directional sharing capabilities which will foster collaboration and allow analysts to work with others to further enrich CTI.

In addition to the MVP solution, the government requires CTI services to supplement the CTI Exchange Platform capabilities. These CTI Services include Research and Analysis, Embedded Analyst Support, RFI and CTI Briefing Support, and Domain Takedowns and Mitigations. CISA and participating organizations operate in a dynamic landscape. The TIES solution may include additional CTI Services which would be specified and consumed as needed throughout the period of performance. That is, CISA may request and resource specific capabilities to be delivered to any or all participating entities. The contractor must remain flexible to support a wide variety of customer needs.

The TIES end state must have inherent flexibility to support a wide range of potential user bases from a contractor that optimizes execution via teaming arrangements or other streamlined approaches.

A high-level conceptual TIES Overview is listed below in a series of diagrams.

https://www.dhs.gov/fusion-center-locations-and-contact-information https://www.dhs.gov/fusion-center-locations-and-contact-information

Figure 2. TIES Overview

Figure 3. CTI Architectural View

Figures 1, 2, and 3 above, depict the notional overview of the platform and potential integration points.

These integration points will be specified during execution of the effort but it should be understood that the platform must be available to integrate with additional commercial feeds that could be procured through this effort or currently existing in a government environment. The Services section highlights a non-exhaustive list of capabilities and offerings to be made available to participating organizations and resourced by that same participating organization.

C.3. OVERVIEW OF TECHNICAL REQUIREMENTS

The following subsections provide an overview and define the technical capabilities and requirements for the TIES Solution. The minimum viable requirements for both the CTI exchange platform and CTI data are cataloged in the Technical Requirements Document (TRD) (Attachment A). The initial deployed Solution shall be the MVP and include all targeted requirements addressed in Attachment A. All requirements (defined as “SHOULD” in the TRD) not realized in the MVP shall be implemented through iterative enhancements as part of a proposed engineering and development approach.

C.3.1 THREAT FEED DATA

The Contractor shall curate or subscribe to threat intelligence feeds to ensure data characteristic requirements listed in Attachment A are met (see Task 3). These threat intelligence feeds shall, but not be limited to, the following:

- Include structured and unstructured data;

- Provide tactical, operational, and strategic intelligence;

- Include confidence and risk scores;

- Map to common cyber attack and intelligence frameworks;

- Be validated against and correlated with internal data holdings;

- Include data and analysis on a variety of specified subjects and themes; and

- Provide visibility and actionable insights into threats and vulnerabilities to an organization’s networks, applications, devices, and data.

C.3.2 CTI EXCHANGE PLATFORM

The TIES CTI Exchange Platform (CEP) will serve as a centralized mechanism to receive and share relevant and timely CTI. The platform must aggregate, ingest, normalize, and enrich CTI from a wide variety of sources.

The platform must have the capability to understand the Indicators of Compromise (IOCs) characteristics from the source of threat feed. When the information is added to the platform, it must be tagged to indicate its original source. The platform should also have the ability to track the lineage of the data, enabling analysts to easily trace its origin and any updates made to it. To accomplish this, the platform must support a tagging system that can categorize data based on its attributes and metadata, making it easier for analysts to search, filter, and prioritize information based on its relevance and importance. This will enable the platform to provide more context to the information being analyzed, increasing speed, accuracy, and confidence in the intelligence being shared among stakeholders.

As the platform is targeted to accommodate collaboration, the solution must foster bi-directional functionality, providing data to and ingesting data from a number of sources. Specifically, the solution must allow data to be shared within and extracted out of the platform as well as between participating entities via the platform.

Among the many cataloged requirements for this cyber threat intelligence solution (Attachment A), the platform must support various formats, including the STIX data exchange format, as well as the TAXI data transfer mechanism, MISP, and JSON. Additionally, the solution must have a REST API that would allow external clients automated access to data and workflows in the platform. The solution must provide for the ingestion, tagging and correlation of multiple threat related data sets. The solution must support native data types for all STIX Domain Objects (SDOs), with the ability to index and query all SDOs.

C.3.3 INTEGRATIONS

The TIES CTI Enterprise Platform must be designed to seamlessly integrate relevant information from various sources, ensuring speed and confidence in threat intelligence analysis. The platform must support a model that promotes coupled integrations and bi-directional sharing of data, information, and attributes, which are enhanced and updated in an ongoing and agile fashion. To achieve this, the government will identify CISA and FCEB systems as well as commercial off-the-shelf (COTS) products that must be integrated into the Exchange Platform.

The contractor will be responsible for developing and maintaining mechanisms to make raw and processed data available for integration and consumption through platform functionalities. This may be achieved through a variety of means such as scheduled exports/ingest, application programming interfaces (APIs), or as identified by the contractor. The goal is to ensure that all relevant information is quickly and confidently accessible to the users of the platform, regardless of the source or format of the data.

C.3.4 CTI SERVICES

The contractor shall provide CTI Support which include the following: The following subsections define high level CTI support areas that may be required throughout the life of the TIES requirement.

C.3.4.1 EMBEDDED ANALYST AND DATA SCIENTIST SUPPORT

The Contractor will provide dedicated and/or on-site analytic support. The Contractor will support the government in implementing the TIES data management strategy, ensuring data is high-fidelity, and identifying data gaps and redundancies.

C.3.4.2 THREAT INTELLIGENCE RESEARCH AND ANALYSIS SUPPORT SERVICE

The contractor shall provide dedicated support for routine analytical work, including triage, analysis, response, and tracking of requests for information (RFI) submitted by TIES users through a designated TIES RFI process; preparation of scheduled roll-up TIES status reports, preparation and delivery of routine threat briefings; support of ad hoc meetings with TIES users to discuss shared intelligence in more detail, and regular coordination with data providers to clarify questions/issues regarding data and its attributes. This service is required as part of TIES MVP.

C.3.4.3 OTHER CTI RELATED SERVICES

The government will continually evaluate the need for addition of CTI-related services. New services will be identified to meet the Government’s need to scale and keep pace with the threat landscape.

C.4. FUNCTIONAL TASKING AREAS

The contractor shall perform the following tasks:

Task 1: Provide Project and Contract Management Support Task 2: Engineering, Test and Secure the Platform Task 3: Operations and Maintenance of the Platform

Task 4: Analyst Support Task 5: Cybersecurity Intelligence Support Services (optional)

This requirement encompasses a wide variety of technical support and CTI subject matter expertise.

CISA’s objectives and priorities are dynamic and complex and as such, the contractor shall use strategic vision, leverage a diverse team of subject matter experts and be ready to surge as requirements evolve.

The contractor should remain flexible and expect to address shifting resource and staffing needs that may arise due to new or emerging cybersecurity initiatives, lines of effort or technologies.

C.4.1 TASK 1 – PROJECT MANAGEMENT SERVICES

The contractor shall provide program management services under this requirement that support the successful implementation of the TIES solution that meets all Federal requirements and objectives. The management services include the management and oversight of all activities performed by service provider personnel, including subcontractors, to satisfy the requirements of this requirement.

The contractor shall notify the General Services Administration (GSA) Contracting Officer (CO) and CISA Contracting Officer’s Representative (COR) of any technical, financial, personnel, Organizational Conflict of Interest (OCI), or general managerial problems encountered throughout the period of performance (POP).

C.4.1.1 CONDUCT A KICKOFF MEETING

The contractor shall conduct a Kick-Off Meeting (Deliverable 1) following award of the contract. The meeting shall provide an introduction between contractor personnel and Government personnel. The meeting shall provide the opportunity to discuss necessary technical and administrative activities associated with execution of the requirement.

The Project Kick-Off Meeting Agenda shall include, at a minimum, the following topics/deliverables:

a. Introduction of team members:

1. Roles and responsibilities of the service provider team.

2. Lines of communication overview between the service provider, its teaming partners, and the Government.

b. Summary of technical approach:

1. Overview of the Solution and its ability to meet technical requirements of Section 4.3.

2. Approach to satisfying requirements of Tasks 1-3.

3. Transition-In approach.

4. Initial timeline to meet technical requirements of Section 4.3.

c. Contract Administration:

1. Reporting requirements

2. Security requirements

3. Sensitivity and protection of information.

4. Invoice requirements

5. Additional administrative items including press/news releases

C.4.1.2 PREPARE A MONTHLY STATUS REPORT

The contractor shall develop and provide a Monthly Status Report (MSR) (Deliverable 2). The MSR shall include the following:

a. Activities during the reporting period, by task (include ongoing activities, new activities, and activities completed, and progress to date on all activities mentioned above). Each section shall start with a brief description of the task.

b. Problems and corrective actions taken. Also include issues or concerns and proposed resolutions to address them.

c. Government actions required.

d. Schedule (show major tasks, milestones, and deliverables; planned and actual start and completion dates for each).

e. Cost incurred by CLIN.

f. Accumulated invoiced cost for each CLIN up to the previous month.

g. Projected cost of each CLIN for the current month.

h. Planned and executed procurement actions.

i. Listing of Agencies participating in the Solution.

j. Performance reports for the Solution.

k. Service ticket inflow, to include the total number of tickets received, types of issues, and how they were resolved.

C.4.1.3 PROCUREMENT SERVICES, ASSET TRACKING AND LOGISTICS

The contractor shall procure and track any hosting costs, tools, and Other Direct Costs (ODCs) required under the requirement. The contractor shall coordinate with the COR and initiate the procurements using the procedures in Section 6. The contractor shall ensure all bills of material artifacts are consistent and tracked over the course of the POP.

The contractor shall identify, track, and control all procurements executed under this requirement. The contractor shall work collaboratively with the COR to ensure that the Government has situational awareness over all inventory of executed procurements. To manage this process, the contractor shall submit a Procurement Report monthly and/or in conjunction with each purchase (Deliverable 3).

C.4.1.4 PROVIDE QUALITY MANAGEMENT

The contractor shall develop a quality management plan (Deliverable 4) for work accomplished under this requirement. This shall align with the Award Fee approach identified at award.

C.4.1.5 PROVIDE FINANCIAL REPORTING

The contractor shall provide a Financial Report of cumulative expenditures monthly (Deliverable 5). The Financial Report shall include as a minimum the following:

a. Project monthly expenditures and labor hours by CLIN and TO level starting with the current month through the end of the POP.

b. Funded levels by CLIN.

c. Labor hours and expenditures incurred to date by CLIN.

d. Diagram reflecting funding and burn rate by month for each CLIN.

e. Cumulative invoiced amounts for each CLIN up to the previous month.

The contractor shall present a Financial Report format at the Project Kick-Off Meeting for Government review. The Government will provide written approval of the proposed format via the COR, and this approved format shall be utilized for the monthly financial reporting requirement. The Government may request updates to the format based on CISA requirements.

C.4.1.6 TRANSITION OUT

The contractor shall provide transition-out support. The contractor shall deliver the initial Transition-Out Plan and updates to the plan six months before the end of any contract year (Deliverable 6). The Transition-Out Plan shall facilitate the accomplishment of a seamless transition from the incumbent to incoming service provider/Government personnel at the expiration of the requirement.

C.4.2 TASK 2 – ENGINEERING, TEST AND SECURING THE PLATFORM

This task includes all engineering, technical planning, development, and testing efforts to initially establish the TIES platform. Following successful approval of design, the contractor shall configure and test the platform consistent with the Government approved design.

The contractor shall ensure that the Solution is secured, receives a CISA Authority to Operate (ATO) including FedRAMP compliance (where applicable), and maintains that ATO/FedRAMP package throughout the period of performance of the requirement. The contractor shall support efforts for the Solution to receive a CISA ATO and FedRAMP compliance as soon as possible after award of the contract.

The evolution of the Solution during this requirement may include iterative enhancements and re-configurations to include additional features and technical capabilities. As additional features and capabilities are introduced, the service provider shall update all design and cost documentation (Deliverable 7) and configure, test, and secure consistent with the updated design.

C.4.2.1 SUBTASK 2.1 – PERFORM TECHNICAL PLANNING

The contractor shall recommend and execute an engineering lifecycle framework for platform development. This framework shall align to the tailored SELC frameworks developed by DHS. At a minimum, the contractor shall develop the appropriate technical reference architectures and complete a Solution Design Review (SDR) in accordance with the proposed engineering approach (Deliverable 7).

The intent of the SDR is to provide Government stakeholders with the common understanding of the architectures, capabilities, and features that will satisfy all of the government’s MVP requirements (Attachment A). The SDR shall include a timeline to close gaps and achieve MVP. This timeline should also be referenced in the Operations plan below. The contractor shall utilize SecDevOps best practices and ensure their approach aligns with the appropriate DHS SELC Framework.

C.4.2.2 SUBTASK 2.2 – PERFORM CONFIGURATION

Following completion of the SDR, the contractor shall proceed to configure the Solution, including the provisioning of all necessary software, hardware, and virtual infrastructure, and any services on behalf of the Government. Capabilities and features should be added to any existing solutions to ensure the full set of minimum viable product technical requirements are met.

The Contractor shall propose a methodology and framework to handle customizations, enhancements, and updates. This includes specified technical direction from the government. Implementation of additional features or technical capabilities to the Solution will require updated design and cost documents and may necessitate additional configuration and testing actions consistent with the requirements of all functional areas.

C.4.2.3 SUBTASK 2.3 – PERFORM TESTING

The Contractor shall ensure that the solution is tested and meets all technical requirements identified in the TRD (Attachment A). Additionally, the contractor shall execute approved testing activities/demonstrations, when requested by the government. Testing activities shall verify and validate that the solution is ready for operation and shall support integration with other data sources and systems as described in previous sections. The contractor shall support further tasking that includes, but is not limited to, the following:

● Identify a testing approach consistent with the engineering framework aligned to Subtask 2.1

● Develop testing plans (Deliverable 8) which validate and/or verify platform and data requirements.

● Build and maintain a non-production environment for testing. The testing environment shall be capable of verifying the solution and shall support integration testing with other sources. The government shall have access to the testing environment and visibility into all aspects of testing (automation, logs, configurations, etc.).

o Inclusion of test licenses (COTs CTI data, etc.).

● Develop and execute approaches that promote efficient, effective software testing methods (e.g., modular, unit, and regression testing; using integration tests to validate the implementation of the technical requirements).

● The Contractor shall promote the use of chaos engineering extreme stress testing best practices to evaluate distributed networks, running experiments against a system while it's in active use in order to build confidence in their operation's ability to withstand turbulent conditions.

● Update technical documentation to incorporate any updates to the solution architecture.

C.4.2.4 SUBTASK 2.4 – SECURING THE PLATFORM

The solution is anticipated to be a FIPS 199 high-impact system. The contractor shall ensure that the solution is secured, receives an authority to operate (ATO) from CISA, and maintains that ATO throughout the POP in accordance with FIPS Publication 140-3, DHS Policy Directive 4300a, and relevant NIST and ISO standards. The Solution shall achieve ATO in the base year of this requirement.

The contractor shall assume a major role in the preparation of privacy/security documentation required by federal law and/or agency policy, and technical alignment of the documentation with those requirements.

Specifically, the contractor shall complete the requirements for the Assessment of Security Controls within six months of award of the contract (i.e., RMF Step 4 – Assess Security Controls NIST Risk Management Framework | CSRC). The government encourages innovative approaches to streamline ATO-related activities. The contractor shall prepare and maintain all documentation required for the solution to obtain and retain an ATO, including a System Security Plan, contingency plan, incident response plan, privacy threshold analysis or impact assessment, and rules of behavior.

There shall be ongoing, regular security assessments as part of the System Security Plan in conjunction with achieving and maintaining Authority to Operative (ATO). Security assessments shall follow an agreed upon, standardized approach (e.g. FedRAMP) and framework. Security assessment results shall be made available to the Government upon completion.

The contractor shall assist the government in developing a Plan of Action and Milestones (POA&M) identifying security weaknesses. The Plan of Action and Milestones (POA&M) document shall describe the plans and associated tasks to correct identified weaknesses that can potentially be harmful to DHS systems. The weaknesses may be combined, summarized or paraphrased in the POA&M for ease of management understanding, but the original source, such as test results from IT control audits or assessments that identified the weakness, shall be available.

The contractor shall provide the following support to include, but not limited to:

https://csrc.nist.gov/Projects/Risk-Management https://csrc.nist.gov/Projects/Risk-Management

1. Create, submit, and maintain all necessary security authorization documentation and obtain an ATO from CISA as soon as possible following award of the contract.

2. Maintain an ATO of the CISA-hosted solution during the entire contract POP, including working to address security findings and updating relevant security authorization documentation as needed.

3. Continuously conduct vulnerability assessments of the solution and immediately inform stakeholders, including agencies and CISA (as appropriate), in writing, of any cyber incidents and breaches.

a. Identify, in writing, any remediation of default risk critical/high vulnerabilities.

b. Identify in writing their incident security breach management practices and allow

Government stakeholders to review any relevant documentation

4. Maintain solution compliance with FIPS Publication 140-3, DHS Policy Directive 4300a, and relevant NIST and ISO standards.

C.4.2.5 SUBTASK 2.5 – PROVIDE INTEGRATION SUPPORT

The solution shall have a flexible integration architecture that supports both platform-wide integrations (e.g., AIS, commercial data feeds procured along with the CTI tool) and tenant-specific integrations. The solution shall integrate data from multiple sources, accounting for multiple variations and deviations in the sources within a federated agency. Sources include cybersecurity tools and other, generalized IT systems and services. It shall ingest data from a variety of sources within unique agency environments and commercial entities. It shall allow for data within the platform to be sent to other integrated systems for a variety of purposes.

Individual tenants within the platform must be able to set up and maintain a unique list of integrations that provide data for use within their tenant. Tenant-specific data can be made available to other tenants at the originating tenant’s discretion. Tags placed on data, as well as roles assigned to users, dictate what data from across the entire platform is visible to a given user within their tenant. The CTI Platform and Contractor shall promote system health monitoring and data quality best practices where applicable and in accordance with CISA guidance.

The platform shall collect, normalize, validate, enrich, and correlate data through streamlined mechanisms. Raw and processed data shall remain accessible to users (both through a user interface and through an API) within the platform for consumption and further integration. The contractor shall ensure there is a standard mechanism through which data from all existing and new sources is integrated into, transformed within, and normalized for use within the solution. This mechanism shall be able to be readily modified to accommodate data source changes (both to consume new sources and to adapt to updates in existing ones) and data processing changes (to evolve/improve over time to meet data normalization and usability needs). The contractor shall work with the government to ensure data quality, integration and processing needs continue to be met as data sources/needs evolve.

C.4.3 TASK 3 – OPERATIONS AND MAINTENANCE

The Contractor shall onboard all agencies and entities participating in the TIES platform and support day-to-day operation and maintenance of the TIES Solution. This includes administrative, logistical and sustainment management support.

C.4.3.1 SUBTASK 3.1 – MANAGEMENT OF THE OPERATIONAL SOLUTION

The contractor shall operate the solution, ensuring that the solution is available 24 hours per day, seven days per week (24/7) and that all performance standards are continually met upon transition to and during operations. The contractor shall ensure data is ingested and displayed and that all features are readily available within the platform. The contractor shall ensure the government has ready access to all technical components for identified personnel.

The Contractor shall develop an Operations Plan (Deliverable 9) that describes how the contractor intends to operate the Solution. The contractor shall perform O&M for Solution in accordance with the Operations Plan once approved by the Government. The Operations Plan shall include, but not be limited to the following:

a. Description of detailed O&M activities that are required for successful ongoing operations, including, at a minimum, the following:

1. Identification of problems and approach to fixing.

2. Ways to improve/maintain the performance of the system.

3. Methodology for continuously monitoring capabilities to support implementation reviews in order to verify operational requirements are being met.

4. Implementation of patches/updates.

5. Conduct scheduled and unscheduled maintenance.

6. Identify and maintain configuration/releases (e.g., security/patch administration).

7. Maintain information security (e.g., security vulnerability scanning and auditing logs for suspicious behavior).

8. Maintain event management (e.g., authorized service interruptions).

9. Account maintenance including provisioning, disabling, and removing accounts.

10. Methodology for measuring availability metrics (up/down).

11. Verifying and validating recovery processes (e.g., backups, snapshots, and integrity thereof).

b. Description of the configuration management and change management methodology.

c. Approach to monitoring and maintaining system capacity, and procedures for scaling services to meet requirements.

d. Recommended operational service levels.

e. Tools and ODCs tracking including license management to the end-user organization support level.

Maintaining the ATO.

C.4.3.2 SUBTASK 3.2 – PERFORM ONBOARDING OF USER ORGANIZATIONS

The Contractor shall support end-user organizations onboarding to the Solution. Onboarding support may include providing a specific end-user organization with the subject matter expertise necessary to support the end-user organization with onboarding tasks. The support shall include, but is not limited to the following:

● Provide onboarding documentation and materials (Deliverable 10) to support CISA and an end-user organization’s use of all aspects and components of the platform.

● User acceptance testing as part of operational needs of agencies and/or entities (to be provided as technical direction as needed).

● Provision of account credentials and initial overview of platform usage, as well as contact points for needed follow-on technical support.

o This includes issuance, management and tracking of hard tokens described in the Section C. 5 Constraints.

● Notification to CISA (by Contractor) of onboards and shall provide CISA a method by which to verify user status (e.g., active vs dormant, etc.).

o The contractor shall recommend the most efficient approach, but this may include live dashboards or interfaces, that provide the government with user metrics at the entity and individual level.

C.4.3.3 SUBTASK 3.3 – PROVIDE HELP DESK SUPPORT

The Contractor shall provide a Help Desk capability that is available to all covered user stakeholders.

Ticketing systems used to track incidents and service requests shall be accessible to CISA and agency stakeholders. This support includes engineering support to remedy operational issues or incidents related to the solution. Help Desk services shall include customer self-help services, and online services. The Help Desk shall serve as a central point-of-contact between the customer and the IT organization to resolve customer issues and provide a consistent and quality customer experience including corresponding subject matter expertise, standardized processes, and an extensive knowledge management system. The Help Desk, supported by a common IT Service Management (ITSM) tool set, shall provide the ability to document, process, and monitor incidents, problems, inquiries, and change and service requests, as well as coordinate new capabilities through an actionable service catalog and support for other ITSM functions. The contractor shall provide the following to include, but not be limited to:

● Help Desk and Tiers I, II, and III services for the platform.

o Tier 1 services include:

▪ Basic troubleshooting

▪ Incident and request management

▪ Patch management

▪ Problem resolution o Tier 2 services include:

▪ In-depth troubleshooting o Tier 3 services include:

▪ Advanced Engineering activities for the CISA Platform

▪ Coordinating remediation with original equipment manufacturer

● Specialized knowledge of the platform to provide solutions for data quality, access, troubleshooting and remediation.

● Track useful metrics and trends for the platform (and its usage) and make them available to the government through the Project Manager.

o This includes ticket flow, user metrics and customer feedback.

C.4.3.4 SUBTASK 3.4 – THREAT INTELLIGENCE DATA SETS

The Contractor shall acquire, curate and/or maintain current and future threat intelligence data and feeds according to the government need. Data characteristics for the MVP are listed in the TRD (Attachment A) and shall be maintained in accordance with the data consistency and quality requirements of the government. The contractor shall support procurement requests for threat intelligence data feeds based on requirements provided by the government and utilizing the purchase process described in Section 6.

To assist the government in identifying the best value data feed solution set, the contractor shall conduct an Analysis of Alternatives (AoA) (Deliverable 11). This analysis shall depict the trade space of data providers and facilitate a cost effective procurement decision. The approach and methodology for the activity may be defined by the contractor, but at a minimum the analysis shall include high level outputs such as the following:

1) Documentation of criteria, data quality standards and requirements baselining

2) Synopsis or review of the marketplace and products

3) Evaluation of data providers and products

4) Cost and affordability analysis

The government will review the output of the AoA and make a determination on the way ahead for data feeds. The Contractor shall continue to support ongoing research and analysis regarding data feeds and quality.

C.4.4 TASK 4 – ANALYST SUPPORT

In addition to the platform capabilities, the government requires highly skilled technical support services.

C.4.4.1 SUBTASK 4.1 PERFORM THREAT INTELLIGENCE ANALYSIS AND RESEARCH

The contractor shall provide Analysis and Research services in support of Platform capabilities and cyber intelligence data and information. The contractor shall perform the following threat intelligence analysis and research support service to include, but not limited to the following:

● Conduct routine analytical work, including triage, analysis, response, and tracking of RFIs submitted by TIES users through the designated TIES RFI process;

● Prepare scheduled roll-up of TIES status reports;

● Prepare and deliver routine threat briefings;

● Conduct ad hoc meetings with TIES users to discuss shared intelligence in more detail; and

● Coordinate with data providers to clarify questions/issues regarding data and its attributes.

C.4.4.2 SUBTASK 4.2 – DATA MANAGEMENT AND EMBEDDED ANALYSIS

At TIES MVP, CB TIES team will require intelligence analysis and data management subject matter expertise. This support will focus on special projects to correlate and enrich data and generate custom reporting based on TIES collections.

Scope of required work includes but is not limited to:

● Data quality control; manages data collections; assesses gaps/duplication of data

● Creates quantitative and qualitative performance metrics assessing/describing data quality

● Implements data management strategies and best practices to ensure accuracy, timelines, accessibility, and actionability of data

● Data analysis, correlation, and aggregation of TIES and other data sources to assess/identify issues of importance to requesting agency/government

● Fusion analysis to generate tailored/custom reporting; sharing back of insight into TIES and other relevant communities

● Coordination with TIES analysts and other analysts to share insight across FCEB

● Use of data science principles to generate trend analyses of TIES or other CTI data;

subsequent develop of reporting and briefing for use by TIES community

● Expertise in understanding the threat landscape for ICS / OT systems

● Ability to directly support TIES operations (e.g. deriving insight from TIES data collections and generating trend analysis for distribution to FCEB)

C.4.5 TASK 5 – CYBERSECURITY INTELLIGENCE SERVICES SURGE SUPPORT

(OPTIONAL)

The government anticipates there will be additional support requirements for this requirement, specifically to support the CISA participating entities, but also to accommodate external organization needs. These requirements will be associated with all task areas described in Section 4 as well as any CTI Services.

C.5. CONSTRAINTS

The government encourages innovative and cost effective approaches to meeting the requirements in this requirement within the parameters outlined in the following constraints:

1) The CTI platform may be delivered as a SaaS hosted solution in the TIES contractor’s existing CSP environment. A solution hosted in a non-COTS configuration (such as a hybrid model that utilizes physical infrastructure managed by the Contractor) will not be allowed. In this instance, the government will require the TIES Contractor to host the platform in the CISA managed AWS GovCloud environment delivered and maintained by a DHS-managed contractor.

2) This platform shall include strong authentication approaches. Specifically, the Platform shall employ a phishing resistant, multi-factor authentication via hard token, supporting FIDO2 specifications (see Identity and Access category in the TRD or reference NIST 800-63b Authentication and Lifecycle Management). The contractor shall support the management, issuance and operations of this approach through Task 3, Operations and Maintenance.

3) The contractor must complete requirements for RMF Step 4 – Assess the Security Controls six

(6) months post award of the contract. Approaches that achieve this step sooner than six (6) months would offer significant benefit to the government.

4) Use of the CTI platform is not mandatory across the FCEB or participating entities.

5) CISA currently utilizes enterprise tools and repositories for knowledge, requirements and risk management. These tools may be utilized in execution of the above tasks and will be identified following award of the contract.

6) The contractor must account for CISA entry on duty (EOD) and suitability challenges as part of its assumptions and solution build up for any analyst support.

C.6. COMMERCIAL PRODUCT PROCUREMENT

The contractor shall support a variety of procurements including but not limited to the following:

1) Commercial data and threat feeds

2) Ancillary hardware

3) Cybersecurity software products and tools

4) Technical research subscriptions

5) Maintenance line items/SKUs

The contractor shall submit request to initiate purchase (RIP) documentation (Attachment TBD) and provide a Procurement Report categorizing and tracking products and tools supporting the solution during the requirement’s POP.

C.7. PLACE OF PERFORMANCE

The primary place of performance will be at the contractor’s site. Certain personnel shall support the government onsite as required by the specific task areas. The Platform shall be available to support US Government operations domestically and internationally.

C.8. PERIOD OF PERFORMANCE

The Period of Performance (POP) for this TO is a 12-month base period followed by five (5), 12-month option periods.

C.9. PERFORMANCE STANDARDS

Performance Standards are not yet determined.

C.10. INFORMATION OWNERSHIP AND USE REQUIREMENTS

To lead the national effort to understand, manage, and reduce cyber risk, CISA must share cyber threat information that enables the protection of the Federal Government, SLTT, Critical Infrastructure and other stakeholders. Likewise, TIES covered users may have their own mission needed to share cyber threat information with various stakeholders. Data Provider(s) shall allow TIES users, including CISA, to consume, enrich, extract, transform, and share all TIES platform data/information to meet the needs of individual covered users, as necessary and without restriction.

CISA retains the right to share finished intelligence products that are the intellectual property of the Data Provider with non-covered TIES users, when necessary. CISA will make its best effort to notify the Data Provider prior to such sharing, but due to critical and/or time sensitive mission requirements, prior notification may not always be possible. As such, Data Provider shall not require prior notification before CISA is allowed to share finished intelligence products.

TIES covered users (other than CISA) may share derived products, based on Data Provider finished intelligence products, with non-covered users in order to satisfy critical and time sensitive mission requirements. TIES covered users will make best effort to notify the Data Provider prior to such sharing, but due to critical and/or time sensitive mission requirements, prior notification may not always be possible. As such, Data Provider shall not require prior notification before users share derived products.

“Derived Product” is understood to mean a work that is based on one or more preexisting works, such as a revision, enhancement, modification, translation, abridgement, condensation, expansion, or any other form in which such preexisting works may be recast, transformed, or adapted, and that, if prepared without authorization of the owner in the copyright in such preexisting work, would constitute a copyright infringement, and specifically shall include any compilation that incorporates such a preexisting work.

C.11. ELIGIBLE ENTITIES AND ORGANIZATIONS

As stated above, the CTI platform shall be made available for the following entities and organizations as part of the MVP:

1) FCEB (Participating Departments and Agencies will be provided separately)

The government expects that the solution shall support a broader group of participating entities. The contractor shall accommodate these entities as they are identified by the government throughout the life of requirement. As stated in the scoping section C.2, this group includes but is not limited to:

1) State and Local Governments including State Fusion Centers

2) ISACs (MS-ISAC/EI-ISAC)

3) Legislative

4) Judicial

5) Critical infrastructure

a. Healthcare and SLTT organizations are currently part of an FY24 CISA pilot and may be targeted as a near term expansion.

The government expects the number of end users to increase incrementally over time, but the historical number of participants from the above entities has been approximately 5,000.

C.12. ROLES AND RESPONSIBILITIES

Roles and Responsibilities are not yet determined.

C.13. KEY PERSONNEL

The following are the minimum personnel who shall be designated as “key.” Additional key personnel beyond the below positions may be added/proposed if rationale is provided.

1. Program Manager (PM)

2. Data Collections Manager

The government desires that key personnel be assigned for the duration of the task order. Key personnel may be replaced or removed subject to Section 9.5, Key Personnel Substitution.

C.13.1 PROGRAM MANAGER

The contractor shall designate and provide a PM to serve as the Government’s primary POC. The contractor designated PM shall provide supervision and guidance for all contractor personnel assigned to the subject effort, supervise on-going efforts, and manage contract performance. The PM is ultimately responsible for the quality and efficiency of the requirement to include both technical issues and businesses processes. The PM shall have the ultimate authority to commit the contractor’s organization and make decisions for the contractor’s organization in response to Government issues, concerns, and comments, as well as be proactive in alerting the Government to potential contractual or programmatic issues. The PM shall be readily available to respond to Government questions, concerns, and comments, as well as be proactive in alerting the Government to potential contractual or programmatic issues. The PM shall be an employee of the Prime Contractor. The PM shall have the following qualifications:

a. Experience in completing, leading, or directing the work of others on projects similar to the size, scope, and complexity of the work and environment described in the Task Areas.

b. Managerial experience providing technical advice, organizing, planning, directing, and managing staff to ensure goals and objectives are achieved.

c. Experience with the management and supervision of teams comprised of technical multi-discipline employees and teaming partners/subcontractors.

d. Experience with risk management and problem solving.

e. Experience with customer service, including ability to communicate clearly with both operational teams and senior leadership.

f. Desired qualifications

i. Experience managing teams working on system architectures, networks, and operations.

ii. Basic familiarity with cyber threat intelligence/analytical processes and concepts

(such as TTPs, IOCs, ATT&CK, Diamond Model, etc.).

C.13.2 DATA COLLECTIONS MANAGER

The Contractor shall designate and provide a Data Collections Manager that shall implement the TIES data management strategy, ensure data is high-fidelity, and identify data gaps and redundancies. This individual will be responsible for the overall quality and consistency of data for the TIES solution as well as the general management of routine and customized reporting, data enrichment and oversight of information supporting routine and special projects.

The Data Collections Manager shall have the following qualifications:

a. Experience navigating, organizing, analyzing, and visualizing large amounts of data.

b. Basic familiarity with cyber threat intelligence/analytic processes and concepts (e.g., TTPs, IOCs, MITRE ATT&CK, Diamond Model, etc.).

c. Excellent problem solving and analytical skills.

d. Experience with modern database and information technologies.

e. Excellent communication skills to translate complex problems for a variety of technical and non-technical audiences as well as for senior leadership.

f. Experience understanding the data needs of a diverse set of stakeholders, including federal and non federal cyber threat analysts, CISO-level decision makers, service managers, and CISA-internal…