FA2-061_TORFP_(FINAL).doc

Environmental Protection Agency

Office of Enforcement and Compliance IT Security Certification and Accreditation Support for Integrated Compliance Information System Task Order Request for Proposal

TORFP # FA2-061

May 8, 2015

FINAL

Table of Contents

41.0

STATEMENT OF OBJECTIVES

41.1 Overview

41.2 C & A Service Requirements

51.3 Service Descriptions and Other Requirements

92.0

PROPOSAL INSTRUCTIONS

92.1 Technical Factor

112.2 Price Factor

122.3.1 Estimated Level of Effort

122.3.2 Period of Performance

133.0

EVALUATION CRITERIA

133.1 Technical Factors (100%)

143.2 Price Factor

154.

BACKGROUND INFORMATION

Office of Enforcement and Compliance

ICIS

IT Security Certification and Accreditation Support Services Task Order Request for Proposal This Task Order Request for Proposal (TORFP) for IT Security Certification and Accreditation (C & A) Support for the. It is being issued by EPA with the intent to issue a Task Order under the ITS-BISS Base Contract. The terms and conditions of the Base Contract apply to this Task Order as appropriate.

1.0

STATEMENT OF OBJECTIVES

1.1 Overview

The mission of the OECA is to protect people's health and safeguards communities by assuring compliance with the nation's environmental laws and by taking enforcement action when laws are violated. Every three years, EPA sets nation al enforcement initiatives to focus civil and criminal enforcement resources and expertise on serious pollution problems affecting communities.

The purpose of the lCIS is to provide a central source of compliance and civil enforcement data and processing for OECA. Assurances that the data are not subject to unauthorized or accidental alterations are important to ensure that accurate data are presented. To protect the data within the ICIS database, security procedures have been and continue to be designed and implemented to maintain the integrity of the data, to allow or disallow a user access to a database object in the ICIS database, to identify which user creates or changes the data, and to provide recovery of the data when necessary.

ICIS is a web-based system that enables individuals from the states and EPA to access multi-media enforcement and compliance and NPDES permit and other data from any desktop connected to the Internet. EPA's ability to target the most critical environmental problems in increasing as the system integrates data from all media. Information can be submitted to ICIS either directly through an internet browser or electronically through transaction s from other systems and formatted using XM L (extensible Markup

Language). DSIMB provides direct customer support plus a number of tools that give customers information about each component of the system. The three major components of ICIS are described below.

ICIS FE&C: supports the reporting of Federal Enforcement and Compliance activities for all media for EPA at Headquarters and in the Regional offices.

ICIS-NPDES: supports the programmatic requirements of the National Pollutant

Discharge Elimination System (NPDES) program under the Clean Water Act.

ICIS-Air: supports the programmatic requirements of the Clean Air Act (CAA) Title V stationary source enforcement and compliance program.

In addition, ICIS supports two electronic reporting tools which are used by regulated entities to submit data to EPA and other regulatory authorities:

NetDMR: provides the capability for regulated entities to directly enter NPDES

Discharge Monitoring Report (DMR) data into ICIS.

The NetDMR Tool allows members of the regulated community to submit electronic

DMRs to EPA. A CROMERR checklist for NetDMR has been thoroughly reviewed and vetted by EPA's Technical Review Committee (TRC) to ensure that electronic submissions from the regulated community using NetDMR are in compliance with OMS and NIST guidelines for Identity Proofing and Non-repudiation. NetDMR users can view, update, and submit only data associated with their permit(s) only after successfully logging into the system. Logins are tracked and displayed to the user on subsequent logins.

NPDES e-Reporting Tool (NeT): provides the capability for regulated entities to directly enter a variety of required NPDES data into ICIS. NeT is used to enable eReporting for data other than DMRs, such as Notices of Intent, Notices of Termination, etc..

ICIS is classified as a moderate risk system within Xacta.

The last formal security TVA for the ICIS application was completed on 06/15/2012.

1.2 C & A Service Requirements This task order requires the Contractor to provide the following IT C & A support services for ICIS.

ICIS

_X__ Technical Vulnerability Assessments (TVAs) and POA&M Update Service

(Note: A Report of the Findings is produced for all TVAs.)

_X__ The Contractor shall use the EPA T-VAL lab to perform scanning.

___ The Contractor shall provide all tools and perform vulnerability scanning.

_X__ System Testing &Evaluation and POA&M Update Service

___ System Security Plan (SSP) Creation or Update Service

___ The revised SSP shall reflect revised NIST Guidance (Rev 3)

___ POA&M Corrective Action Planning Assistance (3, 6, 12 months, or continuous).

1.3 Service Descriptions and Other Requirements Certification and Accreditation (C & A) Service Descriptions:

1) Technical Vulnerability Assessment (TVA) and POA&M Update Service

a. Objective:

i. Determine technical system security posture through the use of automated tools.

b. Services provided:

i. System Scanning:

1. [EPA Option] The contract shall leverage the results from the applicable scanning capabilities provided by EPA’s TVA Lab [Nessus and Foundstone for all systems, WebInspect for web-enabled applications, AppDetective for database applications].

2. [Contractor Option] The contract shall

a. Complete necessary scan request forms

b. Develop and distribute scanning rules of engagement to stakeholders

c. Conduct scans utilizing contractor tool-sets applicable to the system in question.

ii. Conduct a detailed analysis of scan results, which includes the determination and removal of false positives, and document in a scan analysis report that identifies:

1. Vulnerabilities discovered

2. Vulnerability risk ratings

3. Affected components

4. Recommendations for mitigation

iii. Document POA&M entries for applicable findings in a spreadsheet that includes all necessary fields to facilitate the entry of findings into ASSERT.

c. Deliverables:

i. Package of all scan results received and/or generated that were utilized during the assessment.

ii. Scan analysis report (Draft and Final)

iii. POA&M Spreadsheet

2) System Testing & Evaluation (ST&E) and POA&M Update Service

a. Objective:

i. Conduct a thorough assessment of security control implementations for a given system in order to determine if they are implemented, operating as intended, and achieving the desired results.

b. Services provided:

i. TVA (see above for included services)

ii. Develop ST&E Test Plan

iii. Full analysis of security controls, as documented in the System Security Plan (SSP), utilizing:

1. Interviews of system and support personnel

2. Examination of relevant system artifacts, documentation, and system settings

3. Testing of relevant capabilities through the use of test IDs and tools (e.g., verification that access control mechanisms prevent certain actions, timeout sessions, filter input, etc.)

iv. Develop ST&E Security Assessment Report (Draft and Final) that includes:

1. Assessed status for all security controls

2. Description of methods or evidence used to make control status determination

3. List of all artifacts, documents, and records collected and/or relied upon as evidence [package of items issued separately for retention purposes]

4. Incorporates results from TVA

5. Summarizes cumulative risks

6. Risk ratings and corrective action recommendations provided for all identified weaknesses

v. Document POA&M entries for applicable findings in a spreadsheet that includes all necessary fields to facilitate the entry of findings into ASSERT.

c. Deliverables:

i. ST&E Security Assessment Report (Draft and Final)

ii. POA&M Spreadsheet

3) System Security Plan (SSP) Creation or Update Service

a. Objective: Generate or update the System Security Plan.

b. Services provided:

i. Determination or validation of system control environment [identify which are inherited, agency fixed, system specific, or not applicable]

ii. Validate FIPS 199 system categorization determination

iii. Develop and/or validate that control responses are complete and meet all required control criteria according to NIST SP 800-53 Rev 3 (for the applicable system categorization baseline), assigned the correct status [planned, in-place, etc.], properly reflect the inherited system if applicable, and have been assigned the correct points of contact.

iv. Develop/update SSP utilizing EPA’s Rev 3 SSP template (Draft and Final)

c. Deliverables:

i. System Security Plan (Draft and Final)

4) POA&M Corrective Action Planning Assistance Service

a. Objective: On-going support for managing and mitigating system risks.

b. Services provided:

i. Provide on-going support for the development, evaluation, and testing of corrective action plan options for identified weaknesses.

ii. Maintenance of the system POA&M by making all necessary updates resulting from development or successful implementation of corrective action plans.

iii. Provide necessary details required to update relevant system artifacts upon implementation of corrective actions (SSP, CP, RA)

c. Deliverables:

i. System POA&M is kept up to date at all times.

Other Requirements

This section defines other requirements for performing this task order. The Contractor shall consider all of these requirements in developing their Technical Approach. The Contractor shall also consider new or updated Federal and EPA IT security policies and standards in developing their Technical Approach. All applicable NIST, FIPS, and EPA IT security policies and standards shall apply to this TORFP.

1. The Contractor will categorize identified risks and vulnerabilities as management, operational and technical and list recommendation(s) to remediate each.

2. The Contractor will perform the services identified in this TORFP in accordance with Standard EPA methodology and in consideration of applicable current Federal Standards and Regulations. These Standards and Regulations are listed in the Background Section of this document.

Note: If the Contractor identifies any potential conflict between an EPA standard or methodology and other Federal Standard or Regulation, this information shall be brought to the attention of the TOPO and ITS-BISS PO.

3. Pursuant to EPA Directive 2195A1, EPA’s Information Security Manual, contractor personnel with an authorized access to confidential information are required to have an appropriate level background investigation conducted by the Office of Personnel Management (OPM). Based on OMB Circular A-130 Appendix 3, “Security of Federal Automated Information Resources,” the level of investigations should be commensurate with the risk and magnitude of harm that could result from the disclosure of information to which the contractors have access. Accordingly, Minimum Background Investigations (MBIs) will be completed for the Contractor’s employees working on this assignment. Those employees will be required to complete an OPM Standard 85P form and forward it to the Office of Personnel Security through the Contractor’s Security Officer. A letter will be provided from the Contractor’s Security Officer when a similar or higher level security clearance exists for the Contractor’s employees.

4.

Deliverables will use language and formats for information and options in a manner appropriate to executive decision-making bodies in EPA.

2.0

PROPOSAL INSTRUCTIONS

The Contractor shall comply with the following instructions for preparing the Task Order Proposal (TOP). Failure to do so may result in the Contractor’s proposal being considered non-compliant with the terms and conditions of the Base Contract.

The first page of the technical proposal and the cost proposal should indicate the TORFP Number FA2-061 and title: IT Security Certification and Accreditation Support for ICIS.

2.1 Technical Factor

The Contractor’s TOP is to be submitted to the Contracting Officer at the date and time specified by the Contracting Officer.

Written Proposal

The Contractor shall submit a written proposal as outlined in the table below.

(Double-Sided)

Add 1 page for each system

The Written Proposal shall contain a Table of Contents with page numbers for all major proposal sections. The cover page, the table of contents, and resumes are excluded from the page count.

The Written Proposal shall be submitted as an MS Word document. Font size for the proposal shall be at least 12 point. Font size for tables and diagrams is at least 9 point. Page margins shall not exceed 1 inch.

Sub-Factor 4 – Staffing Approach: The Contractor shall describe their staffing approach in the form of a Staffing Plan. The Staffing Plan shall include resumes for the personnel proposed for the Task Order. The Plan shall describe the role and level of involvement of each proposed team member in implementing the SOW tasks. The Plan shall describe the Contractor’s proposed procedure for replacing personnel when team vacancies occur. If Key Personnel are proposed, the Plan shall identify the duration of their proposed assignment(s).

2.2 Price Factor Pricing —the Contractor shall propose a Firm, Fixed-Price (FFP) proposal for this Task Order.

a) The Contractor’s Price Proposal shall provide the cost and hours for each required service and an overall summary for the entire task order.

b) If the Contractor’s FFP is bounded by any special conditions, they must be stated in the Cost Proposal.

2.3 Conflict of Interest Vendors shall provide a completed version of the certification at EPAAR 1552.209-72 with any proposal submitted under this TORFP.

Consistent with the terms of the prime contract, vendors shall disclose any actual or potential conflict of interest to the Contracting Officer as early as possible and prior to submission of any proposal. The disclosure shall include a description of actions which the Contractor has taken or proposes to take, after consultation with the Contracting Officer, to avoid, mitigate, or neutralize the actual or potential conflict of interest. Upon receipt of the information, the Contracting Officer shall make a final decision within three (3) business days.

2.3.1 Estimated Level of Effort

This is a Firm-Fixed Priced Task Order and no LOE is being provided by EPA.

2.3.2 Period of Performance

The Period of Performance is from the date of the Task Order’s Award to the date of the Task Order’s Completion July 31, 2015

3.0 EVALUATION CRITERIA

EPA intends to issue this Task Order to the contractor offering the best value to the Government. Only proposals that are considered technically acceptable will be considered for an award. The technical and cost factors will be evaluated to determine the solution that presents the highest quality and lowest risk while providing the best value to the Government. Proposals will be evaluated on the basis of strengths, weaknesses, deficiencies, and risks for each of the factors below. The technical factors will be more important, though not significantly, than the cost factor.

Please note that, as stated in Section G of the ITS-BISS base contract, the Contracting Officer’s selection decision on each TORFP shall not be subject to the protest or dispute provisions of the base contract, with the exception of a task order increases the scope or maximum value of the contract.

3.1 Technical Factors (100%)

Sub-Factor Weightings:

Sub-Factor 1 – Technical Approach (25%): The Contractor’s SOW will be evaluated on its quality and the extent to which it:

a) Achieves the objectives and requirements of the TORFP.

b) Clearly and completely addresses all tasks and subtasks in the SOW.

c) Applies sound technical IT security principles, processes and practices.

d) Reflects an understanding of the system(s) as well as its operating environment, including applicable management, operational, and security controls.

Sub-Factor 2 – Task Level Experience (TLE) (25 %): The Contractor’s proposal will be evaluated on the results of the TLEs and the impact of the assessments on satisfying the customer’s C&A needs and requirements. The TLEs shall also be evaluated on the similarity of their size, scope, complexity, and relevance.

EPA may utilize other sources of relevant task-level experience (e.g., past performance) information such as the Contractor Performance Assessment Rating System (CPARS) or personal experience with the vendor's work in evaluation of this factor.

Sub-Factor 3 – Management Approach (25%): The Contractor’s Project Management Plan will be evaluated on its quality and the extent to which it:

a) Clearly, completely, and effectively addresses the planning, scheduling, implementation, reporting, customer communications, and other project management elements of the task order.

b) The Contractor’s Project Schedule will be evaluated for realism, logic of schedule dependencies, ability to meet or exceed applicable target dates in TORFP, and for its understanding of unique or significant challenges in meeting the target delivery dates.

c) The Contractor’s Performance Measurement Plan and Quality Assurance Plan will be evaluated on their clarity, completeness, and appropriateness to the activities and deliverables of the TORFP.

Sub-Factor 4 – Staffing Approach (25 %): Proposed personnel will be evaluated on their qualifications to perform in the roles defined in the Staffing Plan, their skills and abilities to provide the required support based on the SOW at the time of project start-up, the proposed LOE for each individual relative to the SOW task, and their experience with projects of similar size, scope, and complexity.

3.2 Price Factor Proposed cost will be evaluated to determine if it is reasonable in relation to the proposed Technical Approach (proposed SOW and component tasks) and the Management Approach. The evaluation shall consider the overall cost of the proposal and the pricing of individual tasks. The evaluation shall also consider whether appropriate labor categories have been proposed for each task based on the complexity and technical requirements of the task order. The cost proposal shall also be evaluated in comparison to the Independent Government Cost Estimate (IGCE).

4.

BACKGROUND INFORMATION

The information in this section is provided for the Contractor to reference when preparing their proposal.

ICIS Background Information ICIS is a web-based system that enables individuals from the states and local governments and EPA to access multi-media enforcement and compliance and NPDES permit data, CAA enforcement and compliance data, and other data from any desktop connected to the Internet. EPA's ability to target the most critical environmental problems is increasing as the system integrates data from all media. Information can be submitted to ICIS either directly through an internet browser or electronically through transactions from other systems and formatted using XML (extensible Markup

Language). DSIMB provides direct customer support plus a number of tools that give customers information about each component of the system System Overview:

Describe the system in terms of its purpose, scope, core and specialized functionality and capabilities, and other notable characteristics and attributes.

ICIS is the central enforcement and compliance data system for EPA. The system integrates enforcement and compliance data to support multimedia and cross-sector analysis and promote the integration of other environmental information. The application is being developed in a multi-phase project plan. The initial phase implemented functionality that was used by Agency users that reside at EPA, both in Headquarters and at the Regional Offices. ICIS has expanded to include all the prior functionality of PCS and AFS and the user base now includes not only more Agency users, but also State and local users located outside of the EPA Intranet.

Describe any unique or special management, operational, or technical security controls that apply to the system. N/A Systems-related Information:

Please attach or insert any system diagrams or graphics that support your responses to the questions in this section.

1. Where is the system, application or network physically located?

The general support systems are physically located at the U.S. EPA NCC data center located in RTP, North Carolina. The data center is managed by EPA’s National Computer Center Division (NCC) and is staffed by non-civil service employees under contract to NCC. Changes to the security of the general support systems to support any additional ICIS security requirements will be negotiated with NCC as required

2. What organization or entity provides O&M and technical support for the system, application, or network? CGI

3. What is the nature of the system or application? Transaction process, data warehouse, and reporting.

4. What is the hardware and software environment for the system, application, or network? Diagram above.

5. Who is the user community and what is its size? 2000 users at EPA, State and local regulatory authorities

a. How do they use the system? Input data, run reports

b. What organizations are the end users associated with? Federal and state and local users.

c. Are they geographically dispersed? Across the US

d. How do they access the system? Web based via WAM ID

6. What other EPA or non-EPA systems does the system interface with? For system interfaces, please indicate the nature of the interface (e.g., Internet, GSS, Network)? FRS, ECHO, CDX, Oil & Gas Database, etc.

7. Are any MOUs or MOAs in place for this system, application or network? Please describe the primary purpose of MOU/MOA. Yes 2

8. Are there any unique aspects of the system, application, or network worth noting?

9. What version of 800-53 is currently in use (Rev 3)

10. When was the last TVA performed? This will be done in April

11. When was the security plan last updated? February and It will be updated in April

12. Have GSS inherited controls or Agency Common Controls been identified for this system? Yes

13. Does the T-VAL perform vulnerability scanning for this system? Yes.

14. What frequency is scanning conducted? Does scanning include all assets? Yes. When was the last scan performed? Full scan last year in April, However scans are done on regular intervals.

15. Is remote access available? No. If so, any limitations on remote testing? yes A copy of the last SSP and TVA will be made available by encrypted files within 2 weeks after award.

Additional Federal Standards and Regulations Applicable to this Task Order Reference Description/URL Federal Information Processing Standards (FIPS) FIPS documents are mandatory federal standards that federal agencies must follow.

FIPS 140-2, Security Requirements for Cryptographic Modules, May 2001, provides a standard that will be used by Federal organizations when these organizations specify that cryptographic-based security systems are to be used to provide protection for sensitive or valuable data.

FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004, documents standards for categorizing information and information systems.

FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006, specifies minimum security requirements for federal information systems in seventeen security-related areas. Federal agencies must meet the minimum security requirements as defined herein through the use of security controls in accordance with NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems, as amended.

http://csrc.nist.gov/publications/fips/index.html National Institute of Standards and Technology Special Publications (NIST SP) 800 series NIST SP 800 series documents are federal guidelines for use by federal agencies. The following are some of the more important guideline documents available on the NIST website:

NIST SP 800-100, Information Security Handbook: A Guide for Managers, October 2006

SP 800-88, Guidelines for Media Sanitization, September 2006

SP 800-64, Security Considerations in the Information System Development Life Cycle, (revision 1 released June 2004) SP 800-61, Computer Security Incident Handling Guide, January 2004 SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories, June 2004 Draft SP 800-53A, Draft Special Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems SP 800-53 Rev. 3, Recommended Security Controls for Federal Information Systems and organizations, August 2009 SP 800-50, Building an Information Technology Security Awareness and Training Program, October 2003 SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems, May 2004 SP 800-34, Contingency Planning Guide for Information Technology Systems, June 2002 SP 800-30, Risk Management Guide for Information Technology Systems, July 2002 Draft SP 800-26, Rev. 1, NIST DRAFT Special Publication 800-26, Revision 1: Guide for Information Security Program Assessments and System Reporting Form, August 2005 SP 800-18 Rev. 1, Guide for Developing Security Plans for Federal Information Systems, February 2006 SP 800-16, Information Technology Security Training Requirements: A Role- and Performance-Based Model, April 1998 http://csrc.nist.gov/publications/nistpubs/index.html EPA Orders

EPA Orders are EPA’s internal administrative polices.

2030.1A, Continuity of Operations Policy, 4/27/05

2040.1a1, National Security Emergency Preparedness Policy, 2/6/01

2060.1A, Disaster Assistance Coordination, 12/2/77

2100.1, Accessible Electronic and Information Technology, 4/5/06 http://intranet.epa.gov/rmpolicy/ads/transorders.htm EPA Manuals EPA Manuals are information technology/information management and related policies.

2100B8, Information Resources Management (IRM) Policy Manual, 6/15/01

2100.3A1, Policy on Limited Personal Use of Government Office Equipment, 4/2/04

2100.5, System Life Cycle Management Policy, 4/7/06

2165.1, Software Management and Piracy Policy, 5/15/03

2195A1, Information Security Manual, 12/20/99 http://intranet.epa.gov/oei/imitpolicy/policies Security Procedures

(IT SECURITY Website)

This website contains EPA security policies, such as the ANSP; procedures, such as the Personnel Security Handbook; technical operations and standards that describe the technical standards required to meet Agency security policies; and security-related guidance that provides details on technical implementation of security requirements.

http://intranet.epa.gov/itsecurity/polprocedures.html Operational Directives

Technical information that describes how to implement procedures that pertain to other assets.

http://basin.rtpnc.epa.gov/ntsd/directive.nsf LAN Operational Procedures and Standards Manual (LOPS) Technical information that describes how to implement procedures that pertain to LANS.

http://rtlanfo.rtp.epa.gov:9876/lanbbs.nsf/c414e620d7fe6d42852562110051e40f/ e958ce49f24febec85256ed00048f34f?OpenDocument

NCC Systems Engineering Procedures

Technical, miscellaneous, and deployment papers.

http://lansys.epa.gov/ http://cfint.rtpnc.epa.gov/otop/network/index.cfm http://ion.rtpnc.epa.gov/UNIX/policies/index.html Standard Configuration Documents (SCD)

The purpose of an SCD for any Operating System (OS) is to provide standards for protecting the EPA network and the systems attached to the network. SCDs cover the minimum configuration and security requirements for connecting to EPA’s network. All OSs connected to any part of the EPA network or any sub-net must comply with the appropriate SCD.

http://cfint.rtpnc.epa.gov/otop/network/index.cfm

PAGE