SOW_IA Compliance_DRAFT FINAL.pdf

U.S. Department of Homeland Security (DHS) Science & Technology Directorate (S&T)

Office of the Chief Information Officer (OCIO)

S&T OCIO Information Assurance Compliance Support Services

Statement of Work (SOW)

1 GENERAL

The U.S. Department of Homeland Security (DHS) Science & Technology Directorate (S&T) Office of the Chief Information Officer (OCIO) focuses on providing the tools, technologies, and knowledge products for the nation’s Homeland Security Enterprise. S&T strives to enable effective, efficient, and secure operations across all homeland security missions by applying scientific, engineering, analytics, and innovative approaches to deliver timely solutions in support of DHS's mission.

The S&T OCIO supports S&T by providing the right people, technology, property, security, and processes. S&T includes approximately 2000 staff in Washington, D.C. and laboratories in New York, New Jersey, Maryland, Alabama and Florida. DHS S&T employs approximately 22 distinct information technology (IT) Systems with currently 2000 endpoints and projects. By the end of this period of performance, these numbers are anticipated to grow to 40 systems with approximately 4000+ endpoints. These systems include multiple General Support Systems (or networks), three distinct Cloud-based deployments, a presence within two Federally Funded Research and Development Centers and a number of standalone and experimental systems supporting Laboratory Operations.

DHS S&T OCIO requires professional technical support services to assist the organizations, missions, functions, and objectives enabling DHS S&T to integrate innovative technology into everyday use by the DHS operational Components. DHS S&T requires this support to maintain and evolve its organizations.

1.1 BACKGROUND

DHS S&T OCIO consists of three branches:

• Business Management Office (BMO)

• Engineering Group, which includes:

• Engineering

• Operations And Maintenance (O&M)

• Information Assurance (IA), which includes:

• Information Systems Security Office

• Compliance

• Service Delivery (SD), which includes:

• IT Operations and Maintenance (O&M)

• S&T Collaborative Solutions (STCS)

1. SCOPE

The scope of work is to support the Information Assurance Compliance function within S&T OCIO. This contract is limited to S&T contract staffing only.

2 SPECIFIC REQUIREMENTS

The Contractor shall support the S&T Chief Information Security Officer (CISO) and shall facilitate Federal Information Security Modernization Act (FISMA, 2014) compliance for all S&T IT systems. Compliance support, including testing and engineering services, will ensure that all Information Systems Security Officers (ISSOs) have the necessary information throughout the life cycle of each system. ensure adherence of S&T IT operations to all DHS rules and regulations associated with DHS Management Directive 4300 and FISMA compliance.

4300A Sensitive Systems Policies.

It is anticipated that work will occur at S&T locations in Washington DC, but travel may be needed to other S&T locations specified in Section 4.10 Place of Performance.

The base effort shall be awarded as a Time and Material (T&M) contract Line-Item Number (CLIN). Surge support may be required and shall be awarded as a T&M CLIN. The Contractor shall meet the performance objectives listed below in the completion of the tasks detailed below.

2.1 Program Management Support

Program Management Support shall perform the following:

• Provide the management and functional support needed to manage all aspects of delivery of the Information Assurance Compliance Support Services defined in this requirement.

Program management activities include, but are not limited to transition planning, special project planning, resource management, quality assurance, risk management, status and problem reporting, and administrative support.

• Ensure that all COR-approved projects under this requirement are executed following the concepts in the Project Management Institute (PMI) Project Management Body of Knowledge (PMBOK) guide. For each project, the Contractor shall prepare a Project Management Plan describing the technical approach, organizational resources, risk management, communication management and other management controls to be employed to meet the cost, performance, and schedule requirements throughout task order execution.

• Provide professional service support to assist with administrative and program management functions to include but not limited to project plan development and coordination, document preparation, scheduling, record keeping, recording minutes, after https://usdhs.sharepoint.com/sites/dhsconnect/org/comp/mgmt/ocio/ciso/Pages/sspolicy.aspx action reports, preparing briefing materials and packages, information research and archival, data entry, and document control activities.

• Develop effective tracking, reporting mechanisms, create effective workflows and notifications, develop process flow diagrams, dynamic reports, and dashboards to provide key risk summary to the S&T CIO and CISO.

2.2. Compliance Services.

Compliance services shall perform the following:

• validate all information system security reporting.

• oversee the Plan of Action and Milestones (POA&M) process.

• maintain an inventory of all S&T information systems.

• develop and publish procedures necessary to implement the requirements of DHS IT security policy for S&T information systems.

• support the S&T CISO in ensuring that security issues are being addressed in configuration reviews and Change Control Boards (CCBs).

• implement an IT Security Review and Assistance Program to aid the ISSOs in authoring security assessment and authorization documentation.

• Conducting security Assessment and Authorization (A&A) or Ongoing Security Assessments as outlines by National Institute of Standards and Technology (NIST) SP 800-37; Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy; and NIST SP 800-30; Guide for Conducting Risk Assessments, to ensure the Information System is implemented following NIST SP 800-53;

Security and Privacy Controls for Information Systems and Organizations.

• Ensuring the Security Assessment Plan (SAP), Security Assessment Report (SAR) and Authorization to Operate review slides are prepared in collaboration with the ISSO (for every system going through the ATO or O-ATO process) and presented to the S&T CISO and CIO.

• Ensuring the ATO status for the system going through assessment (ATO or O-ATO) is timely and accurate documented in the Department’s approved Governance and Risk Compliance (GRC) tool.

• Provide High Value Asset (HVA) Overlay assessments

• work with any automation tool to support Continuous Authorization to Operate (cATO)

• guide efforts to bring all available systems under the On-going Authority to Operate (oATO)

• schedule IT security reviews and assistance visits and ensuring these visits are completed and participating in review and assistance visits.

• coordinate with ISSOs and providing guidance and oversight in identifying and documenting deficiencies and prioritizing them based on the mission, risk, and funding.

• evaluate configurations and implementation of firewalls, proxy servers, routers, Virtual

Private Networks (VPNs), Intrusion Detection System (IDS), wireless networks, etc. against legal requirements, departmental/local policy, industry best practices and vendor recommendations.

• conduct vulnerability assessments and penetration testing for all IT systems, with the assessment/testing level to be based on each system’s status within the security assessment and authorization cycle and authority to operate status.

• Analyze systems for potential vulnerabilities that may result from improper system configuration, hardware or software flaws, or operational weaknesses.

• Respond to vulnerability issues within 5 Calendar days of occurrence.

• Present any security issues that are found to the system owner with an assessment of their impact and a recommendation for mitigation or technical solution.

• perform scans on Operation System Web Application, Dynamic Application Security Testing

(DAST), Databases across the systems under the purview of the S&T Office of the Chief Information Office

• provide penetration testing and ethical hacking services in network, wireless and web application environments; preparing all necessary documentation to include but not limited to; Standard Operating Procedure (SOP), Rule of Engagement (ROE)

• provide Social Engineering (including but not limited to the ability to execute, track and report on Phishing and Spear Phishing exercises on a quarterly basis following the DHS requirements; these services shall be performed following a documented and standardized methodology SOP. The goals and objectives for each exercise will be determined by S&T

CISO.

• provide oversight into implementing, tracking and monitoring Data Loss Prevention (DLS) tools

• perform static code reviews as required, based on a given system’s status within the security assessment and authorization cycle, authority to operate status, and estimated risk profile.

Static code review includes analyzing systems for potential vulnerabilities that may result from improper system configuration, hardware or software flaws, or operational weaknesses.

Also perform static code analysis on software developed in-house and by contracted developers. present any security issues that are found to the ISSO, Compliance Officer, system owner, authorizing official, and the S&T CISO along with an impact assessment and a recommendation for mitigation and technical solution.

• review National Institute of Standards and Technology (NIST) publications applicable to FISMA and other directives for applicability to the DHS IT Security Program.

• ensure coordination among the DHS Security Operations Center and the Information Security Vulnerability Management Program when vulnerability assessments cross multiple Component responsibilities.

• ensure DHS encryption policy is implemented and enforced and advising project managers on the implementation of DHS encryption standards.

• maintain an appropriate security management posture for all S&T IT systems and assets.

• Contractor will maintain all security tools like but not limited to Axonius, SPLUNK, Continuous Detection and Mitigation (CDM), Tenable products etc. or ANY tool used in the place of the current tool sets as it occurs

• Track annual Cyber Security Awareness Training (CSAT) refresher training for all S&T members as well as the Role Based Training (RBT) for a subset of the S&T users as determined by DHS (Fed and Contract).

• coordinate cyber training for S&T personnel and other specialized admin training.

• support S&T CISO continuous monitoring initiatives by collecting, compiling and providing monthly Compliance & Testing submissions for inclusion within Cyber Scope.

• ensure compliance Cyber-Supply Chain Risk Management (C-SCRM) is adhered to in accordance with DHS mandates by monitoring and reporting the assessments performed on component systems.

2.3 Information System Security Officer (ISSO) Services.

The contractor ISSO services shall perform the following:

• comply with the ISSO Roles and Responsibilities as laid out in DHS 4300A Sensitive Systems Handbook, DHS National Security Systems Policy Directive 4300B, DHS Sensitive Compartmented Information (SCI) Systems 4300C Instruction Manual.

• ensure upon assigning or replacing that an ISSO and Alternate Information System Security Officer (AISSO) formal appointment letters are up to date and support the process to have the DHS Chief Information Security Office (CISO) designate the contractor personnel for individual systems.

• ensure that the security Assessment and Authorization (A&A) process is tracked, supported and successfully completed for all systems the ISSO is assigned to.

• ensure the accuracy of continuous monitoring information for assigned systems.

• ensure that all documentation leverages approved templates, forms, regulations, and methods.

• continuously update all security documentation, as necessary, to ensure that all information is current and that the templates, forms, regulations, and methods stay current with updates and changes in appropriate laws, regulations, mandates, directives, policies, or controls applicable towards a U.S. Federal Department / Agency throughout the lifecycle of the systems.

• work with stakeholders to assign resources and establish timelines to ensure the successful Security Authorization of a system.

• ensure that all Security Authorization documentation is delivered in a timely manner and will not negatively impact the Authority to Operate (ATO) or system go live dates.

• document all relevant NIST Publications (continuously current version), Office of Management and Budget (OMB) A-123 security controls, and DHS 4300A/B/C (continuously current version) security controls, hardening / configuration guidance, and/or applicable departmental practices and procedures for each IT system for which the ISSO is responsible.

• draft a security package and perform necessary modifications throughout DHS Risk Management Framework, based on the compliance assessment schedule of IT system to ensure the system attains and maintains its ATO.

• work closely with the System Owner to identify any additional controls that are applicable to the system to maintain a positive security posture; documenting such measures as templates for future reference and re-use.

• provide oversight and advisement on all proposed changes to an IT System as it pertains to the potential change to the existing baseline, using the established change and configuration management process.

• The contractor shall work with auditors to identify Key Controls, which must be assessed on a recurring annual basis.

• ensure to Data Loss Prevention (DLS) tools

• evaluate and provide advisement on all access requests for privileged accounts to IT systems.

• The contractor shall ensure software planned to be introduced to the production environment is evaluated and provide guidance regarding the potential for the software to introduce risk into the environment.

• track the deployment of software to the environment that is not part of the base image.

• ensure Cyber-Supply Chain Risk Management (C-SCRM) is adhered to in accordance with DHS mandates.

• The contractor shall ensure that software deployed in the environment is audited on a quarterly basis.

• The contractor shall provide reports to System Owners, Information System Security

Manager (ISSM), and to Operations and Maintenance (O&M) staff tailored with the level of detail or abstraction as appropriate.

• perform oversight of Information System Vulnerability Management (ISVM) inquiries and ensure that the inquiries are addressed and reported within the allotted timeframe and reported via the accepted methods and formats.

• generate Plan of Actions & Milestones (POA&Ms) for each non-compliant control and/or weakness for each managed IT System based on the compliance assessment schedule

• manage all applicable POA&Ms throughout the lifecycle of the IT system.

• support the Security Incident Response team in the remediation, documentation and reporting of all incidents for the assigned system.

• perform a weekly review of logs for each IT system and present a weekly system status report of any anomaly or malicious activity.

• participate in project discussions in support of the System Owner.

• track and report security requirements throughout the life cycle of all projects that are within the accreditation boundary of their assigned system.

• work closely with the Office of the Chief Information Security Officer (OCISO) to provide guidance and oversight for all requested initiatives. provide timely and detailed responses to all data calls.

• provide support for all Office of the Inspector General (OIG) and other external audit activities.

• review the security system documentation when determining the appropriate security categorization.

• review selected controls that are to be implemented within the systems security boundary.

• take the appropriate DHS security training for ISSOs at no more than 30 days after receiving the award and annually thereafter in accordance with DHS 4300 A or B or C as appropriate.

• provide oversight and guidance regarding requests to modify technical policies such as firewall rules, ports, protocols, etc. for each IT system.

• coordinate with and brief Federal staff on all activities pertaining to each IT system as requested.

• continuously maintain a thorough understanding of all configurations, architecture, installed software, accounts (both Operating System and Application), data flows, ports, protocols, and other relevant data for each IT System.

• ensure that the System Design Document for each IT system is updated by the appropriate operational group to accurately reflect the approved state of each IT system before the scheduled security assessment.

• The contractor may be nominated to serve as a device sponsor with the ability to issue public key certificates for devices within component systems.

• ensure that Configuration Management is continuously updated with the appropriate system configurations via the program operation maintenance group.

• The contractor will attend all DHS S&T All Hands Meetings. This includes the S&T CIO All Hands Meetings as well as the All-Hands Meetings hosted by Office of Enterprise Services (OES) and the Science and Technology Directorate as a whole

• coordinate with and brief the ISSM and System Owner on all scores on the FISMA scorecard concerning activities pertaining to each IT system as requested.

• support the systems change management process by reviewing proposed Change Requests (CRs) and participate in the ICCB or C-ICCB where the proposed changes are reviewed.

• establish and maintain documentation, configuration, and change management for the Cloud Infrastructure.

• For FedRAMP applicable systems, review the baseline security controls in the FedRAMP security controls listed at: www.fedramp.gov.

• For FedRAMP applicable systems, review the Cloud Service Providers User Guide explaining how prospective users (government agencies) will use the system.

• identify the risks associated with the cloud services, the rationale for accepting the risk, and/or provide the risk mitigation solutions.

• The contractor shall, based on the compliance assessment schedule, assist in obtaining the regular reports from the Cloud Provider Security Monitoring Operations (e.g., SOCs) for Cyber Security Risk Management and Compliance (CRMC) support.

http://www.fedramp.gov/

• assist with communication and coordination between the DHS Incident Response and the Cloud Provider Incident Responders in any incident handling activities involving DHS data.

• assist in CISO related meetings associated with Cloud.

• provide expertise on Cloud, FedRAMP, and 3PAO processes.

• assist with establishing the DHS CDM Management Plan for Cloud systems based on the compliance assessment schedule

• assist with the development of Enterprise Service Common Control inheritance based on the compliance assessment schedule by clearly identifying the providers of all the Common Controls within the DHS portfolio (Systems and FedRAMP systems) and review the controls annually. support the maintenance and the validation of the Common Control Programs for CSP (Cloud Service Providers) by reviewing the existing programs for necessary updates annually.

• perform ISSO responsibilities for current and proposed cloud service offerings with DHS-internal cloud service providers and system stakeholders.

• engage the Common Control Working Group (CCWG), and ISSMs to further educate them on policies, standards, processes and procedures for FedRAMP and Common Controls.

• support the CISO in maintaining the COMSEC Inventory. This will include maintaining the necessary documentation and records required to keep the COMSEC Program in compliance with DHS Policy. The Contractor will also perform any necessary upgrades and maintenance required to keep the COMSEC Equipment in operation. This role involves maintaining a Top Secret/ Sensitive Compartmented Information (TS/ SCI) Clearance in order to access the necessary facilities and materials.

• act as the Homeland Secure Data Network (HSDN) Trusted Agent (TA). This role is an essential element in the process for provisioning user accounts by performing the final validation of a user’s identity before issuing the necessary authentication token to access their account. This role involves maintaining the SECRET Clearance necessary to access HSDN as well as undergoing training and maintaining the records to keep S&T in compliance with DHS Policy.

2.4 Information System Security Manager Services. (ISSM)

The contractor ISSM services shall perform the following duties as outlined under the NIST800-37, this includes but not limited to:

• read and track with stakeholders, reoccurring reporting to DHS as well as to S&T management to include proper metrics for all cyber mandates; Executive Orders (EO), Emergency Directives (ED), Office of Management and budget (OMB) memorandums, Department of Homeland Security Cyber Task Orders (CyTO) and others as required.

• assign an ISSM that will oversee the activities of the ISSO Team and ensure the quality of the products being submitted.

• ensure that all IT Systems have adequate ISSO Support

• establish the cadence for all control assessments and documentation updates

• review all security documentation for completeness and accuracy

• act as the interface between the ISSO Team and Federal Management

• act as the primary point of contact with the DHS Privacy Office with regards to the handling of Privacy Incidents

• have knowledge of Continuous Monitoring requirements.

• have knowledge of Ongoing Authorization.

• have knowledge of computer networking concepts and protocols, and network security methodologies.

• have Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

• provide working knowledge on Data Loss Prevention (DLS) tools

• have knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.

• have knowledge of cybersecurity and privacy principles.

• have knowledge of cyber threats and vulnerabilities.

• have knowledge of specific operational impacts of cybersecurity lapses.

• have knowledge of how security/privacy impacts program office mission.

• have knowledge of cyber defense and vulnerability assessment tools and their capabilities.

• have knowledge of cryptography and cryptographic key management concepts.

• have knowledge of organization's enterprise information security architecture.

• have knowledge of organization's evaluation and validation requirements.

• have knowledge of Security Assessment and Authorization process.

• have knowledge of cybersecurity and privacy principles used to manage risks related to the use, processing, storage, and transmission of information or data.

• have knowledge of vulnerability information dissemination sources (e.g., alerts, advisories, errata, and bulletins).

• have knowledge of cybersecurity and privacy principles and organizational requirements

(relevant to confidentiality, integrity, availability, authentication, non-repudiation).

• have knowledge of Risk Management Framework (RMF) requirements.

• have knowledge of information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).

• have knowledge of current industry methods for evaluating, implementing, and disseminating information technology (IT) security assessment, monitoring, detection, and remediation tools and procedures utilizing standards-based concepts and capabilities.

• have knowledge of new and emerging information technology (IT) and cybersecurity technologies.

• have knowledge of Privacy Impact Assessments.

• have knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).

• have knowledge of systems diagnostic tools and fault identification techniques.

• have knowledge of the organization’s enterprise information technology (IT) goals and objectives.

• have knowledge of Supply Chain Risk Management Practices (NIST SP 800-161).

• have knowledge of the organization's core business/mission processes.

• have knowledge of applicable laws, statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures.

• have knowledge of information technology (IT) supply chain security and supply chain risk management policies, requirements, and procedures.

• have knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).

• have knowledge of security architecture concepts and enterprise architecture reference models (e.g., Zachman, Federal Enterprise Architecture [FEA]).

• have knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, Clark- Wilson integrity model).

• have knowledge of Personally Identifiable Information (PII) data security standards.

• have knowledge of Payment Card Industry (PCI) data security standards.

• have knowledge of Personal Health Information (PHI) data security standards.

• have knowledge of laws, policies, procedures, or governance relevant to cybersecurity for critical infrastructures.

• have knowledge of confidentiality, integrity, and availability principles.

• have knowledge of embedded systems.

• have knowledge of penetration testing principles, tools, and techniques.

• have knowledge of Application Security Risks (e.g., Open Web Application Security

Project Top 10 list).

2.5 Security Operations Center (SOC) Services:

SOC Services shall perform the following:

• Operate a SOC with 24x7x365 coverage (including weekends and Federal holidays).

• Monitor and analyze security events from all in-scope log sources (e.g., network devices, servers, applications, endpoints, cloud services).

• Perform initial triage and classification of events (e.g., informational, suspicious, incident).

• Maintain documented standard operating procedures (SOPs) for SOC operations, triage, and escalation.

• Ensure that all SOC analysts and engineers meet Government-specified clearance, suitability, and training requirements.

• Configure and maintain correlation rules, alerts, and use cases in the Security Information and Event (SIEM) and related tools.

• Perform event correlation across multiple data sources (e.g., network, endpoint, application, identity, cloud).

• Conduct deeper-level analysis (Tier 2 / Tier 3) for events escalated from Tier 1 analysts.

• Identify patterns, tactics, techniques, and procedures (TTPs) consistent with known threat actors.

• Proactively hunt for suspicious activity in the environment using available telemetry and tools.

• Follow Government-approved incident response processes and playbooks aligned to [DHS 4300A policy, NIST 800-61, or other specified framework].

• Classify incidents according to S&T categories and severity levels.

• Conduct technical investigation, including:

o Collection and analysis of logs and artifacts o Endpoint and network forensics (within Contractor tools and capabilities) o Identification of root cause and scope

• Provide containment and mitigation recommendations to Government staff (e.g., blocking IPs/domains, isolating endpoints, disabling accounts, applying patches).

• Coordinate with Government incident response teams and other stakeholders as directed.

• Document all incidents, including timeline, actions taken, and lessons learned.

• Support the Government’s vulnerability management program by:

o Integrating vulnerability scan results into the SIEM or other tools, as applicable.

o Correlating vulnerabilities with observed threats and active exploits.

• Provide prioritized vulnerability findings and recommendations to the Government based on risk and potential impact.

• Provide analytic support for remediation tracking, focusing on the highest-risk assets and vulnerabilities.

• Manage, configure, and tune the following security tools/appliances (as applicable):

o SIEM platform o EDR platform o IDS/IPS devices o Network firewalls and related security appliances o Web and email security gateways o Security orchestration, automation, and response (SOAR) tools, if in use

• Implement and maintain log collection and forwarding from all in-scope systems.

• Optimize detection rules to reduce false positives and increase detection coverage.

• Apply security patches and updates to SOC tools in coordination with the Government.

• Integrate Government-provided and Contractor-provided threat intelligence sources into SOC processes.

• Use threat intelligence to enrich alerts and incidents (e.g., malicious IP/domain reputation, indicators of compromise).

• Provide periodic threat briefings and written summaries relevant to S&T technologies, missions, and risk areas.

• Develop and maintain SOC dashboards for Government use, including real-time and historical views.

• Provide routine reports that include, at a minimum:

o Number and type of security events and incidents o Incident severity, response times, and closure rates o Trends over time (e.g., incident types, affected systems) o Status of security device/tool health and coverage

• Provide ad-hoc reports and briefings at the request of the Government.

• Maintain up-to-date documentation, including:

o SOC standard operating procedures (SOPs) o Incident response playbooks and workflows o Use case library and detection logic o System and tool configurations (to the extent permitted)

• Maintain a knowledge base of known issues, resolutions, and lessons learned.

• Provide knowledge transfer to Government personnel through briefings, walk-throughs, and working sessions as requested.

2.6 Zero Trust Architecture Services:

The scope of this Zero Trust Architecture (ZTA) Services task includes ZTA Support and Project Management, ZTA Implementation, Integration, Modernization, and ZTA Program Services. In this task, the Contractor shall:

• Execute the DHS Department’s ZTA Strategic Plan.

• Develop implementation plans based on the Department’s ZTA Strategic Plan.

• Provide subject matter expertise in analyzing, planning, designing, meeting the requirements outlined in and maturing a comprehensive Zero Trust (ZT) modernization initiative aligned with all ZT applicable mandates to include but not limited to; Executive Order (EO) 14028, OMB M-22-09, NIST SP 800-207, CISA Zero Trust Maturity Model (ZTMM), DHS Zero Trust Framework and DHS related agency policies.

• Draft and present to management a Zero Trust Weekly status report

• Participate in and support the ZTA Program in the Department & DHS cybersecurity forums, workshops, and meetings, then present back all requirements, updates and needed improvements.

• The Contractor must assure that security awareness training materials are updated with a ZTA-specific information, explaining of Zero Trust concepts, importance of Zero Trust, the Department ZTA implementation strategy and means to enhance the S&T IT services and business processes.

• The Contractor must provide information security expertise to systems development teams.

• Provide support to the Government leadership to include: (1) providing support for implementation efforts across ZTA stakeholders and S&T programs, (2) maintaining an enterprise ZTA perspective to ensure all of the S&T programs align with DHS objectives,

(3) serving as a centralized point of contact for ZTA questions, issues, and concerns, including advising ZTA Government leads and senior leadership on ZTA strategy (4) providing recommendations for adding revised and new capabilities to the ZTA program,

(5) handling communications and outreach to both internal and external stakeholders, (6) sharing lessons learned with both internal and external stakeholders, and (7) managing and supporting the resolution of program risks and issues across the Department.

• Implement IT project management practices, techniques, methodologies, and standards to facilitate the efficient and effective lifecycle management of the ZT projects.

• Perform change management to include: (1) Following the S&T/ DHS change management processes, (2) facilitation of stakeholder participation and buy-in, and (3) ensure effective implementation of ZTA efforts.

• Be responsibilities for driving the improvements to S&T cybersecurity posture by advancing maturity across identity, devices, data, networks, and application and workloads.

• Develop ability to intake and correlate data feeds from multiple sources and formats to help with strengthen data quality and reporting through CDM Elastic (or any future replacement tool), to include Asset Management. Modernize and advance DHS Security Protections through Government, Risk, and compliance tools, Configuration Baselines, and automation (Continuous Assessment model) to help mature the Zero Trust maturity levels for S&T.

• Perform communication, outreach, and training to include: (1) management of outreach for ZTA goals, initiatives, and changes, (2) conducting customer satisfaction surveys and other instruments to drive service consumer satisfaction and (3) ensures proper training across program initiatives.

• Perform comprehensive project management to include: (1) monitoring the status of program initiatives, (2) drafting and maintenance of program framework, and (3) supporting the development of ZTA roles and responsibilities across the program.

• Perform risk management to include: (1) managing risk across the ZTA program as the landscape evolves, and (2) integrating ZTA into the existing DHS framework as well as mapped to the CISA’s ZTMM, ensuring the solution reaches the optimal state of maturity.

• Identify all the DHS and S&T stakeholders that are actively involved with the program or might be affected by the program’s outcome.

• Ensure that the ZTA Program Charter is drafted, reviewed quarterly, updated and kept current.

• Update and maintain Project Schedule for the ZTA program ensuring all projects involved with the program are accounted for.

• Ensure there is a knowledge management process in place for communication with each of the ZTA program stakeholders.

• Develop and support working groups to ensure collaboration among all stakeholders; all stakeholder requirements must be gathered and incorporated into the ZTA program.

• Ensure that any lessons learned from the working groups are documented and shared in other ZTA implementations to reduce overall program risk and increase efficiency in implementation, expansion, and refinement.

• Update and maintain a Communication Plan that defines and appropriately communicates program objectives and goals with users and stakeholders.

• Draft enterprise-level performance expectations for cybersecurity and risk management through the lifecycle of all ZTA capabilities.

• Streamline and automate S&T level performance reporting for all capabilities within ZTA, aligned with existing and planned reporting and analytics structures and tools, to include but not limited to; the Continuous Diagnostics and Mitigation (CDM) dashboards, Federal Information Security Management Act (FISMA) reporting, as required by the agency.

• Establish an S&T Common Control Provider catalog, specifically to the ZTA capabilities, documenting it in the Department’s approved GRC tool when required and working closely with S&T stakeholders to ensure ZTA controls that can be inherited by other systems are setup for inheritance and draft the control inheritance statements that can be used by other systems.

• Draft and maintain S&T-wide ZT policies and create a repeatable process(s) through developing and maintaining standard operating procedures (SOPs) and supporting documentation for integrating systems with ZTA capabilities. In addition, this work must include items such as white papers, CISO memos and similar documents necessary to show program/systems/service status, conduct change/configuration management of the program/system/service and promote the success and challenges of the program. The cybersecurity policies, instructions, technical standards and implementation guidance must be aligned with overarching Federal regulations, guidance and best practices including but not limited to: Federal Information Processing Standards (FIPS), National Institute of Standards and Technologies (NIST) Standards, Office of Management and Budget Memos, Security Technical Implementation Guides (STIGs), CIS Benchmarks, Vendor Hardening Guides, Executive Orders (EOs), Binding Operational Directives, Office of Inspector General (OIG) recommendations and Government Accountability Office (GAO) recommendations

Zero Trust Capability Assessment, Inventory, Gap Analysis and Modernization Support The Contractor shall conduct a comprehensive Zero Trust Capability Assessment, Inventory Review, and Gap Analysis, as required by DHS, aligned to DHS Framework. This establishes the baseline, identify maturity levels across all capabilities and provides recommendations for improvements to help establish and proceed with all subsequent Zero Trust modernization activities. The contractor shall:

• Generate, maintain and present the Zero Trust Modernization Roadmap consistent with DHS strategy

• Review all capability definitions as outlined by DHS

• Validate sub-capabilities and dependencies

• Confirm S&T-specific variations

• Assess Priority Level placement for each capability

• Evaluate foundational readiness

• Determine enforcement readiness

• Identify gaps in foundational prerequisites/ capabilities

• Identify governance, operational, and architecture gaps as well as generate and maintain

Zero Trust Architecture Documentation Package as required by S&T Zero Trust lead and S&T CISO while aligned with DHS architecture.

• Prioritize gaps based on impact and dependencies

• Generate, maintain and present Zero Trust Capability Assessment, aligned to DHS Framework, validated by S&T

• Generate, maintain and present Gap Analysis Report ensuring gaps are prioritized and mapped to DHS capabilities

• Support S&T in engineering, documenting, and maturing Zero Trust capabilities across all Priority Levels as defined by DHS framework and CISA ZTMM

2.7 Surge Support

Surge support may be required for all services listed in 2.1 through 2.6 if unanticipated support needs arise. Surge support shall be awarded as a time-and-materials CLIN.

3 Reporting

The Contractor shall:

• Provide reports on the full range of services required under this contract, by agreed upon due dates and deadlines, to the COR, the Program Managers, DHS S&T Chief Information Officer (CIO) and DHS S&T Chief Information Security Officer (CISO).

The contractor shall ensure the proper documentation marking is following as required by DHS to protect the sensitivity of the S&T and DHS used data. In addition to progress reporting, the Contractor shall inform the COR of any issues, problems, and recommendations for the overall efficient accomplishment of the contract and task order goals. Recommendations for actions that need to be taken by DHS S&T staff, or other Contractors, shall be clearly defined and communicated to the responsible DHS party, and have identified dates for completion. For special projects, the Contractor shall provide Monthly Status Reports (MSRs) focused on the successful accomplishment of major milestones/deliverables within the planned project schedule, costs and personnel changes. Project reporting shall also address any issues, problems, risks, or concerns that could negatively impact the project.

• Read and track with stakeholders, reoccurring reporting to DHS as well as to S&T management to include proper metrics for all cyber mandates; Executive Orders (EO), Emergency Directives (ED), Office of Management and budget (OMB) memorandums, Department of Homeland Security Cyber Task Orders (CyTO) and others as required.

• Participate and manage all Cyber Audits: to include but not limited to; Cyber Security

• ensure Cyber-Supply Chain Risk Management (C-SCRM) is adhered to in accordance with DHS mandates.

• Manage and coordinate all cyber-Audits to include but not limited to, Cybersecurity

Professional Services (CSP), Communications Security (COMSEC), SILENTSHIELD red team assessment conducted by CISA, Federal Information Security Modernization Act /Inspector General (FISMA/IG), DHS/IG, General Accounting Office (GAO) A-123, etc.

• Cybersecurity Metrics and Reporting:

The Contractor shall:

• Develop, update, maintain, and report on cybersecurity metrics to measure the effectiveness of the DHS CISO’s Cybersecurity Program.

• Develop Compliance Dashboards to leverage centralized security authorization data to support analytics for managing and reporting cybersecurity risks.

• The contractor shall actively develop and support in the compliance monitoring/reporting activities as related to DHS Scorecards and other official reporting (both internal and external to DHS (ex. Cyberscope reporting).

• Create and maintain dashboards and reports for all necessary cybersecurity functions utilizing CDM dashboard, Splunk, Crystal Reports, PowerBi or other authorized platforms.

• Create and generate draft and final versions of monthly/quarterly/annual FISMA scorecards and reports along with tracking all changes, including artifacts and justifications for delivery to Federal Lead.

• Track all monthly, quarterly and annual FISMA reporting requirements as well as work with cross functions to help improve S&T scoring using the DHS FISMA scoring dashboards and methodologies.

Track and report on all cyber mandates to include but not limited to; Executive Orders, Emergency Directives, OMB memoranda, Binding Operational Directives, DHS CISO Cyber Tasking Orders, etc.

• Generate weekly, monthly, quarterly and annual trending of S&T cyber performance in the measured metrics as well as create comparisons and determine discrepancies with the scorecard as required then present this to S&T CIO, CISO, COR and others as needed.

Status Reports The Contractor shall meet with the COR and any applicable personnel on a weekly basis in person to provide current status of projects and activities. The meeting shall highlight any concerns, risks, or dependencies the government should be made aware of. The Contractor shall provide a Weekly Status Report (WSR) of this meeting that shall be due NLT 3 PM on Friday of each week.

The Contractor shall submit the MSR no later than the tenth (10th) calendar day of each month for the preceding month’s activity (or the first following business day in case of a holiday). The report will delineate all ongoing activities and the progress towards the end results. The report will summarize the resource utilization and project run rate to the completion of the task order.

The MSR shall be submitted with a copy of the Contractor’s invoice. A copy shall be provided to the Contracting Officer (CO), Contract Specialist (CS) and the Contracting Officer Representative (COR), as well as the DHS S&T CISO. This report shall include the details of all contractor work accomplishments per task, names of staffing assigned and labor category, Entry on Duty (EOD) approval status, an assessment of technical progress, schedule status, and any Contractor concerns or recommendations for the previous reporting period.

Within the first fifteen (15) days after award, the COR and the Contractor will design and agree on a standard reporting format for the Status Reports (weekly, monthly, and quarterly) to include the following information at a minimum:

• A cover letter with the Contractor’s name, address and telephone number, project manager’s name, the contract number, task order number, task order period of performance, task order award amount, the date of the report, the period covered by the report and date of submission;

• Key accomplishments;

• Issues or key risks, including constraints (e.g., cost, schedule, etc.,) and assumptions, and planned responses for each;

• Status on previously identified issues, actions taken to mitigate the issue and/or progress made in rectifying the issue;

• Significant changes to the Contractor's organization or method of operation;

• Current manning status and plan / estimated dates to fill any open positions.

• Description of significant events occurring during the reporting period;

• Status of pending deliverables, action items with expected delivery dates;

• Problem areas affecting technical and schedule elements of the task order, including background, impact and recommendations for resolution;

• Results related to previously identified problem areas with conclusions and recommendations;

• Planned accomplishments for the next reporting period;

• Explanations for any open and ongoing issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any unresolved issue, including a plan and timeframe for resolution;

• Recommendations for changes or additional activities to ensure that the tasks overall meet CISO & CIO objectives;

• Work planned for the subsequent four (4) weeks (weekly status report only);

• Open actions for both the Contractor and DHS with due dates and agreed upon priorities

(High – impacts schedule if not completed on time; Medium – may impact schedule; Low

– needs to be completed but not a critical path item).

• The Contractor shall provide hours/dollars expended for the reporting period and cumulatively; and hours/dollars remaining, hours utilized by labor category for the reporting period and cumulatively for the period of performance (monthly status report only).

4 CONTRACTOR PERSONNEL

4.1 Qualified Personnel

The contractor shall provide qualified and certified personnel to perform all requirements as specified in the SOW and in the STARS III labor category descriptions for the labor categories listed by the Government.

4.2 Continuity of Support

The contractor shall ensure that the required level of support for this requirement is always maintained, and ensure that all contract support personnel are available for all hours of the workday. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel will not be provided, provide e-mail notification to the Contracting Officer’s Representative (COR) prior to employee absence.

Otherwise, provide a fully qualified replacement.

4.3 Key Personnel

Below is a list of anticipated Key Personnel required for fulfillment of this contract.

Before replacing any individual designated as Key by the Government, notify the Contracting Officer no less than 14 days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise approved by the Contracting Officer. not replace Key Personnel without approval from the Contracting Officer. Key Personnel shall not be assigned by the Contractor as key personnel on any other contract for this requirement. The following Contractor personnel are designated as Key for this requirement.

Table 1. Key Personnel

Key Personnel Labor Category Candidate and Requirements

Project Manager III LCAT:13-1199 Business Operations Specialists, All Other

Must Have:

• CISSP or CISM; and

• Project Management Professional (PMP) from PMI; and

• Minimum 10 years of demonstrated experience in IT Project Management, Must be able to obtain a SECRET Clearance

Security Controls Assessor III Must Have:

• CAP or CASP by CompTIA or ISACA Certified Information Systems Auditor (CISA); and

• CISSP or CISM; and

• Minimum seven years of demonstrated experience in security assessments, Must be able to obtain a SECRET Clearance

IT Security Specialist III Information Security Officer

Must Have:

• CAP or CASP by CompTIA or ISACA Certified Information Systems Auditor (CISA); and

• CISSP or CISM; and

• Minimum seven years of demonstrated experience in security assessments, Key Personnel Labor Category Candidate and Requirements

LCAT: 11-3021 Computer and Information Systems Managers

Must be able to obtain a TOP SECRET/SCI Clearance

IT Security Specialist II

LCAT: 15-1121 Computer Systems Analysts

Must Have:

• CAP or CASP by CompTIA or ISACA Certified Information Systems Auditor (CISA); and

• CISSP or CISM; and

• Minimum five years of demonstrated experience in security , Must be able to obtain a SECRET Clearance

Information Assurance Manager III

LCAT: 11-3021 Computer and Information Systems Managers

Must Have:

• CAP or CASP by CompTIA or ISACA Certified Information Systems Auditor (CISA); and

• CISSP or CISM; and

• Minimum five years of demonstrated experience in security compliance, Security Operations Analysist

LCAT: 15-1122 Information Security Analysts

Must Have:

• CAP or CASP by CompTIA or ISACA Certified Information Systems Auditor (CISA); and

• CISSP or CISM; and

• Minimum five years of demonstrated experience in security assessments, LCAT: 15-1121 Computer Systems Analysts

Must have:

• CCZT, Forrester’s Zero Trust, CISSP, CCSP, or Zero Trust-related vendor certifications (e.g., Microsoft, Palo Alto Networks, Zscaler Zero Trust certifications)

• Minimum seven years of demonstrated general cybersecurity solution implementation experience (at least three years of those for ZTA specific functions identified in position description)

Must be able to obtain a SECRET Clearance

4.4 Employee Identification

Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date.