IESS Attachment 4 - IDIQ Cybersecurity Demonstration 20240319.docx

SOURCE SELECTION PLAN

Defense Logistics Agency Support for ODS Reserve Program Office

RFP SP4703-12-R-0003

ATTACHMENT 4

Cybersecurity Demonstration Evaluation Factor and Criteria

Factor 2: Cybersecurity Demonstration Subfactor A: Security Technical Implementation Guides (STIGs) Subfactor B: Patch and Vulnerability Management Approach

This demonstration is for evaluation purposes and not to be construed as an acceptance modifier to the 100% cyber compliance requirement. Each future Task Order Performance Work Statement will describe in detail the technical and cybersecurity compliance requirements to be followed.

Table 1, Cybersecurity and Risk Ratings, includes consideration of risk in conjunction with the strengths, weaknesses and deficiencies in determining technical ratings and will be used to rate Factor 2. Each subfactor within a factor will be rated independently (using Table 2 and Table 3), and the subfactor ratings will roll up into an overall rating for Factor 2 from Table 1.

Table 1 Cybersecurity Demonstration and Risk Ratings

Color/Adjectival Rating

Table 2 Subfactor A (Application Security and Development Security Technical Implementation Guide (STIG)) Ratings

Overall percentage of compliant controls (Number of controls submitted (at least 30% of approximately 286) divided by Total Number of Compliances)

Table 3 Subfactor B (Patch and Vulnerability Management Approach) Ratings

Color/Adjectival Rating

Subfactor A: Security Technical Implementation Guide (STIG)

The Government will evaluate Offerors’ execution and assessment of the Application Security and Development (ASD) STIG. For Subfactor A, the Offeror shall be assigned one rating from Table 2 as a Compliance Score.

The Government will evaluate this subfactor in two steps. The Cybersecurity Demonstration will be used to gauge Offeror’s ability to use the STIG Viewer tool and their solution compliance for the ASD STIG as delivered for the demonstration. The ASD STIG has approximately 286 items and the offeror’s submission shall be based on the Lenel On-Guard application for consistency. The STIG Viewer tool and the ASD STIG file can be downloaded from https://cyber.mil/.

· Step 1. The Government will evaluate the vendor’s solution and will consider it an acceptable demonstration of the offeror’s ability to use the STIG Viewer if the offeror provides execution and assessment of at least 30% of the 286 ASD STIG items. The Government will then evaluate the offeror’s solution for compliance in Step 2. If offeror provides less than 30%, they will not be further evaluated in Step 2 and will receive an unacceptable rating for Subfactor A.

· Step 2. The Government will evaluate the percentage compliance of the Offeror’s solution with for the ASD STIG as presented. The offeror shall import, address questions, save as a .ckl or cklb file, and provide that attachment along with their proposal.

· For items marked as not an open finding and/or not applicable and the offeror provides a detailed, valid, and applicable explanation for those items would rate as Outstanding.

· For items marked as not an open finding and/or not applicable and the offeror provides no or little explanation would rate as Marginal.

Subfactor B: Patch and Vulnerability Management Approach

The Government will evaluate the Offeror’s approach for proactively supporting patch and vulnerability management (Information Assurance Vulnerability Alerts (IAVAs) and others) for ESS and EKC systems located on DLA networks and also those systems that are isolated or standalone. For Subfactor B, the Offeror shall be assigned one rating from Table 3.

The offeror’s approach shall include handling both of those possible scenarios including details fully describing their methodology, frequency, and timelines.

· When systems are on a DLA network, DLA supports system/network scans and remediates vulnerabilities associated with server and workstation hardware and operating systems and network infrastructure only. Offeror should assume the following for this scenario when writing their approach:

· They support applications related to the ESS/EKC and all ESS/EKC devices not supported by DLA

· DLA would provide Assured Compliance Assessment Solution (ACAS) scans on weekly basis or scans can be requested from DLA.

· They are responsible for remediating vulnerabilities for ESS/EKC devices and application software and reporting compliance.

· Their personnel who meet Department of Defense Manual (DoDM) 8140.03 qualification and certification requirements will have a DLA account with some remote access capabilities to the applications on the ESS/EKC servers only but action needed on workstation applications or ESS/EKC devices may require on-site vendor support.

· When systems are isolated or standalone, there is no DLA support and vendor is fully responsible supporting all devices, servers, workstations, operating systems, network infrastructure, and application software associated with ESS/EKC. Offeror should assume the following for this scenario when writing their approach:

· They are responsible for conducting scans, identifying vulnerabilities, remediating, and reporting compliance to DLA.

· They will not have any remote access and will have to be present at the location to provide this support.

SOURCE SELECTION INFORMATION – SEE FAR 2.101 AND 3.104 Page 1

SOURCE SELECTION INFORMATION – SEE FAR 2.101 AND 3.104 Page 1