Attachment 4.doc

SSA-RFP-12-1036

Attachment 4

Attachment 4 - Definitions This contract includes several advanced terms relating to Information Security that are applicable to the work required. Unless otherwise defined elsewhere in the contract, the following definitions apply:

Advanced Persistent Threat Monitoring: A term used in reference to monitoring long-term patterns of sophisticated hacking attacks aimed at governments and companies, and by implication, also to refer to the groups behind those attacks. An APT, in context of a group, contains both the capability and intent to persistently and effectively target a specific entity.

Adversarial Methodology: The combined methodologies and practices employed by hackers and users with malicious intent against an information system for the purposes of violating the security of the information system and attacking specific systems (e.g., denial or service, injection attacks, or phishing). These methodologies and practices are used during penetration testing to scope the type of testing performed on a system to mimic an attacker with an adversarial intent to discover if information systems are exploitable through the implementation of these practices.

Adversarial System/Infrastructure Testing: A method of penetration testing using an adversarial methodology to discover vulnerabilities within your system/infrastructure based on the technology types that compose the information system/infrastructure.

Federal Holidays: Days that the Government classified as a Federal Holiday and SSA suspends normal business operations. These days include:

New Years Day

Labor Day

Martin Luther King Day Columbus Day

Presidents' Day

Veterans' Day

Memorial Day

Thanksgiving Day

Independence Day

Christmas Day

Analytical Engineer: At least two years of experience in defining security policies and procedures for the protection of information and IT systems. At least one-year experience analyzing the sensitivity of information and performing vulnerability and risk assessments based on defined sensitivity and information flow. At least one year experience using the Cyber Security Assessment and Management tool. Possesses Security+, CISSP (Certified Information Systems Security Professional), or CISA (Certified Information Systems Auditor) information security certification.

Implementation Guidelines: The purpose of the Implementation Guidelines is to help protect people, property, products, processes, information, and information systems by enhancing security with effective security control implementations to address the Confidentiality, Integrity, and Availability of an information system.

Independent Verification and Validation: A comprehensive review, analysis, and testing, (software and/or hardware) performed by an objective third party to confirm (i.e., verify) that the requirements are correctly defined, and to confirm (i.e., validate) that the system correctly implements the required functionality and security requirements.

Information Assurance: Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities.

Information Security Guidelines: A suggested action or recommendation to address an area of the Information Security Policy. A security guideline is not a mandatory action, and no disciplinary action should result from non-adoption. However, Information Security Guidelines are considered Best Practice and should be implemented whenever possible.

Information Security Issues: Security Issues that result in the loss of confidentiality, integrity, or availability of information or information systems and take into consideration the adverse impacts to organizational operations and assets, individuals, other organizations, and the Nation.

Information Security Reports: A series of reports that are produced as a part of the Security Authorization process as denoted in NIST 800-37 Revision 1 – “Guide for Applying the Risk Management Framework to Federal Information Systems” in support of initiation and execution of the agency Information Security Program. These reports provide for the ongoing and continuous assessment of risk for the maintenance and operation of agency information systems to maintain compliance with FISMA and follow the Office of Management and Budget guidelines as stated in Circular A-130 Appendix III, Security of Federal Automated Information Resources.

Information Security Risk Remediation: The steps and processes taken by an organization to mitigate, correct and adjust for detected deficiencies or vulnerabilities in an information system to minimize the risk associated with operation of the system.

Normal Business Hours: Monday through Friday, between the hours of 8:00 a.m. to 5:00 p.m., local time, precluding Federal Holidays.

Outside Normal Business Hours: Monday through Friday, anytime after 5:00 p.m. but before 8:00 a.m., local time, Federal Holidays, and weekends.

Major Information System: An information system that requires special management attention because of its importance to an agency mission; its high development, operating, or maintenance costs; or its significant role in the administration of agency programs, finances, property, or other resources.

Penetration Test: A security testing methodology in which assessors, typically working under specific constraints and with specific tools, attempt to circumvent or defeat the security features of an information system.

Penetration Test Manager: Oversees daily activities of Contractor staff associated with Penetration Tests. This individual must satisfy the qualifications requirements of a Subject Matter Expert as defined in Addendum B of the solicitation.

Project Manager: At least five years of experience in managing projects of varying sizes, with two years of specialized IT project management. At least two years of experience leading IT projects or multiple tasks and retaining overall responsibility for performance, including cost, schedule, deliverables, and overall contractual compliance. At least one year of experience supporting Certification & Accreditation/Federal Information Security Management Act policies and procedures. Possesses CISSP, CISM (Certified Information Security Manager), or PMP (Project Management Professional) information security certification. The Project Manager shall oversee the daily activities of Contractor staff and serve as primary point of contact for discussions with COR or Task Manager throughout the Period of Performance.

Risk: A measure of the extent to which a potential circumstance or event threatens an entity, and typically a function of the adverse impacts that would arise if the circumstance or event occurs; and the likelihood of occurrence. Information system-related security risks are those risks that arise from the loss of confidentiality, integrity, or availability of information or information systems and reflect the potential adverse impacts to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.

Risk Assessment: The process of identifying the risks to system security and determining the probability of occurrence, the resulting impact, and additional safeguards that would mitigate this impact. Risk Assessments are part of Risk Management and synonymous with Risk Analysis.

Security Assessment: Systematic examination of an information system or product to determine the adequacy of security measures, identify security deficiencies, provide data from which to predict the effectiveness of proposed security measures, and confirm the adequacy of such measures after implementation. Aspects of security assessment include Independent Verification and Validation and Risk Assessment.

Security Authorization: The official management decision given by a senior organizational official to authorize operation of an information system and to explicitly accept the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of security controls.

Security Authorization Support Services: Services that employ the methodologies prescribed by the NIST Risk Management Framework that result in identification of residual risk and recommended corrective action, where applicable.

Security Control Measure: The management, operational, and technical controls (i.e., safeguards or countermeasures) prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information.

Senior Analytical Engineer: At least six years related experience in the IT industry with two years of experience in defining security policies and procedures for the protection of information and IT systems. At least four years of experience supporting Certification &Accreditation/Federal Information Security Management Act projects using NIST standards. At least one year experience analyzing the sensitivity of information and performing vulnerability and risk assessments based on defined sensitivity and information flow. At least one year experience using the Cyber Security Assessment and Management tool. Possesses CISSP or CSSLP (Certified Secure Software Lifecycle Professional) information security certification.

Subject Matter Expert: At least ten years of highly specialized IT and/or management experience in the required subject matter. Coordinates and manages the technical analysis for Risk, Compliance, and Security; Enterprise Resilience; and Information Technology services. At least one year of experience supporting Certification & Accreditation/Federal Information Security Management Act policies and procedures. Possesses CISSP, CEH (Certified Ethical Hacker), or GPEN (GIAC Penetration Tester) information security certification.

Vulnerability: Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source.