Statement_of_Objectives_-_CLWTP_FISMA_Compliance_2.pdf

NGWSP –CLWTP FISMA Compliance

STATEMENT OF OBJECTIVES

CUTTER LATERAL – WATER TREATMENT PLANT (CLWTP) FEDERAL

INFORMATION SECURITY MANAGEMENT ACT (FISMA) COMPLIANCE

NAVAJO-GALLUP WATER SUPPLY PROJECT (NGWSP) – NEW MEXICO

1 PROGRAM OBJECTIVES

1.1. General

The first objective for the Cutter Lateral – Water Treatment Plant (CLWTP) Federal Information

Security Management Act (FISMA) Compliance is to bring the Water Treatment Plant (WTP) to current security standards.

These security standards authorize the operation of an information system or component within a specific environment, based on an acceptable level of risk. Per the FISMA, the Bureau of

Reclamation (Reclamation) is required to modify the CLWTP for current security standards. The work is to provide the required support to Reclamation while accomplishing FISMA compliance.

The second objective for the CLWTP is to update the communication link with Navajo Tribal

Utility Authority’s (NTUA’s) Escrito Mesa Data Concentrator was replaced after the completion of the Cutter Lateral Water Treatment Plant project, which has disrupted the communication link between that data concentrator and the CLWTP. This contract will reestablish that link, update the data mapping for the communication link to pull the data from the data concentrator to be display on the Human Machine Interface (HMI) graphics and be available in the control system, and modify the HMI graphics as necessary to account for changes to the list of datapoints available for the water treatment plant.

The third objective for the CLWTP is to include an option for the programming and integration of the new DZ Booster Pump Station.

The Contractor shall furnish materials, equipment, supplies, services, personnel, permits, and other resources necessary to perform the work. Close coordination with Reclamation is required to ensure minimal disruption to NGWSP operations.

1.2. Location

The CLWTP site is located on Government property. The Cutter Lateral takes water from the

San Juan River stored at the existing Cutter Reservoir (a feature constructed originally for the

Navajo Indian Irrigation Project - NIIP) using transmission pipelines and pumping plants to deliver the raw water to the CLWTP for treatment and delivery to the downstream indigenous communities on the eastern edge of the Navajo Nation and the southwest portion of the Jicarilla

Apache Nation.

1.3. Background

Reclamation has the need to provide security, accountability, physical and logical access monitoring, protected asset controls, and regulatory requirements by the FISMA. The Navajo-

Gallup Industrial Control Systems (NG ICS) will safeguard the overall NGWSP by providing monitoring and automation of water treatment and pumping conveyance through transmission pipeline to ensure the delivery of clean potable water. NG ICS cybersecurity programs should always be part of broader Industrial Control Systems (ICS) safety and reliability program. The

Supervisory Control and Data Acquisition (SCADA) systems support the production of drinking water from raw water by providing monitoring and control capabilities of mechanical and chemical balancing equipment and pumping and storage operations along the system.

Operations of the Cutter Lateral and initial water deliveries to Navajo communities began in

October 2020. Reclamation operated and maintained the Reclamation owned sections of the

Cutter Lateral (Reaches 22a, 22b, and the CLWTP) initially until the Operations, Maintenance and Repair (OM&R) responsibility was transferred to NTUA in June of 2022.

1.4. Scope

The scope of services includes, but is not limited to, the following:

1.4.1. The work requires specific knowledge and a deep understanding of the current National

Institute of Standards and Technology (NIST) controls and framework. This capability will ensure that the system has an acceptable security posture and adheres to the required security measures. Contractors must have the ability to address security control deficiencies, achieve compliance, and be proficient in documenting how the system operates with its security measures in a comprehensive System Security Plan (SSP). It also requires experience working with the system while interacting with critical water treatment and delivery operations in a water treatment plant environment to ensure that plant processes are not adversely affected or interrupted.

1.4.2. The Contractor will support the FISMA compliance process by generating, or locating, documentation and making any system updates necessary for the identified Plan of

Action and Milestones (POA&M) list of tasks (Attachment A: 2024 Cutter Lateral

POAM). This would involve providing a work breakdown structure of Contractor tasks with the expected schedule and costs.

1.4.3. The Contractor shall provide project management and logistics for the project. This includes meetings and ongoing coordination with Reclamation staff and decision-makers as needed to move the project forward efficiently. Project management will include coordination of task completion, deliverable reviews, legal reviews, and communication between Reclamation and stakeholders. This should include a kick-off meeting with

Reclamation project team and monthly progress meetings or phone calls with the

Reclamation’s Contracting Officers Representative (COR) and others as needed.

1.4.4. Activities needed to attain FISMA compliance are as described in the attached POA&M list of tasks (Attachment A: 2024 Cutter Lateral POAM) for the NG ICS Cutter Water

Treatment Plant SCADA System. A POA&M is a corrective action plan for tracking and planning the resolution of information security and privacy weaknesses. This list is a document that will be updated periodically for compliance standards.

1.4.5. The Contractor shall provide a Performance Work Statement (PWS) and Contract Data

Requirements List (CDRL) in response to this SOO describing the methodology, techniques, and procedures for each of the items listed herein and in the POA&M list of tasks (Attachment A: 2024 Cutter Lateral POAM). The Contractor shall provide a project timeline for completion of the key tasks.

1.4.6. The Contractor shall provide a communication plan for the project team members and stakeholders.

1.4.7. The Contractor shall provide an update to the Network diagram based on feedback from

Reclamations Risk Management Services Division (RMSD).

1.4.8. The Contractor shall provide monthly progress reports and invoices.

1.4.9. The Contractor shall respond within 24 hours after Government notification of operational issue, with a plan to address issue.

1.4.10. The Contractor shall provide CLWTP Data Mapping from Escrito as follows:

1.4.10.1. Provide software services to map downstream facility data from the NTUA

Escrito Data Concentrator to the CLWTP.

1.4.10.2. Use the ED-USBR_ESCRITO TAG DATABASE excel file to develop the

Programmable Logic Controllers (PLC) and Human Machine Interface

(HMI) graphic that will be displayed on the CLWTP HMI screens (See

Attachment B Tab A in the ED-USBR_ESCRITO TAG DATABASE excel file for example). The PLC software modifications will be done in the

CLWTP PLC-302 Data Concentrator. The HMI software modifications will be done on the HMI servers located at the CLWTP facility. The data mapped from Escrito will provide status of equipment, tank levels, and alarms associated with facilities.

1.4.11. For the Option, the Contractor shall provide CLWTP programing and integration of the

DZ Booster Station. This requires updating the existing displays to include a second tank at the Regulating Tank 3 site, adding displays for the DZ Booster Pum Station Site, transmitting data from the Tank to the Pump Station and onsite support during the startup and commissioning of the Pump Station.

2 CONTRACT OBJECTIVES

2.1 Performance

The COR will document acceptable and unacceptable contract performance. If the Contractor's performance is found unsatisfactory, the COR will report the information to the Contracting

Officer (CO) and no work will progress on the unacceptable work until an acceptable resolution is found. The CO may require the Contractor to explain, in writing, the cause of the poor performance, any corrective actions the Contractor has already taken to obtain an acceptable level of performance, and any future corrective actions the Contractor will utilize to prevent unacceptable performance.

The Contractor shall be responsible for temporary protection, removal, and reinstallation at the same location of facilities affected by its work. Repair, at Contractor's expense, damage to existing installations due to Contractor's operations or Contractor's failure to provide proper protection. Remove protective installations after purpose has been served.

2.2 Period of Performance

The Period of Performance (PoP) for the base will be for one year and six months after award.

The option shall be executed at the agency’s discretion within the base year of the contract if required by the agency.

2.3 Performance Criteria:

As described in the POA&M list of tasks (Attachment A: 2024 Cutter Lateral POAM). The contractor shall submit a list of Key Personnel prior to the start of the tasks.

2.4 Performance Standards / Methods of QA Surveillance

The Government’s submittal response letter will indicate whether submittal is approved, not approved, acceptable, not acceptable, or acknowledged receipt. Submittals returned by the

Government as either not approved or not acceptable shall be revised and resubmitted by the

Contractor.

Task No.

Task Description Performance Indicator Performance Standard

Minimum Acceptable Quality Level (AQL)

CLWTP FISMA

Compliance

• Updates and appropriate measures to 2024 Cutter Lateral POAM list

• SSP and CDRL Submittal

• Development of Standard Operating Procedures

Periodic Document Review

All Discrepancies Resolved.

2 CLWTP Data Mapping from Escrito

• 100% complete Document Review

All Discrepancies Resolved

Submittal of a QC Plan • 100% complete Document Review

All Discrepancies Resolved

4 Submittal of a Communication Plan

• 100% complete Document Review

All Discrepancies Resolved

5 Submittal of Network Diagrams

• 100% complete Document Review

All Discrepancies Resolved

6 Option: DZ Booster Plant Integration

• 100% complete Periodic Review

All Discrepancies Resolved

2.5 Design Constraints

As described in the POA&M list of tasks (Attachment A: 2024 Cutter Lateral POAM).

2.6 Additional Site Considerations

During work under this contract, other work may be performed in the vicinity of the work by

Government or other contractors.

The Contractor shall cooperate and coordinate with Government and other contractors on access to, use of work areas and contractor use areas. The Contractor shall not interfere with work of other contractors or Government in vicinity of work.

2.7 Submittal

Narrative describing work required in the attached POA&M list of tasks (Attachment A: 2024

Cutter Lateral POAM) known as Unique Identifier POAM ID. The Contractor shall address any comments received or revisions needed from Reclamation on a modified list within the 2024

Cutter Lateral POAM listing as an excel file to be provided within fourteen (14) calendar days from receipt.

2.8 Quality Control

Perform the work in accordance with the attached POA&M list of tasks (Attachment A: 2024

Cutter Lateral POAM). The Contractor shall establish and maintain a complete Quality Control

Plan (QCP) to ensure that the requirements are provided as specified. The QCP shall describe the methods for identifying and preventing problems before the level of performance becomes unacceptable. One copy of the Contractor’s QCP shall be provided to the Contracting Officer

(CO) at the time their proposal is submitted. An updated copy of the QCP must be provided to the CO as changes occur.

3 MANAGEMENT OBJECTIVES

3.1 Schedule

The Contractor will be limited to site access Monday through Friday between 8 am to 5 pm (not including holidays). If access is needed beyond this schedule, contact the CO and COR for further guidance.

3.2 Site Access

The Contractor shall protect work, existing facilities and Government's operations from unauthorized entry, theft, and vandalism. The Contractor shall provide a valid driver’s license for each employee requiring site access and provide a list of all vehicles including a description and license plate number for all vehicles requiring site access. The Contractor shall coordinate site access requirements with the COR.

3.3 Risks

The Contractor shall provide the equipment, materials, and labor necessary to satisfy applicable safety regulations and to ensure the safety of the job site at all times.

4 SUBMITTALS

Submittals from the Contractor are required during the term of the contract to ensure quality and safe work. Required submittals are as listed in the attached POA&M list of tasks (Attachment A:

2024 Cutter Lateral POAM) known as Unique Identifier POAM ID.

Submittals shall be prepared in English and labeled with the contract number, contract title, and

RSN, and shall use US customary measurement units.

Submittal transmittal letters shall include the following: contract number and title, RSN for each attached submittal, responsible code, number of sets for each RSN, and identification of each as an initial submittal or a resubmittal.

Submitted certifications by a registered professional engineer shall be signed by registered professional engineer.

Electronic submittals shall be in portable document format (.pdf and in .dwg), shall be processed with optical character recognition, and shall comply with Section 508 of the Rehabilitation Act

(29 U.S.C. § 794d).

END OF STATEMENT OF OBJECTIVES

NGWSP –CLWTP FISMA Compliance Solicitation No. 140R4026X0000

Attachment A

2024 Cutter Lateral POAM

NGWSP –CLWTP FISMA Compliance Solicitation No. 140R4026X0000

Attachment B

ED-USBR_ESCRITO TAG DATABASE