Statement of Work 4 solicitation.docx

Statement of Work (SOW) Submitted by Treasury OCIO – Enterprise Applications Security WebInspect for 1 Named User Subscription

1. Introduction

The Enterprise Applications resides within the US Department of the Treasury’s Departmental Offices (DO), Office of the Chief Information Officer (OCIO). The OCIO provides leadership to the Department of Treasury and its Bureaus in all areas of information and technology management and supports Treasury's Mission by implementing strategies that improve the efficiency and performance of Treasury information technology (IT) systems and business processes. OCIO has Department-wide responsibility for the direction and development of Treasury’s IT strategy, management of IT investments, and leadership of key technology initiatives. As a pillar of Treasury OCIO, Enterprise Applications is a service provider of information technology solutions through shared and scalable products, platforms and services. Enterprise Applications offers its customers a variety of services available through five (5) distinct product suites: HRConnect (HRC), Talent Management Solutions (TMS), Enterprise Content Management (ECM), Enterprise Data Management (EDM), and Enterprise Business Solutions Digital (Enterprise Applications). Supporting these product suites are the Business Operations and Service Portfolio Management (SPM) programs, which provide backend management of acquisition, budget, operations, and administration of the programs and their respective application portfolios.

2. Background

Within Enterprise Applications, the Enterprise Applications Cybersecurity (EAC) Program is responsible for ensuring that IT assets under the purview of Enterprise Applications are in compliance with Federal and Agency policies.

3. Scope

The Department of Treasury is interested in additional Webinspect software license. Webinspect license is needed to ensure EAC stays up to date in terms of security testing, compliance, and risk management.

SCOPE REQUIREMENTS

A. REQUIRED

The Contractor shall provide an annual subscription for the listed products. The products below shall meet IPv6 compatibility. Also, the vendor shall forecast usage rates for out years based on historical trend analysis and provide subscription renewals based on usage forecasts:

4. Tasks

The Contractor shall provide an annual subscription for the listed products. The products below shall meet IPv6 compatibility. Also, the vendor shall forecast usage rates for out years based on historical trend analysis and provide subscription renewals based on usage forecasts. Vendor will provide functional license key. Key will allow Enterprise Applications staff to access the full features of Webinspect. Enterprise Applications Cybersecurity identified ten critical features that solution must be able to provide:

1. Can provide Interactive Application Security Testing (IAST) agent.

2. Can provide dynamic application security testing (DAST) tool functionality.

3. Can provide pre-configured policies and reports for major compliance regulations including PCI DSS, DISA STIG, NIST 800-53, ISO 27K, OWASP, & HIPAA.

4. Can provide Hacker-Level insights such as client-side frameworks and version numbers.

5. Ability to provide Functional Application Security Testing (FAST).

6. Ability to support for the latest web technologies including HTML5, JSON, AJAX, JavaScript, and HTTP2.

7. Ability to support Containerized delivery.

8. Ability to support Auto macro generation.

9. Ability to support MFA and Treasury PIV/CAC authenticated scan support.

10. Ability to support SPA (Single-page application) auto-detect

5. Delivery

Vendor will delivery license key via email. Vendor will ensure license key is fully functional and assist Enterprise Applications with account creation. License will be assigned to Enterprise Applications Security Operations (TBD)

6. Place of Performance

The Contractor shall perform any work to deliver the annual subscription services at their own facilities. License will be utilized at 1750 Pennsylvania Ave NW, Washington DC or remotely via Treasury Internet Connection/DO LAN.

7. Period of Performance

8. Government Furnished Property

Government Furnished Property will not be provided. License key will be provided and accessed via internet.

9. Contract Administration

Contracting Officer: TBD

Contracting Officer Representative: TBD

10. Security Requirements

a. Security

The provisions listed below apply to the Prime Contractor and any subcontractors the Prime Contractor may employ during the course of this task order. The provisions below also apply to tasks, work requests or other identified method of requesting work be performed that flow from this document. This task order is categorized as unclassified at the High (Tier 4/BI) Risk Level.

Contractors are required to comply with the Treasury Directive P 15-71, Treasury Security Manual in the handling, protection, and safeguarding of government information in their possession. The TD P 15-71 will be followed as it specifies Treasury-specific personnel, physical, industrial and information security policy, processes and requirements that apply to this task order.

Personnel security investigations conducted for access to unclassified or sensitive but unclassified (SBU) information will be initiated by Personnel Security, Office of Security Programs (OSP). The task order employees must have and maintain favorable background investigations at the High-Risk level throughout the life of the task order. Contractor personnel who perform work on IT systems or applications will be required to obtain and maintain the appropriate investigation, adjudication, or suitability determination commensurate with the information contained within the application or system.

Department of Treasury retains the right to request removal of Contractor personnel, regardless of prior clearance or adjudication status, whose actions, while assigned to this task order, clearly conflict with the interest of the Government. Lack of the ability to obtain or maintain the required investigation level is included in the reasons Treasury may remove a contractor. The reason for removal shall be documented in writing by the Contracting Officer. Additionally, the Contractor must notify the Treasury Security Office and COR of all terminations/resignations within 24 hours of occurrence. When and if such removal occurs, the Contractor shall, within a two to four-week timeframe, assign qualified personnel to vacancy(s) thus created regardless of whether the individual was in a key- or non-key personnel position. The Contractor shall return all Treasury issued identification cards, building passes, keys, and any other government issued material of those terminated employees to the COR. If government issued material is not available to be returned, a report must be submitted to the COR referencing the number, name of individual to whom it was issued, the last known location, and disposition of the items. If any current or prospective employee is found to be ineligible for access to Government facilities or information by Treasury, the COR will notify the contractor that the employee shall not continue to work or to be assigned to work under the contract. The Treasury may require drug screening for probable cause at any time and/or when the contractor independently identifies circumstances where probable cause exists. The contractor must also ensure that, prior to the end of the task order, all Treasury information, systems, and equipment is returned to the appropriate Treasury personnel.

The contractor must limit the number of individuals requested to undergo any level of investigation/adjudication as specified per the National Industrial Security Program (NISP) guidance (“pools” of investigated employees are not permitted).

Any employee assigned to support the Treasury shall comply with Personal Identity Verification One and Two (PIV-1, PIV-2) requirements as described in Homeland Security Presidential Directive 12 (HSPD-12), “Policy for a Common Identification Standard for Federal Employees and Contractors,” and “Federal Information Processing Standard 201, Personal Identity Verification Standards for Federal Employees and Contractors,” dated August 2013. The use of Non-U.S. citizens, including Lawful Permanent Residents (LPRs), is not permitted in the performance of this contract for any position. Contractor personnel will have limited access to Treasury facilities, information, and equipment. All contractors with access to Treasury facilities, information, or networks for a period of 120 days or greater will be subject to a full suitability process, regardless of reciprocity. All contractors with access to Treasury facilities, information, or networks for a period of 30-119 days will undergo a limited background investigation.

The Contractor shall provide the CO the name of all entities to be used as subcontractors for each type of work to be performed prior to performing any work under this contract in the proposal submission in accordance with the FAR. The Government reserves the right to accept or reject any subcontractors proposed. Contractors should not serve as the escort for their subcontractors or for any other contractor; escorts used should be Treasury Federal employees.

The contractor is responsible for obtaining the approval of the Contracting Officer (CO) prior to release of any information received or generated under the contract. The CO should complete this item as required by internal agency directives to direct the prime contractor to the appropriate office that has public release authority. Prime contractors should serve as focal point for their subcontractors’ public release requests and refer them to the CO. SBU (also known as Controlled Unclassified Information (CUI)) must be protected in accordance with EO 13556, 32 CFR 2002 (full implementation expected to be reached in November 2018), and Treasury Security Manual (TD P 15-71). For Official Use Only must be protected in accordance with the providing Agency’s directives.

Contractors and their subcontractors must perform all initial, annual, contemporaneous, specialized and termination training required per 32 CFR 2004 and Treasury guidance as appropriate for their position.

The Contractor shall report to the COR within 24 hours any adverse information coming to its attention concerning employees working under this task order, to include loss or suspension of clearance. Reports based on rumor or innuendo should not be made. The subsequent termination of an employee does not obviate the requirement of the contractor to submit this report. The report shall include each employee’s name, social security number, and the adverse information.

Ref: SA-4_T.190 For contractors operating a Departmental system at a contractor facility, bureaus shall: (1) include specific language in contracts to ensure applicability of Treasury IT security program policies to all personnel (requiring logical access to Departmental systems); (2) ensure compliance with Treasury IT security policies through the conduct of self-assessments; (3) ensure that contracts provide for the performance of unannounced, on-site inspections of contractor facilities to ensure that an adequate level of security is being maintained.

Ref: SA-4_T.192 Bureaus shall ensure that their security requirements, including FIPS 199 system and data sensitivity, are provided to other agency service providers and documented in the formal shared service arrangement (Memorandum of Understanding (MOU), Memorandum of Agreement (MOA), Data Exchange Agreement, or other vehicle), and that the security provide meets the appropriate level.

Ref: SA-4_T.193 Except for systems principally supporting overseas Federal/Treasury personnel and/or activities, Treasury systems shall be located and operated within the U.S.

INFORMATIVE: This includes Treasury contractor systems.

INFORMATIVE: For brevity, "U.S." is used here to refer to the United States, its possessions, and territories. “Non-U.S. Support” is used here to mean use of contractors or other non-Federal service providers located outside the U.S., its possessions, and territories. (This informative also applies to SA-4_T.194,195)

Ref: SA-4_T.194 Bureaus shall ensure that operations and maintenance of systems located in the U.S. are conducted by personnel physically located within the U.S. or its territories.

INFORMATIVE: This prohibits, for example, foreign remote maintenance, systems monitoring, foreign “call service centers,” “help desks,” and the like.

Ref: SA-4_T.195 Bureaus shall ensure (including through contract requirements, when a contract developer is used) that Treasury systems (i.e., beyond commercial products used as components) that will be located within the U.S. must be developed physically within the U.S. by U.S. citizens or those with lawful permanent resident status.

INFORMATIVE: Detailed personnel security requirements, including requirements for U.S. citizenship, waivers, and employee/contractor screening are promulgated by the Office of Security Programs and are not reproduced here.

Ref: SA-4_T.197 When forming agreements with extra-Bureau entities for operation and maintenance of Bureau-owned IT systems, Bureaus shall include in the agreement language addressing responsibility for Risk Management Framework activities and access to SA&A documentation.

Ref: SA-4_T.198 In acquiring information technology, Bureaus shall ensure the use of common security configurations, when applicable, by (a) requiring vendors to configure IT with common security configurations (when available and applicable, e.g., USGCB) prior to delivery or (b) configuring acquired IT to meet bureau-tailored, secure parameters (e.g., USGCB with approved deviations) after delivery but prior to deployment.

INFORMATIVE: In the latter case, Bureaus do not need to require that vendors securely configure IT for delivery.

SA-5 INFORMATION SYSTEM DOCUMENTATION

The organization:

a. Obtains administrator documentation for the information system, system component, or information system service that describes:

1. Secure configuration, installation, and operation of the system, component, or service.

2. Effective use and maintenance of security functions/mechanisms; and

3. Known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions.

b. Obtains user documentation for the information system, system component, or information system service that describes:

1. User-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms.

2. Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner; and

3. User responsibilities in maintaining the security of the system, component, or service.

c. Documents attempts to obtain information system, system component, or information system service documentation when such documentation is either unavailable or nonexistent and take action as appropriate in response.

d. Protects documentation as required, in accordance with the risk management strategy; and

e. Distributes documentation to at a minimum, the ISSO (or similar role within the organization)].

Ref: SA-11_T.196 Custom Software Security. All software custom developed for Treasury shall be scanned with software code vulnerability detection software before the custom software is accepted by Treasury.

Applicable to MODERATE and HIGH systems:

SA-4(1) SYSTEM AND SERVICES ACQUISITION | FUNCTIONAL PROPERTIES OF SECURITY CONTROLS The organization requires the developer of the information system, system component, or information system service to provide a description of the functional properties of the security controls to be employed.

SA-4(2) DESIGN / IMPLEMENTATION INFORMATION FOR SECURITY CONTROLS

The organization requires the developer of the information system, system component, or information system service to provide design and implementation information for the security controls to be employed that includes: [security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; system-designed design/implementation information at system-defined level of detail].

SA-4(8) CONTINUOUS MONITORING PLAN

The organization requires the developer of the information system, system component, or information system service to produce a plan for the continuous monitoring of security control effectiveness that contains [at least the minimum requirement as defined in control CA-7].

Note: Guidance: CSP must use the same security standards regardless of where the system component or information system service is acquired.

SA-4(9) FUNCTIONS / PORTS / PROTOCOLS / SERVICES IN USE

The organization requires the developer of the information system, system component, or information system service to identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.

SA-4(10) USE OF APPROVED PIV PRODUCTS

The organization employs only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational information systems.

Section 508 Information, Documentation and Support (DEC 2019) In accordance with 36 CFR, Appendix C to Part 1194, the information and communication technology (ICT) products and product support services documentation furnished in performance of this contract shall be provided at no additional cost. The contractor shall provide information, documentation, and support relative to the supplies and services as described in the statement of work, performance work statement or statement of objectives (select one). The following technical standards and provisions have been determined to be applicable to this contract:

_X__ Chapter 6: Support Documentation and Services _X__ 601 General _X__ 601.1 _X__ 602 Support Documentation _X__ 602.1 _X__ 602.2 _X__ 602.3 _X__ 602.4 _X__ 603 Support Services _X__ 603.1 _X__ 603.2 _X__ 603.3 (End of clause) Section 508 Conformance (APR 2024) Each information and communication technology (ICT) product and/or product related service delivered under the terms of this contract, at a minimum, shall conform to the applicable accessibility standards at 36 CFR, Appendix C to Part 1194 at the level of conformance as specified in the Attachment entitled, Voluntary Product Accessibility Template (VPAT).

The following technical standards have been determined to be applicable to this contract:

___ Chapter 4: Hardware ___ 401 General ___ 401.1 ___ 402 Closed Functionality ___ 402.1 ___ 402.2(1-6) ___ 402.3 ___ 402.4 ___ 402.5 ___ 403 Biometrics ___ 403.1 ___ 404 Preservation of Information Provided for Accessibility ___ 404.1 ___ 405 Privacy ___ 405.1 ___ 406 Standard Connections ___ 406.1 ___ 407 Operable Parts ___ 407.1 ___ 407.2 ___ 407.3 ___ 407.4 ___ 407.5 ___ 407.6 ___ 407.7 ___ 407.8 ___ 408 Display Screens ___ 408.1 ___ 408.2 ___ 408.3 ___ 409 Status Indictors ___ 409.1 ___ 410 Color Coding ___ 410.1 ___ 411 Audible Signals ___ 411.1 ___ 412 ICT with Two-Way Communication ___ 412.1 ___ 412.2 ___ 412.3 ___ 412.4 ___ 412.5 ___ 412.6 ___ 412.7 ___ 412.8 ___ 413 Closed Caption Processing Technologies ___ 413.1 ___ 414 Audio Description Processing Technologies ___ 414.1 ___ 415 User Controls for Captions and Audio Descriptions ___ 415.1 _X__ Chapter 5: Software _X__ 501 General _X__ 501.1 _X__ 502 Interoperability with Assistive Technology _X__ 502.1 _X__ 502.2 _X__ 502.3 _X__ 502.4(A-G) _X__ 503 Applications _X__ 503.1 _X__ 503.2 _X__ 503.3 _X__ 503.4 _X__ 504 Authoring Tools _X__ 504.1 _X__ 504.2 _X__ 504.3 _X__ 504.4 _X__ Chapter 7: Referenced Standards _X__ 701 General _X__ 701.1 _X__ 702 Incorporation by Reference _X__ 702.1 ___ 702.2 _X__ 702.3 _X__ 702.4 ___ 702.5 ___ 702.6 ___ 702.7 ___ 702.8 ___ 702.9 _X__ 702.10

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the ICT be compatible with such software and devices so that it can be made accessible if required by the agency in the future.

The following functional performance criteria (36 CFR Chapter 3) apply to this contract.

_X__ Chapter 3: Functional Performance Criteria _X__ 301 General _X__ 301.1 _X__ 302 Functional Performance Criteria _X__ 302.1 _X__ 302.2 _X__ 302.3 _X__ 302.4 _X__ 302.5 _X__ 302.6 _X__ 302.7 _X__ 302.8 _X__ 302.9 (End of clause) Section 508 Services (APR 2024) All contracts, solicitations, purchase orders, delivery orders and interagency agreements that contain a requirement of services which will result in the delivery of a new or updated information and communication technology (ICT) item/product must conform to the applicable provisions of the appropriate technical standards in 36 CFR, Appendix C to Part 1194, and functional performance criteria in 36 CFR Chapter 3, unless an agency exception to this requirement exists at E202 General Exceptions.

The following technical standards and provisions have been determined to be applicable to this contract:

___ Chapter 4: Hardware ___ 401 General ___ 401.1 ___ 402 Closed Functionality ___ 402.1 ___ 402.2(1-6) ___ 402.3 ___ 402.4 ___ 402.5 ___ 403 Biometrics ___ 403.1 ___ 404 Preservation of Information Provided for Accessibility ___ 404.1 ___ 405 Privacy ___ 405.1 ___ 406 Standard Connections ___ 406.1 ___ 407 Operable Parts ___ 407.1 ___ 407.2 ___ 407.3 ___ 407.4 ___ 407.5 ___ 407.6 ___ 407.7 ___ 407.8 ___ 408 Display Screens ___ 408.1 ___ 408.2 ___ 408.3 ___ 409 Status Indictors ___ 409.1 ___ 410 Color Coding ___ 410.1 ___ 411 Audible Signals ___ 411.1 ___ 412 ICT with Two-Way Communication ___ 412.1 ___ 412.2 ___ 412.3 ___ 412.4 ___ 412.5 ___ 412.6 ___ 412.7 ___ 412.8 ___ 413 Closed Caption Processing Technologies ___ 413.1 ___ 414 Audio Description Processing Technologies ___ 414.1 ___ 415 User Controls for Captions and Audio Descriptions ___ 415.1 _X__ Chapter 5: Software _X__ 501 General _X__ 501.1 _X__ 502 Interoperability with Assistive Technology _X__ 502.1 _X__ 502.2 _X__ 502.3 _X__ 502.4(A-G) _X__ 503 Applications _X__ 503.1 _X__ 503.2 _X__ 503.3 _X__ 503.4 _X__ 504 Authoring Tools _X__ 504.1 _X__ 504.2 _X__ 504.3 _X__ 504.4 _X__ Chapter 7: Referenced Standards _X__ 701 General _X__ 701.1 _X__ 702 Incorporation by Reference _X__ 702.1 ___ 702.2 _X__ 702.3 _X__ 702.4 ___ 702.5 ___ 702.6 ___ 702.7 ___ 702.8 ___ 702.9 _X__ 702.10 The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the ICT be compatible with such software and devices so that it can be made accessible, if required by the agency in the future.

The following functional performance criteria (36 CFR Chapter 3) apply to this contract.

_X__ Chapter 3: Functional Performance Criteria _X__ 301 General _X__ 301.1 _X__ 302 Functional Performance Criteria _X__ 302.1 _X__ 302.2 _X__ 302.3 _X__ 302.4 _X__ 302.5 _X__ 302.6 _X__ 302.7 _X__ 302.8 _X__ 302.9 (End of clause)