Statement of Work.pdf
PDF 1 MB Posted
- Solicitation number
- 1301305107
About this file
This Statement of Work (SOW) details a mock Cyber Operational Readiness Assessment (CORA) for the United States Naval Academy's (USNA) unclassified educational environment. The two-week comprehensive cybersecurity assessment will focus on identifying security vulnerabilities, ensuring compliance with security guides, and providing actionable recommendations. The scope includes evaluating boundary/DMZ systems, internal technology, cybersecurity infrastructure, and documentation across operating systems, network infrastructure, web sites, servers, wireless networks, and databases.
The assessment will be conducted in four phases: a 5-day discovery and assessment week involving kick-off meeting, environment setup, and automated scanning; a 5-day validation and analysis week for manual verification and risk analysis; a 14-day post-inspection reporting period for risk rating and recommendation development; and a 30-day final delivery phase for report presentation. The primary deliverable will be a CORA Assessment Report containing an executive summary, detailed technical findings, risk ratings, and specific remediation recommendations. The service provider is responsible for executing inspection activities, maintaining confidentiality, and communicating daily progress, while USNA will provide necessary network access, credentials, and ensure system operational readiness.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Sources Sought Notice.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Statement of Work (SOW) for a Mock Cyber Operational Readiness Assessment (CORA)
This Statement of Work (SOW) outlines the scope, objectives, tasks, deliverables, timeline, and responsibilities for an on-site, comprehensive, two-week cybersecurity assessment of the United States Naval Academy's (USNA) systems and network infrastructure conducted in the same manner as the Department of War’s CORA Team.
1. Project Goals and Objectives
The primary goal of this engagement is to identify, document, and assess security vulnerabilities and risks within USNA’s unclassified educational environment using the assessment standards developed under the CORA model.
Key objectives include:
● Identifying Security Weaknesses: Discovering exploitable vulnerabilities in applications, network devices, and configurations.
● Ensuring Compliance Readiness: Reviewing controls against Security Technical Information Guides (STIG) and Security Readiness Guides (SRG) published by DISA.
● Ensuring Order and Directive Compliance: Reviewing Orders, Policies, and Directives and comparing against USNA’s policies, processes, and controls.
● Providing Actionable Recommendations: Delivering specific, prioritized recommendations for remediation and security posture improvement.
2. Scope of Work
The mock assessment will be limited to the following areas and activities:
A. Target Environment
● In-Scope Systems (Unclassified EDU):
○ Boundary/DMZ: Full and comprehensive evaluation of Boundary systems to include all Operating Systems and Network Infrastructure.
○ Internal Technology Review: Comprehensive evaluation of select major internal
Web Sites and Servers, Virtual Environments, Wireless Networks, Databases to include both Application and Operating System evaluations.
○ Cybersecurity Review: Comprehensive evaluation of Firewalls, Intrusion Detection/Prevention Systems (IDS/IPS), and key network switches.
○ Documentation Review of Orders, Policies, Directives: Existing security policies, incident response plans, network diagrams, disaster recovery plans, and items related to Traditional Security.
● Out-of-Scope Systems: Any and all guest wired and wireless networks.
B. Inspection Activities (Methodology)
1. Vulnerability Scanning: Automated and authenticated scanning of in-scope systems to identify common vulnerabilities (CVEs), missing patches, and misconfigurations leveraging USNA’s Assured Compliance Assessment Solution (ACAS).
2. Configuration Audits: Automated and Manual review of security settings on in-scope systems against security benchmarks (e.g., STIGs, SRGs).
3. Policy and Procedure Review: Evaluation of documented security controls for effectiveness and alignment with Department of War (DoW) Orders, Policies, and Directives.
3. Timeline and Schedule
This project is scheduled to be completed over a period of two (2) weeks (10 business days), followed by a report delivery phase.
Phase Duration Description
Week 1: Discovery & Assessment
5 Business Days Kick-off meeting, environment setup, documentation review, automated vulnerability scanning, and configuration audits.
Week 2: Validation & Analysis
5 Business Days Manual validation of critical findings, risk analysis, and raw data compilation.
Post-Inspection:
Reporting
14 Business Days Risk rating, recommendation development, and report generation.
Final Delivery 30 Business Days Presentation and handover of the final deliverable report.
4. Deliverables
The sole, formal deliverable for this engagement is the CORA Assessment Report. Sections should include, but are not limited to:
Deliverable Description
Cybersecurity Inspection Report A comprehensive document detailing the findings of the two-week inspection.
Executive Summary A non-technical overview for management, summarizing the overall security posture.
Detailed Findings A technical section listing every identified vulnerability, misconfiguration, and policy gap.
Risk Rating Each finding will be assessed based on Severity (e.g., Critical, High, Medium, Low) and Impact.
Actionable Recommendations Specific, prioritized steps for remediation, categorized by short-term and long-term actions.
Presentation/Walkthrough A final presentation of the report to the USNA’s stakeholders.
5. Roles and Responsibilities
A. Service Provider (Assessor) Responsibilities
● Execute all inspection activities as defined in Section 2.
● Maintain strict confidentiality of all USNA cybersecurity data.
● Communicate daily progress, potential issues, and preliminary critical findings to the
USNA’s mock assessment Point of Contact (POC).
● Deliver the final report and presentation within the agreed-upon timeline.
B. USNA Responsibilities
● Designate a Technical Point of Contact (POC) available prior to the engagement, throughout, and post engagement.
● Provide necessary network access, credentials (for authenticated scanning/audits), and relevant security documentation (policies, network diagrams) prior to the Kick-off meeting.
● Ensure that all in-scope systems are operational and that maintenance windows do not interfere with inspection activities.
File details come from the government source that posted it. Updated .