Task 27-8 JPSS Program Mission Security.pdf

Omnibus Multidiscipline Engineering Services II (OMES-II)

All deliverables and requirements must follow the guidelines in NNG17CR69C with no exceptions

Task Order Statement of Work (SOW) Date: 2/17/2021 Task Name: JPSS Program Mission Security Task No. / Mod: 27/8 Task Monitor (TM): Redacted Contract number: NNG17CR69C Contract SOW Reference: Function 5 Infrastructure Services – Sub Section 2 IT Systems Security and System Administrator Function Mod 8 Summary: Extending period of performance;

I. Scope

a. Background – This task supports the JPSS Program. JPSS is a joint NASA/NOAA program to build and maintain a fleet of polar weather satellites; maintain the ground system that controls the satellites and processes the polar weather data.

b. Summary of work –This task supports the entire JPSS Program needs for IT Security services (Program Office, Flight Project, and Ground Segment Project.

c. Required skills/knowledge – Proficiency in Task Management Tools Excellent interpersonal skills Strong oral and written communications skills Strong organizational skills Proficiency in System Engineering Tools and SDLC Proficiency in NIST 800-53 and FISMA Proficiency using QRadar, Tivoli Endpoint Manger/BigFix, NetMRI, Nessus Security Center, Tripwire, McAfee ePolicy Orchestrator, Symantec Endpoint Protection, Splunk, RISCS, CSAM. Updated security applications list (doesn’t affect current task employees).

II. Period of Performance

(Tasks will be issued with no more than 12 month periods of performance unless otherwise justified and approved)

The period of performance during which the work for this task shall be performed is through April 1, 2022.

III. Subtask Descriptions

The JPSS Program Mission Security task will be separated into subtask functions as follows:

Subtask 1 – Systems Engineering Security Documents Review and Security Engineering Support for Ground Segment Project work from Task 28.1 Subtask 4 – Alternate ISSO Support for NOAA Systems Subtask 5 – Security Monitoring Subtask 6 – System Security Engineering Support for Program and Flight Project

Subtask 1 – Systems Engineering Security Documents Review

IT Security and Systems Engineering Support

Summary: Participate in the review and updates of the JPSS Ground System Security Requirements. Related documents may be reviewed and CCR's prepared.

a) Support the Ground Security Manager and Ground Project Contracting Officer’s Representative (COR) on the development of the Ground System Security Requirements (GSSR).

b) Participate in status review meetings, telecons, and development meetings on a GSSR with the Ground Project SEIT representative, COR and the JPSS Program System Engineer.

c) Support the modification of the DOORS elements of the GSSR and related configuration management/change tracking activities.

d) Review and update the front matter of the System Engineering Security documents such as the GSSR.

e) Identify latest versions of the Applicable documents. Determine if additional applicable or reference documents are needed.

f) Document changes needed to update the GSSR to comply with the most recent versions of NIST SP800-53, the applicable documents, and the current and proposed tailoring for NOAA 5042.

g) Review and update all requirement table fields.

h) Prepare and submit update CCR

i) Prepare a summary of the changes to the document and impacts to current Common Ground System

j) With customer, related documents impacted by the change to the Program document, and prepare CCR's

k) Disposition of CCR comments

Task Management Duties:

a) Provide the technical and functional activities at the contract level needed for administrative, clerical, documentation, quality assurance, and related functions.

b) Prepare a task management plan describing the technical approach, organizational resources and management controls to be employed to meet the cost, performance and schedule requirements throughout task execution.

c) Provide monthly financial reports to document plan versus actual expenditures.

d) Provide weekly status reports describing task performance and identify any issues.

Place of Performance - The work performed under this subtask shall primarily be performed at the JPSS Project annex location in Greenbelt, MD.

Travel – 6 trips per year supporting the JPSS Ground Segment Project to Raytheon site, Aurora, CO supporting the JPSS ISSO or GSM;

Additional sites could be Northrup Grumman site in Gilbert, AZ and/or Ball site in Boulder.

Skill Set/Knowledge Required Personnel who perform on this subtask are required to have the following skills:

Proficiency in System Engineering Tools and SDLC Proficiency in NIST 800-53 and FISMA Excellent interpersonal skills Strong oral and written communications skills Strong organizational skills Proficiency using Tivoli Endpoint Manger/BigFix, NetMRI, Nessus Security Center, Tripwire, Symantec Endpoint Protection, Splunk, RISCS, CSAM. Updated applications list (doesn’t affect current task employees).

Materials and Equipment Personal computers for on-site personnel will be provided by the JPSS Ground Segment Project.

Monthly Report in Contractor Format:

1. Summary of Work Performed during Period (Current Month)

2. Plans for Work for Next Period(s) (Month and Quarter)

3. Summary of Travel/Meeting Support 1 Month(s)

Subtask 4 – Alternate ISSO Support for NOAA Systems

Perform Alternate ISSO duties for NOAA System Boundary:

a) Serve as the alternate principle staff advisor to the system owner on all matters involving the security of the information system;

b) Manage the security aspects of the information system and oversee the day-to-day security operations of the system;

c) Assist the system owner in:

i. Developing and enforcing security policies for the information system;

ii. Assembling the security accreditation package, and

iii. Managing and controlling changes to the information system and assessing the security impacts of those changes.

d) Complete the NOAA/NESDIS Annual IT Security training;

e) In accordance with the Commerce Interim Technical Requirement (CITR) 006, Information System Security Training for Significant Roles, possess upon appointment and maintain the DOC-approved professional role-based certification - Certified Information System Security Professional (CISSP).

Place of Performance - The work performed under this subtask to be performed at the JPSS Project annex (GT4) location in Greenbelt, MD; or the NOAA Satellite Operations Facility (NSOF) in Suitland, MD; or CGS Support Node – Riverdale (CSN-R) Facility in Riverdale, MD; Primary support location is GT4.

Travel – up to 3 trips per year supporting the JPSS Ground Project to Raytheon site, Aurora, CO; up to 2 trips per year supporting COOP activities to CBU, Fairmont, WV. Additional sites could be Orbital site in Gilbert, AZ and/or Ball site in Boulder, CO.

Skill Set/Knowledge Required Personnel who perform on this subtask are required to have the following skills:

Proficiency in System Engineering Tools and SDLC Proficiency using QRadar, Tivoli Endpoint Manger, NetMRI, Nessus Security Center, Tripwire, etc.

Strong oral and written communications skills Strong organizational skills

Monthly Report in Contractor Format:

1. Weekly Report – Describe the ISSO work performed during the week and which boundary is affected.

Subtask 5 – Security Monitoring

IT Security Monitoring of the JPSS CGS:

a) Coordinate and conduct Security Tools Monitoring and Analysis of the JPSS CGS using established Security Standard Operating Procedures (SOPs) and work instructions. To include writing up after action reports and daily, weekly, monthly summary graphics and analysis packages.

b) The monitoring must be performed 7 days per week. The monitoring staff would work 40 hours per week.

In order to maintain a 5 day work week, it is acceptable to “swap” a weekend day for a weekday. Example, if the monitoring team member is performing monitoring on a Saturday or Sunday, he or she would then be working 4 days during the week. In order to maintain a 40 hours per week, it is also an acceptable case where the person spends 4 hours monitoring on a Saturday, and then 4 hours on one of the weekdays (say Thursday). And still would have a 40 hour work week.

Place of Performance - The work performed under this subtask to be performed at the JPSS Project annex (GT4) location in Greenbelt, MD; or the NOAA Satellite Operations Facility (NSOF) in Suitland, MD; or CGS Support Node – Riverdale (CSN-R) Facility in Riverdale, MD; Primary support location is GT4.

Travel – up to 3 trips per year supporting the JPSS Ground Project to Raytheon site, Aurora, CO; up to 2 trips per year supporting COOP activities to CBU, Fairmont, WV. Additional sites could be Orbital site in Gilbert, AZ and/or Ball site in Boulder, CO.

Skill Set/Knowledge Required

Personnel who perform on this subtask are required to have the following skills:

Proficiency in System Engineering Tools and SDLC Proficiency using QRadar, Tivoli Endpoint Manger, NetMRI, Nessus Security Center, Tripwire, etc.

Strong oral and written communications skills Strong organizational skills

Monthly Report in Contractor Format:

1. Daily Report of Security Monitoring results – format defined within the Daily Monitoring and Enhanced Monitoring SOPs.

Subtask 6 – Systems Engineering Security Support for Program Office and Flight Project

IT System Security Plan and Systems Engineering Support

a) Perform Computer Security Official/ISSO functions: IT Security support includes managing the IT Security needs for the Program and Flight Project GSFC computing resources, responding to SOC Incident reports, Code 400 actions.

b) Maintaining FPD-M IT Security plan sections for JPSS

c) Support FPD-M A&A effort and POA&M monitoring.

d) Create the JPSS-specific IT Security Plan which covers the JPSS Essential Infrastructure

e) Support for the IT and Deputy IT Managers in terms of Security actions and security plan development

f) IT policy reviews,

g) Support for the Program System Engineer in maintaining the Level 1 or 2 Security Requirements and responding to Center data calls.

h) Support the Flight Project Security needs – such as Book boss for the Satellite Key Management Plans; ComSec PoC for the JPSS building;

i) Other duties as required

Place of Performance - The work performed under this subtask shall primarily be performed at the JPSS Project annex location in Greenbelt, MD.

Travel – 6 trips per year Northrup Grumman site in Gilbert, AZ and/or Ball site in Boulder, CO supporting the Program System Engineer.

Skill Set/Knowledge Required Personnel who perform on this subtask are required to have the following skills:

Proficiency in System Engineering Tools and SDLC Proficiency in NIST 800-53 and FISMA Excellent interpersonal skills Strong oral and written communications skills Strong organizational skills Proficiency using Tivoli Endpoint Manger/BigFix, NetMRI, Nessus Security Center, Tripwire, Symantec Endpoint Protection, Splunk, RISCS, CSAM. Updated applications list (doesn’t affect current task employees).

Personal computers for on-site personnel will be provided by the JPSS Program/Flight Project.

Monthly Report in Contractor Format:

1. Summary of Work Performed during Period (Current Month)

2. Plans for Work for Next Period(s) (Month and Quarter)

3. Summary of Travel/Meeting Support 1 Month(s