Tasks_and_Deliverables.pdf

Development of Supporting Documentation for the DOD Risk Management Framework (RMF) Certification to Insure Continuity of Operations for the Civil Works Business Intelligence (CWBI)

TASKS

The contractor is expected to do quality assurance on all deliverables that should be free from obvious errors, complete (unless otherwise agreed), grammatically correct, and of high and professional quality. The contractor should have the flexibility and capability to meet short deadlines associated with required meetings at HQUSACE (Washington DC) and possible changes in the documentation associated with the RMF processes and gaining approval through DoD/Army channels.

The duration of this task is through March 2017.

TASK 1: DEFINE LIST OF CWBI COMPONENTS AND DEVELOP STRATEGIC PLAN TO

MEET RMF DOCUMENTATION REQUIREMENTS

As a first step in this process, the contractor will meet with the CWBI team to develop a strategy under which to accomplish tasks with the overall lists of components. The contractor is expected to assist the IWR/HQ Team with the screening of the components that will make up CWBI and outline a plan for completing the documentation. The team assisted by the contractor will assess what has already been completed and develop an inventory and schedule for completion of the documentation for each component. The team will also review other aspects of the RMF process including:

1. System definition and network topology.

2. The results of the internal survey conducted by ERDC-RDE-ITL-MS SKA-V TEAM Representative in December 2016

3. Data flow diagrams now and projected into the future

4. Hardware and Software Inventories and locations of servers

5. The internal Project management and Risk reduction plan (if completed)

6. Identify for completion all documentation on the RMF Check List.

7. Identify the key members of the CECI team that will be assisting with the RMF including the designated senior members with approval authorities.

With the information gained from the list of tasks above, the contractor will assist the IWR team with development of a plan and schedule to complete the RMF process.

TASK 2: COMPLETE RMF PROCESS AND ANY REQUIRED DOCUMENTATION

The contractor will be responsible for assisting the IWR Team in developing the required documentation in support of the RMF approval. Based on the strategy developed as Task 1, the contractor will determine the remaining actions required for achieving the RMF and a preliminary timeline to accomplish those actions.

Specifically, the contractor will execute the following tasks as part of the IWR team:

1. In eMASS, migrate the DIACAP documentation and artifacts to RMF.

2. Refine Network Topology

3. Refine the Data Flow Diagram

4. Provide the following documentary evidence within eMASS, as part of the comprehensive self-assessment:

1. System Security Plan (SSP)

2. Configuration Control Board (CCB) Charter and Meeting Minutes

3. Disaster Recovery Plan (DRP)

4. Continuity of Operations Plan (COOP), Contingency Plan

5. Incident Response Plan (IRP)

6. Information System Security Policy/Plan

7. Physical Security Plan

8. Acceptable Use Policy (AUP)

9. System design documentation, system architecture, functional architecture, and system interfaces. The functional architecture should include the following:

a. Logical diagram

b. Network Diagram

c. Data flow (PPS)

d. External interfaces

e. Type of data exchange

f. Protection mechanism(s), to include type of encryption

g. Firewall rules

4. Review and finalize the Software and Hardware Inventories

5. Insure all Memorandums of Agreement (MOAs) are completed

6. Assist the CWBI team in meeting all the System Owner Responsibilities in the SCAV-V

7. Assist the CWBI team in developing the CWBI self-assessment

8. Develop and document the Risk Register

9. Review and incorporate Security Technical Implementation Guides (STIGs), if needed

10. Complete all documentation from the RMF Check List.

11. Assist the IWR with any questions that arise through the process including:

1. ACA Assignment & Analysis

2. ACA Questionnaire Validation and Scorecard Review

3. Receipt of the ACA Estimates

12. Review and incorporate the existing Plan of Actions and Milestones (POA&M)

13. Complete the Privacy Impact Assessment (PIA)

The contractor will be responsible for assisting the team throughout the process and help to resolve questions and discrepancies.

DELIVERABLES

1. DEFINE LIST OF CWBI COMPONENTS AND DEVELOP STRATEGIC PLAN TO MEET

RMF DOCUMENTATION REQUIREMENTS

As described in Task 1 above, the contractor must provide a draft plan that outlines the list of components, defines the necessary steps, and identifies the required documentation to complete the RMF. This draft report shall be provided the IWR Team before moving forward with Task 2.

2. COMPLETE RMF PROCESS AND ANY REQUIRED DOCUMENTATION

As described above, the contractor must assist the team with development of all required documentation in support of CWBI successfully passing through the RMF process.

The contractor will submit timely, clear, and accurate invoices each month and shall bill by the percent of each task completed. The contractor should be familiar with the government billing process and how to properly submit this paperwork.

SCHEDULE

The government will schedule the initial meeting with the contractor team within fourteen (14) days of acceptance of the terms and conditions of the contract. This initial meeting will be used to begin to define the schedule in order to meet the goal within Task 1. Once the plan is completed for Task 1, a final schedule shall be developed to meet the requirements for Task 2 for the SKA-V Validation Test on or about December 2016 and the development of a POA&M form the SKA-V Assessment document on or about March 2017; but the RMF must be completed by NLT 15 May 2017.

The contractor has five (5) business days to respond to specific government requests that are sent to the contractor in writing.

SCHEDULE