A02.12 - CWBI RMF PWS dated 2024.11.20 .docx

20 November 2024

PERFORMANCE WORK STATEMENT (PWS)

CIVIL WORKS BUSINESS INTELLIGENCE

RISK MANAGEMENT FRAMEWORK CERTIFICATION AND CONTINUOUS MONTIORING

1. OVERVIEW

This document describes the Civil Works Business Intelligence (CWBI) program tasks and requirements supporting Risk Management Framework (RMF) certification, cybersecurity continuous monitoring and reporting, and Automated Information System (AIS) change management support. CWBI’s mission is to integrate Civil Works mission data in a Cloud-smart environment that standardizes data organization and management, ensures cybersecurity, delivers innovative technology solutions, rationalizes modules, and enhances decision-making.

2. BACKGROUND

The U.S. Army Corps of Engineers (USACE) Institute for Water Resources (IWR) seeks services and support to government staff with preparing technical documentation, completing specific tasks, and conducting continuous monitoring associated with maintaining an Authority to Operate (ATO) on the Department of Defense Information Network (DODIN) through compliance with DoD instruction 8510.01 Risk Management Framework (RMF) for DoD Information Technology[footnoteRef:1] for software, systems and platform technology managed by the CWBI program. [1: https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/851001p.pdf?ver=2019-02-26-101520-300]

CWBI is an AIS that provides a central location for management and tracking performance of USACE Civil Works (CW) business line activity through an integrated geospatially enabled decision support system. CWBI provides the umbrella structure, support, and guiding procedures to accomplish the migration of systems, applications, and data into a common CW cloud-smart environment. The CWBI environment is aligned with DoD and Army data strategy to make data visible, accessible, understandable, linked, trusted, interoperable, and secure (VAULTIS). A consolidated approach allows the Civil Works mission to:

1) Enhance cybersecurity by placing applications and data in an environment where the Risk Management Framework controls are inherited from the Service Provider and is collective for all applications; and

2) Transfer the risk associated with building, owning, and maintaining the physical IT, network, storage, and computing capacity.

CWBI provides support for applications and data sets not otherwise funded with Direct Appropriation. CWBI also enables application rationalization to ensure each cloud-approach is aligned with data strategy, and advances security, mobility, visualization, readiness, and relevance. CWBI program goals include:

1. Integrate and advance the delivery of the Civil Works mission.

2. Prioritize data and achieve VAULTIS principles.

3. Secure Civil Works Data.

4. Strengthen the CWBI foundation.

The above program goals are not possible without a solid Risk Management Framework foundation.

3. SCOPE

The objective of the PWS is to support the CWBI Program Management Office (PMO) in assuring compliance with DoDI 8510.01, preparing technical documentation and completing specific tasks associated with CWBI’s Authority to Operate (ATO), supporting CWBI cloud cybersecurity architecture, and administering change management procedures. The contractor will work closely with the CWBI PMO, USACE CIO/G-6, and others to develop and monitor the necessary documentation of all applications within CWBI. The contractor will also provide technical information for any necessary meetings with USACE CIO/G-6 and/or Army personnel as CWBI continuously performs RMF steps.

There will be several specific deliverables within this contract associated with anticipated documentation and reports connected with CWBI and its components. There are approximately 140 components (including applications and databases) currently identified as part of CWBI. The contractor will review existing RMF documentation and edit/develop as necessary in partnership with module owners. The assumption in this contract request would be that the documentation for these 140 modules will continue to be maintained and enhanced for future Security Control Assessor – Validator (SCA-V) and/or Continuous Monitoring (ConMon) audits conducted on the CWBI program.

As part of CWBI’s requirement to maintain an ATO, the contractor will assist the CWBI PMO with the implementation of a continuous monitoring strategy, including scanning applications for vulnerabilities, providing guidance on vulnerability remediation, and hardening cloud infrastructure and policies to ensure cybersecurity compliance. Furthermore, the contractor will be an integral part of CWBI’s change management process, serving as a reviewer and validator of application change requests to ensure compliance with DoD RMF and cybersecurity requirements.

4. GENERAL REQUIREMENTS

The following sub-sections provide details of various general requirements for this effort.

4.1. Non-Personal Services

The contractor shall provide strictly non-personal services and contractor employees are not subject to direct supervision and control by the Government. The contractor shall advise and support the Government but shall not make final decisions or certifications on behalf of the Government nor perform any inherently governmental functions. The contractor and its employees shall not represent the Government nor appear to represent the Government in performance of these contract services. Contractor personnel shall clearly identify themselves as contractor employees in all interactions during contract performance.

4.2. Place of Performance

All work will be performed at the contractor’s site.

4.3. Period of Performance

The base period of performance is from date of contract award (DAC) through twelve (12) months, with two (2) option periods of twelve (12) months each.

4.4. Materials

All materials, minus expendable supplies, purchased by the contractor with funds from this contract and used under this contract, become, and remain the property of the Government.

4.5. Travel

The contractor shall provide services necessary to plan and schedule travel and travel shall be reimbursed in accordance with Federal Acquisition Regulation (FAR) 31.205-46. The contractor shall be reimbursed for actual allowable costs and not to exceed the amount allowed in the Joint Travel Regulations (JTR). No fee is allowable on travel costs. The Government anticipates two trips per year, with no more than four personnel in attendance on any trip. The purpose of these expected trips will be to coordinate with the CWBI PMO. The contractor can utilize Washington, D.C. as the primary travel location for cost estimation purposes.

5. BASE YEAR PERFORMANCE REQUIREMENTS (TASK AREAS)

5.1.1 Maintain ATO

5.1.1.1 Maintain and renew existing Impact Level 4 (IL4) cloud ATO

5.1.1.2 Update Enterprise Mission Assurance Support Service (eMASS), CWBI Hub, and Confluence record(s) to include system management information, security controls, implementation plans and control status continuous-assessments, and a continuous monitoring plan

5.1.1.3 Analyze Personally Identifiable Information (PII) and Controlled Unclassified Information (CUI) within CWBI and prepare Privacy Impact Assessment and System of Record Notices (SORN)

5.1.1.4 Maintain and update Record Management Survey (RMS) and supporting appendices

5.1.1.5 Coordinate and work with SCA-V or DoD ConMon program for assessment(s)

5.1.1.6 Perform post-assessment actions to include the creation of a Plan of Action and Milestones (POA&M), a Security Assessment Report (SAR), and a finalized authorization decision through coordination with USACE CIO/G-6 and the Authorizing Official.

5.1.2 Contractor shall provide continuous monitoring support

5.1.2.1 Facilitate CWBI change management activities utilizing standard DevSecOps solution(s)

5.1.2.2 Track change management items and activities from reception to completion

5.1.2.3 Perform security impact assessments for proposed changes

5.1.2.4 Analyze CWBI modules for configuration changes using an automated means

5.1.2.5 Establish and maintain baseline hardware and software configurations, as well as ports, protocols, and services management (PPSM) documentation

5.1.2.6 Update CWBI system documentation per required timelines to reflect current system state, and into eMASS, Army Portfolio Management Solution (APMS), CWBI Hub, and Confluence as necessary

5.2.1 Conduct Assured Compliance Assessment Solution (ACAS), Host Based Security System (HBSS), and Army Endpoint Security Solution (AESS) Scanning

5.2.1.1 Coordinate appropriate system access to allow scans

5.2.1.2 Compile monthly reports based on scans

5.2.1.3 Analyze vulnerability results for impacts/risks

5.2.1.4 Categorize impact levels and assist CWBI PMO in the prioritization of work to minimize risk

5.2.1.5 Provide services for code vulnerability testing, dynamic code scanning, and cloud storage management. These services should match the capabilities of Burp Suite, Cloudberry, and ThunderScan or their equivalents. Any licenses shall be the property of USACE.

5.2.2 Conduct Security Content Automation Protocol (SCAP), Security Technical Implementation Guide (STIG), and Federal Risk and Authorization Management Program (FedRAMP) Analyses

5.2.2.1 Perform SCAP scanning on a quarterly basis, using automated means where possible

5.2.2.2 Perform STIG assessments, using automated means where possible

5.2.2.3 Perform FedRAMP assessments, ensuring cloud service solutions are authorized

5.2.2.4 Analyze results for impacts/risks

5.2.2.5 Categorize impact levels and assist CWBI PMO in the prioritization of work to minimize risk

5.2.2.6 Upload results and new information into eMASS as required

5.2.3 Continuously/actively monitor system security events using system log and system monitoring tools

5.2.3.1 Receive and process event log monitoring notifications. This task may require coordination between multiple technical groups.

5.2.3.2 Evaluate events and create service tickets with appropriate parties (e.g., ACE-IT, CWBI Infrastructure Team, etc.)

5.2.3.3 Track and process service tickets to successful resolution

5.2.3.4 Provide lessons learned reports to incorporate into existing CWBI configurations, processes, and documentation.

5.2.4 Provide Incident Response (IR) Reporting

5.2.4.1 Coordinate multiple IR reporting systems and compile related outputs

5.2.4.2 Perform impact analysis on incidents

5.2.4.3 Provide course of action to resolve issues affecting CWBI operations

5.2.4.4 Communicate system up/down to CWBI application owners and users

5.2.5 Perform Code Testing

5.2.5.1 Assist CWBI application owners and technical leads in performing code analysis, and provide tool recommendations

5.2.5.2 Provide impact analyses for code analysis results, including the prioritization of remediation work

5.2.5.3 Assist CWBI technical teams in interpreting code analysis results and in providing solutions to present risks/problems

5.3.1 Ongoing Cybersecurity Support

5.3.1.1 Input OMB metrics into Electronic Capital Planning and Investment Control (eCPIC)

5.3.1.2 Support CWBI application enhancements and changes through security planning and the organization of/assistance in creation of documentation materials using Platform One (P1) or its replacement

5.3.1.3 Provide strategic planning and analysis

5.3.1.4 At minimum, deliver two cybersecurity training sessions to all CWBI users per year, emphasizing compliance with all DoD and Army cybersecurity and RMF requirements

5.3.1.5 Contribute to CWBI quarterly Sharing Sessions, by delivering cybersecurity and RMF reminders to all CWBI users

5.3.2 USACE CIO/G-6 Compliance

5.3.2.1 Maintain system Business Capability Analysis (BCA), Configuration Management and Change Control Plan, Development and Test Management Plan, Program Management Plan, and Risk Management Plan

5.3.2.2 Conduct and maintain records of: A Privacy Impact Assessment (PIA) every three years, a Business Process Re-Engineering (BPR) analysis every three years, a review of CWBI’s status as an authoritative source for information (RMS and SORN) every three years, Section 508 compliance assessments every year, and Federal Information Security Management Act (FISMA) compliance testing every year

5.4 Provide Environment Management Support

The CWBI program is comprised of multiple modules operating in numerous environments with varying security and operational requirements. The contractor shall provide broad support to CWBI and its modules in optimizing, and where possible standardizing, security, operations, and financial efficiency/effectiveness. Some examples of specific activities follow:

5.4.1 Monitor AWS and AWS GovCloud sites for appropriate resource sizing and optimized uptime to maximize operational and financial efficiency. That is, ensure that servers/sites being utilized on AWS and AWS GovCloud do not exceed the resources required for their use cases, and are shut down when not in use (e.g. Dev and Test environments are rarely used outside of normal business hours).

5.4.2 Validate AWS and AWS GovCloud baseline information and requirements using a cloud management platform/cost management platform (CMP).

5.4.3 Monitor industry best-practices and CWBI adherence to those best-practices.

5.4.4 Install and maintain continuous monitoring software or scripts on USACE, AWS and AWS GovCloud environments.

5.4.5 Provide consolidated continuous monitoring information across environments and modules.

5.4.6 Provide quarterly host inventory and software updates across environments and modules.

5.4.7 Assist in the tracking and management of P1 JIRA issues and trouble tickets (or equivalent system) completed by CWBI PMO, application owners and technical POCs, CWBI infrastructure and system engineering / geospatial contractors, USACE CIO/G-6, and other helpdesk systems.

5.4.8 Analyze AWS and AWS GovCloud security groups and Network Access Control Lists (Network ACLs or NACLs), and provide guidance on implementation and maintenance

5.5 Provide AWS and AWS GovCloud Architecture, Security Engineering, and ATO Support

The contractor shall provide broad support to CWBI and its modules on the AWS and AWS GovCloud environments to develop architectures, provide security engineering, and ATO support for Level 2 and Level 4 segments. Some examples of specific activities follow:

5.5.1 Verify and validate Impact Level 2 and Impact Level 4 network topologies and assist with differentiation

5.5.2 Create and modify architecture design to accommodate the DoD Cloud Computing Security Requirements Guide (CC SRG), accommodate the use of Secure Cloud Computing Architecture (SCCA), and ensure all applicable STIGs are met, as well as compliance with USACE Cloud Computing Policy.

5.5.3 Guide migration efforts for as-is network topologies and environments into to-be solutions based on guidance and best practices

5.5.4 Recommend actionable changes to cloud security posture to meet all applicable government policies while maintaining customer requirements.

5.5.5 Manage workflows and ad-hoc meetings to resolve business process and technical issues, while identifying and tracking gaps and overlaps in significant business process and technical challenges.

5.5.6 Analyze and provide guidance on concerns/issues and impacts to cost, schedule, and performance of CWBI

5.6. Acquire and run code vulnerability testing software. This software should be of the same category and general functionality of ThunderScan or HP Fortify. This software should include both static and dynamic code analysis features. This software package and any licenses shall be the property of USACE.

6. OPTION PERIOD 1

6.1 For an additional period of twelve (12) months from the date of award on this option, the contractor shall perform all tasks as outlined in Section 5, including all subsections.

7. OPTION PERIOD 2

7.1 For an additional period of twelve (12) months from the date of award on this option, the contractor shall perform all tasks as outlined in Section 5, including all subsections. This option period does not require support for IGP and should only cover CWBI.

8. DELIVERABLES AND DELIVERY SCHEDULE

Deliverables and their frequencies are listed in section 5.

In addition to task specific deliverables, a Contractor Monthly Status Report is to be submitted monthly, to accompany the invoice. The Contractor shall meet with the CWBI PMO, at minimum, bi-weekly to relay system RMF and cybersecurity status and issues.

9. GOVERNMENT FURNISHED PROPERTY (GFP)

GFP is required for this contract and the contractor is responsible for all GFP during the performance of this PWS. Upon contract termination the contractor shall promptly return all GFP to the Government.

10. SECURITY

10.1 General Security Requirements and Guidance

The security requirements described below apply to all contract personnel (including employees of the prime Contractor (“Contractor”) and all subcontractor employees) supporting the performance requirements of this contract. The Contractor is responsible for compliance with these security requirements. Questions regarding security matters shall be addressed to the designated Government representative (e.g., Contracting Officer Representative (COR), Requiring Activity (RA) representative, or Contracting Officer (if a COR or other RA representative is not appointed)). Contract personnel are critical to the overall security and safety of US Army Corps of Engineers (USACE) installations, facilities and activities, and security awareness training contributes to those efforts. The Department of Defense (DoD) and Army security training requirements specified below, if applicable, are performance requirements; all applicable contract personnel shall complete initial training within 30 days of contract award or the date new contract personnel begin performance on the contract. Within five business days from the completion of training, the Contractor shall provide written documentation (e.g., email or memorandum) to the Government representative. The documentation shall include the names of contract personnel trained and which training they completed; the Contractor shall maintain training records as part of their contract files and be prepared to provide copies of training certificates to the Government representative. Contractor personnel and vehicles are subject to search when entering federal installations. Additionally, all contract personnel shall comply with Force Protection Condition (FPCON) measures, Random Antiterrorism Measures (commonly referred to as “RAMs”), and Health Protection Condition (HPCON) measures. The Contractor is responsible for meeting performance requirements during elevated FPCON and/or HPCON levels in accordance with applicable RA plans and procedures --this includes identifying mission essential and non-mission essential personnel. In addition to the changes otherwise authorized by the changes clause of this contract, should the FPCON or HPCON levels at any individual facility or installation change, the Government may implement security changes that affect contract personnel. The Contractor shall ensure all contract personnel are aware of their security responsibilities, including any site-specific requirements identified in local policies or procedures.

10.2 Antiterrorism (AT) Level I Training

All contract personnel requiring routine access to Army installations, facilities, and controlled access areas, or requiring network access shall complete initial and annual refresher AT Level I awareness training. Online AT Level I awareness training is available at https://jko.jten.mil/ (website subject to change).

10.3 Physical Security and Access Control Requirements

All contract personnel requiring physical access to a federal installation or facility shall comply with the access control procedures of that location. Contract personnel requiring unescorted access to meet contract performance requirements on a DoD installation in the US shall be vetted by the installation/facility Provost Marshal/Directorate of Emergency Services/Security Office using the National Crime Information Center-Interstate Identification Index (commonly referred to as “NCIC-III”) and Terrorist Screening Database (commonly referred to as “TSDB”). Contract personnel shall comply with all personal identity verification requirements specified in installation/facility policies and procedures. Contract personnel who do not meet requirements for unescorted access to USACE facilities shall coordinate escorted access with the Government representative, as needed. Contract personnel who receive keys, access cards, or lock combinations that provide access to government-owned property shall comply with key and lock control procedures of the RA.

10.4 Contract Personnel Requiring a Common Access Card (CAC)

Contract personnel will be issued a common access card (CAC) only if duties involve one of the following: (1) both physical access to a DoD facility and access to DoD information systems or networks; (2) remote access to a DoD information system or network using DoD-approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. Before CAC issuance, contract personnel must have at a minimum, a favorably adjudicated Tier 1 investigation or an equivalent or higher investigation in accordance with applicable Army regulations and Homeland Security Presidential Directive-12 (HSPD-12). At the discretion of the RA, an initial CAC may be issued based on a favorable review of a fingerprint check and a successfully scheduled Tier 1 investigation with the National Background Investigations Bureau. The RA provides contract personnel with additional information and forms to initiate the CAC issuance process, and/or to initiate background investigations, when required. Contract personnel shall complete these processes within established timelines to avoid delays.

10.5 Contract Personnel Requiring Access to Government Information Systems

All contract personnel with access to a government information system (including USACE business systems and CAC-enabled websites) shall comply with applicable DoD and Army regulations and shall use the organization's User ID - Password Administration and Security System (U-PASS) at commencement of services to request network user accounts. Contract personnel shall complete DoD Information Assurance Awareness training prior to accessing information systems, and annually thereafter.

10.6 Contracts Requiring a Formal OPSEC Program

The Contractor shall develop an OPSEC SOP/Plan within 90 days of contract award. The OPSEC SOP/Plan shall be reviewed and accepted by the RA OPSEC Officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it, and why it needs to be protected. In accordance with Army and DoD regulations, the contractor shall have a certified Level II OPSEC coordinator, who shall ensure OPSEC compliance during contract performance.

10.7 Training Requirements for the Protection of Sensitive Information

All contract personnel with access to critical information (as identified in the RA's OPSEC Program) shall complete initial and annual refresher OPSEC Level I Awareness training, which is available at the following websites: https://www.iad.gov/ioss/, or http://www.cdse.edu/catalog/operations-security.html (websites subject to change). All contract personnel with access to Controlled Unclassified Information (CUI) shall complete initial and annual refresher CUI training in accordance with applicable Army policy.

10.8 Information Assurance (IA) / Information Technology (IT) Requirements

All contract personnel performing IA/IT services must comply with DoD training and certification requirements specified in DoD 8570.01-M, Information Assurance Workforce Improvement Program, and maintain required background investigations specified in RA policy. Contract personnel shall provide the Government representative with documentation of certification(s) prior to performing on the contract. In accordance with applicable DoD, Army, and USACE regulations, the Contractor shall ensure that all information systems (IS) and platform information technology (PIT) systems developed and/or supported under this contract comply with cybersecurity and architectural requirements, including, but not limited to: security technical implementation guides (STIG)(e.g., the current version of the Application Security and Development STIG, and the internet access point (IAP) demilitarized zone (DMZ) STIG), and the use of security controls developed under the risk management framework documentation for the system or platform. The Contractor shall address questions regarding these provisions to the Government representative, who will coordinate between the Contractor and the USACE Chief Information Officer (CIO).

10.9 Pre-Screen Candidates Using E-Verify Program

Contractors shall comply with the requirements set forth in FAR clause 52.222-54 Employment Eligibility Verification and FAR Subpart 22.18 in using the E-Verify Program at (https://www.e-verify.gov/) (website subject to change) to meet the contract employment eligibility requirements. Contractors are encouraged to cooperate with Federal and State agencies responsible for enforcing labor requirements to include eligibility for employment under United States immigration laws in accordance with FAR 22.102-1(i). An initial list of verified/ eligible candidates shall be provided to the COR no later than three business days after the initial contract award. When contracts are with individuals, the individuals will be required to complete a Form I-9, Employment Eligibility Verification, and submit it to the Contracting Officer to become part of the official contract file.

11. APPLICABLE DOCUMENTS

In compliance with DoDI 8500.01 (2014) section 3.c.2, DoDI 8510.01 (2016) section 3.d, and USACE ER 25-1-112 (2014) section 7.1.3; all information systems (IS) and platform information technology (PIT) systems developed and/or supported under this contract shall comply with all DoD, DISA, Army, and USACE cybersecurity and information technology (IT) requirements. This includes IS/PIT compliance with DISA security technical implementation guides (STIG) and being categorized IAW CNSSI 1253 using security controls developed IAW the risk management framework (NIST SP 800-53). STIG compliance shall include but is not limited to most current version of the DISA published Application Security and Development STIG and the internet access point (IAP) demilitarized zone (DMZ) STIG. Further, the Contractor shall comply DFARS clause 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) and implement NIST SP 800-171 requirements to protect covered defense information / controlled unclassified information.

· DoD Directive 5144.02, “DoD Chief Information Officer (DoD CIO),” November 21, 2014

· National Institute of Standards and Technology Special Publication 800-37, “Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach,” February 2010, as amended

· Subchapter III II of chapter 35 of Title 44, United States Code (also known as the “Federal Information Security Management Modernization Act (FISMA) of 2002 2014”)

· Committee on National Security Systems Instruction 1253, “Security Categorization and Control Selection for National Security Systems,” March 15, 2012 March 27, 2014, as Amended

· National Institute of Standards and Technology Special Publication 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations,” current edition

· National Institute of Standards and Technology Special Publication 800-53A, “Guide for Assessing the Security Controls in Federal Information Systems and Organizations: Building Effective Security Assessment Plans,” June 2010, as amended

· DoD Instruction 8500.01, “Cybersecurity,” March 14, 2014

· National Institute of Standards and Technology Special Publication 800-39, “Managing Information Security Risk: Organization, Mission, and Information System View,” March 2011

· National Institute of Standards and Technology Special Publication 800-30, “Guide for Conducting Risk Assessments,” September 2012, as amended

· DoD Directive 8000.01, “Management of the Department of Defense Information Enterprise (DoD IE),” March 17, 2016

· Executive Order 12333, “United States Intelligence Activities,” December 4, 1981, as amended

· DoD Directive 8115.01, “Information Technology Portfolio Management,” October 10, 2005

· Section 11331 of Title 40, United States Code

· DoD Directive 8140.01, “Cyberspace Workforce Management,” August 11, 2015

· DoD Instruction 8581.01, “Information Assurance (IA) Policy for Space Systems Used by the Department of Defense,” June 8, 2010

· DoD Instruction 8320.07, “Implementing the Sharing of Data, Information, and Information Technology (IT) Services in the Department of Defense,” August 3, 2015

· DoD Instruction 5000.02, “Operation of the Defense Acquisition System,” January 27, 2015, as amended

· DoD Chief Information Officer Memorandum, “DoD Enterprise Services Designation – Collaboration, Content Discovery, and Content Delivery,” February 2, 2009

· DoD Chief Information Officer and Intelligence Community Chief Information Officer Memorandum, “Use of Unified Cross Domain Management Office (UCDMO) Baseline

· Cross Domain Solutions (CDSs),” December 1, 2011

· DoDI 8510.01, March 12, 2014 Change 2, 07/28/2017 8 ENCLOSURE 1

· Chairman of the Joint Chiefs of Staff Instruction 6211.02D, “Defense Information Systems Network (DISN) Responsibilities,” January 24, 2012

· DoD Instruction 8100.04, “DoD Unified Capabilities (UC),” December 9, 2010

· DoD Directive 5105.53, “Director of Administration and Management (DA&M),” February 26, 2008

· DoD Manual 5200.02-R, “Procedures for the DoD Personnel Security Program,” January 1, 1987, as amended April 3, 2017

· DoD 8570.01-M, “Information Assurance Workforce Improvement Program,” December 19, 2005, as amended

· Appendix III to Office of Management and Budget Circular No. A-130, “Security of Federal Automated Information Resources,” November 28, 2000

· Committee on National Security Systems Instruction 4009, “National Information Assurance (IA)Committee on National Security Systems (CNSS) Glossary,” April 26, 2010 April 6, 2015

· National Security Presidential Directive-54, “Cyber Security and Monitoring” /Homeland Security Presidential Directive-23, “Cybersecurity Policy,” January 8, 2008

12. CONTRACTING OFFICER REPRESENTATIVE AND/OR TECHNICAL POINT OF CONTACT (TPOC)

A contracting officer representative (COR) and/or technical point of contact (TPOC) will be appointed for this contract. The COR and TPOC have no authority to direct the contractor in any way to alter the contractual obligation. The contracting officer is the only individual authorized to make changes to the contract.