Professional Documents
Culture Documents
Background: TAC 7-3a Information Assurance and Protection
Background: TAC 7-3a Information Assurance and Protection
1. Background
The United States Agency for International Development (USAID) has Corporate
Headquarters in Washington, D.C., missions, and field offices in more than 80
countries that must share information electronically in support of USAID’s
humanitarian and development programs. USAID's work relies on an interconnected,
automated information systems and networks. Therefore, it is imperative that the
Agency has assurance that its global information processing enterprise and
component systems operate with a high degree of confidentiality, integrity, and
availability. USAID and other Federal agency face increased information system
security threats posed by hackers, viruses, and other threat agents. USAID requires
an information security program that will protect against these and other threats and
comply with regulatory requirements that include the Computer Security Act (CSA) of
1987, the Clinger-Cohen Act of 1996, OMB Circular A-130, Raines Rules, as well as
USAID’s directives. As the Agency evolves its information processing enterprise,
relies on increased remote access to electronic information systems, and supports a
mobile work force, USAID must ensure that cost effective security mechanism, policies
and procedures are in place to protect Agency computers and information.
2. Objectives
The purpose of this TAC is to provide services that will maintain and improve USAID's
Information Systems Security (ISS) program and capabilities. Specifically, this TAC
shall provide assistance in the execution of USAID’s Information System Security
Officer (ISSO) responsibilities and in the implementation of Information Assurance (IA)
initiatives identified in the USAID’s Information Systems Security Program Plan
(ISSPP). Major objectives of this TAC include the following:
b. Identify and begin the process to eliminate USAID ISS material weakness and
IG audit findings.
1
TAC 7-3a Information Assurance and Protection
e. Provide ISS impact analysis support for waivers to USAID ISS policy and
procedures.
n. Create, review and track tactical action plans that provide guidance for the
implementation and execution of ISS initiatives identified in IRM’s ISSPP.
o. Infuse life-cycle system security engineering processes and best practice into
USAID.
3. Scope
The contractor's efforts shall focus on the continuation and improvement of ISS at
USAID/W and overseas missions. The contractor shall employ with USAID’s approval
best practices such as those specified in the System Security Engineering – Capability
2
TAC 7-3a Information Assurance and Protection
Maturity Model (SSE-CMM) in accomplishing the tasks within this TAC. Additionally,
the contractor shall to the greatest extent possible leverage on-going security activities
and product developments from other on-going government programs and industry
initiatives.
The contractor shall conduct the following activities in support of the ISSO’s execution
of his responsibility in concert with the ISSPP and IRMS’s Strategic Information
Resources Management Plan. The contractor shall ensure that no duplicate or
overlap is conducted between this TAC and other TACs under the USAID PRIME
contract.
The contractor shall under this TAC document security processes, standards, and
methodologies deployed within USAID in the “Best Security Format “ developed by the
USAID Security Group.
The IA scope of work for the USAID Security Program can be divided into three broad
categories. These are:
3
TAC 7-3a Information Assurance and Protection
Due to the changing nature of security requirements, the TAC Owner will, as
necessary, provide the contractor direction on conflicting work and requirement
priorities. The contractor shall provide qualified staff to support these three broad
categories. The contractor shall prepare a staffing profile, work breakdown, and
schedule as part of this TAC.
The contractor shall conduct the following activities in support of the ISSO’s role of
providing IA for USAID’s enterprise.
2. Identify ISS projects current, near-term (1 year out) and far-term (2-3 years out)
that are required to meet and or maintain OMB A-130 and CSA compliance.
The contractor shall use the Tactical Plan format for identified projects unless
otherwise directed by the government. The plan shall include rough order
magnitude (ROM) estimated resource requirements for implementation.
The first draft of the report is to be delivered no later than 10 working days after the
end of the initial assessment. USAID will have 10 working days to respond with
4
TAC 7-3a Information Assurance and Protection
comments; the final report is to be delivered 10 working days after receipt of USAID
comments. Unless otherwise directed by the government, non-receipt of comments
after 10 working days constitutes approval of the report.
The contractor shall conduct periodic RA, compliance, and other ISS related
assessments across the USAID’s enterprise. This task shall include an on-site
assessment of four USAID overseas Missions as part of USAID’s mission ISS
assistance visit. The contractor shall be given a minimum of thirty- (30) calendar days’
notice of this requirement. The contractor shall prepare a schedule, work plan, and
resources estimates for this activity. The contractor shall include a rough order cost
estimate for each trip as part of the overall project plan for this TAC.
This RA assessment shall address, but not necessarily be limited to: knowledge of and
compliance with existing regulations; ISS vulnerabilities; appropriate audit tools;
appropriate use of encryption and user authentication tools; applicability of existing
ISS policies and procedures; emergency preparedness; appropriate implementation
and effectiveness of existing or planned safeguards (e.g. firewalls); adequacy of
staffing in terms of numbers of people, knowledge and experience; and, adequacy of
organizational structure, responsibilities, and authority. The RA activity shall follow the
following guidance and procedures identified in the USAID mission risk assessment
procedure handbook. As a minimum:
The contractor shall deliver the draft of the report 25 working days after the RA event.
USAID will have up to fifteen (15) working days to provide comments on the first draft
of the report. The final shall be delivered within 10 working days after receipt of
Government comments. The contractor shall format the report of findings and
recommendations in a standard format consistent with CMM level two and higher
5
TAC 7-3a Information Assurance and Protection
When directed, the contractor shall prepare a briefing package suitable for USAID’s
executive management. The contractor shall deliver a draft briefing Five (5) working
days after USAID’s approval of the RA report. USAID will have Five (5) working days
to review and provide comments on the briefing package. The contractor shall deliver
the final package Five- (5) working days after receipt of the comments. The contractor
shall be prepared to conduct the briefing when requested by the ISSO.
The contractor shall conduct a yearly update of USAID’s ISSPP. The update shall
include project plans submitted by the contractor for USAID approval that shall include
implementation actions, requirements for staffing, funding, personnel, calendar time
estimates for implementation, end products, performance measures, and other
relevant resources. These products shall be directly usable by USAID’s ISS Working
Group (ISSWG) and the Capital Investment Review Board (CIRB).
When approved by USAID and validated by FEDSIM, the contractor shall implement
approved and funded project plans that are appropriate for this TAC.
As part of the ISSPP update and maintenance, the contractor shall keep an ongoing
project summary that will include:
A written, up to date project summary will be available upon request by the USAID
Task Manager or designated representative.
6
TAC 7-3a Information Assurance and Protection
The contractor shall develop and document an ISS Certification and Accreditation
(C&A) Program for USAID’s implementation. The ISS C&A program shall support the
security requirements specified by federal and USAID’s organizational policy and
directives.
The contractor shall provide security audit, certification and accreditation standards
that can be used for certification of the Agency ‘s information systems during their life
cycle. Audit, compliance and accreditation criteria will include but not necessarily be
limited to:
1. Computer operating system and application software and data protection from
unauthorized access and modification.
2. Access controls for sensitive but unclassified (SBU) data in forms.
3. Software and data backup and alternative processing requirements and
capabilities.
4. Contingency of Operation Plan (COOP).
Deliverables from this effort shall include a document that will include bulletized
security checklists for use by personnel performing the function of application system
owner and program manager, LAN manager, network administrator, and other
functions as appropriate. The contractor shall propose the appropriate level of
document required for the C&A program for USAID’s approval.
The contractor shall also support the development of the USAID enterprise security
architecture. The contractor shall ensure that key security requirements are
addressed as part of the overall enterprise engineering activity.
The contractor shall conduct recurring activities in support of the ISSPP and the
ISSO’s responsibilities. These shall include as a minimum the following areas:
7
TAC 7-3a Information Assurance and Protection
Security Awareness training will include, but not necessarily be limited to:
The contractor may have to schedule more than one class for each training
session to accommodate operational schedules.
The contractor shall also prepare and issue evaluation forms to participants of
classroom training. The evaluation forms will be used to a) determine
8
TAC 7-3a Information Assurance and Protection
3. Centralized Repository - The contractor shall develop (if necessary) and keep
up to date a centralized repository of security information and contractor
deliverables. To the extent possible, this will be an electronic repository with an
index for storage and retrieval purposes and will be kept on a USAID server
with access by both IRM Security direct-hire and USAID PRIME Team. This
centralized repository will include, but not necessarily be limited to:
4. ISSPolicies and Procedures – Each TAC year the contractor shall conduct a
review, and as necessary, update Agency Information Security policies and
procedures promulgated by the Automated Directives System (ADS).
5. Emergency Preparedness - Each TAC year the contractor shall conduct a review of
the Agency's emergency preparedness program regarding:
9
TAC 7-3a Information Assurance and Protection
The contractor, with USAID’s approval, may use their existing test facilities if it
provides cost benefits for USAID.
b. The contractor shall also provide necessary support for the implementation,
continued maintenance and administration of advanced user authentication
hardware and/or software.
Normal work hour’s operational requirements will be eight hours per day, five days
per week. Overtime and holiday work may be required and shall be approved in
advance by the USAID TAC Manager except in an emergency. The exception to this
is the operational support required for the Firewall. The contractor shall support this
requirement with 5X8 staffing and on-call emergency support.
10
TAC 7-3a Information Assurance and Protection
9. TOP SECRET SCI Support - The contractor shall be able to provide staff to
support the operation requirements of a TOP SECRET Secure Compartmentalized
Information Facility (SCIF). More information will be provided during TAC
negotiation.
10. Incident Response Support to Office of Security - The Office of Security requires
technical ISS support and assistance to investigate potential breaches of security
in Bureaus and independent offices at USAID’s main office complex in Washington,
DC.
a. At the direction of the agency’s ISSO, a support team from the USAID
PRIME contractor will be formed to provide the necessary ISS technical
support. This technical support will focus in three areas: Identification of
compromised information and materials, the search for subject information
on identified computer resources, and the removal and sanitation of
designated information from designated information systems and
equipment.
b. In addition, with the concurrence of the agency ISSO the USAID PRIME
Security TAC 98-07 can be tasked for further assistance beyond the original
task.
(1) Protect National Security Information whose loss could result in damage
to National Security and/or loss of life
(2) Assist the Office of Security in the identification of potentially exposed
classified material, information, and documents
(3) Return network operations to normal as soon as practical
(4) Clean designated computer systems as required by the Office of Security
(5) Report findings, actions, and any follow-on information security
recommendations to IRM management, bureau/office representatives,
the ISSO, and the Office of Security officials
11. Reviews - The contractor shall conduct progress reviews of ISS projects quarterly.
By the 10th working day after this TAC monthly reporting period, the contractor shall
schedule a meeting with and provide to the TAC OWNER a written and verbal
report with any proposed work schedule changes. As approved by USAID, the
contractor will implement updated project plans and schedules and produce
required deliverables. Contractor reporting will include, but not necessarily be
limited to:
11
TAC 7-3a Information Assurance and Protection
Within the priorities determined by USAID, the contractor shall provide staff to
effectively deal with and resolve Information Security problems and issues related,
but not necessarily limited to the following types of unscheduled requirements.
3. General requirements:
12
TAC 7-3a Information Assurance and Protection
4.3 Task Area 3 - Information Exchange Meeting and ISS Working Group
(ISSWG)
The contractor shall support the implementation and conduct of a monthly USAID
ISSWG. The contractor shall assist the ISSO in the conduct of the meeting and
provide technical support. Additionally, the contractor shall support all ISS team
offsites, periodic USAID offsites, and EXOs, Controllers, and System Managers
conferences. The contractor shall plan for a total of two (2) offsites each TAC
performance year. The contractor shall prepare and deliver minutes from these
proceedings for USAID’s review and approval.
The contractor shall address risks that will impact the delivery of services and products
requested in this TAC. The contractor shall identify the risks and present mitigation
options for USAID’s review, selection and approval. The contractor shall include a risk
tracking and mitigation process as part of the TAC project plan that shall be submitted.
The contractor shall provide technical support as part of the USAID’s BSP activities.
Specifically, the contractor shall prepare white papers, briefings, and analysis, attend
working group meetings required to implement CIO BSP tasking.
Specifically, the contractor shall produce and deliver the reports, products, and
services identified in section 6 of this TAC.
The contractor shall support USAID’s ISSO interagency coordination as part of the
BSP. This support shall include participation at Federal INFOSEC working groups and
committees identified as necessary to support the development of the MISSP.
5. Period of Performance
This period of performance will run one calendar year from date of TAC award. There
will be three (3) optional one-year renewal periods. The overall period of performance
will not exceed the life of the USAID Prime contract. This TAC will cover the period
from May 29, 2000 thru May 31, 2001.
6. Schedule of Deliverables
13
TAC 7-3a Information Assurance and Protection
Deliverables and schedules will be determined at the time of task assignment unless
identified elsewhere in this TAC. Reports will be provided in written and electronic
forms. USAID will migrate to a Microsoft Office environment. The contractor shall
deliver electronic versions compatible with this environment.
The contractor and the Government will monitor the timely progress of this TAC using
the following schedule of significant milestones.
In addition, each task area below will have specified milestones for performance and
delivery of services and products.
3. Unscheduled Activities:
Deliverables and performance measures for this work category will be defined
at the time tasks are assigned.
.
• White Papers (1minimum)
• Analysis conducted
• Meeting minutes
• Briefing Slides with supporting notes
• Proto-type web-site for review of negotiated BSPs. (6 minimum)
14
TAC 7-3a Information Assurance and Protection
7. Security Guidance:
The contractor may be required to have access to classified information or data within
government-controlled space. Therefore, ISS contractor employees shall be required
to have a secret clearance as a minimum. The contractor shall be able to provide ISS
personnel that are clearable to the TOP SECRET and SCI level when needed. The
USAID Prime contract, form DD 254, provides security classification guidance
applicable to the contractor. No contractor employee will be granted access to any
classified information for which he or she has not been cleared.
The contractor will not be required to possess, process or retain any classified data at
the contractor-provided location. The contractor may be required to process and store
sensitive but unclassified (SBU) information/data at the contractor's site.
The contractor shall use USAID approved means to conduct remote access into
USAID’s enterprise.
The contractor shall ensure that adequate security is provided for all government
property in its possession from loss unauthorized access, modification and disclosure.
This includes USAID information and data collected, processed, transmitted, stored or
disseminated when and where under the contractor's control.
The contractor shall comply with the requirements of the USAID computer security
program as defined by the USAID Automated Directives System (ADS).
15