Inactive

The Federal Information Security Management Act (FISMA) of 2002 requires agencies to develop, document, and implement an agency wide (includes NRC headquarters facilities, regions, etc.) program for t... The Federal Information Security Management Act (FISMA) of 2002 requires agencies to develop, document, and implement an agency wide (includes NRC headquarters facilities, regions, etc.) program for the security of information and information systems that support the operations of the agency. These information systems include those provided or managed by (1) the agency, (2), another agency, (3) Contractor, or (4) other source. Agencies must perform periodic assessments of the risk and magnitude of the harm that could result from the unauthorized use, access, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency. Under these task orders, the Contractor assists the NRC in establishing and maintaining a robust Cyber Security Program. The Contractor ensures that the CSPSS program operates in compliance with the applicable federal and NRC Cyber Security regulations, policy, standards, and guidance. The period of performance for these task orders is February 26, 2014 through May 20, 2022 if all options are exercised. The scope of these task orders includes: • Project Management: ? Maintain a Quality Assurance Plan. ? Develop and maintain a Project Management Plan. • Special Projects: ? Report on cyber security risks across the NRC infrastructure quarterly. ? Evaluating new technologies to understand their security impact and how they could be used to enhance the NRC Cyber Security Program. ? Analyze Cyber Security best practices and make recommendations on how those practices could be used at the NRC. • FISMA Compliance and Oversight: ? Assist the NRC in authorizing each of its information systems to operate. ? Support the NRC in establishing and maintaining a robust Cyber Security continuous monitoring program. ? Assist the NRC with Cyber Security related data calls from other government agencies and the NRC Office of Inspector General. ? Assess planned or completed remediation actions to ensure they meet federally mandated and NRC defined cyber security requirements. • Cyber Situational Awareness: ? Support the NRC’s computer security incident response efforts. ? Perform Computer Security Vulnerability Assessments. ? Develop and establish and maintain a Cyber Security Laboratory. ? Verify and validate the agency’s use of the Security Content Automation Protocol (SCAP). ? Assist the NRC in establishing a software quality assurance program to verify and validate information systems are resistant to cyber security attacks. ? Perform computer security penetration testing. ? Evaluate system security designs and configurations. ? Develop and implement and maintain an in-depth Security Architecture that follows the Federal Segment Architecture Methodology. ? Pilot systems that support the NRC Cyber Security Program. ? Perform Security Impact Assessments (SIAs). • Policy, Standards, and Training: ? Assist the NRC in developing, establishing, and maintaining Cyber Security Policy that adheres to federally mandated requirements and industry best practices. ? Assist the NRC in developing processes, procedures, templates, checklists, standards, and guidance that support the NRC Cyber Security program. ? Analyze business solutions to ensure they meet federally mandated and NRC defined cyber security requirements. ? Establish, conduct, and maintain IT Security Awareness Training, Role-based Training, and other specialized Cyber Security training. ? Assist the NRC in effectively communicating Cyber Security information to the NRC user community.