Cybersecurity and Privacy (CSP) Support Services Bridge

Scope:  The Government seeks innovative approaches to meet ACF’s Cyber Security and Privacy requirements.  The contractor is encouraged to identify alternative approaches that will help ACF OCIO’s CSP Division achieve its stated objectives. The contractor shall provide and/or manage personnel, processes, procedures, and technical resources to establish an integrated Information Security and Privacy Program. This includes the coordination of support provided by application system owners and other Agency contractors.  Except where specifically noted, the contractor should assume the “full scope of support”. This includes promoting a trusted, collaborative partnership with the Government in support of all aspects of this contract.  Specific requirements include but are not limited to:

1. Provide a highly reliable, consistent, and effective Cyber Security and Privacy program that meets or exceeds agreed upon service levels and industry best practices.

2. Ensure all aspects of the Cyber Security program are performed in accordance with Department of Health and Human Services (HHS) security policies, National Institute of Standards and Technology (NIST) standards and Committee on National Security Systems (CNSS) policies.

Requirements:  The contractor and the government staff will develop and foster a “team environment” allowing government and contractors to work together to gain efficiencies and increase knowledge sharing and collaboration to support the requirements of this PWS. All tasks are assigned by the Contracting Officer’s Representative (COR) or Task Monitors (TM). Post-award, the COR will designate in writing those TMs authorized to direct the Contractor, outlining the respective areas of their authority/responsibility.  In the absence of direction from a TM, the Contractor should obtain authorization from the COR. TMs shall be assigned for each program area to provide oversight and prioritization of all activities in each task and to monitor the execution and completion of tasks. TM will most likely be the Chief of Information Security Officer. All deliverables described throughout Tasks 1-6 are subject to the pre-approval of the tasking COR/TM prior to the Contractor implementing or disseminating the deliverable.