Managed Compliance Services 2.5

The contractor shall support the U.S. Department of Homeland Security (DHS) Headquarters (HQ) Office of Chief Officer (OCIO), Chief Information Security Officer Division (CISOD) by providing key security services to the DHS Enterprise as well as to the Management (MGMT) portfolio of systems and security engineering services. These services include Information System Security Officer (ISSO), risk management services, and assessments of the security posture of systems. The services are typically performed on systems within defined Federal Information Security Modernization Act (FISMA) boundaries and may be required by DHS Policy 4300A/B. Tasks that form part of these services include the following:ISSO support services to develop, support, and maintain the appropriate operational security posture for assigned information security systems and/or programs.Independent Assessment support, including personnel to assess information systems or organizations for compliance with defined

performance measures, development of annual performance plans, assess and measure maturation of cybersecurity, operation of tools, development of products, training, and management of the compliance portfolio.Enterprise Risk Management support, including service desk incident handling, cybersecurity training and knowledgebase management, customer outreach, security analysts for Plans of Action & Milestones (POA&Ms), document review, security authorization programs, risk reporting, and common controls oversight support. Also required for systems support are database administration and application development support.Management Risk Management Support, including component cybersecurity training and component information security program support for security authorizations, ongoing authorizations, and POA&M management.Security Engineer support services to enable the Information Technology office to rapidly respond to the growing security tool portfolio and all DHS  HQ FISMA system to Network Operations Security Center (NOSC) Tools and the infrastructure that supports the NOSC Tools.