Specifications include, but are not limited to: Contractor shall provide Chief Information Security Officer (“CISO”) advisory and support services for USAC. Contractor shall act as an integral part of the USAC organization driving successful outcomes required by USAC’s Information Security Program. Contractor is expected to work directly with USAC staff and other contractors in order to satisfy the objectives of USAC’s Information Security Program. USAC’s Information Security Program adheres to the Federal Information Security Management Act as amended by the Federal Information Security Modernization Act of 2014 (“FISMA”) / National Institute of Standards and Technology (“NIST”) framework for information security. This framework has been applied to systems in production and new systems being developed that support the mission of the USF. USAC organizational characteristics with respect to the Information Security Program, are as follows: • Five (5) customer-facing business units which include: (1) Lifeline and the Affordable Connectivity Program, (2) E-rate and the Emergency Connectivity Fund, (3) Rural Health Care, (4) High Cost, and (5) Contributions that interact via web-based applications and application programming interfaces (“APIs”) with USF and the appropriated programs (the Affordable Connectivity Program and the Emergency Connectivity Fund), beneficiaries (schools, libraries, rural healthcare providers, low-income Lifeline subscribers), telecommunications service providers, and USF stakeholders. Each of these business units has no more than five (5) key systems. The majority of these systems are custom-built and on premise. More recent systems are managed in third-party vendor cloud environments. • The business units are also supported by USAC internal systems including, but not limited to, the general support services (“GSS”), the enterprise database system (“EDS”), and the financial operations system, to include both the existing and the modernized financial systems. • The business support units (HR, Internal Audit, OGC, and Information Technology) mostly have commercial off-the-shelf (“COTS”) based support systems that are configured to meet business unit requirements. Contractor shall provide CISO advisory services to include: 1. Information Security Program management support 2. Cybersecurity Incident Response support 3. Information Security Awareness Training Support 4. Information Technology, Information Security, and Cybersecurity Audit Support
