Information Technology Security Posture Assessment
The purpose of this effort was to provide an assessment of the Forest Service’s information technology (IT) security practices and programs. The assessment was documented via a study using quantitative and qualitative analysis to determine if current IT security systems were effective, the level of risk to the IT environment and applications was acceptable, and provide USDA with a prioritized action plan to address short term, intermediate, and long term needs. The results of the analysis were delivered via an initial assessment report (due after 30 days – the firm-fixed-price portion of the effort) and then a final assessment report 120 days after contract award (the time and materials portion of the effort). Other deliverables included test documentation, an internal controls report, and an action plan for remediation of the identified weaknesses.
TDG selected a set of partners that bring unique skills to this effort. TDG Inc. led the effort based on our past performance with USDA and our significant security experience. The other team members – SI International (now Serco, Inc.), Kforce, Technik, and Guidance Software – were selected to support the effort based on their particular areas of expertise for the effort. The effort encompassed six tasks as shown below
Task 1 was Project Plan and Management
Task 2 assessed and analyzed the current state of USFS’s security posture and defined a “gap” between the current state and the desired end state
Task 3 assessed the gap that was defined in Task 2 and examined the weaknesses and vulnerabilities that might be exposed
Task 4 conducted penetration testing of USFS systems using Retina, EnCase, and conceptSearch tools
Task 5 documented the state of the internal controls for financial reporting within USFS
Task 6 assessed the state of the incident response capability within USFS.
A 30 day initial assessment was followed 90 days later by a final assessment report that included action plans for the identified shortcomings.
