Description
Summary:- The contractor will perform a comprehensive strategic assessment of cyber security program and architecture, including an analysis of existing security controls and processes and evaluation of residual unmitigated risks, and submit prioritized recommendations for further reductions in risk.
- Understand the overall security architecture which strives to maintain an open scientific network while minimizing risk of unauthorized access, (based on presentations from lab security team)
- Prepare assessment of security and network architecture
- Understand the details of existing security defenses and processes (based on presentations from lab security team)
- Review security controls, taking account of the standard set of "Critical Security Controls" and of recommended security controls for low and moderate level systems.
- Analyze and report on the remaining level of risk from APT threats given current architecture and controls
- Prepare recommendations to further reduce risks to acceptable levels. These recommendations could include both changes in overall security and network architecture as well as additional (or strengthened) security controls.
- Written report evaluating site security and network architecture
- Written report evaluating current state of site security controls
- Written report evaluating current level of residual risk given as-is state of security and network architecture and security controls
- Written report of a strategic plan for evolving site security and network architectures to allow for reduction of risks
- Prioritized lists of recommendations (with associated costs) to reduce risks to acceptable levels including attack prevention, attack detection, and sensitive data protection.