PROviding Treasury Enterprise Cybersecurity Technology and Services (PROTECTS) BPA

Provide comprehensive cybersecurity services across the Treasury and its Bureaus. This includes adapting and transforming cyber operations and operating models to improve capabilities, consistency, and economies of scale. The key tasks outlined in the Performance Work Statement (PWS) include:

1. Information Security Incident Management: This involves real-time alert monitoring and triage, incident report acceptance and coordination, incident analysis, and response activities to manage anomalous and/or malicious events.

2. Vulnerability Management: This includes asset mapping, vulnerability scanning, assessments, and reporting to maintain a holistic picture of the enterprise environment and assess the security posture.

3. Adversary and Advanced Operations: This involves cyber threat intelligence collection, threat hunting, insider threat hunting, and adversary emulation to understand and counter cyber adversaries.

4. Enterprise Architecture, Engineering, Deployment, and Management: This includes SOC architecture and strategy, security architecture review, system security engineering, and deployment and management of network, endpoint, and cloud security capabilities.

5. Capability Improvement Activities: This involves knowledge transfer, content/knowledge management, and efforts to modernize and consolidate cybersecurity operations across the enterprise.

6. Managed Security Services Provider (MSSP): This requires delivering both MSSP and on-premises business operating models to provide integrated solutions across multiple functional areas.