01 -Performance Work Statement.pdf

Performance Work Statement (PWS) Deputy Under Secretary of the Navy (Management)

Information Technology Division (ITD)

1. INTRODUCTION

The Deputy Under Secretary of the Navy (Management) - Information Technology Division - DUSN (M) ITD is seeking contractor support to maintain and operate DUSN (M) ITD owned systems and applications, provide and maintain Secretariat customer support services, provide Subject Matter Experts (SMEs) when requested, Information Assurance (IA), Information technology/Information management (IT/IM), Document Management (DM), Records Management (RM), Knowledge Management (KM) and other related tasks, to the Secretary of the Navy (SECNAV) Headquarters. The following Performance Work Statement (PWS) provides the requirements of the Task Order.

2. BACKGROUND

DUSN (M) ITD provides a wide array of Information Technology (IT) oriented services to its 4,000 customers.

These services include: incident and request support; conducting program analysis and studies; developing, operating, and maintaining IT systems and applications; maintaining vigilance with regard to information assurance including compliance with the Federal Information Security Modernization Act (FISMA); interfacing with the Next Generation Enterprise Network (NGEN/NGEN-R) Program Office (currently PMW-205); and acting as the Customer Technical Representative (CTR) on the NGEN/NGEN-R contract for the Secretariat. These IT services are deployed either directly or indirectly to support DUSN (M) customers across the Navy Headquarters within the National Capital Region (NCR) including sites located at the Pentagon, Washington Navy Yard, Joint Base Anacostia-Bolling, Arlington Annex and Crystal City. The contractor shall provide onsite services to all changed or additional DUSN (M) sites within 25 miles of the NCR, based upon facility realignment or consolidations.

The NGEN/NGEN-R contract continues to use the name Navy Marine Corps Intranet (NMCI) to refer to the Navy enterprise network. Use of the term NMCI in this task order may refer to the network, services that support the network, or other NGEN/NGEN-R uses.

DUSN (M) IT serves as the liaison between the Office of Administration for the Secretary of the Navy, DUSN (M), and Commander, US 10th Fleet (C10F) / US Fleet Cyber Command (FLTCYBERCOM). DUSN (M) IT, working with DON CIO, must track and report to FLTCYBERCOM user compliance with mandated annual IA awareness training and all other mandated reportable FISMA requirements. DUSN (M) IT is also responsible for coordinating with the Naval Approving Official (NAO) and FLTCYBERCOM to ensure that each software application, system, and network obtains a valid certification and accreditation (C&A) approval from the appropriate source(s).

As DUSN (M) IT continues to refine its execution strategies, key elements to its overall success are the knowledge of the DUSN (M) business plans, the understanding of DUSN (M)’s business requirements and continuity of the service provided once support has begun.

3. SCOPE

This task order shall be used to facilitate a wide array of contracted resources to achieve IT, DM, RM and KM related requirements.

The contractor shall provide IT and IT-related support services to over 4,000 customers within the Navy Secretariat and OPNAV within the NCR in the following areas: customer services (including help desk, desktop, ACTR services, conferencing, telephony and wireless services), database administration, software development, system and application support, system rationalization and consolidation, information assurance, assessment and authorization (A&A), portfolio management, NMCI tech refreshes, mobile device services, inventory logs, maintenance of SharePoint sites, portal upgrades, program analysis, system analysis, development of Plan of Action and Milestones (POA&Ms), engineering, installation, integration, training, research, development, testing, assessing, tracking, managing and/or operating DUSN (M) Claimancy / SECNAV Headquarters’ hardware, software and related systems. The contractor shall provide support services onsite (i.e., at Government facilities) with Government furnished equipment. When deemed necessary by the Government, the contractor shall be required to work offsite at a non-government location within 25 miles of the NCR.

The contractor shall track, monitor and submit for payment Research, Development, Test and Evaluation (RDT&E) support separately from operations and maintenance (O&M) services. An estimated ratio of time between O&M / RDT&E is provided throughout this PWS and in the level of effort (LOE) for estimation purposes.

When system rationalization and/or consolidation must occur, the contractor shall assist in the transition of the system into approved Navy hosting environments and other hosting sites as required. The contractor shall be responsible for completing the transition of a variety of systems and applications, including operating, maintaining and managing those systems in their current configuration, until the transition has been successfully completed and Authority to Operate (ATO) is achieved. An estimated 20-30 ATOs are supported under this requirement. The transition services shall include inventorying current server and software applications, assisting the customer with the transition, virtualization and disposal of old systems following DON guidance, and other transition activities as defined by DUSN (M) IT. During transition periods, the contractor shall work to ensure continuity of operations, minimizing any disruption to the existing operations, and maximizing use of existing assets.

3.1 Critical and Sensitive

Due to the volatility, and sometimes immediate emergence of requirements based upon political, time sensitivities and senior levels of the Secretariat, efficient and effective services are required. The contractor shall provide high quality support, on time, the first time. The contractor shall provide personnel capable of effectively and professionally communicating and servicing the highest-level seniors within the Department of the Navy. The contractor shall provide personnel that meet the personnel qualifications included in this solicitation.

Key personnel (4 roles) are listed later in this document.

3.2 Support Coverage

Continuous help desk services are required Monday through Friday (except Federal holidays) between 6:00 AM ET to 6:00 PM ET. During this timeframe, the contractor shall provide onsite, staggered support to sustain normal business operations. Occasionally, the contractor may be required to support ad hoc services due to emerging mission requirements, after hours, weekends and holidays. The contractor shall not charge for services after hours, weekends and holidays without prior approval from the Contracting Officer’s Representative (COR).

3.3 Technical Instruction (TI)

3.4 TIs shall be issued by the COR to the contractor for tasking and/or special project requests that require significant resources and/or time. The contractor shall officially respond within the time noted in the TI for acceptance or clarifications (usually 5 (five) business days). Usual, regular and common services will not have TIs issued. Constraints

The contractor shall be knowledgeable about applicable laws, guidance and policies affecting service requirements stated herein. The contractor shall comply with all applicable laws, guidance and policies regardless of whether or not this document specifically states the requirement. The contractor shall not interpret laws, guidance and policies to minimize or eliminate the support to the Government. Two examples are cited:

Example One: The contractor shall issue equipment as necessary. If the equipment being loaned is a portable hard drive, then the Data At Rest (DAR) requirement is mandatory. Although Vulnerability Management does not specifically state DAR compliance, it is expected that the contractor knows the requirement and ensures compliance before loaning the device.

Example Two: The contractor shall provide application development and maintenance for current and future systems as requested. If this is a website, then the programming of the code shall include assistive technology such as Public Law 508. Although the contract does not specifically state all Public Law, it is expected that the contractor knows the requirement and complies.

The contractor shall comply with the following laws, policies, and standards:

• Federal Information Security Modernization Act (FISMA).

• Risk Management Framework (RMF) as defined by DoDI 8510.01.

• Public Law 508 for accessibility compliance.

• Secure Technical Implementation Guides (STIGs) for system configurations.

• Cyber Task Orders (CTOs) and Information Assurance Vulnerability Alerts (IAVAs).

• Department of Defense (DoD) and Department of the Navy (DON) cybersecurity policies.

The contractor shall maintain a compliance matrix, updated quarterly, to track adherence to these requirements. Any deviations or non-compliance issues shall be reported to the COR immediately.

3.5 IT Tools and Systems

The IT tools and systems supported under this requirement include, but are not limited to:

Current Helpdesk Tool – Crow Canyon New Helpdesk Tool – ServiceNow Configuration Management – SharePoint Inventory/Asset Management – SharePoint SharePoint Online New Inventory/Asset Management – Crow Canyon Asset Management Patch Management – SolarWinds Patch Manager and WSUS VMWare vCloud Director Red Hat Linux Microsoft Server 2016 and 2019 Microsoft Defender for Endpoint and Identity S3 Buckets Cloudian (TM) Active Directory Delinea Secret Server Remote Desktop Gateway Remote Access Services Security Information and Event Management tools (SIEM) – Splunk and SolarWinds Vulnerability Scanners – Nessus and SCAP VEEAM Backup PKI Oracle SQL Server

TOAD

Visual Studio New Tools – Web Inspect and Citrix SAN – Storage Area Network NAS – Network Attached Storage BIG-IP F5 – Reverse Proxy GitHub

IIS

MobaXTerm Wireshark

NMAP, NPCAP

VERINT EFM Community NET Framework Oracle Web Logic

Oracle Access Management (OAM) Oracle Forms and Reports Cloud environment (AWS / Azure) PowerShell

REST API

3.6 Data Rights

The Government has unlimited rights to all documents/material produced under this contract/order. All documents and materials, to include the source codes of any software, produced under this contract/order shall be Government-owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer and/or Contracting Officer’s Representative. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

4.0 PERFORMANCE WORK STATEMENT

The contractor shall provide technical and professional support as required to satisfy the Scope stated in paragraph

3.0 of this PWS and as further detailed in the tasking below.

The requirements stated in this PWS are derived from within the following areas:

Task 4.1: Program Management Task 4.2: Transition Plans Task 4.3: Applications Development and Maintenance Services Task 4.4: Development Services Task 4.5: System and Application Services Task 4.6: System Support Task 4.7: Information Assurance Support Task 4.8: Customer Services Support Task 4.9: Engineering/Integration Support Task 4.10: Business and Technical Analysis and Planning Task 4.11: Other Direct Costs Task 4.12: Liaison Services

TASK 4.1 PROGRAM MANAGEMENT

The contractor’s program management team is responsible for ensuring that costs are contained within the budget parameters established by approved work plans, as discussed below. The contractor is also responsible for ensuring that required quality levels are met. The contractor shall provide onsite Program Management support for execution of this task order. The contractor shall provide all necessary personnel, administrative, financial, and managerial resources necessary for the support of this task order. The contractor shall designate a Program Manager (PgM) who shall act as the single point of contact (POC) for the purpose of communicating issues, concerns, or problems arising during the performance of this task order. The PgM shall have the ultimate authority to commit the contractor and make decisions for the contractor in response to Government issues, concerns or problems. The PgM shall be readily available to respond to DUSN (M) IT questions, concerns, and comments, and be proactive in promptly alerting the Government to potential contractual and programmatic issues. Although Government staff may coordinate with contractor staff, the PgM shall serve as the single contractor representative responsible for resolving all issues, concerns, and problems. Management and other status reports shall not be used as a means of notifying DUSN (M) IT of a problem, concern, issue, or plan that has not already been brought to the attention of DUSN (M) IT management. The contractor shall attend meetings and provide the DUSN (M) IT Program Manager (IT PgM) and/or the IT PgMs designees with briefing information in the form of presentations, papers and/or analyses as directed by the IT PgM. Presentations shall be scheduled by the IT PgM, in coordination with the contractor, and shall consider the contractor's schedule of activities and deliverables, which may result in briefings to the IT PgM.

The contractor may be required to attend or schedule ad hoc meetings to discuss accomplishments, issues and planned activities.

1) The contractor shall designate the following roles as key personnel for this task order:

a) Program Manager (PgM): Responsible for overall contract/task order execution, communication with the Government, and resolution of issues. The PgM shall have a minimum of 10 years of experience in program management within the Federal IT sector and hold a Project Management Professional certification.

b) Cybersecurity Lead: Responsible for ensuring compliance with RMF, FISMA, and other cybersecurity requirements. The Cybersecurity Lead shall hold a Certified Information Systems Security Professional (CISSP) certification and have at least 7 years of experience in cybersecurity operations.

c) Database Administrator (DBA): Responsible for database maintenance, performance tuning, and security. The DBA shall have a minimum of 5 years of experience with Oracle and Microsoft SQL databases and hold relevant certifications (e.g., Oracle Certified Professional, Microsoft Certified Solutions Expert).

d) Help Desk Manager: Responsible for overseeing help desk operations and ensuring customer satisfaction. The Help Desk Manager shall have at least 5 years of experience in IT support and hold an ITIL v4 certification.

The contractor shall ensure that key personnel are available throughout the duration of the task order. Any changes to key personnel must be approved by the Contracting Officer (CO) and Contracting Officer’s Representative (COR) in writing.

4.1.1 Prepare a Program Management Plan (PgMP) and Administrative Management Plan (AMP)

The contractor shall develop and maintain throughout the task order performance period, a Program Management Plan (PgMP) that shall be used as a foundation for technical direction and resource management planning. The PgMP shall consist of a project and administrative management plan. These plans shall minimally consist of:

1) Project Management Plan (PMP) relative to planned initiatives and projects:

a) Work Breakdown Structure (WBS) to the Work Package (WP) Level

b) Schedule and Critical Milestones

c) Task dependencies and interrelationships

d) Expected at Completion (EAC)

e) Risk Management

f) Risk Identification

g) Risk Mitigation Planning (including any conflict-of-interest issues)

2) Administrative Management Plan (AMP), relative to contract administrative management:

a) Staffing, including Subcontract Management to ensure coverage of all hours and will factor staffing requirement in when personnel scheduling leave b) Contractor/Government Organizational relationships, including subcontractors and problem c) Escalation

a) Key deliverables

b) Budget information (initiatives and projects)

c) Risk Management

d) Risk Identification

e) Risk Mitigation Planning (including any conflict-of-interest issues)

f) Risk Management, including risk ID, and mitigation

g) Recommended GFE/GFI replacement

h) Quality Assurance (QA)/Quality Control (QC)

The PgMP shall be coordinated with, approved and signed by the COR and the IT PgM (or designee) before implementing the PMP or AMP. The contractor shall not deviate from the PgMP without prior authorization from the COR and IT PgM.

Where the contractor identifies necessary deviations from the PgMP, the contractor shall provide the supporting rationale necessitating the deviation, in a written submission to the COR and IT PgM. The contractor shall keep the PgMP up-to-date and be prepared to brief any plan content to DUSN (M) IT at short notice (within 24 hours).

Projects and tasks shall be identified and reported in accordance with Information Technology Infrastructure Library

(ITIL)

v.4 or later standards. The PgMP shall be used as a foundation for the Monthly Status Report (MSR). The contractor shall structure the PMP WBS allowing for Technical Instructions (TIs) to be cross-referenced to a specific WBS task.

The WBS shall be identified to at least the subtask level (as identified within the context of this Task Order), to include planned projects and initiatives, in order to discretely identify schedule, performance, and cost.

4.1.2 Contract Status Reports: Monthly (MSR) and Quarterly (QSR)

The contractor shall deliver a MSR. The MSR shall focus on contractual successes and issues, such as finances, performance, personnel, innovative ideas and schedules, and recap all problems, issues, concerns, and actions taken over the report period. The basis of the MSR shall be the PgMP. The contractual finance information in the MSRs shall coincide with the contractor's invoices to include all financial information reported. The format of the MSRs shall be agreed to after task order award. The contractor shall provide a MSR within three (3) business days of the contractor’s accounting system close, but no later than the 15th day of the following month, that:

• Summarizes projects, costs, schedules, activities, travel, and actions taken, and

• Identifies concerns, issues, risks, and resolutions of identified problems or concerns

At the end of each quarter throughout the fiscal year, the contractor shall deliver a Quarterly Status Report (QSR).

The QSR shall be a modified MSR, and also contain an aggregate quarterly review and synopsis, based upon the previous quarter(s).

1) The contractor shall report on the following Key Performance Indicators (KPIs) in the MSR and QSR:

a.) Help Desk Metrics:

i. Average ticket resolution time: Target of 4 hours for standard tickets and 1 hour for VIP tickets.

ii. First-call resolution rate: Target of 90%.

iii Customer satisfaction score: Target of 95% or higher based on post-resolution surveys.

iv System Uptime:

v Target uptime for critical systems: 99.9%.

vi Target uptime for non-critical systems: 99.5%.

b) ATO Compliance:

i Percentage of systems maintaining ATO status: Target of 100%.

c) Training Metrics:

i Number of training sessions conducted: Minimum of 4 per year.

ii Percentage of personnel completing mandatory IA training: Target of 100%.

The contractor shall provide detailed explanations for any deviations from these targets and propose corrective actions in the MSR.

4.1.3 Configuration Management (CM)/Non-NMCI Inventory

The contractor shall maintain the system configuration and inventory of all equipment, parts, supplies and software under this task order. The contractor shall maintain the inventory for all virtualized and non-virtualized resources to include the Virtual Machine (VM) or server properties, RAM, storage quotas, PKI certificate expiration dates, software lists and expiration dates. The contractor shall make the effective use of the Defense Property Accountability System (DPAS). All NMCI inventory are listed in NMCI databases. A single database for all other Government assets and resources shall be required. The contractor shall assist in maintaining a complete and accurate CM/non-NMCI inventory. The maintenance process shall include the in-processing and out-processing of assets (ex: DRMO). CM tasking shall include:

• Development and maintenance of system configuration documentation describing hardware and software environment, configuration, patches, services, network dependencies and operational procedures.

• Semi-Annual CDs containing all internally developed source code and documentation used in the production environment

• The contractor shall provide the following ancillary equipment support material, as an integral component of configuration management, as part of normal commercial best practices:

• Technical Documentation, such as Technical Manuals, Standard Operating Procedures, operating instructions, policy documents, etc.

• Software licenses, which shall be transferable to the Government upon acceptance

• Warranties, which shall be transferable to the Government upon acceptance

• Maintenance agreements, which shall be transferable to the Government upon acceptance

TASK 4.2 TRANSITION SUPPORT

Because it is vital to ensure a seamless continuation of services without interruption when transitioning between contractors there will be transition periods. In order to maintain continuity of services, the following requirements shall be performed by the incumbent and/or transitioning contractor:

The incumbent contractor will continue to perform all services as prescribed within its existing PWS without reduction of manpower, quality of services and interruption to customers up to and including the end date of the incumbent contract Period of Performance (PoP). For a maximum of thirty (30) days prior to the end of the incumbent Order PoP, the incumbent contractor will provide support to the transitioning contractor to enable the transitioning contractor to learn the procedures and processes associated with the tasks of this PWS. The transitioning contractor shall be responsible for full performance of the PWS tasks at the end of the transition period.

The contractor shall deliver their Transition-Out Plan 4 weeks prior to contract end date. The Government will review the Transition-Out Plan, and provide to the contractor, within 10 business days, a statement of requested changes, rejection, or approval of the Transition-Out Plan.

1) The contractor shall develop a detailed Knowledge Transfer Plan, including:

a) Comprehensive documentation of all systems, processes, and procedures.

b) Training sessions for incoming contractor personnel.

c) Handover of all credentials, inventories, and system configurations.

d) A 30-day overlap period for shadowing and knowledge transfer.

The contractor shall submit the Knowledge Transfer Plan to the COR for approval at least 60 days before the end of the task order period.

TASK 4.3 APPLICATIONS DEVELOPMENT AND MAINTENANCE SERVICES

The contractor shall provide a range of support for prototypes, graphic designs, piloting applications, enhancements to existing systems and full engineering projects. The contractor shall manage and implement these efforts under “normal” work or as a project/TI. The contractor shall manage projects through the project management and lifecycle development approach, producing management plans and system documentation. The contractor shall be capable of developing in full stack development not limited to SQL, T-SQL, Oracle, SharePoint Online, C#.NET, Visual Basic.NET, JAVA, jquery and accommodate evolving technologies. The contractor shall design using Adobe Creative Suite, CSS, HTML, and JavaScript and accommodate evolving technologies. The contractor staff shall have experience with development, design, programming, branding, documentation, training and basic taxonomy.

The contractor shall work onsite providing direct support to the DUSN (M) applications development effort.

Priorities shall be provided to the contractor by the onsite Government Applications Development Lead. All Application and Database Source Code, graphics and training documentation developed/updated/augmented by the contractor shall be provided to the Government as completed.

The contractor shall proactively identify and recommend emerging technologies that could enhance DUSN (M) operations. This includes, but is not limited to:

• Artificial Intelligence (AI) and Machine Learning (ML) for predictive analytics and threat detection.

• Zero Trust Architecture for enhanced cybersecurity.

• Containerization technologies (e.g., Docker, Kubernetes) for scalable application deployment.

• Advanced cloud solutions (e.g., serverless computing, hybrid cloud models).

The contractor shall submit a quarterly Emerging Technology Report to the COR, detailing potential technologies, their benefits, risks, and implementation costs. The contractor shall also provide pilot demonstrations or prototypes upon Government request.

4.3.1 Applications Development and Maintenance

The contractor shall provide application development and maintenance for current and future systems, as requested.

This includes developing an application from inception or upgrading an existing application into a current/different technology. The contractor shall collect requirements from the user and form a solution that best meets the need. The contractor shall provide documentation and training, as needed, to the users of the application. Maintenance shall be performed regularly to include improvements to the functional capabilities of the application, scanning and remediating security vulnerabilities as well as any updates relevant to the respective technology being utilized by the application. Duties include branding, graphics, taxonomy and overall ability to document work performed.

The contractor shall create web graphics from scratch and/or in collaboration with users to meet their desired needs.

The contractor shall implement graphics into a SharePoint environment and conform to Public Law 508 compliance.

In addition to web graphics, the contractor shall create custom PowerPoint templates, Excel data sheets, slick sheets and advertisements. The contractor shall design in the adopted technology based on requirements gathered and provided by the Government applications development lead. The contractor shall provide developer personnel using the adopted technologies of the DUSN (M) applications development initiative. The majority of development is Web technologies. The contractor shall provide Web and Application Developers to code in the respective programming language, have extensive knowledge of the functionality of the technology, and have the overall ability to document work performed, all the while conforming to 508 compliance, DoD policy and DON policy.

The contractor shall perform a code review on new and existing code to ensure there are no security vulnerabilities.

The contractor shall be able to determine technology limitations and provide expert knowledge to the Government applications development lead. The contractor shall be capable of developing in the adopted technology based on requirements gathered and provided by the Government applications development lead. The contractor shall offer guidance on the policy and governance of any application that is developed or utilized. The contractor shall be knowledgeable of rules and policies released by DoD and the DON and adhere to those policies when developing an application or system. The contractor shall develop to the standards and follow all processes outlined by the Government applications development lead.

The contractor shall provide personnel that have policy, training, and documentation experience using the adopted technologies of the DUSN (M) IT applications development initiative. Duties include training, development of policy, documentation and gathering end-user requirements. The contractor shall work with the applications development team to help fully document processes and functionality of applications being developed.

4.3.2 Database Administration and Maintenance

The contractor shall provide database administration and maintenance for current and future systems as requested.

The contractor shall provide database administration (DBA) support for Oracle and Microsoft SQL database management systems and applications. The contractor shall support ad hoc trouble tickets that do not require a lifecycle development approach. This includes troubleshooting portal sites and user accounts, making modifications to an existing portal site, and managing permissions of portal sites. The contractor shall perform DBA tasks, such as performance tuning and database maintenance, backups and archiving, performing system management and administrative functions, update and upgrade testing and maintain a complete and accurate library of system documentation. The contractor shall work with the Information Owner to compile a complete and accurate data catalog for the DON data cataloging initiative.

The contractor shall create a repeatable process for automating DBA tasks defined above. Automation shall be a coordinated effort with Engineering, DBAs, and System Administration for maximum output.

TASK 4.4 DEVELOPMENT SERVICES

The contractor shall provide backend database development for legacy and future systems as requested. This includes developing an application from inception. The contractor shall perform database administration (DBA) tasks, creating, updating, and archiving databases as required. The contractor shall be capable of developing in the adopted technology based on requirements gathered. Furthermore, the contractor shall provide DBA support for Oracle and Microsoft SQL database management systems and applications.

The contractor shall engineer a scalable environment for testing development efforts. The environment shall be locked down by principles not limited to Zero Trust, least privilege, multi-factor authentication, Identity providers and other emerging security concepts. The contractor shall make every effort to minimize the impact to costs incurred via Cloud Hosting through analysis and the reduction of resources as well as utilizing scalable technologies such as containerization.

The contractor shall provide a range of support for prototypes, piloting applications, and for full engineering projects.

The contractor shall manage projects through the project management and lifecycle development approach, producing management plans and system documentation. The contractor shall offer guidance on the policy and governance of any item that is developed, as well as fully document processes and functionality of items being developed. All Application and Database Source Code developed by the contractor shall be provided to the Government as completed.

TASK 4.5 SYSTEM AND APPLICATION SERVICES

The contractor shall provide systems administration and engineering support to current and new systems as required.

All systems must comply with information assurance standards to maintain ATOs via Assessment and Authorization (A&A). The contractor shall implement proactive measures to ensure all systems remain operational, with no impact to DUSN (M) or its customers.

4.5.1 Application Maintenance

The contractor shall provide maintenance support for Secretariat applications. This includes performing such functions as performance tuning, administration of applications, application enhancement/development and webhosting.

4.5.2 Systems Administration Support

The contractor shall provide system administration for all systems and applications supported by DUSN (M). This work includes complying with DoD, DON, and DUSN (M) security guidance, orders and directives, identifying and remediating vulnerabilities, implementing and testing security controls, assisting with software upgrades and maintaining a healthy system. The contractor shall perform tasks required to achieve and maintain Authorizations to Operate (ATOs) for all systems and applications supported by DUSN (M). The contractor shall ensure all servers are virtualized, maintain accurate diagrams and maintain baseline documentation of the server configurations. The contractor shall provide system administration for applications residing in commercial and Government cloud-based environments. The contractor shall assist the Government with consolidation and rationalization efforts that could include the need to migrate applications to an approved Navy hosting environment.

4.5.2.1 Backup and Restoral

The contractor shall ensure that daily and weekly backups are conducted and maintained on and off-site for all production and identified development servers. Backup outages shall be identified and tracked to resolution though notification to the client, submitting vendor tickets if needed and providing an After-Action Review for lessons learned. Any data sent to a vendor shall be scrubbed of sensitive content and reviewed by a government official prior to submission. Server and file restoration shall be provided on an as needed basis, within 24 hours of the request.

Restoration process shall be tested quarterly.

4.5.2.2 Disaster Planning and Disaster Recovery

In support of DUSN (M) IT systems, the contractor shall support disaster planning activities, consisting of developing, testing or performing several layers of disaster procedures. These procedures include but are not limited to off-site storage and recovery processes, server and application reconstitution processes and business recovery processes. The contractor shall also provide input and assist, as required, with periodic training and disaster recovery drills. The contractor shall update and maintain the Disaster Recovery Plan.

4.5.2.3 Software Patches and Upgrades

During the “normal” course of system support, the contractor shall test software patches and upgrades. The contractor shall test patches and upgrades prior to production rollout and make recommendations to the Government. Whether this is a problem resolution, vendor supplied patch, security patch, total rebuild or reconfiguration, the contractor shall detail the contractor plan of action, method of testing, back out process, customer notification plan and schedule. The contractor shall assist the Government with adhering to Secure Technical Implementation Guides (STIG), Cyber Task Orders (CTO) and Information Assurance Vulnerability Alerts (IAVAs). The contractor shall be aware of applications and disclosed vulnerabilities provided through official and Open-Source Information channels such as vendor notifications and professional publications. Based on the impact to hosted systems, the contractor shall work with the Government to prioritize the mitigation and remediation of zero-day vulnerabilities.

4.5.2.4 Problem Resolution

The contractor shall provide problem resolution to restore services that have been degraded or have experienced a mission impacting service outage. During normal business hours, the contractor shall immediately begin the resolution process, which is to include Government notification within thirty minutes of detection. The contractor shall provide, at a minimum, a plan of action to resolve the problem within two hours of the notification. The contractor shall provide a Root Cause Analysis (RCA) for all events where a “mission impacting” service outage was experienced. The Government IT PgM may request an RCA for other events as required.

4.5.2.5 Monitoring

The contractor shall use Government-provided tools to perform application/system monitoring of all services, including customer-provided applications. The contractor shall provide monthly reports of performance metrics and capacity planning within five business days of each month for the activities of the previous month. The contractor shall take proactive measures to prevent any foreseeable system degradation or outages. The contractor shall notify the Government of any cost overruns discovered from monitoring cloud environments not limited to errant snapshots and requiring additional testing resources.

4.5.2.6 Operating Procedures

The contractor shall develop and maintain a “library” of standard operating procedures (SOPs) for all activities and services performed by the contractor under this task order. These procedures shall be reviewed and revised upon any system configuration change, maintained online and be available for Government review upon request. The contractor shall adhere to the change management process as defined by the Government lead. All change management requests should be as detailed as possible so as to enable less technical personnel to understand the change and roll back if required.

4.5.3 Systems Engineering Services

The contractor shall provide Systems Engineering Services in support of DUSN (M) requirements. The contractor shall be responsible for gathering desired outcomes/objectives and translate those requirements into solutions. The contractor shall be responsible for the secure design and operations of complex systems from the conceptual phase through product deployment. The contractor shall develop processes and procedures to analyze and maintain the confidentiality, integrity and availability of systems engineering hardware and software in accordance with acceptable enterprise architecture guidance. The contractor shall present solutions to the Government that are secure and cost efficient for the task.

TASK 4.6 SYSTEM SUPPORT

A primary goal of DUSN (M) is the timely and responsive management of resources authorized for use in the execution of Secretary of the Navy programs. This goal is realized through support provided by DUSN (M) ’s IT team. In addition to the operations and maintenance of systems hosted by DUSN (M) IT, the contractor shall provide application development and test, operations, maintenance and SME support for DON Secretariat websites and systems:

4.6.1 Website Development and Maintenance and IT Security

The contractor shall serve as the principal web-based developer for the Secretariat’s hosted websites and applications, as required, described below:

• Provide primary design and functionality enhancements for the Secretariat hosted portals/websites

• Provide Webmaster functions, updates to website content, reevaluation and enhancement of website

• Rehabilitation Act Provide primary design and functionality enhancements for the Secretariat hosted portals/websites

• Analyze software upgrades and provide recommendations for implementation. Include an estimated cost of implementation. The contractor shall maintain the DON’s Transportation Incentive Program (TIP) web application as described below:

• Update homepage and links monthly

• Keep documents, such as, the monthly newsletter up to date

• Provide Technical help desk support

Contractor shall also perform IT security for Secretariat hosted portals/websites:

• Act as Secretariat’s Information Systems Security Officer (ISSO)

• Perform and maintain any required Assessment & Authorization (A&A), in coordination with DUSN (M) IT Cyber and System branch administrators and developers and the Navy’s SCA and NAO, for network connectivity, authority to operate (ATO) or any related security requirements at the application level.

• Assist DUSN (M) IT staff in registering application/system information in the DON Applications and Database Management System (DADMS) and the DoD Information Technology Portfolio Repository –DON

(DITPR-DON)

Provide management and engineering analysis services to assist with DoD/DON statutory and regulatory requirements for IT portfolio management in all life cycle stages.

To include:

• Provide management with engineering services related to network system design server consolidation, Information Assurance, and application development

• Provide program level support in the development and implementation of engineering changes, testing and evaluation documentation, fielding procedures and plans, risk assessments and various decision briefings

Contractor shall perform Help Desk and administrative functions to include but not limited to:

• Maintain DUSN (M) IT issued and inventory equipment database

• Submission of IT/phone repair tickets

• Troubleshoot and provide technical help desk support and resolution to personnel

• Provide support as needed to Business Operations Office and other administrative tasks

The contractor shall utilize an existing SharePoint automated system for all Help Desk requests in order to track tickets and resolution. Additionally, the contractor shall be able to provide administrative, development and testing support within SharePoint. The contractor shall provide weekly status reports on any and all issues related to this task by Tuesday of the following week for the previous week.

TASK 4.7 INFORMATION ASSURANCE (IA) SUPPORT

The contractor shall provide IA support under this task order for DUSN (M) claimancy applications, systems and networks.

4.7.1 Assessment & Authorization (A&A)

The contractor shall support and implement all phases of the Risk Management Framework (RMF) as defined by the Department of the Navy (DON) to meet compliance with DoD Instruction (DoDI) 8510, Risk Management Framework (RMF) for DoD Information Technology (IT) and DoDI 8500.01, Cybersecurity. The contractor shall provide cyber analyst and validator support as required for all 6 Steps as currently defined by DON’s RMF process guide. Contractor shall provide daily Assessment & Authorization (A&A) updates through use of the internal cybersecurity portal as well as weekly activity report documentation. Assist Package Submitting Office (PSO) with assessment packages entered into the required A&A processing system (currently the Enterprise Mission Assurance Support Service (eMASS). The contractor shall provide fully qualified Navy validator(s) (FQNV) - normally between 1-3 FQNV depending upon mission requirements - to ensure compliance with required Navy Authorizing Officials (NAO) and Navy Security Control Assessor (SCA) procedures and guidelines. The contractor shall provide assistance to the Echelon I Information System Security Manager (ISSM) to review all Secretariat packages for collaboration and maintaining current FISMA compliance for approximately thirty systems and various applications.

The contractor shall monitor and report on each A&A packages, Plan of Action and Milestones (POA&Ms) generated in eMASS, to track the closures of reported open security control findings. The contractor shall provide highly consistent, timely, effective and correct assessment and validation support to meet defined schedule and deliver a monthly POA&M report to PSO and ISSM.

4.7.1.1 Navy Assessment & Authorization (A&A) System Documentation

The contractor shall maintain and assist personnel supporting Navy Secretariat systems with required process documentation under RMF and related assessment and authorization procedures. The contractor shall create and maintain each specific system’s formal collaboration meeting minutes and other formal or informal communications documentation relate to decisions, actions, meetings, reviews and assessment findings for supported systems. The contractor shall update Cybersecurity’s branch internal knowledge base by documenting current system status, planned actions, system changes to include personnel, security related configurations and IA process required documentation. The contractor shall provide weekly activity report to identified Government personnel. The contractor shall provide appropriate documentation associated with follow-on assistance to supported systems’ personnel and PSO during and after the Navy SCA liaison and Navy Authorizing Official (NAO) representative review process to ensure that an Authority to Operate (ATO) is obtained and maintained from the NAO. The contactor shall ensure that SCA liaison and NAO issues, if any, are properly documented and answered in a timely manner. The contractor shall provide a biweekly report of the A&A status of all Secretariat systems.

4.7.2 Protect Information and Information Systems

The contractor shall assist in the risk management process by gathering relevant threat information to assist in defining system security requirements, and recommending the appropriate Mission Assurance Category, Confidentiality Level (CL), and Impact Level (IL) for all applications and supported Navy Secretariat systems. This information shall be properly documented and communicated with identified Government personnel. The contractor shall be knowledgeable and experienced with host intrusion detection, host intrusion prevention, system compliance profiling, rogue system detection, application blocking, and Information Operation Condition (INFOCON) in order to recommend approved IA actions required to protect, monitor, analyze, detect and respond to found vulnerabilities and known cybersecurity threats.

4.7.3 Computer Network Vulnerability Testing

The contactor shall serve as the computer network vulnerability testing agent for Secretariat Information Security (IS) and networks. This includes Technical Evaluations, Operational Evaluations, System vulnerability scans and Verification of Correction of Deficiencies. The contractor shall ensure compliance with IA and Computer Network Defense (CND), tracking and reporting claimancy Information Assurance Vulnerability Management (IAVM) and Command Tasking Orders (CTO) status.

4.7.4 Perform Web Risk Assessment (WRA) and Analysis

The contractor shall perform Web Risk Assessment (WRA) and analysis on all Secretariat systems and applications to ensure Navy Secretariat and Secretariat Staff web pages resident on the World Wide Web comply with prescribed DoD and DON guidance. The contractor shall assist the Information Security Manager (IAM) in providing guidance and direction to ensure the content, compliance and investment of all unclassified Web sites and their associated Uniform Resource Locators (URLs) have potential risks identified and employ the necessary IA safeguards to protect operational security, privacy of information, and information security. The contractor shall assist the IAM in consolidating DON web site and URL investments to reduce the infrastructure footprint, in order to better protect operational security, privacy of information and information security. The contractor shall assist the IAM in the registration of all URLs in the DON Application and Database Management System (DADMS) for inclusion into the DON IT/IM investment portfolio.

4.7.5 Management of the Secretariat’s Information Assurance Vulnerability Management (IAVM) Program

The contractor shall serve as the IAVM agent for supported systems and monitored sites through use of Vulnerability Remediation Asset Manager (VRAM) created environment and if required by supporting approved mitigation plans. The contractor shall review VRAM on a daily basis, excluding weekends and holidays. The contractor shall query System Administrators on status, as required, and report IAVM Compliance in VRAM, as required. The contractor shall notify the PSO identified Government personnel when an organization fails to comply with the IAVM program. The contactor shall provide Information Assurance Vulnerability Alerts (IAVA) support through analyzing and assessing automated Assured Compliance Assessment Solution (ACAS) scan results of implemented security controls, onsite system analysis of system settings, security procedures, application security requirements and operating system security requirements. The contractor shall provide timely acknowledgement of vulnerability alerts, bulletins and messages as required for FISMA compliance.

4.7.5.1 Performance Validation Services

The contractor shall perform master level validation services through level III and level II FQNV personnel. The contractor shall possess qualifications and skills to independently perform required validation activities leading to SCA signature and acceptance of RMF Security Assessment Report (SAR). The contractor shall maintain valid NQV credential through meeting annual maintenance requirements and having proficiency in performing required validation activities. The contractor shall work as an integral function of Cybersecurity branch as a trusted agent of the SCA.

4.7.5.2 Functional Area Management (FAM) Federal Information Security Modernization Act (FISMA) reporting.

The contractor shall request and monitor the Microsoft Defender for Endpoint (MDE) dashboard on a weekly basis.

The contractor shall ensure that MDE data is complete, accurate and current. The contractor should follow up on recommendations made by MDE through coordination with the Government.

The contractor shall perform as lead for Information Assurance/Cybersecurity assistance to supported systems’ Program Managers (PgM) with reporting compliancy within DO Application and Database Management System

(DADMS) and DoD IT Portfolio Repository for DON (DITPR-DON) by assisting in registration of Secretariat’s organizations requests for applications use and IT systems’ registration. The contractor shall facilitate annual FAM(s) security reviews when required through coordination and execution of collaborations to complete and compiled security questionnaires by customer service (CS) to reflect security status of assets, personnel security training, network security posture, and software portfolio.

TASK 4.8 CUSTOMER SERVICE SUPPORT

4.8.1 Customer Service

The Customer Service Branch (CSB) is the face of the DUSN (M) IT for the Navy Secretariat, which consists of 21 directorates. The contractor shall provide Customer Services Operations and Maintenance (O&M) support.