832471018 FORSCOM Draft PWS.pdf

CUI

Controlled By: US FORSCOM

CUI Category: PROCURE

Distribution/Dissemination Control: FEDCON

POC: bobbie.a.johnson2.civ@army.mil

Page 1 of 32 Pages

PERFORMANCE WORK STATEMENT (PWS)

Award/Mod Effective Version Date

Contract Number: To Be Determined (TBD)

Task Order Number: TBD

Contractor Name TBD

Tracking Number: 832471018

Follow-on to Previous Contract and

Task Order Number:

HC102820D0001 HC102820F0622

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator. See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title. United States (U.S.) Army Forces Command (FORSCOM) Cybersecurity &

Communications Security (COMSEC) Program Support

3. Background.

The U.S. Army FORSCOM is the largest U.S. Army command and provider of expeditionary regionally engaged, campaign-capable land forces to combatant commanders. FORSCOM trains and prepares a combat ready, responsive Total Forces to build and sustain readiness to meet Combatant Command requirements.

Desired support footprint includes 15 regional sites: FORSCOM HQs; three Army Corps (I Corps at Fort Lewis, WA; III Corps at Fort Hood, TX and XVIII Airborne Corps at Fort Liberty, NC). Together they include eight divisions, three separate brigades, two armored cavalry regiments, 37 support brigades.

FORSCOM desires support in two specific sectors: Cybersecurity and COMSEC.

4. Objectives.

Provide professional cybersecurity and COMSEC mentoring, training and Subject Matter Expertise (SME) support to FORSCOM staff and subordinate personnel. All support will be in in accordance with (IAW) all Department of the Army (DA), all related Army Regulation (AR), DODI 8500.01, Department of Defense (DOD) 8570.01-M, and any other DoD mandated guidelines and polices.

5. Scope.

The effort includes providing Cybersecurity and COMSEC program support to the FORSCOM G6 Staff and subordinate units/sites including requirements that provides the capabilities needed to support networks and infrastructure.

Page 2 of 32 Pages

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 20% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

The Government will require hours to be adjusted during times of high demand. Examples may include, major events/exercises and mobilization prep. Contractor shall work additional hours to support demand and in turn receive the same number of hours off the previous or following week, based on contractor availability.

• Performance Area 1 - Enterprise IT Policy and Planning

• Performance Area 2 - Integrated Solutions Management

• Performance Area 3 – Process, Performance, and Strategic Benchmarking

• Performance Area 5 - Requirements Analysis

• Performance Area 7 - Information and Knowledge Management

• Performance Area 12 – Network Support

• Performance Area 13 – Cyber Security Assessment, Authorization, and Implementation

• Performance Area 17 – Operations Support

• Performance Area 18 – IT Support Services

• Performance Area 19 – Cloud Professional Services

Operation:

The Government will require contractors to provide best effort support to non-manned sites. Sites will be supported remotely via teleconference or planned site visits. Objectives and timeframes will be discussed and developed during Site Assisted Visit (SAV) planning.

Cybersecurity contractors at the Corps sites (I Corps, III Corps & XVIII ABC) will coordinate with the COR /

Alternate COR, contractor Program Manager (PM) and local Government support to develop a timeframe to provide dedicated support at the local Divisions (7ID, 1 CAV & 82nd ABN). Support will nominally be provided at a 70%

Corps to 30% across all Division split throughout the option year with Corps taking precedence.

6. Performance Requirements.

6.1. TASK: Cybersecurity and COMSEC Program Management

6.1.1. Subtask 1 – Performance Based Management – Program Management Organization

a. Provide overall program management for the TO. This includes, general program management, schedule, risk and opportunity management, contract management, financial management, data management and quality assurance.

b. Provide the technical and functional activities required for integration of all tasks specified within this PWS.

Include productivity and management methods such as quality assurance, progress/status reporting and program reviews.

c. Prepare and maintain a Program Management Plan to manage the requirements, describing the technical approach, organizational resources and management controls to be employed to meet the cost, performance and schedule requirements throughout TO execution.

d. Prepare a cybersecurity scorecard outlining the training and certification compliance of FORSCOM units and status of quarterly privilege user reviews. The Contractor shall:

a. Coordinate with Contracting Officer (KO) / COR.

b. Apprise senior management on productivity and quality assurance.

c. Develop transition/ migration plans.

d. Support Government efforts for document review and approval.

e. Gather stakeholder requirements.

Page 3 of 32 Pages

f. Manage project schedules and coordinate Contractor activities IAW the PWS.

g. Identify and communicate issues and risks to the Government and offer recommendations on how issues / risks should be mitigated to successfully satisfy the requirements.

h. Notify the COR when the contractor believes that any Government activity may impact performance, schedule, or cost.

i. Develop and provide the Government with a monthly Cybersecurity Scorecard. Report will reflect the current status of all Units related to: (Army Training and Tracking Status - % of Baseline Certified personnel, % of CE trained personnel, completion % of Cyber Awareness, Privileged level Access

Agreements, DD Form 2875 and IT User Agreements.)

j. The Contractor shall maintain an adequate work force for the minimized interruption of performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

k. The contractor shall provide a Program Review to update government of current cost, schedule and performance. Collaborate on planning, contract implementation and due outs.

l. Constraints: Work schedule 5 weekdays x 8 hours, Secret Security Clearance, PMI PMP certification, 7 years program management experience.

Deliverables:

• F001 - Program Management Plan

• F002 - Program Management Review

• F003 - Report of Government Furnished Property (GFP)

• F004 - Cybersecurity Scorecard

• F005 - SAV Plan

• I001 - Weekly Activity Status Report

6.1.2. Subtask 2 – Security Requirements

The Contractor shall:

a. Perform the work conducted under this PWS in detail in section 6 IAW security guidelines noted in

PWS section 12. Security Requirements. Classification level requirements for this work will vary, and for some activities will include up to Secret.

b. Implement and adhere to security polices and classification of the networks IAW with DISA and DoD classification guides. Storage and reporting of information shall be IAW the classification guides.

Report security incidents and Negligent Discharge of Classified (NDCI) IAW current DoD and Army policies and procedures.

c. The Contractor shall establish and implement security aspects of the contract Execution environment

(e.g. policies, procedures, standards, resources, controls, and outcomes to include applicable verification testing) that are compliant, effective, and reliable in the areas of personnel security (for clearances and access), information security and assurance, and physical security and protection of facilities and infrastructure.

d. Constraints: Work schedule 5 workdays x 8 hours, Secret Security Clearance, PMI PMP certification, 7 years program management experience.

6.2. Task 2 – Cybersecurity Program Support

6.2.1. Subtask 1 – Cybersecurity Policy and Planning Support

6.2.1.1. Places of Performance

❖ 20th CBRNE, Aberdeen Proving Ground, MD

❖ 1st Infantry Division, Fort Riley, KS

❖ 4th Infantry Division, Fort Stewart, GA

❖ 10th Mountain Division, Fort Drum, NY

❖ 1st Armored Division, Fort Bliss, TX

❖ 32nd AAMDC, Fort Bliss, TX

❖ JRTC, Fort Johnson, LA

❖ NTC, Fort Irwin, CA

Page 4 of 32 Pages

❖ 1st Cavalry Division, Fort Cavazos, TX

❖ 7th Infantry Division, JBLM, WA

❖ 82nd Airborne Division, Fort Liberty, NC

❖ 101st Airborne Division, Fort Campbell, KY

The Contractor shall provide the following support:

a. Perform business analysis to develop and implement standard methodologies to facilitate requirements for managing and monitoring activities surrounding identified core business operations, related to cybersecurity assessments, technical audits and SAVs.

b. Draft, edit, analyze, and provide recommendations on the annual review of Cybersecurity policies, Standard Operating Procedures (SOP’s), Tactics, Techniques & Procedures (TTPs), Plan of Action and

Milestones (POA&M’s). To include:

1. Collecting/reporting metrics using current/future cybersecurity tools and software.

2. Preparing/disseminating cybersecurity information and alerts.

3. Reviewing and providing security guidance on Information Assurance Vulnerabilities

Management (IAVMs) & U.S. Army Cyber Command (ARCYBER)/ FORSCOM Critical

Tasking Orders & Operation Orders.

4. Collecting/compiling/reporting Federal Information Security Management Act (FISMA) metrics.

5. Collecting/compiling/reporting Army Portfolio Management Solution (APMS) metric data.

6. Collecting/compiling/reporting Assured Compliance Assessment Solution (ACAS) metric data.

c. Collect, compile, and report APMS, FISMA, ACAS, or successor program compliance metrics for

FORSCOM G6 Staff and subordinate units.

d. Constraints: Work schedule 5 workdays x 8 hours, Secret Security Clearance, DoD 8140-01-M IAT Level

II certification, BA/BS in a technical discipline with at least 10 years of experience.

6.2.1.3. Places of Performance

❖ I Corps, JBLM, WA

❖ III Corps, Fort Cavazos, TX

❖ XVIII Airborne Corps, Fort Liberty, NC

The contractor shall provide the following support:

a. Develop Cybersecurity related TTPs:

1. Collect/compile/report Enterprise Mission Assurance Support Service (eMASS) metrics.

2. Collect/compile/report endpoint Azure metrics.

b. Constraints: Work schedule 5 workdays x 8 hours, Secret Security Clearance, DoD 8570-01-M; IAT Level

II certification with an MA/MS in a technical discipline with at least 15 years of experience.

Deliverables resulting from this work are as follows:

• I002 - Policies, Guidance, SOP’s, TTPs

• I003 - Task / Operation Orders

• I026 - Cybersecurity Scorecard (ACAS, Army Training and Certification Tracking System (ATCTS)

& Risk Management Framework (RMF))

6.2.2. Subtask 2 – Cybersecurity Readiness / (SAV Support

6.2.2.1. Places of Performance:

❖ 20th CBRNE, Aberdeen Proving Ground, MD

❖ 1st Infantry Division, Fort Riley, KS

❖ 4th Infantry Division, Fort Carson, CO

❖ 3rd Infantry Division, Fort Stewart, GA

❖ 10th Mountain Division, Fort Drum, NY

❖ 1st Armored Division, Fort Bliss, TX

❖ 32nd AAMDC, Fort Bliss, TX

Page 5 of 32 Pages

❖ 7th Infantry Division, JBLM, WA

a. Perform SAVs in support of FORSCOM and subordinate units/sites. SAVs will be coordinated with local site G6 staff and approved by the COR /ACOR. Site plan will be assessed quarterly and updated as needed, with change request from local units or COR/ACOR.

b. Perform security audits (via spot check) and identify security gaps in environment, provide recommendations for inclusion into the unit’s risk mitigation strategy.

c. Plan and recommend modifications or adjustments based on SAV or Cyber Operations Rapid

Assessment (CORA) results or environment review.

d. Analyze results / implement CORA mitigation on unclassified, classified and tactical information systems and networks.

e. Develop a SAV plan, including logistics for executing, TTPs, schedule, roles/responsibilities of involved parties.

f. Conduct SAVs and unannounced cybersecurity compliance visits to assist subordinate units with securing information and associated system resources.

g. Review and provide recommendations based on site’s Disaster Recovery/Disaster Recovery Plan (DR /

DRP) / Continuity of Operations (COOP) / Contingency Business Continuity (CBCP) and Incident

Response Plans (IRP) and documented results of DR/COOP exercises to validate compliance of actions taken to prevent, protect and defend information and information systems.

h. Constraints: Work schedule 5 workdays x 8 hours, Secret Security Clearance, DoD 8570-01-M; IAT

Level II certification with an BA/BS in a technical discipline with at least 10 years of experience.

6.2.2.2 Places of Performance:

a. Validate / review eMASS required documentation prior to Information System Security Officer approval.

b. Cloud Support to meet DoD Cloud Computing Security Requirements Guide and Army CIO memorandums. Specifics include, coordination with Enterprise Cloud Management Agency (ECMA), verification of vendor’s Federal Risk and Authorization Management (FedRAMP) certifications and eMASS registrations and updates.

c. Constraints: Work schedule 5 workdays x 8 hours, Secret Security Clearance, DoD 8570-01-M; IAT Level

II certification with an MA/MS in a technical discipline with at least 15 years of experience.

Deliverables resulting from this work are as follows:

• I006 – SAV Out brief (each planned and unannounced site inspection)I007 – DRP/ COOP/CBCP/IRP

Status Report – includes status of outcome of DR/COOP/ CBCP/IRP exercises, lessons learned.

6.2.3. Subtask 3 – Cybersecurity Program – Daily Operations Support

6.2.3.1. Places of Performance

❖ 20th CBRNE

❖ 1st Infantry Division, Fort Rieley, KS

❖ 4th Infantry Division, Fort Carson, CO

❖ 3rd Infantry Division, Fort Stewart, GA

❖ 10th Mountain Division, Fort Drum, NY

❖ 1st Armored Division, Fort Bliss, TX

❖ 32nd AAMDC, Fort Bliss, TX

Page 6 of 32 Pages

❖ 7th Infantry Division, JBLM, WA

The Contractor shall:

a. Support to the Government may include reviewing & drafting cybersecurity polices, creating SOPs, training programs and assisting with compliance monitoring of local and subordinate units. To include: all

DOD regulatory guidance (See Appendix 1) and direct support of the local Organization -Information

Systems Security Manager (O-ISSM).

b. Provide DoD Best Business Practices (BBPs) and secure methodologies where required to maintain and/or improve the security posture of information systems (IS), the network, and remedy deficiencies.

c. Provide verification of DoD Information Network (DODIN) compliance by:

1. Collecting, reviewing, and analyzing CORA/SAV/ACAS results and resolving compliance via

POA&Ms.

2. Evaluating mitigation efforts addressed, identify gaps, and make recommendations to address the security non-complaint deficiency.

d. Implement procedures to provide the capability to identify, preserve, protect, detect, react, revise, and recover from threats, intrusions, and denial of services. The procedures shall be implemented to adequately protect network, server, mobile devices, workstations, COMSEC and the physical facility.

e. Contractor shall resolve computer security incidents and bring systems back to compliance.

f. Implement security designs and approaches to resolve vulnerabilities, mitigate risks, and recommend security changes to system or systems components as needed. Implement specific cybersecurity countermeasures for systems and/or applications. Server, desktop, and network administrators shall implement system security measures that are relevant to Confidentiality, Integrity and Availability , authentication, and non-repudiation.

Contractor shall at a minimum:

1. Support Alternate Smart Card Login implementation for Non-Secure Internet Protocol Router

(NIPR), Secret Internet Protocol Router (SIPR) and tactical networks.

2. Support the O-ISSM by responding to and resolving security incidents on client computers, servers, network devices, Voice over IP (VoIP) phones, and physical Intrusion Detection System on doors and vaults.

Constraints: Work schedule 5 workdays x 8 hours, Secret Security Clearance, DoD 8570-01-M; IAT Level II certification with an BA/BS in a technical discipline with at least 10 years of experience.

6.2.3.2 Places of Performance

❖ I CORPs, JBLM , WA

a. Verify Department of DODIN compliance through:

1. Reporting results, recommendations and identifying risk to appropriate senior leadership.

2. Provide cybersecurity support for Assess Only. Interim Authority to Test or Assessment and

Authorization (A&A) for unit-procured / Non – Program of Record (POR) systems.

b. Provide expertise in assessing, documenting, and reporting vulnerabilities on new and evolving technologies.

c. Provide expertise in applying Security Technical Implementations Guides (STIG) or successor programs to identify system vulnerabilities.

d. Execute RMF standards and provide related system lifecycle, support plans, concept of operations, operational procedures, and maintenance documentation, to be loaded within eMASS.

e. Provide SME to the Government requirements to submit and amend RMF packages.

Page 7 of 32 Pages

f. Constraints: Work schedule 5 workdays x 8 hours, Secret Security Clearance, DoD 8570-01-M; IAT Level

II certification with an MA/MS in a technical discipline with at least 15 years of experience.

Deliverables:

• I004 - Compliance Metric Report

• I008 - Site Compliance Report - (Source: CORA; ACAS Scans and SAV results)

• I009 - Privileged Account Audits

• 1012 - IAVM Metrics Report

• 1022 - Unit Inspections and SAV Reports

• 1023 - Privileged level Account Reports

• 1024 - Plan of Action and Milestones (POA&M)

• 1026 – Cybersecurity Scorecard (ATCTS, ACAS, RMF)

6.2.4 Subtask 4 - RMF / Accreditation Support

6.2.4.1 Places of Performance

❖ III Corps, Fort Cavazos, TX

❖ XVIII Airborne Corps, Fort Liberty, NC

The Contactor shall provide the following:

a. Review, verify and validate required DoD Cybersecurity RMF documentation and artifacts to support full compliance with current DoDI 8500.01, AR 25-2 and DA Pamphlets (PAMs), as well as superseding policies and regulations for obtaining certification and accreditation of all tactical networks.

b. Utilize eMASS repository for all documents required by the Security Control Assessors.

c. Provide technical expertise in the verification and validation of accreditation of subordinate unit/sites non-POR IS and networks through:

1. Prepare and submit RMF packages for unclassified and classified networks and enclaves for review and approval by the O-ISSM.

2. Provide guidance on System Security Plans for unclassified and classified information systems and networks.

3. Contractor will not provide a security guidance document.

d. Upload all supporting artifacts into eMASS, provide recommended improvements and verify compliance prior to submission.

e. Provide technical support to the unit pre/post site security inspection.

f. Provide site security self-assessment plan (TTPs, checklists, and procedures).

g. Complete continuous monitoring of system/application cybersecurity posture.

IAW RMF, AR 25-2, DA PAM 25-2-14, Army CIO policy memos, and system continuous monitoring.

Constraints: Work schedule 5 workdays x 8 hours, Secret Security Clearance, DoD 8570-01-M; IAT Level II certification with an MA/MS in a technical discipline with at least 15 years of experience.

Deliverables

• I014 – RMF Accreditation Status Report (Track system/application Authorization Termination Dates

(ATD) to begin re-authorization 180 days prior)

• I015 – RMF Artifacts (System Security Plan, Hardware/Software report, Network Diagram)

6.2.5. Subtask 5 – Training / Cybersecurity Awareness Support

6.2.5.1 Places of Performance – All

The contractor shall:

a. Draft, review, edit, update, analyze, recommend and/or provide written cybersecurity awareness training materials. Training materials are developed based on common compliance issues observed

Page 8 of 32 Pages during site visits, review of compliance or accreditation materials, or as requested by local

Government. Training materials may be provided in the form of one-pagers, newsletters, screen captures, Computer Based Training (CBT), or live, and shall be delivered via existing mechanisms

(e.g., training portal, FORSCOM and subordinate units/sites websites, Defense Collaboration Services

(DCS)). Final approval provided by Government.

b. Track Cybersecurity unit/sub-unit training program compliance (user IA training compliance) within the Digital Training Management System (DTMS) and/or ATCTS.

c. Conduct technical reviews and develop materials for system users in order to meet cybersecurity training compliancy. Reviews and materials shall beat the Secret level and below.

d. Constraints: Work schedule 5 workdays x 8 hours, Secret Security Clearance, DoD 8570-01-M; IAT

Level II certification with an MA/MS in a technical discipline with at least 10-15 years of experience.

• I016 – Training Artifacts

• I017 – Enterprise Training Metrics Report – FORSCOM Compliance report – DoD 8570.01-M

6.2.6. Subtask 6 – Program Communication and Coordination Support

6.2.6.1 Places of Performance – All

The contractor shall provide the following support:

a. Develop and present briefings and documentation in support of unit / sub-unit requirements.

b. Support the Government in tracking and managing reports, data calls, briefings, tasks / operation orders, and policy letters.

c. Prepare and disseminate technical, operational, functional, cybersecurity, computer network defense or cyber defense training material.

d. Identify, baseline, review, implement and integrate functional security requirements into current and future systems architectures.

e. Participate, attend, document, review, analyze and report on unit Configuration Control Board/

Command Management Board/Technical Review Board (CCB/CMB/TRB).

f. Constraints: Work schedule 5 workdays x 8 hours, Secret Security Clearance, DoD 8570-01-M; IAT

Level II certification with an BA/BS/MA/MS in a technical discipline with at least 10-15 years of experience.

• I018 – CCB/CMB/TRB Status Report

• I020 – Status/Tracking Matrix for reports, data calls, briefings, tasks, operation orders and policy letters.

• F021 – Quarterly Business Metrics

6.3 Task 3 –COMSEC Program Support

6.3.1 Subtask 1 – COMSEC Policy and Planning Support

6.3.1.1 Places of Performance

❖ III Corps, Fort Cavazos, TX

❖ XVIII Airborne Corps, Fort Liberty, NC

The Contractor shall:

a. Provide professional security services for COMSEC support to FORSCOM and subordinate units/sites

IAW DA guidelines, AR 380-40, Technical Bulletin (TB) 380-41, Chairman of the Joint Chiefs of Staff

Notice 6510, and any other DoD mandated requirements that govern this program.

Page 9 of 32 Pages

b. Review policies, COMSEC technical reports and provide SME recommendations to FORSCOM staff.

c. Safeguard COMSEC materials including proper storage, use, handling, inventory, destruction, and physical security.

d. Provide the following cryptographic infrastructure capabilities:

1. Information Systems Security Program - Army (ISSP-A) user management.

2. Employ common standards and technologies to reduce redundancies and maximize reuse of existing technologies.

3. Respond to cyber threats, mission changes and interoperability needs.

e. COMSEC required capabilities:

1. Develop/update unit emergency evacuation and destruction plans.

2. Develop/update COMSEC SOPs, TTPs and BBPs.

3. Provide SME on COMSEC mission support plans. (Related to Combat Training Center (CTCs) and Over Seas (OCONUS) planning/missions.

4. Manage COMSEC compliance program.

5. Develop/update command COMSEC management plans.

6. Draft/review COMSEC call-out messages for CTCs, OCONUS/CONUS training and missions.

7. Prepare annual CRYPTO evaluation report.

8. Track CRYPTO equipment/keys.

f. COMSEC Vulnerability Site Assessment:

1. Develop a SAV plan of all subordinate units.

2. Provide COMSEC risk assessment on unit threats: classification of critical assets, non-compliant facilities, lack of trained personnel and additional non-compliant items related to DoD

Communications Security Logistics Activity (CSLA) checklist.

3. Document all findings and provided recommended mitigations.

4. Serve as primary Department of the Army Cryptographic Access Program (DACAP) Liaison with the the Unit Security Office (S2/G2).

5. track subordinate units’ monthly status report submission to FORSCOM.

g. COMSEC Support/Guidance:

1. Conduct COMSEC training/briefs to Soldiers and Senior staff.

2. Conduct Management Client (MGC) user training and guidance.

3. Handle, transport and store MGC Node.

4. Establish Key Management Infrastructure (KMI) accounts.

5. Develop facility security backup plan.

6. Download new IAVMs via an MGC connection to the KMI storefront.

7. Create and offload the KOA backup files.

8. Archive KOA accounting data.

h. Provide COMSEC services/support to FORSCOM, I Corps, III Corps, and XVIII ABN Corps and all projects requiring COMSEC services at each Corps, to include COMSEC reports necessary to maintain a

Corps COMSEC office per the policies and guidelines set forth by the DA COMSEC Office of Records.

i. Integrate any technology changes and upgrades as approved by the KO or COR to meet user requirements and to maintain operational currency of COMSEC systems and networks. Currently, the Corps’

Headquarters are composed of approximately 79 COMSEC accounts distributed amongst Divisions, Brigade Combat Teams, and Expeditionary Signal Battalions.

j. Attend program meetings such as status meetings, Army Key Management Working Groups, Army

Command COMSEC Discussions, Regionally Aligned Forces Video Teleconferences (VTC), Quarterly G-

6 VTC, and other sustainment activities. The contractor shall be prepared to answer questions pertaining to the sustainment of Corps’ COMSEC account, and present the results of research completed to the COR.

(At no time will the Contractor represent the Government)

Page 10 of 32 Pages

k. Constraints: Work schedule 5 workdays x 8 hours, Top Secret Security Clearance, Key Management

Infrastructure (KMI) Client certification, 5-7 years COMSEC program management experience.

Deliverables:

• F050 - Quarterly Business Metrics Reports.

• I002 - Polices, Guidance, SOPs and TTPs.

• I003 - Task/Operation Orders.

• I004 - Compliance Metrics Reports.

I025 - Consolidated DACAP Reports.

6.3.2 Subtasks 2 – COMSEC Program – Daily Operations Support

The Contactor shall provide the following support:

a. Provide expertise to FORSCOM and subordinate units/sites to resolve COMSEC incidents and compromises.

b. Recommend best business practices and secure methodologies to maintain and improve the security posture of IS, the network, and remedy deficiencies.

c. Verify enterprise compliance through:

1. Collecting, reviewing, and analyzing CSLA audit results and POA&Ms.

2. Evaluate mitigation efforts, identify gaps, and make recommendations to address security deficiencies.

3. Track POA&Ms to completion utilizing Government provided tools.

4. Report results, recommendations, and identify risks to appropriate senior leadership.

d. Recommend best business practices and secure methodologies to maintain and improve the security posture of COMSEC program.

e. Provide trip and out brief reports for unit inspections and SAVs.

f. Review internal processes (incident reporting and annual assessment procedures on the state of COMSEC operations; recommend and document process improvements.

g. Review, verify, and report on the handling or use of protectively packaged keying material or tamper-sealed information processing equipment, utilizing technologies.

h. In coordination with the Government, work with outside agencies to resolve communications security incidents.

i. Serve as an escort, courier, or hand-carry classified material IAW DoD 5200.01, vol 3, DoD Information

Security Program and AR 380-40, Safeguarding and Controlling Communications Security Materials.

j. Constraints: Work schedule 5 workdays x 8 hours, Top Secret Security Clearance, Key Management

Infrastructure (KMI) Client certification, 5-7 years COMSEC program management experience.

k. Contractor will develop a analytical COMSEC status report monthly listing unit status: (Unit monthly report, personnel shortages/trained personnel, inspection schedule, Top 10 inspection failures).

• F140 - FORSCOM COMSEC Analysis Report (routing)

• I004 - Site Compliance Metrics Report

• I008 - Site Compliance Report (Command Inspection/SAV) results

• I022 - FORSCOM Inspection and SAVs

• I024 - Plan of Action and Milestones (POA&M)

6.3.3 Subtask 3 – Training/COMSEC Support

The contactor shall:

a. Provide administrative support to draft, review, edit, update, analyze, recommend and/or provide written

COMSEC training materials to be approved by the FORSCOM COMSEC representatives. In coordination with the Government, develop training material based on (common compliance issues observed during site visits and review of compliance or accreditation materials. Training materials may be provided in the form of one-pagers, newsletters, screen captures, CBT, or live, and shall be delivered via existing mechanisms

(e.g., training portal, FORSCOM and subordinate units/sites websites, DCS).

Page 11 of 32 Pages

b. In coordination with the Government, track the COMSEC training program for units/sites by tracking compliance of all users in completing required information assurance training using DTMS and/or ATCTS;

provide recommendations for increasing compliance levels.

c. Upon completion of specific training, contractor shall conduct COMSEC training for COMSEC tools and required COMSEC certification. (Based on available funding)

d. Constraints: Work schedule 5 workdays x 8 hours, Top Secret Security Clearance, Key Management

Infrastructure (KMI) Client certification, 5-7 years COMSEC program management experience

• I016 - Training Artifacts

• I017 - Enterprise Training Metrics Report

6.3.4 Subtask 4 – Program Communications and Coordination Support

a. Develop and present briefing supporting the COMSEC unit/subordinate unit COMSEC program.

b. Track reports, data calls, briefings, tasks / operations orders related to unit/subordinate COMSEC program.

c. Prepare and disseminate COMSEC material released from the DA, National Security Agency (NSA) and the FORSCOM HQs.

d. Constraints: Work schedule 5 workdays x 8 hours, Top Secret Security Clearance, Key Management

Infrastructure (KMI) Client certification, 5-7 years COMSEC program management experience.

• I018 - CCB/ CMB

• I019 – COMSEC Report

• I020 – Status/Tracking Matrix (reports, data calls, briefings, tasks / operation orders, policy letters)

• I021 - Briefing Presentation

7. Performance Standards. Acceptable Quality Levels (AQL) standards are established to ensure common expectations and evaluation of Contractor performance. To ensure that the program is at an appropriate phase for measurement, that the means of measurement are well defined and are in place / ready for use.

a. Adhere to the contractor Quality Manual and be committed to meeting customer and company requirements by implementing and continually improving policies, processes, and procedures that ensure quality and mission success throughout the product or service lifecycle.

b. Commit to fulfill quality, service management, and information security objectives and satisfy applicable requirements.

c. Commit to effective continual improvement.

SUBTASK 6.1.1. Program Management

Performance Standard Acceptable Quality Level (AQL) Surveillance Method

Program Management

Task Elements:

(a. – l.)

Performance/ Deliverables:

Contain required information, 90% accurate / error free, and delivered on time.

Any required revisions are:

• Resolved within 1 week

• Accepted by KO/COR

Inspection of delivered materials.

SUBTASK 6.1.2. Security Requirements Management

Performance Standard Acceptable Quality Level (AQL) Surveillance Method

Security Requirements

Management

Quality – Completely Addresses all areas of implementation

Inspection

Page 12 of 32 Pages

Performance Standard Acceptable Quality Level (AQL) Surveillance Method

Task Elements:

(a. – c.)

Timely – Completes actions within the specified deadline.

SUBTASK 6.2.1. Cybersecurity Policy & Planning Support

Cybersecurity Policy &

Planning Support

(a. - c.)

Performance / Deliverables:

free, and delivered on time

Resolved within 1 week

Accepted by KO/COR

Inspection of delivered materials.

SUBTASK 6.2.2. Cybersecurity Readiness / Site Assistance Visits (SAV)

Performance Standard Acceptable Quality Level (AQL) Surveillance Method

Cybersecurity Readiness /

Site Assistance Visits

(SAV)

(a. – g); 6.2.2.1

(a. -b)); 6.2.2.2

Performance occurs with no required re-performance or re-work at least 90% of the time. Problems that occur are minor and are resolved in a satisfactory manner.

Inspection

SUBTASK 6.2.3. Cybersecurity Program / Daily Operations Support

Performance Standard Acceptable Quality Level (AQL) Surveillance Method

Cybersecurity Program /

Daily Operations Support

(a. – f.); 6.2.3.1

(a. – e); 6.2.3.2

Performance/Deliverables:

Contain required information, 90% accurate/error free, and delivered on time

• Accepted by KO/COR

Inspection of delivered materials for all documents.

SUBTASK 6.2.4. Risk Management Framework (RMF) / Accreditation Support

Risk Management

Framework (RMF) /

Accreditation Support

(a. – f.)

Performance/ Deliverables:

Contain required information, 95% accurate / error

• Accepted by KO/COR

Inspection of delivered

SUBTASK 6.2.5. Training / Information Assurance Cybersecurity Awareness Support

Training / Cybersecurity

Awareness Support

(a. – d.)

Performance/ Deliverables:

• Accepted by KO/COR

Inspection of delivered

SUBTASK 6.2.6. Program Communication and Coordination Support

Page 13 of 32 Pages

Performance Standard Acceptable Quality Level (AQL) Surveillance Method

Performance Standard Acceptable Quality Level (AQL) Surveillance Method

Program Communication and Coordination Support

Task Elements:

(a. – e.)

Performance / Deliverables:

• Accepted by KO/COR

Inspection of delivered materials.

SUBTASK 6.3.1. COMSEC Policy and Planning Support

Performance Standard Acceptable Quality Level (AQL) Surveillance Method

COMSEC Policy and

Planning Support

Task Elements:

(a. – l.)

Performance/ Deliverables:

Contain required information, 90% accurate / error free, and delivered on time.

Any required revisions are:

• Resolved within 1 week

• Accepted by KO/COR

Inspection of delivered materials.

SUBTASK 6.3.2. COMSEC Program - Daily Operations Support

Performance Standard Acceptable Quality Level (AQL) Surveillance Method

COMSEC Program / Daily

Operations Support

(a. - k.)

Performance / Deliverables:

Contain required information, 95% accurate / error

• Accepted by KO/COR

Inspection of delivered

SUBTASK 6.3.3. Training / COMSEC Support

COMSEC Policy and

Planning Support

(a. – c.)

Performance/ Deliverables:

• Accepted by KO/COR

Inspection of delivered materials.

SUBTASK 6.3.4.: Program Communication and Coordination Support

Performance Standard Acceptable Quality Level (AQL) Surveillance Method

Program Communication and Coordination Support

Task Elements:

(a. – c.)

Performance / Deliverables:

• Accepted by KO/COR

Inspection of delivered

8. Incentives. Both positive and negative performance will be documented in past performance reports/database, Contractor Performance Assessment Reporting System (CPARS), as appropriate and will be taken into consideration for follow-on work.

9. Places of Performance.

a. Program Manager shall be located at Fort Liberty, NC and travel to all supported sites where Cybersecurity

& COMSEC contractors are located. Contractor shall be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this

Page 14 of 32 Pages contract. All travel requires advanced approval/authorization by the COR/ACOR. Exceptions to these guidelines shall be approved in advance by the KO.

b. Cybersecurity Contractors shall travel in & around the primary place of performance throughout the period of performance. Travel includes local unit and base assigned. Additional travel within CONUS will be required to support the requirements of this PWS, to support subordinate units at offsite bases. Contractor shall use phone and videoconferencing to the maximum extent possible to minimize travel. Contractor shall be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation

(JTR) and the limitation of funds specified in this contract. All travel requires advanced approval/authorization by the COR/ACOR. Exceptions to these guidelines shall be approved in advance by the KO.

c. FORSCOM COMSEC shall be assigned to Fort Liberty, NC and travel to any unit requiring direct

COMSEC support that cannot be supported by Corps COMSEC contractor. Contractor shall be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. All travel requires advanced approval/authorization by the

COR/ACOR. Exceptions to these guidelines shall be approved in advance by the KO.

d. COMSEC Contractors shall travel in & around the primary place of performance throughout the period of performance. Travel includes local unit and base assigned. Additional travel within CONUS will be required to support the requirements of this PWS, to support subordinate units at offsite bases. Contractor shall use phone and videoconferencing to the maximum extent possible to minimize travel. Contractor shall be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation

(JTR) and the limitation of funds specified in this contract. All travel requires advanced approval/authorization by the COR/ACOR. Exceptions to these guidelines shall be approved in advance by the KO.

e. Trip Reports. Trip Reports shall be provided within (5) working days to local government representative/

PM/COR/ACOR after travel has been completed.

f. The following locations are identified as Places of Performance (see Attachment 1, FORSCOM &

Subordinate Units/Sites Locations where contractors will be):

Cybersecurity COMSEC Home Unit

FORSCOM, Fort Liberty, NC No Yes Yes

I Corps, JBLM, WA Yes Yes Yes

III Crops, Fort Cavazos, TX Yes Yes Yes

1st Armored Division, Fort Bliss, TX Yes No Yes

4th Infantry Division, Fort Carson, CO Yes No Yes

XVIII ABN Corps, Fort Liberty, NC Yes Yes Yes

3rd Infantry Division, Fort Stewart, GA Yes No Yes

10th Mountain Division, Fort Drum, NY Yes No Yes

20th CBRNE, APG, MD Yes No Yes

32 AAMDC, Fort Bliss, TX Yes No Yes

JRTC, Fort Johnson, LA Yes No Yes

NTC, Fort Irwin, CA Yes No Yes

1st Infantry Division, Fort Riely, KS Yes No Yes

101st ABN Div, Fort Campbell, KY Yes No Yes

1st Cav Div, Fort Cavazos, TX No No No

7th Inf Div, JBLM, WA No No No

82nd Abn Div, Fort Liberty, NC No No No

* Home Unit - Contractor is assigned to a specific unit. Listing of “No” home unit requires the local on Base contractor to provide a percentage of support throughout the period of performance.

g. There shall be no travel to Country/City Security Assessment Ratings (CSAR) five countries. Travel to

OCONUS is not authorized.

h. Duties of the contractor shall be performed at Government Facilities.

i. Alternate Place of Performance – Alternative work sites allow for regular telework or remote work flexibilities. Regardless of where work is performed, the Contractor shall ensure that work is completed effectively and that mission needs and requirements are met, without degradation of services. Also, the

Page 15 of 32 Pages contractor may be required to account for the physical location of their personnel should this information be requested by the COR. The Contractor shall propose on-site rates for all work performed at an alternative work site. Incidental charges incurred while working at an alternative work site (e.g., electricity, internet) are not allocable to the contract and shall not be billed to the Government.

j. Long distance travel within CONUS may be required to support the requirements of this PWS. Long distance travel within CONUS must be pre-approved in writing by the COR prior to the Contractor incurring the cost in support of this contract.

k. Secondary Place of Performance – Contingency Only. As determined by the COR, contractor employees may be required to work at a secondary place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies

(e.g., pandemic conditions, exercises, Government closure due to inclement weather). Additionally, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed

Government facility. Contractor shall report in person on all Federal holidays not honored by the contractor agency. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the KO or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

In the event of a Telework / Remote work request the Government, via the KO and the contractor will agree to terms and conditions on the specifics of any type of off-site routine work.

10. Period of Performance. The period of performance is a base, plus four, one-year option periods. As directed by the KO, the contractor shall continue performance in emergency or mission essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

• Base period: 1 June 2025 - 31 May 2026

• Option Period 1: 1 June 2026 - 31 May 2027

• Option Period 2: 1 June 2027 - 31 May 2028

• Option Period 3: 1 June 2028 - 31 May 2029

• Option Period 4: 1 June 2029 - 31 May 2030

11. Security Requirements. This section supplements Block 13 of the Government provided DD Form 254, Contract

Security Classification Specification. The following security requirements shall apply to this effort.

a. The contractor shall coordinate visits with site POCs providing at least a 72-hour notice (or according to each site security requirements) prior to any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by cleared DISA personnel (civilian, military, or contractor).

b. Maintain his/her assigned area IAW applicable policies. End-of-day checks will be performed to ensure sensitive information is properly stored.

1. Cubicles will be checked for classified material prior to end of workday.

2. Classified material will be stored in the assigned safe or security container.

3. Hard disk drives will be removed from classified computers.

4. Safe(s) or security container(s) will be locked.

c. Safeguard all PII IAW AR 25-22, The Army Privacy Program.

References:

a. DISA End User Access Agreement, 11 February 2021

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-36, Personnel Security

e. DISA Instruction 240-110-38, Industrial Security

f. DISA Instruction 240-110-43, Insider Threat Program

Page 16 of 32 Pages

g. DISA Instruction 630-230-19, Cybersecurity

h. DoD Manual 5200.01, Vol 1-3 Information Security Program, 24 February 2012

i. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

j. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

k. 32 CFR Part 117, “National Industrial Security Program Operating Manual (NISPOM)”, 24 February 2021

l. DoD Manual 5105.21 Sensitive Compartmented Information Administrative Security Manual:

Administration of Information and Information Systems Security (remove if not applicable)

m. DoD Manual 5205.07 Special Access Program Security Manual (remove if not applicable)

n. DoD PAM 25-2-7, Army Information System Privileged Access, 8 April 2019

o. DoD PAM 25-2-6, Cybersecurity Training and Certification Program, 8 April 2019

n. DoDI 5230.24, “Distribution Statements for DoD Technical Information,” January

10, 2023.

11.1 Facility Security Clearance. Work performed under this contract/order is up to the Top Secret level. Therefore, the company must have an interim or final Top Secret Facility Clearance from the Defense Counterintelligence and

Security Agency Facility Clearance Branch.

11.2. Security Clearance. All personnel performing on or supporting a DISA contract/order in any way shall be U.S.

citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance eligibility delineated in the table below when performance starts.

PWS Task /

Subtask

Clearance

Level

Level of

Classified Access Justification for Access to Classified

Task:

6.1

Secret

NIPRNET

Secret and SIPRNet accesses required to support Government mission.

The Government utilizes the SIPRNet to coordinate cyber compliance resolution.

Contractors will be required to be cleared to access up to SECRET information in order assess, advise and resolve non-complaint system vulnerabilities.

6.2

Secret

NIPRNET/

SIPRNET

The Government utilizes the SIPRNet to coordinate cyber compliance resolution.

Contractors will be required to be cleared to access up to SECRET information in order assess, advise and resolve non-complaint system vulnerabilities.

6.3

Top Secret

NIPRNET

/SIPRNET/JWICS

Top Secret, JWICS accesses are required to support Communication Security

(COMSEC) mission.

Government request in some instances are provided via Top Secret (OCONUS key support) or with JWICS to view high level issues concerning COMSEC.

11.3 Investigation Requirements. All personnel requiring Top Secret and SCI access under this contract/order shall undergo a favorably adjudicated Tier 5 (T5) investigation (formerly known as a Single Scope Background

Investigation (SSBI)) as a minimum requirement. Enrollment into Continuous Evaluation current within 5 years and reflected in Defense Information System for Security (DISS), would meet the requirement for a current Periodic

Reinvestigation (PR).

Page 17 of 32 Pages

11.3.1 All personnel requiring Secret access under this contract/order shall undergo a favorably adjudicated Tier 3

(T3) Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access

National Agency Check and Inquiries as a minimum investigation. Enrollment into Continuous Evaluation current within 5 years and, reflected in DISS, would meet the requirement for a current PR.

11.4 Visit Authorization Letters (VAL). Visit requests shall be processed and verified through the DISS to Security

Management Office (SMO). DISS visits for contracts/orders are identified as “Other” or “TAD/TDY” and will include the Contract/Order Number of the contract/order in the Additional Information section. Contractors that do not have access to DISS may submit visit authorizations by e-mail in a password protected .pdf to the COR/ACOR specified in DITCO Additional Text G1 - Points of Contact.

*Prior coordination with the security manager should be made via email to ensure the VAL/ Visit

Authorization Request (VAR)/ Visit Termination Notification (VTN) process is agreed upon and properly secure.

11.4.1 VAR Package. VARs must be received via email and require pre-approval from the assigned DISA COR five business days in advance of the report date. The VAL/VAR/VTN should be sent via email to the appropriate COR.

The VAL/VAR/VTN should be sent using in a locked “Zip” file in one e-mail and then followed-up by another e-mail with the password to unlock the Zipped file, because it contains sensitive information covered by the Privacy

Act.

Documents to include in the VAR Package:

1. Inter-office Memorandum (IOM)

2. DD Form 254 Prime and/or Sub (Good Standing approval emails for current option year)

3. Contractor VAL signed by the Contractor Facility Security Officer (FSO)

If DISS is not available, the VAL must contain the following information on company letterhead:

• Company name, address, telephone number, facility security clearance

• CAGE CODE

• Contract/Order Number

• Name, SSN, date and place of birth, and citizenship of the employee intending to visit

• Certification of personnel security clearance and any special access authorizations required for the visit

(type of investigation & date and adjudication date & agency)

• Name of COR/Alt COR

• Dates or period the VAL is to be valid

*Any VAL/VAR submitted without the above information will be denied. *

11.5 Security Contacts. FORSCOM Security Personnel can be contacted for Industrial or Personnel Security related issues at (910) 570-6682 or via mail at:

U.S. Army FORSCOM

ATTN: G6 – Security Manager

4700 Knox Street, Fort Liberty, NC 28310

11.6 Information Security and other miscellaneous requirements.

11.6.1 Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the Government facility.

11.6.2 Contractor employees shall be required to comply with all Government security regulations and requirements.

Initial and periodic safety and security training and briefings will be provided by Government security personnel.

Failure to comply with Government security regulations and requirements shall require the company to provide the

Page 18 of 32 Pages

Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract/order.

11.6.3 Contractor employees with an incident report in DISS who have had their access to classified suspended…