832571054 - PWS Draft.docx

CUI

CUI

PERFORMANCE WORK STATEMENT (PWS)

1. Contracting Officer’s Representative (COR).

a. Primary COR. See Defense Information Technology Contracting Organization (DITCO) Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title. Sensing Systems Support (SSS) for development, cybersecurity accreditation, sustainment, Lifecycle Management, and Tier-III support.

3. Background. As the Department of Defense (DoD) SSS Manager and Representative, the Defense Information System Agency (DISA) Program Executive Office Cyber (PEO-Cyber) compiles and supports a broad range of requirements for each of the Combatant Commands/Services/Agencies component activities and depends on the successful, well-maintained operation of a diverse group of state-of-the-art technology components and interconnected sub-systems. PEO-Cyber provides for wide-ranging sensing, collection, and analysis enabling capabilities derived from strategic union points across the Defense Information Systems Network (DISN) architecture and perimeters. PEO-Cyber is responsible for sensor systems requirements collection, market research, engineering, integration, testing, baselining, certification and accreditation, installation, implementation, operations, and maintenance, and “End of Life” disposition. In addition, PEO-Cyber is responsible for the documented architecture of the DISA Cyber Perimeter Sensing Initiative.

Historically, DISA PEO-Cyber was the established Program Management Office (PMO) for several key operational capabilities the Department of Defense Information Network (DoDIN), formerly known as Computer Network Defense, community of interest relies upon each day. These capabilities include the development and management of the sensor deployment plan, development, and deployment of new Network Intrusion Detection (NIDS) sensor technologies, research, analysis, and adoption of new technologies related to NIDS, integration of key, disparate data sets, visualization of sensor data to provide enhanced network intelligence to the analyst, and sustainment of the backend infrastructure to support these daily operations.

To fulfill its designated role, PEO Cyber requires contractor support to accomplish the tasks necessary to fulfill the responsibilities outlined in applicable DoD Directives.

4. Objectives: This task order will acquire Subject Matter Experts (SME)s that shall support software/hardware integration, generative artificial intelligence and machine learning integration, data tagging, test, certification and accreditation, baseline operations and management, installation, procurement, technical writing, and project management for sensors throughout the DoDIN. These SME’s shall utilize any combination and/or all the following guidelines, methodologies, and Frameworks to complete the terms of this task order:

· Department of Defense Architecture and Framework (DoDAF).

· Information Technology Infrastructure Library (ITIL).

· Project Management Fundamentals.

· Scaled Agile Framework (SAFe).

5. Scope. Work performed by the contractor under this task order is intended to support the sustainment of sensing capabilities: Open Sensor Platform (OSP), Full Packet Capture (FPCAP), Automated Security Validation (ASV) and Intrusion Detection System (IDS). The contractor shall support a broad range of technical and programmatic activities including, sustainment, operation and Tier-III engineering support.

As an optional task, the task order will also support the design and integration of sensing capabilities into Non-Secure Internet Protocol Router (NIPR)/Secure Internet Protocol Router (SIPR) network and cloud: Modernization of OSP and integration to NIPR/ SIPR network, integration of ASV and multi-site reporting tools (MSR) to SIPR network, transitioning of Intrusion Detection System (IDS) into cloud hosting environment, and modernization of SIPR sensing capabilities. The Government recommends leveraging commercial off the shelf (COTS) software/Government off the shelf (GOTS) software capabilities for the design.

The efforts are essential to provide network and system operations, maintenance and management services for network and information systems, systems administration, software, applications, and demonstrations support for the sensing capabilities. The contractor shall comply with the appropriate Federal Government laws, policies, guidelines, publications, standards, and DoD/DISA approved policies and directives. Seamless interoperability of the various mission and support applications encompassing DISA’s computer network defense mission, allowing information to be provided to warfighters regardless of location, is an absolute requirement for this contract. This will include working with and coordinating efforts between other DISA/DoD contractors as requested by the COR.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 20% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

· Task Area 1 - Contract Management (All capabilities).

· Task Area 2 - Sustainment (All capabilities).

· Task Area 3 – Operations & Maintenance (O&M) Engineering (OSP, FPCAP, and ASV).

· Task Area 4 – Sensor Authorization and Accreditation (A&A- all capabilities).

· Task Area 5 - Sensing Development (optional- as required).

Sustainment Capabilities:

Open Sensor Platform (OSP):

OSP is an advanced threat detection cyber sensing platform, part of the Enterprise Sensor Grid, deployed to increase the collections and analytics capability of dynamic creative optimization (DCO) analysts. OSP Advanced Threat Detection aligns with DCO’s threat detection capabilities requirements. OSP leverages a COTS platform from BluVector, the Original Equipment Manufacturer (OEM).

The platform is deployed and integrated into Acropolis Transport Network (ATN) infrastructure, but under its own separate accreditation.

OSP primary requirement include:

· Detection at perimeter vantage points.

· High degree of detection accuracy for zero-day and polymorphic malware in (near) real time without dependence on cloud analytics.

· AI-driven (sense-and-respond) toolset that identifies and analyzes threats including file’less malware, zero-day malware, and ransomware in real-time.

· Collects Zeek (Bro) logs, Event Logs and Alerts, Metadata that includes NetFlow information, Files/Objects.

· Signature-based detection with network and file content visibility.

Machine Learning Engine Classifiers, Scripts updates, ClamAV, Yara, File Reputation Engine signatures Ingest into Security Information Incident Management (SIEM) using specific forwarders, syslog, or via KAFKA, or Zeek's Kafka plugin. Use Zeek to generate metadata and carve potential threats from network protocols. It then contains those threat according to customized rules.

Targeted logs automatically correlated to detection events with Zeek metadata before and after detected threat. FPCAP has been undergoing platform expansion to support the increasing throughput rates at the Internet Access Points (IAP)s. This effort involves physical deployments to the IAP locales by the Joint Cyber Implementation Program (JCIP) team.

The contractor shall manage all production instances of OSP, acting as baseline configuration manager, field engineering dispatch, and as the administrative support team applying all approved changes to the operational platforms as requested by the Program Manager (PM).

The contractor shall perform all required network, system, and storage related administration for OSP. The OSP program in its present environment consists of 55 sensors at 11 physical locations. Open sensor platform is not currently virtualized. The contractor shall assume a 5% growth rate per year for this service.

Full Packet Capture (FPCAP):

FPCAP is a cyber sensing platform deployed by ID6 in support of DCO mission. It intercepts and records full packets (both header and payload) that transverse the DISA IAPs. FPCAP leverages a COTS platform from Endace, the OEM. It is deployed at the 10 IAPs. When queried, FPCAP provides data to a DCO analyst about adversarial actions on the DODIN, with the results transported via the data brokering service into multiple data environments, such as the DCO Splunk.

FPCAP Primary Requirements include:

· Capture and store inbound/outbound IAP data (last 14 to 30 days).

· Query on Timestamp, Source IP, Source Port, Dest IP, Dest Port, Location, Direction.

· Federated Query Across all IAPs/AORs.

· Isolation Survivability Across AORs.

· Support 30+ Concurrent Analyst Logins.

· Support Download of Merged PCAP.

· Integrate with Existing Cyber Tools (SPLUNK).

FPCAP is integrated into the ATN infrastructure, under the Acropolis Authority to Operate (ATO). FPCAP has been undergoing platform expansion to support the increasing throughput rates at the IAPs. This effort involves physical deployments to the IAP locales by the JCIP team.

The contractor shall manage all production instances of the FPCAP program’s deployments across the DODIN, acting as the administrative support team applying all approved changes to the operational platforms as requested by the FPCAP PM.

The contractor shall perform all required network, system, and storage related administration for the FPCAP program. In its current environment, FPCAP instances consist of 66 sensors. The FPCAP service is not virtualized. The contractor shall assume a 5% growth rate per year for this service.

Automated Security Validation (ASV) ASV is a hardware and software-based service that implements Breach and Attack Simulation capabilities to test, validate and improve network and endpoint cybersecurity solutions used to defend the DODIN. ASV is envisioned as a DOD Enterprise Service with customers within DISA and across the DOD. The primary function of the ASV program office is to procure, deploy, and sustain the ASV capability in support of DISA, Joint Forces Headquarters DODIN (JFHQ-DODIN), and the DOD Chief Information Office (DOD CIO).

The ASV capability consists of COTS “agents” deployed to the DODIN nodes and end devices and a central manager. The ASV program also consists of a centralized repository, MSR used for collecting results for DAO’s and making the data available for dashboarding tools. The ASV program will interface with up to 10 IAPs. Initially, the contractor shall be responsible to sustain ASV capability at one IAP node. ASV capability will be added to three IAP nodes each year for a total of up to 10.

Intrusion Detection System (IDS) DISA provides Intrusion Detection System services as part of DISA Computer Security Service Provider Program (CSSP). The capability provides intrusion detection alerts and are currently using COTS sensors and management consoles for managing the sensors and aggregating feeds to DISA's SIEM.

The IDS baseline is maintained at DISA Chambersburg, PA data center. The contractor shall be responsible for Tier II support for the IDS capability with its 336 sensors and eight management consoles. Remote support shall be required for Chambersburg, PA, Columbus, Pensacola, FL, and San Antonio, TX. Local support shall be required at those locations if remote access is lost or if hands-on work is required.

DISA J3/5/7, the CSSP provider and under a different contract, will have Tier III responsibility for the configuration of all the sensors and management consoles.

Development Capabilities (Optional):

Modernization of OSP:

Develop and maintain a replacement for the existing PEO Cyber Open Platform Sensing system using open-source programs. Use a provided virtual machine (VM) with necessary programs pre-installed. Configure, Secure, and Test programs to ensure they function as intended. Validate sensing data against existing OSP data. Work with Data Brokering to ensure transport/transformation of data to the SIEM environment.

Develop a centralized management mechanism for the deployment, maintenance, management, and configuration of a distributed network of VMs running open-source cyber security sensing programs. Must be able to push policy and signatures to the sensing software as well as provide standard IT tasks to a bulk group of VMs.

Integration of ASV and MSR into SIPRNet:

The contractor shall deploy and integrate the ASV and its MSR Platform into DoD networks. The contractor shall coordinate with the customer to deploy the ASV/MSR Platform. The contractor shall identify system requirements, port/protocol exceptions, and other requirements needed to enable ASV and MSR Platform communications between the customer and each site’s Director. The contractor shall work with the customer to ensure they provision required infrastructure, accounts with appropriate permissions, and facilitate the change control process to support the ASV/MSR deployment.

IDS Transition to Cloud:

The contractor shall design, test, and implement the transition of DISA IDS capability to the DISA Cloud environment.

SIPR Sensing Modernization:

Architect and develop Cyber Sensing Solution designed to monitor the DoD telecommunications infrastructure to include:

· Requirement analysis and design.

· Coordinating with install staff to Implement sensing at customer Access Migration sites.

· Configure sensing at Access Migration sites.

· Consolidate multiple separate sensing solutions onto a single hardware/software platform supporting sensor virtualization.

· Deploy Enterprise Sensor at Customer Edge and Service Edge locations.

· Feed data into centralized monitoring solution.

6. Performance Requirements.

6.1 Task 1 - Contract Management.

6.1.1 Subtask 1 - Contract Management Control Planning. Provide the technical and functional activities at the required level for integration of all tasks specified within this task order, to include an Integrated Master Schedule. This schedule should include check points for productivity and management assessment methods such as quality assurance, progress/status reporting and program reviews. Management Plan shall include at a minimum:

· Organization.

· Resources.

· Personnel Management.

· Task Order Management.

· Management structure/control (by name).

· Contract execution plan.

· Quality Assurance/Control Plan.

· Deployment and Implementation Plan.

· SME support.

· Program Support.

· Deployment Action Plan.

· Technology Refresh Strategy.

Deliverables:

· Integrated Master Schedule.

· Contract Management Plan.

6.1.2 Subtask 2 – Contract Reporting. Contract reporting describes how the contractor is meeting, not meeting, or exceeding goals set forth in the Contract Management Plan. The contractor shall provide a Monthly Status Report (WSRs) monitoring the quality assurance, progress/status reporting, and program reviews applied to the contract. The information in the WSR shall identify the following:

· Progress on contract execution.

· Engineering plan updates.

· Trouble Ticket Status.

· Status on current/outstanding deliverables and issues.

· DoD Information Assurance Compliance updates.

· After Action Report.

· Travel.

· Coordination.

· Test Procedures.

A Project Management Review (PMR) Meeting will be held at the discretion of PM to expand on questions raised in the WSR, provide additional explanation, or define execution of activities under the contract. The PMR will consist of an interchange between the Government and contractor concerning a review of the WSR elements.

Deliverables:

· Weekly Activity Report.

· Monthly Status Report.

· PMR Progress Report.

6.1.3 Subtask 3 – Technical Interchange Meeting (TIM). The introduction of the management and technical teams supporting this contract, and the presentation/delivery of the Management Plan shall be accomplished during a TIM to take place in the National Capital Area within five days after contract award. This will be the beginning of a dialogue between the Government and the contractor to ensure successful execution of the contract. The contractor shall coordinate the date, place and agenda for the TIM and include, as a minimum, the following:

· Introduction of management and technical teams.

· Presentation of Draft Management and Technical Plans.

· Establishment of common understanding of the contract.

Deliverable:

· Technical Interchange Meeting Minutes.

6.1.4 Subtask 4 – Technical Exchange Meeting (TEM). An initial TEM shall be conducted no later than 15 working days after the contract start date at the primary Government location. The TEM will be the beginning of a dialogue between the Government team and the contractor to ensure the successful exchange of the technical aspects for this requirement.

The contractor shall prepare a presentation that provides updates to the technical and management approach including current and projected schedule and performance data. The TEM agenda shall include the following:

· Plans and Accomplishments.

· Issues, Risks and Mitigation Strategies.

· Action Item Review.

· Other relevant items may be introduced at the discretion of the contractor and/or the Government.

The TEM shall continue to meet on a weekly basis at the primary Government location. In addition, the contractor shall produce minutes of all TEM meetings, including a synopsis of the technical discussion and a list of open/closed action items.

Deliverables:

· Technical Exchange.

· Meeting Minutes.

· Meeting Agendas.

· Briefing Materials.

· Action Item.

· Tracking Report.

6.1.5 Subtask 5 – Transition Implementation Plan. Upon contract award, the contractor shall work with the incumbent contractor to create and execute a Transition Implementation Plan (TIP) to transfer, in coordination with the incumbents:

· Government Furnished Equipment (GFE), Government Furnished Information (GFI), (i.e., all Configuration Items), source code, system architectures, system access controls, and other program artifacts.

· DISA facility access; lab access; DoD Common Access Cards; network(s) access; DISA Net-Centric Enterprise Services collaboration services; and other relevant accesses.

· Roles and Responsibilities in any Government managed forum currently supported by the Incumbents.

The Government will facilitate the execution of the TIP to ensure continuity of all current activities supported by the Incumbent.

At the end of the contract, the contractor shall create the TIP to support the transition to a follow-on team as specified by the Government.

Deliverable:

· Transition Implementation Plan.

6.1.6 Subtask 6 – Risk Management. The contractor shall implement a Risk Management process that encompasses identification, analysis, mitigation planning, mitigation plan implementation, and tracking for all projects, programs, and portfolios throughout the lifecycle. The objective is to provide a repeatable process for balancing cost, schedule, and performance goals within program funding, especially on programs with designs that approach or exceed the state-of-the-art or have tightly constrained or optimistic cost, schedule, and performance goals. The contractor shall be responsible for managing all hardware, software and firmware security compliance and implement patches, security updates etc. as needed to maintain required accreditations in accordance with current governance policies.

Deliverable:

· Risk Management Plan.

· Risk Management Tracking Tool.

6.1.7 Subtask 7 – Meeting Support. The contractor shall attend programmatic planning and scheduling meetings, TEM, and conferences. This support shall also include regular technical exchange meetings with external interface partners to ensure interoperability with these partners. The contractor shall prepare meeting agendas and presentation materials, briefings, draft white papers, prepare meeting minutes to include action item lists, track action items, and participate in forums or working groups as the SMEs.

Deliverable:

· Briefings.

· Meeting minutes.

· Action Items List.

6.2 Task 2 – Sustainment.

6.2.1 Subtask 1 – Operations and Maintenance (O&M). The contractor shall provide technical expertise for the O&M of the deployed software and sensors systems. The contractor shall ensure that the systems (and its associated connectivity to all critical interfaces) is operational and maintained to support mission requirements (ready, stable, and reliable). The contractor shall appoint a Service Owner for sensing platforms who shall help create, document, and maintain a Sensing Service Design Plan (SDP) that defines all aspects of the service throughout all stages of its lifecycle. The SDP and Standard Operating Procedure shall be updated anytime there is a change to the architecture, financial posture, or requirements of the service. The Service Owner shall be the primary internal and external SME for the service they are assigned to manage. The SME shall always be aware of the state of their service and report on that status to the Government as required. The Service Owner shall work with all other sensing business managers to ensure that their service is providing value to the sensing programs and their mission partners and users.

Deliverable:

· Sensing Service Design Plan.

· Standard Operating Procedure.

6.2.2 Subtask 2 – Help Desk Reach Back Support (Tier-II). The contractor shall provide technical expertise to the system help desk in resolving operational issues reported by system users. DISA’s Global Service Desk (GSD) will act as help desk/Tier-I where users will call to report issues and open trouble tickets. DISA GSD will reach out to the contractor through phone or ticket system to provide Tier-II support to the users.

The contractor shall provide Tier-II support from Ft. Meade during regular business hours (Monday-Friday 0800-1630 EDT), excluding weekends and holidays. The contractor shall provide immediate response as required to priority I & II incidents with a required problem resolution time within 72 hours from receipt of incident ticket. Responsive within 12 hours to priority III, IV & V incidents with a problem resolution time wholly dependent on the required fix action (not to exceed 1 month without COR approval).

After duty hours, the contractor shall respond to priority I & II incidents on call within 1 hour from notification of the incident ticket by DISA GSD. If remote access is required by the contractor to resolve the incident, the contractor shall report to the place of performance within 3 hours from notification of the incident by GSD. Priority III, IV & V incidents shall be addressed during the next business day. Priorities I-V will be defined by DISA GSD ticketing system.

The contractor shall respond to each request for operational and troubleshooting support. The contractor shall escalate the ticket to Tier-III support if the issue cannot be resolved at the level of Tier I or II. Once the issue is resolved, the contractor shall deliver a summary of the actions taken to the Government in the form of an Issue Resolution Report and close the ticket.

Deliverable:

· Issue Resolution Report.

6.2.3 Subtask 3 – System Maintenance. The contractor shall analyze the deployed System (software, hardware, configuration, etc.) to determine if any changes are required to maintain operational status (for example, changes by external interfaces that impact the system baseline, compliance with Information Assurance vulnerabilities, underlying COTS software upgrades, resolution of Help Desk problem reports, etc.). The detection of this shall be automated. The contractor shall provide the Government with the details of anticipated changes, to include the plan, cost, and schedule associated with implementation (this information shall be documented in the O&M Report). All re-deliveries shall be accomplished in accordance with the instruction in this PWS, including updating all applicable and associated documentation.

The contractor shall:

· Establish and maintain a reference implementation instance within the Government’s development environment in order to support troubleshooting and analysis activities.

· Provide technical expertise to regression testing activities undertaken by the Government to verify the integrity of all proposed O&M related modifications to include support for Government Acceptance and deployment activities.

· Perform hardware and software life cycle management and sustainment including requirements analysis, documentation, installation, testing, and disposition.

· Create and maintain a Master Site POC list for each Sensor operating site; list to be updated every six months.

· Create and maintain a Master Equipment list to include each accountable property item assigned to the respective sensing program.

· Request and coordinate scheduled or emergency Authorized Service Interruptions (ASI)s.

· Coordinate with all affiliated organizations at least 72 hours in advance and perform all scheduled and unscheduled preventive maintenance and network changes.

· Implement software and hardware upgrade.

· Maintain, install, and update Information Assurance Vulnerability Alert (IAVA) patches.

· Perform Backups of servers and network configurations.

· Coordinate with hardware/ software vendors and service providers.

· Provide sensors PM with updated copies of network diagrams and software information as changes occur.

· Provide reports, briefing slides, as-is baseline updates, and meeting materials upon request.

· Dispose of non-supportable or non-repairable sensing equipment IAW DoD guidance.

· Create technical and operational documents.

Licenses and COTS Products - The contractor shall review all licenses and COTS products utilized in support of the system for currency. The contractor shall document the status of all license renewals and COTS products upgrades in the O&M Report. The contractor shall provide no less than 180 calendar days notification to the Government on all forthcoming license renewal and COTS product upgrade requirements.

Deliverables:

· O&M Report.

· Master Site POC list.

· Master Equipment list.

· System Backup.

· System logs.

· Network diagrams and software/ hardware information.

· Briefings.

· Disposal plan and report.

· Technical and operational documents.

6.2.4 Subtask 4 – Continuous Monitoring. Continuous monitoring entails self-assessments, monitoring Information Assurance Validation (IAV) notifications, code reviews, validations, and software update monitoring. The contractor shall maintain and provide a prioritized list of Plan of Action and Milestones (POA&M)s with recommended mitigations and comments to the Government. The contractor shall review the POA&Ms with the Government monthly.

Deliverables:

· POA&Ms.

6.2.5 Subtask 5 – Assured Compliance Assessment Solution (ACAS) Scanning. The contractor shall run scans on the system per ATO requirements. The contractor shall review and respond to any vulnerability scan findings identified to be associated with the system as a non-compliant Security Technical Implementation Guide (STIG) item.

Below are the assets being scanned. The number may increase by 10 assets every year.

· OSP - 58 assets scanned weekly.

· FPCAP – 64 assets scanned weekly.

· ASV – 10 assets scanned weekly.

· Firepower - One baseline ACAS scanned daily in the Project Support Lab.

Deliverable:

· Cybersecurity scan and mitigation report.

6.2.6 Subtask 6 – Configuration Management. The contractor shall provide Configuration Manager support to include creation, documentation, and maintenance of a Configuration Management Plan that shall define all aspects of the Configuration Management process within the sensing programs. The Configuration Manager shall ensure that all configuration items required to deliver sensing services are identified, controlled, audited, and reported in a Government approved Configuration Management System. The contractor shall mange configuration control board (CCB) for system changes. The following shall be included as configuration items:

· Software Licenses.

· Hardware List.

· Warranty List.

· GFE.

· IT Asset Lists.

For each configuration item, the Configuration Manager shall track location, quantity, physical ownership, cost, expiration date, and other relevant details. Quarterly, the Configuration Manager shall provide 100% accounting of all configuration items (accounted for or missing) to ID6 leadership.

Deliverables:

· Master Site POC List.

· Master Equipment List.

· Configuration Management Plan.

· GFE List.

· Warranty List.

· Hardware List.

· Software List.

· CCB plan and log.

6.2.7 Subtask 7 - Asset Management. The contractor shall provide asset inventory and asset tracking services for all GFP to be reported quarterly. Specific duties include receiving all sensor equipment at the Government warehouse; properly documenting and tracking equipment throughout its life cycle; moving/staging/testing/shipping equipment as necessary; providing direct support to DISA property custodian, as related to sensor equipment.

Any interim GFP changes shall be reported to the Government in the MSR. The Quarterly Equipment Inventory Report shall include:

· Make/Model of equipment, Manufacturer, and Serial Number (if applicable) for all hardware and software.

· Physical location to include Building, Room, and Rack identification.

· Ownership to include hand receipt data consistent with Defense Property Accountability System (DPAS).

· A description of how the equipment is being utilized.

· Contract Management aspects to include: Leases, Maintenance Agreements, Service Contracts, and Warranties.

· Financial aspects to include Cost and Depreciation.

Specialized and Government proprietary resources and equipment needed will be provided. The specialized equipment may be GFP or purchased as Order Level Materials at the Government’s discretion.

Coordinating with appropriate site personnel, and DISA property team, to properly track and account for system equipment in the event that equipment is moved as a result of Tier III support activities (i.e. Return Merchandise Agreement (RMA)); completing necessary forms, including but not limited to DD1149, DD1150, and DA316 Property Management forms.

The contractor shall support DPAS and property custodian audits.

The contractor shall return all equipment to the Government’s facility once the equipment is no longer a viable asset, or in support of sensing development, operations, or maintenance. The contractor shall support DISA designated Property Team to dispose of the equipment as necessary.

Deliverables:

· Monthly Shipping Report (incoming/outgoing equipment).

· Monthly RMA Reports.

· Asset Management Plan.

· Asset Management Reports.

· Disposal Plan.

· Interim GFP Updates (MSR).

· Quarterly Equipment Inventory Report.

6.2.8 Subtask 8 – Other Direct Costs (ODCs). DISA will use ODCs to purchase additional hardware/software to support the sensing capabilities. Procurement of hardware/software through ODCs must be approved by the Contracting Officer (KO) before purchase.

ODCs shall cover contractor travel, training DoD staff at all DAOs and Higher Headquarters at hosting and operational sites, hardware/software updates and upgrades, updates to the installation and set-up of the hosting environment, and other hardware/software needed to support sensing capabilities.

Deliverables:

· Procurement/ Travel Report.

· Hardware / Software Updates.

6.3 Task 3 - O&M Engineering.

6.3.1 Subtask 1 – Tier III Support. Tier III support shall be integral to all lifecycle phases of a system. Tier III Support to be provided during normal business hours, excluding weekends and federal holidays:

· Baseline changes to correct issues.

· Configuration Management – managing baselines (change logs, CCB activities, baseline specifications, version control).

· Troubleshooting and resolution of operational issues escalated from Tier II; includes providing updates to Tier II, in accordance with Tier II reporting requirements (i.e. daily updates for high priority tickets).

· Onsite maintenance, as requested; includes coordinating site/theater access, notifications, and other activities necessary to deploy team members to individual sites.

· Coordinate with vendor to resolve advanced operational issues such as defects or other deficiencies that are degrading system performance and/or function.

· Coordinating with appropriate site personnel, and DISA property team, to properly track and account for system equipment in the event that equipment is moved as a result of Tier III support activities (i.e. RMA); includes completing necessary forms such as DD1149, DD1150, and DA316 Property Management forms.

· Information Assurance (IA) – lab scans and resolution of IA findings.

· Testing of patches in the lab and creation of installation procedure for production systems.

· Supporting installation of patches on production equipment.

· Designing and testing capabilities to address operational issues or shortfalls.

Deliverables:

· System updates procedures.

· DISA Task Order (DTO).

· Test procedures and result.

· A&A (scan and DTO) mitigation plan.

· Property Movement Forms (as needed).

· Updated Rack Diagram (as needed).

· Updated Cabling and Interfaces Diagram (as needed).

· Inventory Reports.

· Weekly Shipping Report (incoming/outgoing equipment).

· Monthly RMA (Return Merchandise Authorization) reports.

6.3.2 Subtask 2 - Sensing Lab. The sensing programs are often called upon to build and test new and existing cyber related tools and technologies. This is primarily due to the secure design of the sensing environment, but also because all cyber related data flows through the data brokering service. The contractor shall provide a sensing lab for the sensing capabilities that can support security testing, integrating testing, verification and validation testing and all aspects of system updates. All interoperability testing within the sensing lab shall be performed in coordination with the Joint Interoperability and Testing Command (JITC) at Ft Meade. The lab shall be designed and built within the JITC lab or in a DOD approved cloud solution. The contractor shall develop a sensing Lab Concept of Operations (CONOPS) that shall present the Government with the best value approach for the environment in which the sensing lab will be deployed. This sensing Lab shall support all baseline testing and be accessible from as many places of performance on the contract as possible.

Tasks include: installing hardware (if Government waiver is approved), installing virtual components as systems, installing servers, installing operating systems, installing software, uninstalling software, monitoring systems and processes, patching operating systems and software applications, installing network devices, configuring network devices, patching network devices, monitoring network devices, installing storage and database systems, patching storage and database systems, configuring and tuning system processes, and troubleshooting and resolving problems with lab projects.

The contractor shall appoint a service owner for the sensing lab environment who shall help create, document, and maintain a lab SDP that defines all aspects of the service throughout all stages of its lifecycle. The SDP shall be updated anytime there is a change to the architecture, financial posture or requirements of the service. The Service Owner shall be the primary internal and external SME for the service they are assigned to manage. The SME shall always be aware of the state of their service and report on that status to the Government as required. The service owner shall work with all other sensing business managers to ensure that their service is providing value to the sensing programs and its mission partners and users.

Deliverables:

· Lab Architecture and Setup for Sensor Testing.

· Sensing Lab CONOPS.

· Sensing Lab Test Plan.

· Sensing Lab Service Design Plan.

6.4 Task 4 – Authorization and Accreditation (A&A).

6.4.1 Subtask 1 – A&A for all capabilities except ASV. Upon award of the contract, the contractor shall support A&A of the sensing capabilities via the Risk Management Framework (RMF). The appointed Designated Approving Authority is required to accept all residual risk before granting the Authority to Operate (ATO). The solution must receive an ATO before it is placed on any DoD operational environment. The ATO must be maintained for the entire life of the contract. The Government will review the contractor’s solution and report findings/non-compliance to the contractor. The contractor shall review the findings monthly, identify a mitigation solution, and submit a findings and remediation report to the Government. The contractor shall be required to provide a SME on site to support C&A activity at the Fort Meade location.

Per DOD directive 8500.1, all hardware, firmware, and software will be STIG and IAVA compliant, and information systems shall be assessed using the RMF process before being allowed to process DoD information or connect to a DoD network, unless waived in part by the Government due to critical operational issues. All hardware shall be labeled with the appropriate classification level, labeled with the appropriate inventory control number, labeled with the hardware identification, documented, and inventoried. All cables shall be labeled at each site for easy identification by local POCs. A standard install/rack elevation and wiring configuration shall be followed IAW the sensing PM’s instructions.

Baseline configuration will be based upon accredited sensing Type-accreditation by the DISA CIO. The contractor shall be responsible for maintaining the baseline at the Ft Meade lab and work with Operations to ensure that all systems in the field are configured IAW the baseline unless approval is received by Chief, Infrastructure and Sensing Systems Branch. The contractor shall maintain all baseline systems in the Ft Meade lab and ensure they are updated monthly with the latest patches, fixes, and updates necessary to maintain their ATO. The sensing capabilities baseline shall be scanned monthly with approved compliance software and remediated by the contractor IAW CTO 08- 005.

The contractor shall be responsible for running weekly scans based off the required current software/ hardware on the baseline, uploading findings to the DISA current reporting system, and mitigating and STIG or IAVA related findings required to maintain the security compliance of the baseline IAW the sensing ATO’s.

For the sensing capabilities baseline, the contractor shall be responsible for deploying all patches to comply with a published IAVA/B/T. If necessary, the contractor shall be responsible for developing the POA&M and mitigation dates for OPS to update DISAs current reporting system.

· Continuity of Operations.

· Operational Sustainment, Support and Evolution.

· Configuration Management.

Deliverables:

· Supporting documentation for A&A process.

· Any applicable POA&M.

6.4.2 Subtask 2 – A&A for ASV Only. The contractor shall support A&A of the ASV capability via the RMF as defined in section 6.4.1 Subtask 1.

The base year support shall start later than the contract award date on 03 August 2025 through 02 March 2026. Option year support will align with the contract’s option year dates of 03 March 2026 – 02 March 2027 and 03 March 2027 – 02 March 2028.

Deliverables:

· Supporting documentation for A&A process.

· Any applicable POA&M.

6.5 Task 5 – Sensing Development (Optional). As part of the development phase for DISA sensing software and hardware capabilities and the integration with networks, the contractor shall assist the Government in determining the most efficient and relevant business processes to implement beneficial updates to the sensing system. The contractor shall be responsible for identifying and engineering solutions to support DoD’s requirement to protect and defend the DoDIN. The contractor shall design and document sensor systems that fulfill the JFHQ-DoDIN role. The contractor shall use to the maximum extent possible, COTS and GOTS solutions. The contractor shall consider scalability and integration issues with existing technologies and network infrastructures whether on premises, in the cloud or a combination of the two. The contractor shall provide engineering reports that list the advantages and disadvantages for selecting and integrating a suggested sensor system and configuration solution.

Deliverables:

· White Paper.

· Analysis of Alternatives.

6.5.1 Subtask 1 - Program Management Support. The contractor shall fully support the business processes of the sensing programs by providing support to include the drafting of memos, briefings, and reports by a technical writer; audio/video support and audio teleconferencing for the sensing program. The contractor shall provide program management support for all developed processes, documents, and other associated products necessary to support the sensing program's success. The contractor shall assist the Government in establishing repeatable processes, SOPs, and Techniques, Tactics, and Procedures within the ITIL framework. The contractor shall also ensure that meeting minutes are kept for all official meetings and shall be delivered to the Government as directed.

The contractor shall conduct a formal Weekly Status Meeting to the ID6 leadership and sensing PM that reviews all projects currently required to be tracked by the Government. The contractor shall conduct each Weekly Status Meeting with a coordinated agenda, briefing materials, and document minutes. The Weekly Status Meeting shall provide for task order level interchanges between the Government within ID6 and the contractor. The Weekly Status Meeting shall provide a forum to address technical and programmatic topics of the contract and may include contractor proprietary information.

The contractor shall provide a Monthly Status Report outlining the progress of all projects. This Monthly Status Report shall show both completed and future project milestones and shall clearly identify any risks or issues that require Government interaction. The Monthly Status Report shall include the level of effort or labor hours broken down by each task or project. The Monthly Status Report shall be briefed in the Monthly Status Meeting and then distributed by close of business that same day to the sensing PM.

The contractor shall provide a Monthly Status Report. Information within the Monthly Status Report shall be used by the contractor to provide a summarized review of all deliverables accomplished within the given month and shall report on cost, schedule, and performance. The Monthly Status Report shall highlight major accomplishments and their impact on the sensing mission to protect and defend the DODIN. In addition, the Monthly Status Report shall include an overall quality metric for the work being performed on the contract, financial information from the contractor’s Financial Manager including charging and invoicing information related to the contract, and availability metrics from the Availability Manager. The information provided within the Monthly Status Report will be used to update the Contractor Performance Assessment Reports System (CPARS).

The contractor shall provide the sensing PM with an event driven Integrated Master Schedule (IMS) for the sensing program. The contractor shall use Microsoft Project or other software designated by the Government for developing and maintaining the schedule. The contractor shall leverage an agile framework like SAFe to manage the IMS. The contractor shall review and identify any dependencies or interrelationships between the task order and other program efforts and significant dates. The contractor shall prepare and maintain an IMS for the overall task order to include schedules for each subtask and the level of effort (LOE) for task completion. The IMS shall address dependencies, risks, key milestone events, critical path activities, and delivery dates. The schedule shall also outline all resources assigned to individual tasks and the LOE for each task’s completion. The contractor shall coordinate with the appropriate Government Functional Leads and assess the risks identified in the schedule and recommendation for program resolution. The schedules shall be developed and base-lined in collaboration with the Government schedule team. The base-lined schedule shall not be modified without the Government PM approval. The schedule shall be coupled with weekly management control meetings to ensure all organizations and activities underway are coordinated and support the objectives of the overall program. The contractor shall submit an updated IMS to the Government PM on a weekly basis.

Deliverables:

· Monthly Status Report.

· Weekly Quad Charts.

· Weekly Activity Report.

· Meeting Minutes.

· Integrated Master Schedule.

6.5.2 Subtask 2 – Requirement Analysis. The contractor shall support the Government to establish and decompose requirements for the sensing capability. The contractor shall maintain a Requirements Traceability Matrix (RTM). The contractor shall conduct a System Requirements Review/System Functional Review (SRR/SFR) to analyze project cost, schedule, and performance requirements to determine sufficiency for developing a technical solution. The contractor shall document assumptions and risks. The contractor shall provide technical consultation to internal and external Agency customers to refine requirements and to provide potential courses of action for developing the sensing solution.

Deliverables:

· RTM.

· SRR/SFR briefings.

6.5.3 Subtask 3 - Systems Engineering. The objective of the Systems Engineering subtask area is to establish the technical framework for delivering materiel capabilities to secure the infrastructure. The contractor shall develop, maintain, and execute the program’s Systems Engineering Plan (SEP) that aligns with program plans. The contractor shall develop an architecture that ensures conformance to standards, requirements, and associated systems. The contractor shall use the DoDAF, and/or other framework(s), as specified by the Government.

Deliverable:

· SEP.

· User Stories.

· Reference, enterprise and solution level architectures.

· Initial Capability Document.

· Capability Development Document.

6.5.4 Subtask 4 - Preliminary Designs. The contractor shall provide preliminary designs in support of project and customer requirements. Preliminary designs include the initial design mapped to requirements, testing requirements, and rough order of magnitude solutions with the initial Manufacturing Bill of Materials (MBOM) and a cost estimate. The contractor shall prepare artifacts for Preliminary Design Reviews (PDR)s and other decision forums. The contractor shall work with the Government to determine an appropriate scope for an initial preliminary architecture and design pass prior to implementing the Release Plan, which will be subject to final approval by the Government. The preliminary architecture and design shall be presented at the PDR along with the IMS and Release Plan and contain sufficient detail to transition into development iterations/sprints upon acceptance by the Government.

Deliverables:

· PDR Brief.

· Draft of system diagrams.

· Draft of system design description.

· Draft interface control document.

6.5.5 Subtask 5 - Final Designs. The contractor shall provide final designs in support of project and customer requirements. Final Designs include complete design solutions mapped to requirements, test results, request for work, final MBOM with costs. The contractor shall prepare artifacts for Critical Design Reviews (CDR)s and other decision forums. The final architecture and design shall be presented at the CDR for decision making.

Deliverables:

· CDR Brief.

· Final system diagram.

· Final system design description.

· Interface control document.

· Product Life-Cycle Management Plan.

· Test and evaluation strategy.

· Build of Material.

· Request for Work.

6.5.6 Subtask 6 - Integration and Testing. The contractor shall integrate sensing software/ hardware solutions with associated networks to validate the various externally developed software packages and devices. Integration testing shall be completed to ensure that the individual software packages and devices work together as a whole with other software packages and devices. The integration tests shall validate:

The system and security requirements have been met and that there is no loss in prior functionality, and all interfaces interact in accordance with requirements so an Interoperability Certification can be achieved.

The contractor shall:

· Perform and support testing to ensure the operations and hardware/software are functioning as designed and that hardware and software requirements meet or exceed performance standards and are ready for delivery.

· Demonstrate that the system built complies with the system design and develop and verify a complete set of usable deliverable system elements Perform integration verification.

· Demonstrate that the system is mature (e.g. no thrown exceptions, shutdowns/reboots, data resets, synchronization issues, manageability, etc.).

· Provide real-time reporting of issues, severity, and recommended course of corrective action during continuous integration testing.

· Deliver system release notes and test data, to accompany the system being delivered.

The contractor shall conduct four types of testing:

1. Regression Testing – The contractor shall develop an automated regression testing process that can be used to routinely verify previously released functionality has not been negatively impacted by new software/ hardware deployments.