832572545 PKE Draft PWS.docx

PERFORMANCE WORK STATEMENT (PWS)

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Administrative COR. See DITCO Additional Test G1 – Points of Contact

d. Property Administrator See DITCO Additional Text G1 - Points of Contact

2. Task Order (TO) Title. Department of Defense (DoD) Public Key Enabling (PKE) Engineering Consultation and Support

3. Background. DoD has recognized the importance of Information Assurance (IA) and has adopted a Defense In Depth strategy as a means for realizing an effective security posture across the Department. A critical element of the Defense In-Depth strategy is a common, integrated DoD Public Key Infrastructure (PKI). The Deputy Secretary of Defense issued a memorandum dated 6 May 1999 that directed the development and implementation of the DoD PKI and provided specific guidelines for applying PKI services throughout the Department. The 12 August 2000 Deputy Secretary of Defense memorandum further defined these guidelines and superseded the memorandum of 6 May 1999. On 10 November 1999, the Deputy Secretary of Defense directed that the Common Access Card (CAC) be used as the DoD’s primary platform for the PKI authentication token in the Memorandum, “Smart Card Adoption and Implementation.” DoD Directive 8190.3, “Smart Card Technology” dated 31 August 2002 and certified current as of 21 November 2003 identified the CAC as the PKI authentication token and canceled the 10 November 1999 Memorandum.

The DoD also recognized that a PKI without Public Key Enabled applications has no value to the community. To take advantage of the IA security services that the DoD PKI provides, applications supporting electronic information interchange should be PK-Enabled, that is to say that applications must be customized to integrate into the DoD PKI. Enabling applications allows interoperability in accepting and processing DoD PKI x.509 digital certificates to perform one or more functions that provide security services (e.g., digital signatures, data encryption, and system/network authentication) DoD Instruction 8520.2, “Public Key Infrastructure (PKI) and Public Key (PK) Enabling” dated 1 April 2004, updated 18 May 2023 directed implementation of DoD Public Key Enablement to include network login, email systems, web applications, and web servers. Homeland Security Presidential Directive 12 (HSPD 12), dated 27 August 2007, updated 27 March 2024, entitled “Homeland Security Presidential Directive-12 Personal Identity Verification and Credentialing Policy, and Background Investigations for Contractor Employees” directed the promulgation of a Federal standard for secure and reliable forms of identification for Federal Employees and Contractors and directed smart card access in gaining physical access to controlled Federal facilities and logical access to controlled Federal information systems. As required by the Directive, Federal Information Processing Standard 201-3 (FIPS 201) currently dated January 2022 which describes the minimum requirements for a Federal Personal Identity Verification (PIV) system that meets the control and security objectives of Homeland Security Presidential Directive 12, including personal identity proofing, registration, and issuance. Part two provides detailed specifications that support technical interoperability among PIV systems of Federal departments and agencies. Part three specifies implementation and processes for binding identities to authenticators, such as integrated circuit cards and derived credentials used in the federal PIV system.

Joint Task Force-Global Network Operations (JTF-GNO) has directed DoD to aggressively implement PKI. JTF-GNO issued Communication Tasking Order (CTO) 06-02 to mandate accelerated PKI implementation across the DoD. In December 2007, JTF-GNO issued CTO 07-15 to mandate DoD PKI Phase II implementation reinforcing previous tasks addressed in CTO 06-02 and incorporating new tasks that includes Information Awareness (IA) PKI training, certificate revocation list (CRL) caching and proper handling\securing of subscribers software certificates.

DoD Directive 8500.01E, “Information Assurance (IA)” certified 23 April 2007, renamed to DoD Instruction 8500.01 as of 14 March 2014 states that the use of PKI certificates and biometrics for positive authentication shall be in accordance with published DoD policy and procedures. These technologies shall be incorporated in all new acquisitions and upgrades whenever possible.

The DoD Chief Information Officer (CIO) Memorandum, dated 22 July 2008, “Approval of External Public Key Infrastructures” outlines the categories of External Public Key Infrastructures (PKIs) that are approved for use with DoD relying parties. The PKI External Interoperability Plan (EIP) dated 26 August 2010 outlines the steps to be accomplished in order for External PKIs to be designated as approved for use with DoD relying parties. Certificates issued by approved external PKIs can be used within DoD for authentication to DoD private web servers and/or digital signature or encryption. An external PKI is any non-DoD PKI, operated in accordance with a published certificate policy and that issues PKI certificates to defined subscribed populations. PKI credentials that are DoD approved can be used for authentication to any DoD IT logical and physical access controls systems. Where PKI is required for the exchange of unclassified information with vendors and contractors, the Department of Defense shall only accept PKI certificates obtained from a DoD-approved external certificate authority or other mechanisms approved in accordance with DoD policy.”

DoD PKE supports the integration of External PKIs that have been approved for use in DoD. Interoperability between DoD and External PKIs is a multifaceted challenge involving the ability of entities within DoD to interoperate with the external PKIs of other United States (U.S.) Federal Agencies, Non-Federal Agencies, and Foreign, Allied, and Coalition Partners. DoD recognizes the need to interoperate with external PKI; however, this must be done in a way that does not compromise the integrity of the DoD network and still provides complete protection of resources.

Public Key Enablement is the use of PKI. It enables the security services of authentication, confidentiality, data integrity, non-repudiation into DoD applications and networks by:

· Replacing an existing or creating a new authentication mechanism using DoD X.509 certificates instead of other techniques such as; usernames and passwords for networks, servers, routers, or other devices.

· Implementing PKI to digitally sign, in a legally enforceable manner, transactions and documents.

· Using PKI to encrypt data-at-rest and/or data-in-transit.

· Using PKI to digitally sign and encrypt e-mail communications.

The Department of Defense Instruction (DoDI) 8520.04 “Access management for DoD Information Systems” dated 3 September 2024 establishes policy, assigns responsibilities, and provides direction for managing access to DoD information technology (IT) resources hosted by systems and system components by person and non-person entities (NPE’s) in conformance with DoDI 8500.01.

4. Objectives: The objective of this TO is to provide a core PKE consultation and engineering support team over the period of performance (PoP) to support the consumers of DoD PKI to leverage existing and emerging PKI capabilities for increased productivity and an improved IA posture. DoD PKE provides engineering consultation, develops custom enterprise solutions, creates collaborative environments, and works to ensure commercial products interoperate with the DoD PKI. DoD PKE is committed to increasing the security posture of the DoD by providing a seamless security environment supporting Identity Management efforts with the overarching goal of defending and protecting the U.S. DoD PKE works to enhance business processes and improve the IA posture of the DoD through widespread use of PK-Enabled applications. The supporting goals of PKE include the following:

· Enable DoD applications and networks for the use of DoD and DoD approved PKI to provide enhanced security for information.

· Implement DoD approved PKI in a manner that provides as much transparency to the end user as is feasible, consistent with sound security practices.

· Facilitate the use of PKE Commercial-off-the-Shelf (COTS) applications across the DoD.

· Assist the consumers of DoD PKI in adopting and securely implementing PKI through consultation, configuration documentation, best practices, training, conference support, web presence, technical interchange meetings and quarterly newsletters.

· Align DoD PKI/PKE policy and guidance regarding the use of PKI.

· Enable the acceptance of DoD approved external PKIs.

· Assist the consumers of DoD PKI in adopting PKI enhancements and emerging capabilities of the PKI Program Management Office (PMO).

5. Scope. The scope of this TO consists of a multi-year, multi-task effort to provide the consumers of DoD PKI consultation and engineering support. This includes, but is not limited to, custom code development and maintenance, requirements analysis, procurement, IA analysis related to PKI, facilitation of interoperability with external partners, integration of COTS products and services with the DoD PKI, PKE consultation and engineering support to Combatant Commands/Services/Agencies (CC/S/A) and Enterprise Programs, community collaboration, and configuration documentation to support systems on the Non-Classified Protocol Router Network (NIPRNET) and the Secret Internet Protocol Router Network (SIPRNET) as well as the associated testing of these systems and their required documentation. The contractor shall perform as an integrated team member with other vendors, other Government contractors, and Government organizations in providing services under this PWS. The Contractor shall comply with the appropriate DoD-approved architectures, programs, standards and guidelines, such as the IA DoD Policies.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the TO and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 10% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

6. Performance Requirements.

6.1 Task 1 – Enterprise IT Policy and Planning

6.1.1 Subtask 1 – TO Management. The Contractor shall provide the technical (TO level) and functional activities needed for the program management of this PWS. The Contractor shall include productivity and management methods such as Quality Assurance, Progress/Status reporting, and Program Reviews at the TO level. The Contractor shall provide the centralized administrative, clerical, documentation, and other related functions.

The Contractor shall prepare a TO Management Plan (TOMP) describing the technical approach, organizational resources and management controls to be employed to meet the cost, performance, and schedule requirements throughout TO execution. The TOMP shall be updated as required during the performance of this task to reflect changes and to further define of program criteria and milestones. All modifications to the Management Plan shall be submitted to the Government for approval before execution.

A draft TOMP is due with the initial proposal submission. In order to conduct a thorough technical evaluation of proposals, it is necessary to have information from the bidders on the key staffing and qualifications being proposed, as well as the labor categories and labor mix of the personnel performing the tasks in the PWS. The final TOMP is due thirty (30) days after initial contract award for the base period and fifteen (15) days after each of the four (4) follow-on 1-year option periods.

The Contractor shall use a detailed Project Work Breakdown Schedule (PWBS), in conjunction with regular management control meetings, to ensure all organizations and activities in support of DoD PKE are coordinated and integrated into one overall view. Completion of this subtask requires the definition of productivity and management methods, emplacement of a support structure for the execution of defined methods, and enforcement of personnel compliance. Productivity and management methods include a Quality Assurance Program and conducting Program Reviews at the TO level. Support structure elements provide the centralized administrative, clerical, documentation and related functions.

The Contractor shall provide the Government with IA Certificates for all personnel performing IA functions (due at initial Program Management Review (PMR) and 30 days after hire of any IA personnel hired after the initial PMR).

6.1.1.1 Transition Plan. The Transition Plan shall facilitate the accomplishment of a seamless transition from the incumbent to an incoming contractor/Government personnel at the expiration of the TO. The contractor shall perform this Transition within 30 calendar days after the expiration of the TO. The contractor shall identify how it will coordinate with the incoming contractor and/or Government personnel to transfer knowledge regarding the following:

· Project management processes

· Points of contact

· Location of technical and project management documentation

· Status of ongoing technical initiatives

· Appropriate contractor-to-contractor coordination to ensure a seamless transition

· Transition of key personnel

· Identify schedules and milestones

· Identify actions required of the Government,

· Establish and maintain effective communication with the incoming contractor/ Government personnel for the period of the transition via weekly status meetings

· System configurations

· Network infrastructure

· Project management processes

· Load Balancing configurations and processes

· Program Management documentation

6.1.2 Subtask 2 - TO Reporting. TO Reporting describes how the Contractor is meeting, not meeting, or exceeding goals set forth in the TOMP. TO Reporting will be provided to the Government with Monthly Status Reports (MSR). The contents of the MSR shall include monitoring the quality assurance, progress/status reporting, program reviews, actual expenditures against projected expenditures, balance of unexpended TO funds, contractor staff assigned to the task, and changes to the schedule as detailed in the TOMP. Any issues requiring Government response or action shall be readily identified.

At a minimum, the MSR shall specifically identify the following:

· Descriptions of activities and deliverables during the current month for the TO. The descriptions shall include problem definitions and recommendations for program resolutions. Attention shall be given to risk management activities.

· Discussion of Issues/Problems

· Funding Execution Data (cumulative planned, cumulative actual hours, cumulative other direct costs (ODCs), and cumulative actual dollars by task; cumulative actual hours and cumulative actual labor by subtask; staff hours by subtask and by individual for the reporting period). Note that “actuals” are accruals, not invoiced.

· Budget estimates (actual and revised) of overall and monthly projected hours and cost for the TO. The report should also provide an explanation of differences between actual and projected expenditures.

· The activities planned for the coming month.

· Trips, meetings attended, technical visits, and related results for the reporting period.

· Personnel reassignments including all personnel added to or removed from the TO by task shall be in accordance with the key personnel clause of the contract.

· Hardware or software or other equipment acquired during the previous reporting period.

· DoD 8570.01-M certification status.

· Number and types of support requests organized by CC/S/A Program for remote and on-site support via PKI support email including resolution status (reference 6.4.1.1.)

In addition to the MSR, the Contractor shall provide a weekly status report that covers what activities were accomplished during the week and what activities are planned for the coming week. The weekly status report should also highlight any critical issues or actions the Government should be aware of.

6.1.3 Subtask 2 – Program Management Reviews (PMR). The Contractor shall hold an initial PMR within 30 days of the contract award and then as requested by the Government. PMR's will be conducted either in person, via teleconference, or a combination of both. The Government reserves the right to conduct In Process Reviews (IPR) on an as needed basis to ensure that the contract and supported programs are executing according to the TOMP. The Contractor shall conduct each PMR and IPR with a coordinated agenda, briefing materials, document minutes of the PMRs and IPRs and provide information regarding TO status, e.g., work progress, cost, funding profiles, schedule data, projected tasks with completion status and issues of concern. PMRs and IPRs shall provide for TO level interchanges between the Government and the Contractor. The IPRs shall provide a forum to address technical and programmatic topics of a TO and Contractor proprietary nature.

Deliverables:

Final – 30 days Updates fifteen (15) days after each option award

Final – 45 days Updates will be negotiated on a case-by-case basis between the Contractor & Government

Final – 45 days Updates will be negotiated on a case-by-case basis between the Contractor & Government

Due at initial PMR and 30 days after hire of any IA personnel hired after the initial PMR

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.2 Task 2. Custom Application Development

6.2.1 Subtask 1 - Maintenance of Custom Software. The PKE team has a suite of testing and administrator support tools written in a variety of languages. The Contractor shall be able to support the following programming languages at a minimum: C++, C#, Java, VB.NET Python, and Rust. The Contractor shall also be familiar with Windows and UNIX shell scripting.

Maintenance consists of creating and updating the code source to support the evolution of the DoD PKI and to incorporate additional capabilities. Examples of such updates include but are not limited to the deployment of new CA certificates/trust anchors, changes in PKI policies, and the support of new standards.

The Contractor must maintain/update any PKE tools previously developed to include, but not limited to, the following custom software:

· Mail Crypt

· Cert Admin

· CRL Auto Cache

· Kebler Revocation Tool (KRT)

· InstallRoot

· Scripts

· Mini CRL Fetch

· Cross Certificate Removal Tool

· Install Root

· Tact

· PKI Interoperability Test Tool (PITT)

· DoD ACME

· Smart Card Login (SCL) Troubleshooting Tool

These tools will be provided to the contractor as Government Furnished Equipment (GFE).

· The Contractor shall work with the Government to clearly define the scope and requirements of the software. The Contractor shall clearly communicate the level of effort required to develop and test the software. The Contractor shall develop a schedule detailing development milestones and a delivery date. The Contractor must provide a test plan and procedures to the Government and perform all testing prior to acceptance of the software

· The Government requires the fully commented and documented source code with compilation instructions, a binary file with installation instructions and relevant release notes. All software documentation shall be uploaded and maintained in the pre-defined PROJECT similar to the Command and Control Software Factory (C2SF) online repository. Proper documentation and requirements must be met as determined by the Government. If these requirements are not met, the government will not accept the deliverables and thus the fault is on the Contractor for not meeting the requirements and the Government will not accept the software.

· The Contractor shall follow the NIST 800-53 Rev. 5, Recommended Security Controls for Federal Information Systems and the DISA PEO MA guidance to ensure that the Software will be or has been developed using secure coding practices in a manner that minimizes security flaws within the Software. Prior to the execution of a software development work request, the Contractor shall provide the Government a copy of the Contractor’s secure coding best practices policy and upon delivery of the software to the DISA PEO MA, the Contractor shall certify to the Government that the Contractor complied with the Policy in the performance of its obligations under the TO.

6.2.2 Subtask 2 - Custom Software Development. In instances involving unique application architectures or requirements for PKI services that exceed the capability of COTS PKE tools, custom software development to achieve the required security functionality will be necessary.

Custom software development occurs on an infrequent basis. The scope and size of development is based on boundary cases not adequately addressed by COTS solutions.

· The Contractor shall work with the Government to clearly define the scope and requirements of the software. The Contractor shall clearly communicate the level of effort required to develop and test the software. The Contractor shall develop a schedule detailing development milestones and a delivery dates. The Contractor shall provide a test plan and procedures to the Government and perform all testing prior to acceptance of the software.

· The Government requires the fully commented and documented source code with compilation instructions, a binary file with installation instructions and relevant release notes. Proper documentation and requirements must be met as determined by the Government. If these requirements are not met, the government will not accept the deliverables and thus the fault is on the Contractor for not meeting the requirements and the Government will not accept the software.

· The Contractor shall follow the NIST 800-53 Rev 5, recommended “Security and Privacy Controls for Information Systems and Organizations” and the DISA PEO MA guidance to ensure that the Software will be or has been developed using secure coding practices in a manner that minimizes security flaws within the Software. Prior to the execution of a software development work request the Contractor shall provide the Government a copy of the Contractor‘s secure coding best practices policy and upon delivery of the software to the DISA PKI-PMO, the Contractor shall certify to the Government that the Contractor complied with the Policy in the performance of its obligations under the TO.

· The contractor shall preform monthly source code reviews and provide the data to the COR and the Government Security Compliance Lead.

Deliverables:

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.3 Task 3. Test & Evaluation

6.3.1 Subtask 1 - Policy and Guidance Development and Review – Technical & Strategic. The Contractor shall provide technical advice and guidance on the correct use of DoD PKI certificates in the development and review of existing policy, directives, instructions, guidance, and emerging capabilities documentation. Technical and strategic guidance may include configuration, implementation and certificate validation recommendations and may include, but are not limited to:

Cyber Command (CYBERCOM) Communications, DoD Directives, DoD Instructions, and DoD Memorandums DISA Security Technical Implementation Guides

· NIST FIPS and Special Publications The amount of support will vary depending on the source document and the content and may require significant review and research.

6.3.2 Subtask 2. Evaluation and Integration of COTS Software and Hardware with DoD PKI. The Contractor shall evaluate emerging commercial technologies as required by the Government for interoperability with the DoD PKI. This requires significant technological knowledge of PKI fundamentals and the DoD PKI Program. DoD PKE directly supports the evolution of the DoD PKI. As the DoD PKI PMO incorporates new PKI capabilities to meet Capability Development Document milestones, the Contractor shall be required to re-evaluate existing COTS software and hardware solutions for compatible functionality with these new features. Additional testing may be required as this is an ongoing support function. Known capabilities include, but are not limited to:

· Migrating to stronger cryptographic algorithms

· Supporting non-person entity certificates

· Derived Credentials

· Compliance with FIPS 201-3

· PKI implementation on SIPRNet

· PK Enabled wireless mobile devices

· Cryptographic Smartcard Login

· PK Enabled Single Sign-on (SSO) solutions

· Secure remote access capabilities

· PK Enabling of web servers

The Contractor shall liaison directly with vendors, communicate requirements, obtain evaluation copies of hardware and/or software devices/applications, and perform preliminary testing in a Contractor test facility with GFE to validate that the device or application fully supports the engineering and security standards that underpin the DoD PKI. The Contractor shall obtain COTS hardware and software from available sources, as directed by the Task Monitor, and shall complete tests of the integration of functionality with the DoD PKI. The Contractor shall develop and deliver a report to the Government 10 days after testing is complete detailing COTS product compatibility and functionality with DoD PKI.

The Contractor shall be responsible for the following:

· Evaluate the efficiency, effectiveness, and proper implementation of COTS products in their support of in the DoD PKI

· Provide requirements input to Joint Interoperability Test Command (JITC) PKE application and Interoperability testing.

· Provide feedback on test results to COTS vendor(s), reporting whether or not their products meet/exceed the criteria of incorporation in DoD plans. Results of evaluations will be shared directly with vendors (after Government review) and shall be periodically made available to other DoD organizations at the discretion of the Government.

6.3.2.1 Support for DoD Migration to Stronger Cryptographic Algorithms. In October 2024, the National Institute of Standards and Technology (NIST) released draft Special Publication (SP) 800-131A Rev3, “Transitioning the Use of Cryptographic Algorithms and Key Lengths”. This publication is part of the multi-publication series first introduced in SP 800-57 and continued with SP 800-78. This revision discusses the transition from a security strength of 112-bits to a 128-bit security strength, and quantum-resistant algorithms for digital signatures and key establishment. The security algorithms will impact encryption, digital signing, key agreement, key derivation, key wrapping, key transport, hash functions, and message authentication codes.

In accordance with NIST Special publications, the Contractor shall develop and execute a plan for the DoD’s migration to stronger cryptographic algorithms. This includes coordination with COTS vendors to determine the feasibility through testing and the timeliness of their product’s transition plan to support the stronger algorithms and working with the coordination cell and Component CIOs to either evolve or replace IT portfolios products. The Contractor shall test COTS products, coordinate with COTS vendors and continue to support the coordination cell and Component CIOs. The Contractor shall review and update PKI enablement and application-specific PKE documentation to support higher algorithm evolution (AE) and post quantum computing (PQC) transition. The Contractor shall develop and deploy environments to support testing and PKI application updates. The contractor shall track vendor support information and raise any identified gaps as issues with the vendors though a vendor tracking report. The Contractor shall test, and document results of AE and PQC integration with COTS products in the PKE lab and report results to working groups.

6.3.2.2 Support for the DoD and Federal Partner Zero Trust (ZT) Compliance. The rapid growth of adversaries on DoD networks creating offensive threats emphasizes the need for the DoD and Federal Partners to adapt and significantly improve our deterrence strategies and cybersecurity implementations. To meet these challenges, the DoD requires an enhanced cybersecurity framework built upon ZT principles that must be adopted across the DoD and Federal Agencies, enterprise-wide, as quickly as possible. The Contractor shall document methods on modernizing DoD PKI to reduce the need for Only Locally Trusted (OLT) PKIs. The contractor shall advise OLT PKIs on compliance and interoperability with ZT. The Contractor shall develop, document, and maintain guidance on additional ZT requirements.

6.3.3 Subtask 3 - PKE Implementation Documentation. The results of DoD PKE/PKI engineering work, to include the results of the evaluation of COTS software and hardware, are communicated to the DoD community through information papers, reference guides, and other documentation. The information papers are often used to inform decision makers of technical issues, risks and recommendations as related to PKI. The reference guides are used by System and Network Administrators to implement recommended configurations of COTS hardware and software solutions to interoperate with the DoD PKI. Implementation documentation is also provided to end users and developers and system integrators.

The Contractor shall update detailed technical manuals to include, but not limited to: End Users Guides, Quick Reference Guides, and Administrator Documentation. The Contractor shall be responsible for the development of new manuals as additional COTS products and/or PK-enabled tools are developed and/or approved for use as directed by the Task Monitor. Since these manuals are vendor specific, the manuals will change as the vendor’s product evolves.

Documentation will include results from any testing initiative. Documentation should be clear, concise, and written for the intended audience by an experienced technical writer. All documents will be reviewed by the TM prior to publication and distribution.

The Contractor will provide PKE implementation documentation to include configuration guides, recommendation and decision papers, best practices papers, frequently asked questions, and reference guides.

Deliverables:

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.4 Task 4. Operations Support

6.4.1 Subtask 1 – PKE Consultation and Engineering Support. The primary area of engineering support is direct consultation to end users, system and network administrators, developers and system integrators, DoD PKI privileged users such as Registration Authorities (RAs), Local Registration Authorities (LRAs), Key Recovery Agent (KRA), and TAs, and other help desk personnel for all issues concerning the use of DoD PKI and DoD approved PKI certificates within DoD NIPR and SIPR networks and information systems. This is a core function of DoD PKE and is the most important value-added area to the PKI PMO program, federal agencies, and the DoD community.

The Contractor shall provide Tier-1, Tier-2, & Tier-3 PKE support to the DoD and Federal Agency Communities in the form of technical consultation, security analysis and configuration support for the acceptance and use of DoD PKI certificates and existing DoD approved PKI certificates within DoD networks and information systems with stronger cryptographic algorithms. The DoD community is defined as the CC/S/A. Support may be required for either ongoing operations or for planned implementations. This can range from a basic support question such as “how to send an encrypted email” all the way up to a request for on-site support for a DoD Enterprise Program to assist with designing the security architecture to accept and validate External Certificate Authorities (ECAs), DoD PKI, and DoD-approved PKI certificates.

Support can occur via email, telephone, or in-person. In total, support requests may reach up to, or may exceed, 250 requests per month with a consistent mix of non-technical and technical questions. Basic questions may require referencing existing documentation (Tier-1). Mid-level questions may require review of the customer’s system configuration and a reasonable knowledge of PKI (Tier-2). Technical questions may require onsite support and testing and research of the problem along with extensive knowledge of PKI fundamentals and the DoD PKI program (Tier-3). The latter type of questions will be reviewed by the Government and tasked accordingly. Some questions may require an extended amount of time to support until resolution comes to completion.

To adequately support this task, a successful team will require engineers with significant technological knowledge of PKI fundamentals and the DoD PKI Program; operating system knowledge must include Microsoft, Linux, Unix, and Mac; cryptographic libraries knowledge must include MS CAPI, MS CAPI NextGen, NSS, OpenSLL, and MOD NSS. Areas of focus include certificate validation and PKI Trust Models (Direct/Explicit and Cross Certificate/Implicit).

This includes PKE consultation and engineering support for, but not limited to:

· COTS and GOTS applications;

· DoD Enterprise Programs;

· ECA;

· Federal Participating Agencies (PAs);

· Operating Systems (OS);

· Service Oriented Architecture (SOA) services;

· Mobile Devices;

· Non-Person Entities (NPE);

· COTS product configuration and new PKI technologies and capabilities;

· Support for DoD PKI RAs, KRAs, and LRAs.

6.4.1.1. Remote Support via PKE Support e-mail. The Contractor shall have a team of junior engineers that will provide email support in response to email requests during normal business hours (9 a.m. to 5 p.m. EST). The contractor shall monitor daily the DISA Customer Service Management Portal for PKI/PKE related questions, https://services.disa.mil/csm?id=community_home. The Contractor shall provide an initial response within 48 hours of receiving questions or requests for support. The PKE Support team shall be able to research and elevate questions to senior engineers and the Government when circumstances require it. Responses shall meet the quality expectations of the Government. The number and type of requests shall be reported in the monthly status report.

6.4.1.2. On-site support via PKE Support. The Contractor shall provide on-site PKE support as directed by the Government to assist in technical advice, security analysis and configuration support. All efforts are made to provide support remotely via email or telephone and minimize on-site support. On-site support outside of the National Capital Region (NCR) is rare and will be at the discretion of the TM.

6.4.1.3. Non-Person Entity (NPE) Support. The DoD Public Key Infrastructure / Enablement program provides digital certificate services for DoD assets known as NPEs. Examples of NPEs that could be supported by the NPE system include Web Servers, Domain Controllers, Workstations, Mobile Devices, etc. The network backbone for the DoD NPE CAs, devices, and services is NIPRNET and SIPRNET.

DoD PKE is currently working on guidance which enables the DoD and Federal communities to issue and accept NPE certificates on multiple internal and external enclaves. DoD PKE must be prepared to configure stakeholder assets and applications in a robust and secure fashion. Due to the frequency in which DoD PKE receives inquiries and assistance requests for NPE support, guidance may be developed by DoD PKE to be leveraged by DoD and Federal partners for interoperability.

The Contractor shall produce recommendations and application configuration guidance to support senior leadership’s initiatives towards secure NPE enablement and acceptance throughout DoD approved PKIs. The Contractor shall modify all existing documentation to provide information on properly trusting and validating NPEs across the DoD approved external PKIs and over multiple domains and repositories.

The Contractor shall work closely with the Federal PKI community, and specifically the Federal Bridge, on proposed NPE configuration changes to ensure DoD PKI can successfully validate external DoD approved PKI NPE certificates through cross certificate or implicit trust. The Contractor shall compile and deliver DoD and Federal NPE system Change Requests (CRs).

The Contractor shall maintain the JITC interoperability test plan and provide assistance to the JITC PKE team during NPE testing of potential DoD partners and providing updates to the JITC Interoperability Testing Plan.

The Contractor shall maintain a list of all partner NPE certificate issuance status and partner NPE revocation status information in order to give DoD system administrators the guidance they require to securely trust and validate DoD approved partner NPEs. The Contractor shall deliver a NPE Certification Status Repository.

6.4.2 Subtask 2 – Enhanced SIPRNet PKI Support. A major goal of the DOD PKI is to have a robust PKI for the SIPRNET that is separate from the NIPRNET, while still leveraging a hardware token. The SIPRNET Token Management System is separate and distinct from the NIPRNET based DEERS/RAPIDS system utilized to issue CAC. The Committee on National Security Systems (CNSS) have developed a common Root Certification Authority (CA) to establish a secure link and trust with external partner PKIs within classified environments. The DoD PKI PMO and CNSS have developed a common policy architecture and DoD PKI PMO developed, deployed, and manage this common Root CA as well as the Subordinate Root CA. This NSS-PKI allows the DoD to directly and securely exchange information, at a classified level, with other federal agency partners, however, it introduces new PKE authentication and authorization complexities as DoD application owners cannot simply trust the NSS Root or they will allow all NSS Subordinate CAs access to their applications. To support these capabilities, DoD PKE requires additional resources to develop new installation and configuration guidance and to develop a robust web presence on the SIPRNET to ensure users have real-time access to information. Additional engineering and consultation personnel will also be needed to respond to the increased volume given these significant changes.

The Contractor shall provide comprehensive engineering and consultation support for the transition of legacy PK-Enabled SIPRNET applications and to future applications that will leverage the SIPR hardware token with the NSS-PKI.

The Contractor shall finalize draft PKE documentation and continue the development of a full catalog of new products and services for users, system administrators and developers on the SIPRNET. The documentation will focus on correctly leveraging certificates for authentication and authorization given that all of the Federal Subordinate CAs will be signed under the same root CA.

The Contractor shall add additional dedicated resources to the PKE email support to handle the surge of requests for assistance on the installation/configuration of new middleware to support the hardware token and other issues as the arise.

The Contractor shall provide RA services in support of the NSS-PKI.

6.4.2.1 ECA PKI Support. The DoD sponsored \ ECA program was established to support the issuance of DoD-approved certificates to industry partners and other external entities and organizations. The ECA program is designed to provide the mechanism for these entities to securely communicate with each other or with U.S. government representatives at local, state, and Federal levels, including the DoD, and to authenticate to DoD Information Systems. The contractor shall provide support for on-boarding on new ECA Vendors into the ECA Program. This support shall include working with JITC to create or update documentation required for onboarding, testing, and validation. The contractor shall maintain and update monthly the list of Authorized DoD Employees (ADEs) who can provide identity vetting services to ECA certificate applicants outside of the CONUS. The contractor shall send a copy of the ADE list to the government by the 5th day of each month. The contractor shall monitor on a daily basis the ECA Help Desk email address for requests for ADE support. The contractor shall assist ECA applicants with locating the nearest geographically located ADE in their region from the ADE list.

6.4.3 DoD PKI PMO Support. DoD PKE supports the DoD PKI by recommending enhancements to the infrastructure as issues are identified through consultation that support improving the efficiency and effectiveness of the DoD PKI. The contractor shall recommend changes (CRs) to the Government to DoD PKI that will improve usability and recommend changes to support External PKI integration. They may be either specific enough to be reviewed, approved and implemented, or they may be future-oriented (such as architectures developed for long term planning options discussions). The deliverable associated with this subtask shall normally consist of system / security / application presentation; however, White Paper(s) may also be tasked, at the discretion of the Task Monitor. The Contractor supports the design, development, testing, and installation of new root CA for the DoD PKI PMO at the direction of the Task Monitor. The Contractor will coordinate root CA development efforts with parties affiliated with the PKI PMO and others at the direction of the Task Monitor in support of the design, development, testing, and installation of a new root CA.

6.4.4 External PKI Interoperability. DoD PKE has supported high visibility information sharing initiatives such as the Navy/VA consolidation, DoD authentication to Department of State networks and workstations at embassies around the world, Partner and Industry web authentication to Foreign Military Sales, DoD to Federal Partner PKI (e.g. Treasury, GSA, etc) Interoperability, and the AKO/DKO migration to accept certificates for DoD approved external partner PKIs. Future natural disasters are of particular concern where timely secure information sharing between all Federal Departments and Agencies is imperative. Additionally, DoD PKE is currently working on guidance which enables these organizations to configure their applications in a robust and secure fashion. DoD PKE frequently receives help requests for these efforts (Executive Office of the President, Intelink, AKO/DKO) because current guidance does not exists. Guidance developed by DoD PKE can also be leveraged in other interoperability environments such as CCEB, CCER, Coalition, etc.

· The Contractor shall produce recommendations and application configuration guidance to support senior leadership’s initiatives towards full Federal secure information sharing and acceptance of DoD approved PKIs. The Contractor shall modify all existing documentation to provide information on properly trusting and validating DoD approved external PKIs over multiple domains and repositories.

· The Contractor shall work closely with the Federal PKI, and specifically the Federal Bridge, on proposed cross-certificate changes to ensure DoD PKI can successfully validate external DoD approved PKI certificates through cross certificate or implicit trust.

· The Contractor shall support the DoD’s External Interoperability Working Group (EIWG), the Federal PKI Certificate Policy Working Group (CPWG), Certificate Policy Management Working Group and the Federal Logical Access Working Group (LAWG).

· The Contractor will maintain the JITC interoperability test plan and provide assistance to the JITC PKE team during testing of potential DoD partners.

· The Contractor will maintain the authoritative list for DoD approved partner PKIs on the existing External PKI web presence.

· The Contractor will maintain a list of all partner certificate assurance levels and partner revocation status information in order to give DoD system administrators the guidance they require to securely trust and validate DoD approved partner PKIs.

6.4.5 DoD PKI/PKE Community Collaboration and Customer Outreach. DoD PKE community collaboration consists of a collaborative and information web presence, quarterly PKE Newsletters, Technical Interchange Meetings (TIMs) with the DoD PKE Community, and Conference Support.

6.4.5.1 Website Support. The contractor shall maintain the online web presence for PKI tools, documentation, and content. The web presence will serve as a resource for all PKE development activities and contain a knowledge base with all pertinent PKE documentation. The PKI Program Management Office uses the PKI web presence to support the implementation of PKI by providing information on the DoD PKI program, processes and procedures, and general information including links to other DoD and vendor sites. The PKI website presence also includes information on upcoming events, RA/LRA/KRA training dates, initiatives, resources, policies, news, and specific guidance for end users, system and network administrators, developers and system integrators, RAs, LRAs, KRAs, and Frequently Asked Questions. The Contractor shall maintain the PK-Enabled web interface on both NIPRNet and SIPRNet for access to PKI-protected PKI tools, documentation, and content, The Contractor shall maintain the internet accessible interface to provide PKI tools, documentation, and content that have Public Affairs Office (PAO) approval for internet accessibility. The Contractor shall review the content monthly and make updates to any tools, documentation, and content that require updating. For any content that needs to be published on the internet facing web presence, the contractor shall submit the content for PAO approval. PAO approval must be granted prior to posting content on the internet facing web presence. The Contractor shall provide a monthly status report for NIPRNet, SIPRNet, and Internet on any updates or changes made. The Contractor shall monitor monthly usage and provide a monthly usage report of downloaded content.

6.4.5.2 Quarterly Newsletters. The Contractor shall produce a 4 to 6 page, double sided quarterly newsletter per calendar year. Content for the newsletter is provided by DoD PKI, PKI PMO, and the DoD community. Approval of articles is provided by the Government. A template of the newsletter will be provided.

6.4.5.3 Technical Interchange Meetings. TIMs will be held quarterly per calendar year for the DoD PKI/PKE community lasting 2-3 hours via MS Teams. If video teleconferencing is required, the Contractor may leverage DISA collaboration services for remote presentation, electronic white board, and chat support. The Contractor shall produce minutes including synopses of attendees, technical discussions, and lists of open/closed action items.