842267373 PWS.docx

PERFORMANCE WORK STATEMENT (PWS)

Cross Domain Solution (CDS) Enterprise Implementation

1. Contracting Officer’s Representative (COR). a. Primary COR.

Name:

Organization:

Department of Defense Activity Address Code (DODAAC):

(refer to the DODAAC web site at https://dodaac.wpafb.af.mil for additional information)

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR.

Name:

Organization:

Phone Number:

Fax Number:

E-Mail Address:

2. Contract or Task Order Title. Cross Domain Solution (CDS) Enterprise Implementation

3. Background.

Currently, the Intelligence Systems & Analytics (IS&A) Cross Domain Server Set (CDSS uses a software/hardware combination called Tactical Communications Support Processor (TCSP). This software is a Government-Off-The-Shelf (GOTS) solution that was purpose-built for IS&A to support message routing and cross domain capabilities. This software and hardware combination has approached End-of-Life and requires a replacement software for message routing to be employed. IS&A uses an old standard of message record traffic (USMTF 2004), with a proprietary delivery protocol called Full Duplex Message Protocol (FDMP) for assured delivery. This data type and software is purpose-built to support the IS&A mission. The Government requires a Commercial-Off-The-Shelf (COTS) solution that supports FDMP protocol and USMTF 2004 standard.

4. Objectives:

The nature of this action is to procure proprietary, commercial off-the-shelf (COTS), brand name Forcepoint software licenses, software support and professional services. The Government’s need is to procure a Trusted Gateway System (TGS) and High-Speed Guard (HSG) solution.

It is the Army’s goal to acquire the capability to provide a hardware/software and support services solution. The CDS Enterprise is composed of software and hardware. All software products will be installed and configured with the hardware to ensure that the desired capability works. All software and hardware are unclassified, but the hardware will become classified to the level of data that is being processed. Support services will be CONUS cleared Government facilities up to the TS/SCI level and at their own classified facility in Herndon, VA. The highest level of facility clearance required for the contractor to perform on this contract is TOP SECRET. TOP SECRET clearance is only required at government facilities. The highest level of classified material the contractor will be required to safeguard at its own facility is SECRET. Note that only certain contractors working at Government facilities shall require TS/SCI clearances to perform their job duties.

5. Scope.

Procure software and professional services from industry to include Site Survey, Pre-Onsite Engineering Services, Pre-Onsite Support Services, TGS and HSG Onsite Implementation Services, Test Services, and post-Onsite Services.

To have a “CDS Enterprise” comprised of TGS, HSG, C2, and 3-rd Party Filters COTS software to transfer data via Top Secret and Below Interoperability (TSABI) networks. The proposed implementation will utilize the TGS to transfer approved files between networks. The offerors solution will provide installation, training, and support services for two (2) TGS server(s), two (2) HSG servers and one (1) other instance at one (1) location in CONUS Location.

6. Performance Requirements.

6.1 Task 1 – Software License and Software Support Solution

The Contractor shall provide all perpetual software licenses and software support (maintain the most recent fixes, patches, and versions). The COTS software must have the same functionalities as the current capability used by the Agencies, seamlessly integrate into the existing environment, and allow all products in the environment to maintain full functionality and capability across the Agencies while ensuring the security of the network is not compromised.

The “CDS Enterprise” will require two users to operate. The CDS Enterprise is composed of two (2) TGS servers, two (2) HSG servers, and one (1) C2 instance. COTS GFE hardware will be available for contractor to establish the “CDS Enterprise”. Products must currently meet the National Security Agency (NSA) Raise-The-Bar (RTB) guidelines, such as HSG, TGS, Glasswall, Purifile, Aware, and Sophos.

There are two (2) TGS server(s) included with this effort.

Each server is based on Large 1U TGS hardware.

The data networks are expected to be 10 Gb Ethernet, with each TGS server having two dual port 10 Gb fiber NICs (includes SR SFPs with LC connectors) There is one on-board DP NIC, and one add-on PCI DP NIC There are two (2) HSG Guards and one (1) Admin Server included with this effort Each server is based on Large 1U HSG hardware.

There is an isolated HSG administration network, with each Guard directly connected to the HSG Admin via dedicated Ethernet connection.

The data networks are expected to be 10 Gb Ethernet, with each HSG Guard having two dual port 10 Gb fiber NICs (includes SR SFP’s with LC connectors) There is one on-board DP NIC, and one add-on PCI DP NIC There is one (1) C2 instance that will run on the Admin server noted above

Filter Specification.

The TGS system utilizes third party filters to enable deep content inspection for a variety of file types. Many of the filters enabled within TGS are mandated through A&A requirements. The scope of work in this SOW includes support for the implementation of filters for up to ten (10) file types to be specified by DCGS-A CD2 Enterprise. The TGS implementation detailed in this SOW shall, at least, include the following filters.

The contractor shall deliver the following:

6.2 Task 2 – Support Services

The contractor shall support and perform all activities related to the system engineering process (SE). The SE process ensure all requirements are identified then properly incorporated into the design phase then integrated into the capabilities. Assist with network analysis, configuration management, patch deployments, and system troubleshooting/trouble management, as well as coordinate and communicate with operations and other engineering personnel. Support brand name Forcepoint software licenses, maintenance and updates needed for a working CDS solution.

The contractor shall provide Pre-Onsite Engineering services, provide project management (oversight, resourcing, budgeting, scheduling, risk mitigation) to include conducting a kickoff and remote site survey for the TGS, HSG and C2 implementation. The contractor is responsible for performing system architecture/design and technical risk mitigation, create System Design Document (SDD), define file type and transfer policies for the TGS system, develop HSG Rule Sets (filters) for the data types expected to traverse the HSG Guards, USMTF messages, transfer mechanism will be the Lightweight Adaptable TCP/UDP Proxy (Phoenix), and document the Rule Set validation with a Data Validation Guide (DVG).

The contractor shall provide input to a System Security Plan (SSP) and Security Controls Traceability Matrix (SCTM) for TGS, HSG and C2 Update/modify Site-Based Security Assessment (SBSA) tests for TGS and HSG, provide onsite implementation Services supporting deployment of the TGS solution, install, configure and integration support.

The contractor shall integrate the TGS servers with network infrastructure; Configure TGS transfer and file inspection policies; Configure TGS data transfer paths; Configure TGS to transfer log and audit files to external SSH servers; Perform functional end-to-end testing between all networks; Deployment of HSG solution; Install and configure one (1) HSG Admin Server and two (2) HSG Guards; Integrate the HSG servers with network infrastructure; Tailor data filter rules as necessary. The contractor shall perform functional end-to-end testing between all networks; Deployment of the solution; Configure the SW on the Admin server; Integrate the TGS and HSG servers with C2; Onsite Test Services - at CONUS Location; Assist site in performing TGS and HSG SBSA dry-runs and conducting TGS and HSG SBSA testing; Assist site in creating TGS and SBSA Reports and Plan of Action and Milestones (POA&M) findings, as necessary.

Post Onsite Support services, the contractor shall provide software support and update/deliver revisions of the SDD. The professional services support provided will be installing and supporting brand name Forcepoint software. The contractor shall Deliverable the following:

7. Performance Standards. (ATP: Authority to Proceed)

8. Incentives. None

9. Place of Performance.

The contractor will be required to perform work associated with task order in the United States, specifically on-site at (Government) facilities and customer facilities, as well as any customer site or other alternate work area based on prior Government approval.

The CDS Enterprise is being built at TS government facilities; however, the OEM may need assistance from their technical personnel, located in their contractor’s plant in Herndon, VA, to replicate and Troubleshoot issues found while implementing this effort at government facilities. For work locations, please see DD FORM 254, Block 8a.

Alternate Place of Performance - Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at an alternate place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather, etc.). Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

10. Period of Performance. The PoP shall be one year Base, plus four (4) option years, starting after contract award.

11. Security Requirements The contractor shall coordinate site visits with site POCs at least 72 hours prior to requiring any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by Government personnel who are cleared.

This section shall be considered a supplement to Block 13 of the Government provided DD Form 254, DoD Contract Security Classification Specification. The following security requirements shall apply to this effort.

The highest level of facility clearance required for the contractor to perform on this contract is TOP SECRET. TOP SECRET clearance is only required at government facilities. The highest level of classified material the contractor will be required to safeguard at its own facility is SECRET. Note that only certain contractors working at government facilities shall require TS/SCI clearances to perform their job duties

For all specific security requirements, which are contractually required, please refer to:

DD Form 254 (or Enterprise CDS 2022 solicitation DD Form 254.pdf) DD Form 254 Item 13 Continuation Page (or Enterprise CDS 2022 solicitation DD Form 254 Item 13 Continuation page.pdf);

DD Form 254 SCI Addendum (or Enterprise CDS 2022 DD Form 254 SCI Addendum.pdf); and Security and AT_OPSEC Appendix to the PWS SOO or SOW (or Enterprise CDS 2022 Security and AT_OPSEC Appendix to the PWS SOO or SOW.pdf)

a. SCI Requirements The DCGS-A Cross Domain Solution (CDS) Enterprise shall implement the Trusted Gateway System (TGS), High Speed Guard (HSG), Forcepoint Control Center (FC2) capability between two (2) Top Secret and Below Interoperability (TSABI) networks. The CDS Enterprise is being built at government facilities; however, Forcepoint, will need assistance from their Forcepoint technical personnel, located in their contractor’s plant in Herndon, VA, to replicate and Troubleshoot issues found while implementing this effort at government facilities. The CDS Enterprise is composed of software and hardware. All software products will be installed and configured with the hardware to ensure that the desired capability works. All software and hardware are unclassified, but the hardware will become classified to the level of data that is being processed. Forcepoint will work at CONUS cleared government facilities up to the TS level and at their own Secret facilities in Herndon, VA. The highest level of facility clearance required for the contractor to perform on this contract is TOP SECRET. TOP SECRET clearance is only required at government facilities. The highest level of classified material the contractor will be required to safeguard at its own facility is SECRET. Note that only certain contractors working at government facilities shall require TS/SCI clearances to perform their job duties

12. Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government-Furnished Information (GFI).

COTS GFE hardware will be available for contractor to establish the “CDS Enterprise”:

-(2) Intel® Xeon® Gold 6132, 14C, 2.6G/19M, 128GB, 4 x 960GB SSD RAID 5, DP 1Gb RJ-45 & DP 10Gb Fiber, Dual 750W, PCI 1x LP & 1x FH, 9x5 NBD service, defective HW retention

-Intel 2 Port 1/10Gb Fiber Network Adapter - Full Height (no SFP's)

-Intel 1/10Gb Fiber SR SFP+.

13. Other Pertinent Information or Special Considerations.

a. Identification of Possible Follow-on Work. None

b. Identification of Potential Conflicts of Interest (COI). If any COIs become known to the Government, as defined by FAR Part 9.5, they will be identified. However, if the contractor has access to sensitive information, the remedy to which is discussed in paragraph 11.b. detailed below.

c. Identification of Non-Disclosure Requirements. The contractor shall have access to information, records, and live data which may be sensitive and/or proprietary, including information about government files, source selection activities and processes, system vulnerabilities, data processing activities or functions, user IDs, passwords, and other sensitive information. The Contractor shall not divulge information about government files, source selection activities and processes, or any other sensitive information to anyone not authorized to receive such information. The Contractor shall ensure that other persons are authorized to receive sensitive information before releasing it to them. Unless waived by the Contracting Officer, the NDA must be executed between the contractor employee and the Government before the employee has access to government furnished information. The Contractor is responsible for identifying that all personnel, to include any new personnel on the contract, have executed the DISA-provided NDA as attached.

d. Inspection and Acceptance Criteria. The contractor shall deliver all software licenses, software support and support services to a working condition per the PWS.

Enclosure 4a, PWS Page 1 of 11 Pages 2015/Version 9

Page 12 of 12 Pages image1.emf

NonDisclosure Agreement for DISA Contractors v8 - 19 Sep 2017.docx

DEFENSE INFORMATION SYSTEMS AGENCY

NON-DISCLOSURE AGREEMENT FOR CONTRACTOR PERSONNEL

THIS CERTIFICATION CONCERNS A MATTER WITHIN THE JURISDICTION OF AN AGENCY OF THE UNITED STATES AND THE MAKING OF A FALSE, FICTICIOUS, OR FRAUDULENT CERTIFICATION MAY RENDER THE MAKER SUBJECT TO PROSECUTION UNDER TITLE 18, UNITED STATES CODE, SECTION 1001.

I, (print or type name), as an employee of

(insert employer name) (“the Company”), a contractor or subcontractor for the Defense Information Systems Agency/Defense Information Technology Contracting Organization (DITCO) or other relevant DoD entity, performing under Contract Number (insert contract number), understand that as a result of my assignment under this contract, I may have access to, become aware of, or possess information/data that is considered sensitive or proprietary and may be protected by law from unauthorized use or disclosure.

I agree not to disclose to any individual, business entity, organization, or anyone within or outside of the Company who has not signed a non-disclosure agreement for the purposes of performing this contract: (1) any planning, programming, and budgeting system information; (2) any contractor bid or proposal information or source selection information as defined in Federal Acquisition Regulation (FAR) 3.104-4; (3) any information exempt from disclosure under the Freedom of Information Act, 5 U.S.C. § 552(b), including any trade secrets, proprietary, or financial information protected under § 552(b)(4); (4) any personally-identifiable information or protected health information; and (5) any other sensitive information considered Confidential or For Official Use Only (FOUO). I also agree to use such information/data solely for the purposes of performing this contract, and not to use such information/data to obtain anything of value or to provide a financial benefit or a competitive advantage to any third party and/or my employer.

I continue to be bound by the obligations of this Agreement after my performance under the contract has ended, and after the contract has been terminated or closed, until such time as the information/data protected by this Agreement is approved by the United States Government for public release. Any sensitive or proprietary information/data in my possession at the end of my performance under this contract must be returned to the Government. I understand that I may be subject to administrative, civil, and criminal sanctions for violating this Agreement, and any violation of this Agreement may result in my removal from assignment to this contract.

This Agreement does not bar disclosures to Congress or to an authorized official of an executive agency or the Department of Justice that are essential to reporting a substantial violation of law, and this Agreement does not prohibit disclosures which are required under order of a court of competent jurisdiction. These provisions are consistent with and do not supersede, conflict with, or otherwise alter the obligations, rights, or liabilities created by existing statutes or Executive orders relating to (1) classified information, (2) communications to Congress, (3) the reporting to an Inspector General of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety, or (4) any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling Executive orders and statutory provisions are incorporated into this agreement and are controlling. These controlling Executive orders and statutory provisions include Executive Order No. 13526, as amended; Section 7211 of Title 5, United States Code (governing disclosures to Congress); Section 1034 of Title 10, United States Code, as amended by the Military Whistleblower Protection Act (governing disclosure to Congress by members of the military); Section 2302(b)(8) of Title 5, United States Code, as amended by the Whistleblower Protection Act (governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the Intelligence Identities Protection Act of 1982 (50 USC 3121 et seq.) (governing disclosures that could expose confidential Government agents); and the statutes which protect against disclosure that may compromise the national security, including Sections 641, 793, 794, 798, and 952 of Title 18, United States Code, and Section 4(b) of the Subversive Activities Act of 1950 (50 USC 783(b)).

My execution of this Agreement shall not nullify or affect in any manner any other Confidentiality or Non-Disclosure Agreement, including any Standard Form 312 or 4414, which I have executed or may execute with the United States Government or any of its departments or agencies.

I have carefully read this Agreement and understand my obligations under it.

Signature of Contractor Employee Date