Attachment__1_Performance_Work_Statement_(PWS).pdf

Attachment #1

89233118QNA000043

Department of Energy, National Nuclear Security Administration Office of Radiological Security (NA-212)

Performance Work Statement Cyber and Physical Security in

Support of Global Efforts to Secure Nuclear and Radiological Materials

1.0 INTRODUCTION/BACKGROUND

The Office of Radiological Security (ORS)(NA-212) mission is to enhance global security by preventing high activity radioactive materials from use in acts of terrorism. This is accomplished by conducting activities to: 1) protect radioactive sources used for vital medical, research and commercial purposes; 2) remove and dispose of disused radioactive sources; and 3), reduce global reliance on radioactive sources through their replacement with viable, non-isotopic alternative technologies.

This effort is directly related to the first strategy of ORS, protecting radioactive sources.

Radioactive sources play a critical role in medical, industrial and commercial applications however if these sources are not managed securely they pose a significant risk of theft and use in a radiological dispersal device One of these devices could cause major economic impact including relocation of the public and take years take years to recover from. ORS works with hospitals, universities, and research facilities to evaluate existing security systems, provide physical protection upgrades, guidance, and training to enhance the security of these high-activity radioactive sources.

The purpose of this contract is to provide support to federal project managers on a range of activities related to the physical security, including cybersecurity, of radioactive material.

2.0 SCOPE

The Contractor shall provide support for implementation of cyber and physical security enhancements at government, commercial, and private facilities protecting radioactive material both domestically and internationally. The Contractor shall provide support to the International Atomic Energy Agency (IAEA) through radiological security training programs and guidance development efforts, as well as providing support and collaboration with HQ staff, laboratory staff, Department of Homeland Security (DHS), Nuclear Regulatory Commission (NRC), and domestic and international stakeholders and partners to ensure a shared outcome in implementing radiological security. The Contractor shall act as lead Coordinator for various project teams.

3.0 PERFORMANCE REQUIREMENTS:

3.1 The Contractor shall draft cyber security guidance for ORS program-wide use and develop draft guidance specific for ORS-provided security enhancements.

3.2 The Contractor shall conduct cyber/physical security assessments at ORS partner sites in consultation with HQ staff and lab project teams.

3.2.1 Review of domestic and international sites that have received ORS security enhancements.

3.2.2 Discussion of any lessons learned from these assessments and discussions with project teams on what is observed in the field.

3.3 The Contractor shall develop cyber/physical security awareness training for ORS HQ staff on issues specific to ORS provided security equipment, cyber security awareness training for sites receiving ORS security enhancements, and training for physical protection experts supporting ORS from the laboratories.

3.4 The Contractor shall participate as a cyber security Subject Matter Expert (SME) at the Nuclear/Cyber Interagency Working Group, the National Security Council Cyber Nuclear Sub-Policy Coordinating Committee and other working groups.

3.4.1 Support to ORS HQ staff as a cyber security SME on cyber security issues related to ORS provided security enhancements;

3.4.2 Representation of ORS at technical meetings, review of relevant documents and recommend courses of action when impacts are anticipated to ORS equities;

3.4.3 Ensuring interagency partners are informed on ORS cyber security activities and ensuring ORS guidance is consistent with other agency guidance.

3.5 The Contractor shall conduct reviews with International Atomic Energy Agency and

Nuclear Regulatory Commission on cyber security, which shall include at a minimum:

3.5.1 Review IAEA and NRC developed cyber security documents and material for potential impacts on ORS’ radiological security work;

3.5.2 Participate on writing teams as directed by ORS on IAEA implementation and technical guides, as well as training courses.

3.6 The Contractor shall develop plausible cyber/physical security scenarios for use in

ORS program vulnerability assessments.

3.6.1 Development of cyber scenarios consistent with the capabilities of the threat as outlined in the ORS’ “Potential Adversaries Capabilities” guidance;

3.6.2 Recommendation of cyber security countermeasures to any plausible scenarios where an adversary would use a cyber tool to facilitate a physical attack on a facility that has received ORS security enhancements;

3.6.3 Coordination with the DNN Computer Security Team and lab project teams to review scenarios for credibility and accuracy.

3.7 The Contractor shall provide SME input/review to ORS studies including current study on “Analysis and Mitigation of Cyber Attacks on Radiological Material Transport Vehicles.”

3.8 The Contractor shall conduct cyber/physical security assessments of ORS-deployed equipment.

3.8.1 Commercial Off The Shelf security equipment;

3.8.2 Non-commercially available radiological material security equipment;

3.8.3 Mobile Source Transit System.

3.8.4 Other ORS-deployed equipment

3.9 The Contractor shall manage the testing of equipment developed or funded by ORS to ensure ORS provided security equipment does not introduce cyber security vulnerabilities to a site when this equipment is installed and introduced.

3.9.1 Observe Sentry Remote Monitoring System development and provide SME reviews and technical support on the program’s Sentry Remote Monitoring System.

3.9.2 Observe and provide SME reviews on other ORS-funded or ORS-developed systems.

3.10 The Contractor shall serve as the lead coordinator for various project team related to the scope of work. This team is made up of laboratory contractors and other contractors.

3.10.1 Review of financial data. Provide project management activities in G2 to recommend approval on FinPlan changes to ensure budgets are allocated properly per the scope of work.

3.10.2 Review and coordinate of monthly status reports, work progress and financial status reports from team members.

3.11 The Contractor shall draft ORS Project Work Plan and provide recommendations to leadership on project budgeting, quality assessment & control and resource management in support of projects.

3.12 The Contractor shall provide ad hoc support on security topics that are relevant to

ORS.

3.12.1 Review of the evolving cyber threat and evaluation of ORS concerns in any new vulnerabilities or exploits that may be identified;

3.12.2 Coordination with lab project teams, lab cyber security experts, and the DNN Computer Security Team to make recommendation to ORS to address the exploits.

3.13 The Contractor shall provide regular updates to ORS leadership.

3.13.1 Status of projects;

3.13.2 Recommendations for changes in an evolving cyber/physical security program;

3.13.3 Recommendations for next steps to mature the ORS cyber/physical security program;

3.13.4 Anticipation of objectives and needs to better advise on relevant program objectives.

3.14 The Contractor shall review ORS cyber security policies, guidelines and standards.

3.14.1 The Contractor shall provide recommendations to enhance radiological security.

4.0 KEY PERSONNEL

4.1 The Cyber and Physical Security Subject Matter Expert (SME) is a key person consistent with the Key Personnel clause and may only be filled by one individual.

The Cyber and Physical Security SME shall provide all support to fulfill all requirements identified in the PWS. The individual fulfilling the key personnel role must have extensive experience in physical and cyber security for sealed radioactive sources, working with international organizations including the IAEA, developing and providing training, and acting as SME to agency leadership. The Cyber Security SME shall have an active, current DOE Q clearance. The NNSA reserves the right to reject proposed contractor key personnel based on skills, experience, inter-personal communication skills, the results of personnel security background checks, or other factors that would negatively impact the NNSA’s mission, strategic priorities, operations, or the efficient completion of contract requirements.

5.0 DELIVERABLES

-Project Status Reports including input to the monthly executive performance report -Project Work Plans -Best Practice Guides

6.0 TRAVEL & OTHER DIRECT COST (ODC)

The Contractor may be required to travel to both domestic and international locations in the exercise of this order. All other direct costs shall be approved by the COR in writing in advance of the cost being accrued or incurred by the Contractor.

7.0 PLACE OF PERFORMANCE

The Contractor shall perform the required support services at the Department of Energy’s (DOE) James Forrestal Building, located at 1000 Independence Avenue, S.W., Portals III, 1201 Maryland Avenue SW, Washington D.C. 20024. Contractors may telework offsite if approved by the COR. When teleworking, contractors must work through the DOE/NNSA Network via a Citrix, VPN, etc. connection. Official work product developed under this contract shall not be transferred from the DOE/NNSA Network to an unapproved resource (e.g. locally stored on a personal computer, transferred to personal cloud storage, etc.).

8.0 GOVERNMENT FURNISHED EQUIPMENT AND FACILITIES

8.1 Necessary office space at Portals III in Washington, DC.

8.2 Necessary telecommunication and computer equipment on site to perform DOE-assigned tasks.

8.3 Necessary office equipment and supplies.

8.4 All DOE work areas necessary for Contractor personnel to access to perform the requirements of this SOW.

9.0 SECURITY CLASSIFICATION

All Contractor employees will be required to have an active DOE Q-level security badge and comply with all DOE Security guidance and directives as stated in the order.

10.0 PERIOD OF PERFORMANCE

The period of performance for this Contract will be from October 1, 2018 to September 30, 2023.

11.0 PERFORMANCE BASED OBJECTIVES, MEASURES AND EXPECTATIONS

11.1 Contractor performance shall be evaluated on the following performance criteria on an annual basis: Quality, Timeliness, and Business Relations:

Performance Objectives

SOW

Reference

Minimum Performance Standard

Assessment Methods

Quality 3.0 Deliverables and reports are accurate, complete, meet professional standards, and have been properly coordinated with NNSA.

COR verification that the requirements of the standards are satisfied

Timeliness 3.0 Deliverables and reports are submitted within the stipulated timeframe.

COR verification that the requirements of the standards are satisfied

Performance Objectives

SOW

Reference

Minimum Performance Standard

Assessment Methods

Business Relations

Identified issues are resolved in a timely manner and to the satisfaction of the

NNSA.

COR verification that the requirements of the standards are satisfied

11.2 Performance Management Meetings: Meetings shall be held as often as necessary at the discretion of the COR.

12.0 QUALITY CONTROL

The contractor shall establish and maintain such controls and operating procedures as may be necessary to assure that services performed under this order meet acceptable levels of quality.

The contractor shall submit a quality control plan on the order start date. This quality control plan shall include a method for identifying deficiencies in performance or accuracy and subsequent corrective action. The plan shall be revised in accordance with Government comments within 30 days of award. The contractor shall maintain and update the plan as required by the COR.