A03 Draft PWS - OT Cybersecurity Solution.pdf

PERFORMANCE WORK STATEMENT (PWS)

Operational Technology (OT) Cybersecurity Solution (OTCS) for FSD Facility Related Controls System (FRCS) Networks

PART 1

GENERAL INFORMATION

1. GENERAL: This is a non-personal services contract to provide Operational Technology (OT) Cybersecurity Solution support services for the Facilities Services Directorate (FSD) Facility Related Control Systems (FRCS) network. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1. Description of Services / Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to support the development, operation, maintenance, installation and troubleshooting of the Dragos Cybersecurity Platform as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2. Background: Washington Headquarters Services (WHS) Facilities Services Directorate (FSD) is responsible for providing facility management support for the National Capital Region (NCR). FSD also provides administrative and operational support to a vast array of Department of Defense (DOD) activities. Within this Directorate are many programs designed to support all personnel working in the managed and leased buildings overseen by WHS. Of these programs, the Facilities Operations and Services Division (FOSD) is responsible for operating and maintaining the Pentagon Reservation and Mark Center Reservation. Within FOSD, The Reservation Facility Related Control Systems (RFRCS) Branch is responsible for all operations and maintenance for both complexes, which includes – but is not limited to – the utilities, vertical transportation systems, fire protection systems, and Facility Related Control Systems (FRCS) Networks.

The overall contract management will be accomplished by the Facilities Services Directorate of the Washington Headquarters Services. The Reservation Facility Related Controls System (RFRCS) Branch will serve as the Government point of contact (POC) for FSD’s FRCS Networks OT Cybersecurity Solution.

1.3. Objective(s): The objective of this contract is to obtain support from a qualified contractor to provide services to include, but not be limited to: Continuous Monitoring capabilities; Architectural Assessment;

Architectural Review; and Cyber Threat Analytics of the FRCS Networks to strengthen and improve the overall cybersecurity posture at both facilities. The RFRCS Branch has procured and deployed the Dragos Cybersecurity Platform and Dragos Network Sensors and requires contractor support services to assist in the development of this OT Cybersecurity Solution. The contractor shall be capable of providing the personnel necessary for supporting this development, as well as being able to provide the capability to procure additional hardware, software, licensing and/or services.

1.4. Scope: The scope of this contract is for the contractor to provide the personnel, equipment, and services necessary to support the development, operations, maintenance, installation and troubleshooting of FSD’s OT Cybersecurity Solution (OTCS) environments at both the Pentagon Reservation and Mark Center

Reservation. The OTCS is currently comprised of the Dragos Platform, which includes the Dragos Site Store and Dragos Network Sensors.

1.5. Period of Performance: The Period of Performance (PoP) for one (1) twelve-month base period, and four

(4) twelve-month Option Year (OY) periods.

1.6. General Information

1.6.1. Quality Control (QC): The contractor shall develop and maintain an effective quality control plan

(QCP) to ensure services are performed in accordance with (IAW) this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is how they assures themself that the work complies with the requirement of the contract. The QCP shall be delivered to the Government no later than (NLT) thirty (30) calendar days after contract award. After the Government has provided formal acceptance of the QCP, any contractor-proposed changes to the QCP must be approved by the Contracting Officer (CO/KO) in writing prior to the contractor implementing any changes to the QCP. The Government will evaluate the contractor’s performance under this contract IAW the Quality Assurance Surveillance Plan (QASP). After the Government’s acceptance of the QCP the contractor shall receive the Contracting Officer’s written acceptance of the Government’s proposed change(s) to the contractor’s QCP.

1.6.2. Quality Assurance (QA): The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3. Recognized Federal Holidays: Government personnel recognize the following Federal Holidays, as published by the Office of Personnel Management (OPM), and will be absent from their respective duty station [Reference 5 U.S.C. §6103]

New Year’s Day January 1* Birthday of Martin Luther King, Jr. 3rd Monday in January Washington’s Birthday 3rd Monday in February Memorial Day Last Monday in May Juneteenth National Independence Day June 19* Independence Day July 4* Labor Day 1st Monday in September Columbus Day 2nd Monday in October Veterans Day November 11* Thanksgiving Day 4th Thursday in

November Christmas Day December 25*

*If the date falls on a Saturday, the Government holiday is the preceding Friday. If the date falls on a Sunday, the Government holiday is the following Monday.

1.6.3.1. In addition to the days designated as holidays, the Government observes the following days:

• Any other day designated by Federal Statue

• Any other day designated by Executive Order

• Any other day designated by the President’s Proclamation

1.6.4. Hours of Operation: The contractor is responsible for conducting business between the hours of 6:00 a.m. through 4:00 p.m. Monday through Friday except on Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. For other than firm fixed price contracts, the contractor will not be reimbursed when the government facility is closed for the above reasons. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.5. Place of Performance: The contractor shall perform all tasks under this contract onsite at the

Pentagon Reservation and/or Mark Center Reservation. It is especially noted that the Pentagon Reservation encompasses all ancillary buildings within the complex, to include but not be limited to the following: Heating & Refrigeration Plant (H&RP); Remote Delivery Facility (RDF); Pentagon Emergency Response Center (PERC); Pentagon Support Operations Center (PSOC); Modular Office Complex (MOC); and Secondary Modular Office Complex (SMOC).

1.6.6. Type of Contract: The Government will award a firm-fixed priced (FFP) contract.

1.6.7. Security Requirements: Contractor personnel performing work under this contract must have a

Secret clearance at the time of the proposal submission and must maintain the level of security clearance required for the life of the contract. The security requirements are in accordance with the attached DD254.

1.6.7.1. Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.6.7.2. Key Control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer.

1.6.7.2.1. If keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks;

however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.6.7.2.2. The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

1.6.8. Post Award Conference / Periodic Progress Meetings: The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The Contracting Officer, Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the Contracting Officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

The contractor is responsible for taking the meeting minutes and submitting them for review within five (5) business days after the meeting.

1.6.8.1. Monthly Status Report: Reporting requirements for the monthly status reports will be outlined at the initial orientation meeting. The report will be due prior to the 10th of the month. It is expected that these will include, but not be limited to:

• Program Status – to include objectives met, work completed, and work scheduled to be completed

• Issues or obstacles that are impeding progress, as well as recommended solutions

• Status of deliverables/milestones

• Resources planning/status

• Topics or issues identified by the KO, COR, or Contract Specialist (CS)

• Budget total to include costs to date and for the reporting period

1.6.8.2. Annual Report: The contractor shall submit an annual report at the end of the base period and at the end of each option period. The report shall include all items described in Section 1.6.8.1 along with an annual or final assessment.

1.6.9. Contracting Office Representative (COR): The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially about changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.10. Key Personnel: The following personnel are considered key personnel by the government: Contract

Manager, Alternate Contract Manager, Senior Solutions Architect. The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 6:00am and 4:00pm, Monday thru Friday except on Federal holidays or when the government facility is closed for administrative reasons. Qualifications for all key personnel are listed below:

Key Personnel Title Minimum Qualification Contract Manager and Alternate Education: N/A Must be fluent in English

Years of Experience Two (2) years of direct contract management experience

Senior Solutions Architect Education Years of Experience Certifications

Non-Key Personnel Title Minimum Qualifications

1.6.10.1. Contract Manager and Alternate: The Contract Manager and Alternate must have 2 years of

Contract Management experience, with some of this experience being specific to a government contracting environment; excels at multi-tasking and has excellent project management, time management, and organization skills; collaborates with internal and external stakeholders and has strong interpersonal skills; learns new skills and software quickly; communicates effectively and has strong written and verbal communication skills; and has prior operational technology experience.

1.6.10.2. Senior Solutions Architect:

1.6.11. Identification of Contractor Personnel: All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. All contractor personnel will be required to obtain a Pentagon Facilities Alternative Credential (PFAC) or Common Access Card (CAC) and always wear this credential when performing work onsite under this contract.

1.6.12. Contractor Travel: The contractor will be required to perform work under this contract onsite when the work cannot be performed remotely. It is the Government’s discretion on what work being performed under this contract can and cannot be performed from a remote location. The contractor shall ensure there is personnel available to travel when required to perform work onsite. The contractor may be required to travel CONUS and within the NCR during the performance of this contract to attend meetings, conferences, and training. The contractor will be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. All travel requires Government approval/authorization and notification to the COR and KO. Local travel within the National Capital Region is not reimbursable.

1.6.13. Other Direct Costs: All costs relating to travel and shipping expenses for the work being performed under this contract shall be included in the other direct cost CLIN’s of this contract. This category includes travel (outlined in 1.6.12), reproduction, and shipping expenses associated with training activities and visits to contractor facilities.

1.6.14. Organizational Conflict of Interest (OCI): The contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interest (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may enact other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.6.15. Phase in/Phase out Period

1.6.15.1. Phase In: To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the Contractor shall have personnel on board, during the 30-day phase in/phase out periods. During the phase in period, the Contractor shall become familiar with performance requirements to commence full performance of services on the contract start date.

1.6.15.2. Phase Out: The contractor shall provide a phase out plan NLT sixty (60) days priors to expiration of the final the contract to the government designated representative, KO, and incoming contractor. The contractor shall identify how it will coordinate with incoming contractor and Government personnel to transfer knowledge to minimize disruption of transferring to a new contract regarding the following:

• Program/Project management processes

• Point of Contact

• Location of all documentation relevant to the work performed under this contract

• Appropriate contractor to contractor coordination to ensure a seamless transition

• Establish and maintain effective communication with the incoming contractor/Government personnel for the period of the transition via weekly status meetings.

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS

2.1. DEFINITIONS:

2.1.1 BUSINESS Days. Monday through Friday, except for federal holidays

2.1.2 CALENDAR Day Calendar Day refer to every day on the calendar all 365 days of the year (366 if it is a leap year)

2.1.3 CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.4 CONTRACTING OFFICER. A person with authority to enter, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.5 CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S.

Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor if that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.6 DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.7 DELIVERABLE. Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

2.1.8 KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.9 PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.10 QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.11 QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.12 QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of a product or service shall meet contract requirements.

2.1.13 SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.14 WORKDAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.15 WORK WEEK. Monday through Friday, unless specified otherwise.

2.2 ACRONYMS:

ACOR Alternate Contracting Officer's Representative AOI Area(s) of Interest BCTF Boards, Commissions, and Task Forces CAC Common Access Card CFR Code of Federal Regulations CLIN Contract Line Item Number CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative COTS Commercial-Off-the-Shelf CS Contract Specialist DD Form 254 Department of Defense Contract Security Requirement List DFARS Defense Federal Acquisition Regulation Supplement DMDC Defense Manpower Data Center DOD Department of Defense EM Enterprise Management Directorate FAR Federal Acquisition Regulation FFP Firm Fixed Price FOG Facility Operations Group FOSD Facilities Operations & Services Division FRCS Facility Related Controls System FSD Facilities Services Directorate GFE Government Furnished Equipment HIPAA Health Insurance Portability and Accountability Act of 1996 HTTPS Hypertext Transfer Protocol Secure IAW In Accordance With IT Information Technology JSP Joint Service Provider KO Contracting Officer MFA Multi-Factor Authentication MOC Modular Office Complex NCR National Capital Region NLT No Later Than OCI Organizational Conflict of Interest OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs O&M Operations & Maintenance OT Operational Technology OTCS Operational Technology Cybersecurity Solution OY Option Year PCAP Packet Capture PERC Pentagon Emergency Response Center PFAC Pentagon Facilities Alternate Credential

PHRP Pentagon Heating & Refrigeration Plant PIPO Phase In/Phase Out PLC Primary Logic Controller POC Point of Contact POP Period of Performance PRS Performance Requirements Summary PSOC Pentagon Support Operations Center PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program RDF Remote Delivery Facility RFRCS Reservation Facility Related Controls System SMOC Secondary Modular Office Complex SME Subject Matter Expert(s) TE Technical Exhibit TLS Transport Layer Security VLAN Virtual Local Area Network VRF Virtual Routing and Forwarding WHS Washington Headquarters Services

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES

3.1. SERVICES: The Government will provide, when available, the Subject Matter Experts (SME’s) and personnel as required for the contractor’s use in performance of tasks outlined in this PWS. The Government will provide all information relating to the FRCS Network required by the Contractor for execution of all tasks as outlined in this PWS.

3.2. FACILITIES: The Government will provide all necessary workspace for the contractor personnel to perform the tasks as outlined in this PWS, to include but not be limited to physical desk space, telephones, computers and other items necessary to maintain an office environment. Physical access to this space will be managed by the Government.

3.3. UTILITIES: The Government will provide all utilities in the facility as required for the contractor’s use in performance of tasks outlined in this PWS. These utilities include electricity, lighting, and water. The Contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount to accomplish cleaning vehicles and equipment.

3.4. MATERIALS: The Government will provide all relevant Standard Operating Procedures, internal policy documents, network configuration information (IP Address, Subnet Mask, Gateway).

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES

4.1. GENERAL: The Contractor shall furnish all supplies, personnel, equipment, facilities and services required to perform work under this contract that are not listed under Section 3 of this PWS.

4.2. SECRET FACILITY CLEARANCE: The contractor shall possess and maintain a SECRET facility clearance from the Defense Security Service. The Contractor’s employees, performing work in support of this contract shall have been granted and maintain a SECRET security clearance from the Defense Industrial Security Clearance Office. The DD254 is provided as Attachment 2 – DD254.

4.3. MATERIALS: The Contractor shall furnish materials, supplies, and equipment necessary to meet the requirements under this PWS. The Contractor shall provide the Government the MAC Addresses of each device being introduced to the FRCS Network. The Contractor shall provide a complete inventory of every device provided.

4.4. EQUIPMENT: The Contractor shall provide all necessary equipment required to execute the work being performed under this contract. The Contractor shall provide a complete inventory of every piece of equipment being provided.

PART 5

SPECIFIC TASKS

5. GENERAL TASKS

5.1. FRCS Networks:

The Reservation Facility Related Control System (RFRCS) Branch is responsible for overseeing the operations and maintenance of the Pentagon and Mark Center FRCS Networks.

The Pentagon FRCS Network is a critical component to supporting the overall mission of defending the Nation.

It provides FSD personnel with the capability to monitor, control, operate, and troubleshoot all of the utility equipment of the Pentagon Building.

The Pentagon FRCS Network is comprised of a combination of Information Technology (IT) and Operational Technology (OT) assets. It resides on a network transport infrastructure that is owned, operated, and maintained by the Defense Information Systems Agency (DISA) / Joint Service Provider (JSP). It is contained within one

(1) virtual routing & forwarding (VRF) and is comprised of approximately twenty-one (21) virtual local area networks (VLANs) but is not limited to expansion and/or growth. The current Areas of Interest (AOI) where the Pentagon FRCS Network resides shall include but not be limited to:

• Pentagon Building o Corridors 1 & 2 o Corridors 3 & 4 o Corridors 5 & 6 o Corridors 7 & 8 o Corridors 9 & 10 o Basement o Mezzanine o Remote Delivery Facility (RDF) o National Military Command Center (NMCC) o Pentagon Redundant Utility Plant (PRUP) o Pentagon Generator Support Program (PGSP)

• Pentagon Heating & Refrigeration Plant (PH&RP)

• Pentagon Emergency Response Center (PERC)

• Pentagon Support Operations Center (PSOC)

• Modular Office Complex (MOC)

• Secondary Modular Office Complex (SMOC)

• Mark Center

In support of PWS Section 5.1, the contractor shall:

5.1.1. Provide all labor, material and equipment required to assess the current cybersecurity posture of the FRCS Networks, identify weaknesses and vulnerabilities, and provide recommendations to improve and strengthen the overall security posture.

5.1.2. Maintain both a physical and logical N+1 redundant configuration, to include network-level redundancy as well as the capability for utility-level (electrical) redundancy.

5.1.3. Maintain a complete inventory of all hardware, software, and licenses provided to the Government.

The inventory shall contain all serial numbers, model numbers, part numbers, licensing information, manufacturer information, warranty expiration, purchase dates, and physical locations as applicable.

5.2. Hardware

In support of PWS Section 5.1, the contractor shall:

5.2.1. Ensure that firmware updates are provided on a routine basis of no less than annually, or within the following time restraints upon identification of a vulnerability:

Vulnerability Severity Level Required Vulnerability Mitigation

Low 90 Days or Less

Moderate 60 Days or Less High 45 Days or Less

Critical 30 Days or Less

5.2.2. Provide a warranty of no less than five (5) years for all hardware being introduced to the FRCS

Networks.

5.2.3. Be responsible for the installation of all hardware, or for supporting the installation of all hardware, at the discretion of the COR.

5.2.4. Coordinate all installation activities with the COR and appropriate FOSD personnel as designated by the COR.

5.2.5. Replacement parts

5.2.6.

5.3. Software

In support of PWS Section 5.3, the contractor shall:

5.3.1. Provide installation documentation for all software installations. This documentation shall include a step-by-step instruction for installing all software.

5.3.2. Provide step-by-step documentation that details the process on how to update all software.

5.3.3. Provide step-by-step documentation that details the process on making any modifications to the software, as required.

5.3.4. Ensure that all software accessible via a web interface supports the use of Hypertext Transfer

Protocol Secure (HTTPS).

5.3.4.1. With the use of HTTPS, all software shall also support the use of, at a minimum, Transport Layer Security (TLS) version 1.2 or higher.

5.3.5. Ensure that all software supports the ability to be integrated to Microsoft Active Directory (AD).

All software shall be integrated to each respective AD instance on the FRCS Networks for managing user and group authentication and permissions.

5.3.6. Ensure that all software supports the use of Multi-Factor Authentication (MFA). All software shall be integrated and configured for MFA login via the MFA solution that is utilized on each respective FRCS Network.

5.4. Licensing

5.4.1. Provide licenses for all hardware, software and/or virtual solutions that are implemented to satisfy the requirements of this PWS.

5.4.2. Ensure that all hardware, software and/or virtual solutions support the ability to be licensed offline.

All licenses shall be activated without the use of an Internet-based licensing server.

5.4.3. Allow for hardware licenses to be exchanged for virtual licenses, if necessary. In the event that this occurs, additional licenses will need to be purchased for the physical hardware prior to use of this equipment.

5.5. Maintenance & Support

5.5.1. Placeholder

5.5.2. Placeholder

PART 6

APPLICABLE PUBLICATIONS

6.0 Applicable Publications:

6.1 The Contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures.

PART 7

Technical Exhibits

7.1 Exhibit 1: Performance Requirement Summary

7.2 Exhibit 2: Deliverable Schedule

TECHNICAL EXHIBIT 1

PERFORMANCE REQUIREMENTS SUMMARY

The Contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Objective (The Service required—usually a shall statement)

Standard Performance Threshold (This is the maximum error rate. It could possibly be “Zero deviation from standard”)

Method of Surveillance

PRS # 1.

The contractor provided FRCS network support in accordance with the contract requirements.

As defined in the PWS under 5.1 FRCS Networks

99% Compliance Periodic surveillance by

COR

PRS # 2

The Contractor shall Ensure that firmware updates are provided on a routine basis of no less than annually, or within the following time restraints upon identification of a vulnerability as describe in the PWS.

As defined in the PWS under 5.2 Hardware

95% Compliance Periodic surveillance by

COR

PRS # 3

The contractor shall Provide installation documentation for all software installations as describe in the PWS.

As defined in the PWS 5.3 Software

99% Compliance Periodic surveillance by

COR

PRS # 4

The contractor shall provide all licenses as describe in the PWS.

As defined in the PWS 5.4 Licenses

95% Compliance Periodic surveillance by

COR

The following listing provides various types of Surveillance as examples to select from and should not be included on the final document:

Random Sampling: Appropriate for frequently recurring tasks. Evaluate randomly selected samples of the lot to determine the acceptability of the entire lot.

Random Inspection Guide, Method of surveillance, Lot size, Sample size, Performance requirement, Sampling procedure, Inspection procedure

100 Percent Inspection: Appropriate for tasks that occur infrequently. Inspect and evaluate performance each time task is performed.

Periodic Surveillance: Evaluation of samples selected on other than 100% or statistically random basis. (i.e., monthly, quarterly, semi-annually etc.)

Validated Customer Complaint: Complaints must be validated.

TECHNICAL EXHIBIT 2 DELIVERABLES SCHEDULE

The contractor shall provide all deliverables as described as specified in the chart below. The contractor shall turn over all records and copies of reports to the COR within five calendar days after contract completion or termination. The Contractor shall provide deliverable test plans, forms, and templates for government review and approval prior to testing. The COR will provide any edits within five (5) business days. The contractor shall address and update the test plans, forms, and templates based on government comments. All quantities listed are per contract year.

PWS

Section

Deliverables Format Frequency Quantity Deliv ery

Form at

1.6.1

Quality Control Plan Contractor

Provided

30 Days after award/ as needed

KO/COR

MS

Word

1.6.8

Meeting Minutes Contractor

5 Business days after meeting

1.6.8.1

Monthly reports Contractor Provided 10th of the

Month

12 KO/COR MS

Word

1.6.8.2 Annual reports Contractor

Provided After each exercise option

1 KO/COR MS

1.6.15.2

Phase Out Contractor

60 days prior to expiration