A23 Attachment 1 - PWS Cybersecurity_Bridge 5.29.2026.pdf

PERFORMANCE WORK STATEMENT (PWS)

Defense Security Cooperation Agency (DSCA) Information Management & Technology (IM&T)

Cybersecurity Support Service

29 May 2026

PART 1

GENERAL INFORMATION

1. GENERAL: This is a non-personal services contract to provide Cybersecurity Support services. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Cybersecurity Support services defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background: The Defense Security Cooperation Agency (DSCA) has program responsibilities regarding the sale and transfer of defense articles and services to international customers. As part of its overall responsibilities, DSCA is the Department of Defense (DoD) agency delegated the responsibility to manage the transfer, sale, and lease of U.S. military end-items under Sections 516 and 623 of the Foreign Assistance Act (FAA) of 1961 (22 U.S.C. 2321j) as amended, and Chapters 2, 3, and 6 of the Arms Export Control Act (AECA). DSCA requires contractor support pertaining to Cybersecurity Support services to best execute these responsibilities.

Information Management and Technology’s (IM&T) Role in the DSCA Mission and Security Cooperation (SC) Community is to manage a portfolio of Information Technology (IT) mission systems and services efficiently enabling the DSCA mission for the SC. IM&T operates and maintains the robust IT infrastructure relied upon by DSCA workforce and the SC community worldwide.

IM&T is working toward the integration of the SC community with streamlined mission systems and information sharing practices to (1) provide a near real-time view of enterprise community activities, (2) facilitate organizational learning, (3) enable strategic decision making, and (4) efficiently allocate IT resources to successfully support the SC mission.

The organizational structure of IM&T is aligned functionally and highlights services including customer and requirements management, portfolio management, application development and support, help desk support, and partner relationship management. IM&T is comprised of the IT Policy and Planning Division (PPD), Technology Services Division (TSD), and Enterprise Application Development and Support Division (EADSD); IM&T is led by the Chief Information Officer (CIO) and resides within the Office of Business Operations (OBO).

1.2.1 Tasks: The primary tasks for Cybersecurity Support services are:

A. Governance and Strategy B. Cybersecurity Compliance C. IT Enterprise Risk Management D. Cybersecurity Operations

1.2.2 Objectives: The objective of this requirement is to provide qualified and professional, responsive, clear, and reliable Cybersecurity support for DSCA’s Information Technology (IT), to include service in the areas of Governance, Risk, Compliance, and Operations support that meets the requirements of this PWS and the DSCA Cybersecurity Branch Service Catalog.

Obtain strategic and programmatic support to DSCA Cybersecurity Branch (CYBR) based on vendor industry knowledge, best practices, and strategies available at the time work is performed. Obtain Subject Matter Expert (SME) knowledge that can be leveraged throughout the life of the contract to be able to address new requirement related but not specifically capture here to continue compliance with all previously mentioned requirements as these evolve over the life of the contract.

1.3 Scope: The services will include:

• Cybersecurity Compliance Support

• Cybersecurity Risk Support

• Cybersecurity Operations Support

• Cybersecurity Governance Support

• Strategic and Program Support Enhancements

• Advisory Services to improve policy, process, and procedure for CYBR overall

The support requested is intended to provide services for the areas shown in Part 5 below.

1.4 Period of Performance: The period of performance shall be for one (1) Base Period of three (3) months and three (3) Option Periods of one (1) month. The Period of Performance reads as follows:

Base Period: 15 June 2026 – 14 September 2026 Option Period: 15 September 2026 - 14 October 2026 Option Period: 15 October 2026 - 14 November 2026 Option Period: 15 November 2026 - 14 December 2026

1.5 General Information:

1.5.1 Quality Control: The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program (QCP) is the means by which he assures himself that the work complies with the requirement of the contract. The QCP is to be delivered within 30 days after contract award. A copy shall be submitted to the Contracting Officer (KO) and Contracting Officer Representative (COR) within five (5) working days when changes are made thereafter. After acceptance of the quality control plan the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to the Quality Control (QC) system.

1.5.1.1 Inspection and Acceptance Criteria: The COR or technical representative will require up to five

(5) business days from receipt of all deliverables for review and comment/acceptance. Government acceptance will be based upon the deliverables meeting accepted professional standards for technical content, workmanship, and relevance to stated functional task requirements.

1.5.2 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.5.2.1 Identification of Non-Disclosure Requirements: The activities in this PWS will require the contractor to receive Government Furnished Information (GFI), and access data and information proprietary to other contractors or Government agencies and/or of such a nature that its dissemination or use, other than in performance of this PWS, would be averse to the interests of the Government and/or others. The contractor, including contractor personnel, subcontractors, and consultants, will not divulge or release data or information developed or obtained in performance of this PWS except to Government authorized personnel or upon written approval of the CO or COR. The contractor will not use, disclose, or reproduce proprietary data, which bears a restrictive legend, other than as required in the performance of this PWS. The limitations above do not apply to data or information that has been made public by the Government. All products, deliverables and work produced, as well as associated back-up documentation will be considered the property of the Government. The contractors will be expected to sign Non- Disclosure Agreements (NDA) within one (1) business day of onboarding.

1.5.3 Recognized Holidays: The contractor is not required to work on federal holidays. However, if a program occurs over a holiday period, a limited number of personnel may be needed to support a program. Prior coordination shall be made and approved between the COR and KO.

• New Year’s Day, January 1.

• Martin Luther King Jr.’s Birthday, the third Monday in January.

• President’s Day, the third Monday in February.

• Memorial Day, the last Monday in May.

• Juneteenth National Independence Day, June 19.

• Independence Day, July 4.

• Labor Day, the first Monday in September.

• Columbus Day, the second Monday in October.

• Veterans Day, November 11.

• Thanksgiving Day, the fourth Thursday in November.

• Christmas Day, December 25

1.5.4 Hours of Operation: The contractor is responsible for conducting business between the hours of 0900 – 1700 Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

For other than firm fixed price contracts, the contractor will not be reimbursed when the government facility is closed for the above reasons. The contractor shall maintain an adequate workforce at all times for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.5.5 Place of Performance: The work to be performed under this contract will be completed at the contractor’s facilities.

Work that requires Secure Internet Protocol Router (SIPR) access will require the contractor to work at a Government facility. The contractor can complete this work at the DSCA Headquarters (HQ), 201 12th Street South, Suite 300, East Tower Arlington, Virginia 22202 or at DSCA Mechanicsburg, 5450 Carlisle Pike, Bldg. 107N Mechanicsburg, PA 17055. The Government will not pay for contractor travel to Government locations for completing work on SIPR network.

1.5.5.1 Telework: The Government may permit telecommuting (telework) to contractors when determined to be in the best interest of the Government in meeting work requirements (e.g. COOP).

The contractor must identify to the COR any task/work requirements that may be performed at an alternate worksite.

The Individual contractor Personnel shall provide services from their authorized telework worksite location IAW Department of Defense Instructions (DoDI) 1035.01 Telework Policy.

https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/103501p.pdf

1.5.6 Type of Contract: The government will award a Firm-Fixed-Price contract.

1.5.7 Security Requirements: The overall classification of work associated with this PWS is at the SECRET level. The contractor shall have a current facility clearance of SECRET at the time of proposal to work this effort. All personnel assigned to this contract must be U.S. citizens.

1.5.8 Special Qualifications: Within ten (10) business days of award of this contract or ten (10) days of employment, the contractor shall ensure that all contractor employees complete annual Government-furnished training in Information Assurance, Privacy Act, Operational Security and other assigned training required. Any contractor behavior deviating from standards taught in the course shall be grounds for termination of the contract. The contractor must maintain a cyber-threat security awareness certification plan.

The contractor is expected to provide a fully trained workforce to the Government; therefore, personal development training costs and hours are not billable to the Government.

1.5.9 Post Award Contractor/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The COR and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.5.10 Contracting Officer Representative (COR): Refer to DFARS Clause 252.201-7000 “Contracting Officer’s Representative”.

1.5.11 Contract Personnel:

1.5.11.1 Key Personnel: The personnel listed below are considered essential to the work being performed under this contract. Before removing, replacing, or diverting any of the listed or specified personnel or facilities, the contractor shall (1) notify the Contracting Officer reasonably in advance and (2) submit justification (including proposed substitutions) in sufficient detail to permit evaluation of the impact on this contract. The contractor shall make no diversion without the Contracting Officer's written consent.

Please see the below chart for the one (1) key personnel position.

1.5.11.1.1 Key Personnel Minimum Qualifications

SUPPORT TASK POSITION QUALIFICATIONS

PWS: 1.5, 5.1, 5.2,

5.3, 5.4, 5.5

Cybersecurity Engineer

Twelve (12) years of information technology experience.

https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/103501p.pdf

• Ten (10) years Government cybersecurity experience, including security requirements definition, systems analysis, cybersecurity test and evaluation, and scanning

• A four (4) year degree in information technology or related field from an accredited institution

• Identity and Access Management (IAM) Level III Certified (CASP + CE, CCNP Security, CISA, CISSP, GCED, GCIH, CCSP)

• Certified Project Management Professional

(PMP)

PWS: 5.2, 5.3, 5.4, 5.5 Security Architect

Ten (10) years of information technology experience.

• Eight (8) years of experience with technical engineering to include requirement analysis, systems engineering, network/systems administration, and cybersecurity

• A four (4) year degree in information technology or related field from an accredited institution

• Information Assurance System Architects and Engineers (IASAE) Level II Certified

(CASP +CE, CISSP, CSSLP)

1.5.12 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. All contractor personnel will be required to obtain, use, and display a Common Access Card (CAC) throughout the performance of this requirement.

1.5.13 Contractor Travel: N/A

1.5.14 Other Direct Costs: N/A.

1.5.15 Data Rights: Reference FAR 52.227.14 Rights in Data clause.

1.5.16 Organizational Conflict of Interest (OCI): Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent OCIs as defined in FAR Subpart 9.5. The contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.5.17 Phase Out Period: The contractor shall provide a phase-out plan no later than ninety (90) days prior to expiration of this contract. The contractor shall maintain documentation that is assessable to designated government representatives via a web portal or other electronic means as designated by the government.

Prior to the end of the contract, the incumbent contractor shall support a thirty (30) calendar days transition period with the in-coming contractor. The contractor shall overlap with an incoming contractor during transition and will work with Government personnel and the incoming contractor to transfer knowledge, information, and documentation for all projects and tasks related to this contract. The type of information and documentation to be transferred includes, at a minimum:

• Points of Contacts

• Location of technical and project management documentation

• Program data, databases and data management systems

• Status of ongoing technical initiatives and deliverables

• Appropriate contractor-to-contractor coordination to ensure a seamless transition

• Identify schedules, deliverables, and milestones

• Identify actions required of the Government

• Establish and maintain effective communication the incoming contractor/Government personnel for the period of the transition via weekly status meetings

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. BUSINESS DAY. The term business day means Monday through Friday, except the legal public holidays specified in PWS section 1.5.3.

2.1.2. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.3. CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

2.1.4. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S.

Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.6. DELIVERABLE. Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

2.1.7. KEY PERSONNEL. contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS.

When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.8. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.9. QUALITY ASSURANCE. The Government procedures to verify that services being performed by the contractor are performed according to acceptable standards.

2.1.10. QUALITY ASSURANCE SURVIELLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.11. QUALITY CONTROL. All necessary measures taken by the contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.12. SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.2. ACRONYMS:

ACAS Assured Compliance Assessment Solution AECA Arms Export Control Act AFG Above Fiscal Guidance ATO Authorization to Operate AVS Adjudication and Vetting Services CAC Common Access Card CCSP Certified Cloud Security Professional CFR Code of Federal Regulations CIO Chief Information Officer CMRS Continuous Monitoring Scoring COAMS Cyber Operational Attribute Management System COCOM Combatant Commander CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative CSSP Cybersecurity Service Provider CYBR Cybersecurity Branch DATT Denial of Authority to Test DFARS Defense Federal Acquisition Regulation Supplement DOD Department of Defense DODI Department of Defense Instructions DPMS Data Protection Management System DSCA Defense Security Cooperation Agency EADSD Enterprise Application Development and Support Division eMASS Enterprise Mission Assurance Support Service ESS Enterprise Security Services FAA Foreign Assistance Act FAR Federal Acquisition Regulation FCG Foreign Clearance Guide FOIA Freedom of Information Act FISCAM Federal Information System Controls Audit Manual FSO Facility Security Officer GCC Global Combatant Command GFI Government Furnished Information GRC Governance, Risk, and Compliance GUI Graphical User Interface HQ Headquarters IAM Identity and Access Management IASAE Information Assurance System Architects and Engineers IM&T Information Management & Technology IP Internet Protocol IR Incident Response ISCM Information Security Continuous Monitoring ISL Industrial Security Letter ISSE Information Systems Security Engineering ISSM Information Systems Security Manager IT Information Technology ITP Insider Threat Program JFHQ-DODIN Joint Force Headquarters Department of Defense Information Network JTR Joint Travel Regulation

KO Contracting Officer KPI Key Performance Indicators MAC Message Authentication Code NDA Non-Disclosure Agreement NIPSOM National Industrial Security Program Operating Manual OBO Office of Business Operations OCI Organizational Conflict of Interest ODC Other Direct Cost OPSEC Operation Security OSHA Occupational Safety and Health Administration PM Project Manager PMP Project Management Professional POA&M Plan of Action and Milestones POC Point of Contact PPD Policy and Planning Division PPSM Ports, Protocols, and Services Management PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program SC Security Cooperation SIPR Secure Internet Protocol Router SME Subject Matter Expert SO System Owner SOP Standard Operating Procedures TE Technical Exhibit TSD Technology Services Division VAR Visitor Authorization Request WHS Washington Headquarters Services

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1. Services: The Government will provide access to DSCA as required.

3.2. Facilities: The Government will provide the necessary workspace for the contractor staff to provide the support outlined in the PWS to include desk space, telephones, computers, and other items necessary to maintain an office environment when contractor staff are working at a DSCA facility.

3.3. Utilities: The Government will provide all utilities in the facility available for the contractor’s use if the contractor is working at a DSCA facility.

3.4. Equipment: The Government will provide the contractor access to scanners, fax machines, printers, computers, audio visual, and other equipment for when the contractor is working at a DSCA facility.

3.5. Materials: The Government will provide the contractor access to regulations, directives or other policy documents required when the contractor is working at a DSCA facility.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1 General: The contractor shall furnish all supplies, equipment, facilities, and services required to perform work under this contract that are not listed under Section 3 of this PWS.

4.2 Secret Facility Clearance: The individual joint venture entities, Arlo Solutions and Deloitte Consulting, shall possess and maintain a SECRET facility clearance from Defense Counterintelligence and Security Agency (DCSA) at quote submission. The contractor shall hold and maintain the level of facility clearance for the life of the contract. contractor personnel performing work under this contract shall have and maintain a fully adjudicated Secret clearance for the life of the contract. The DD Form 254 is provided as an attachment.

PART 5

SPECIFIC TASKS

5. Specific Tasks:

5.1. Task 1: Basic Services: The contractor shall provide services for Cybersecurity Support services.

These services include services for the Cybersecurity Branch (CYBR) or DSCA in the areas of Governance and Strategy, Cybersecurity Compliance, Enterprise Risk Management (Audit Governance, Risk Assessment, Controls Validation, and Security Software Design and Assessment), Cybersecurity Operations, and Security Cooperation Community Liaison that falls under Governance, Risk, and Compliance (GRC).

5.2. Task 2: Governance and Strategy: The contractor shall Input into the CYBR 5- and 8-year strategy that aligns to DSCA agency mission/strategy, DSCA CIO initiatives, and DOD CIO and Joint Force Headquarters Department of Defense Information Network (JFHQ-DODIN) strategy with anticipation of updates to audit and inspection metrics that CYBR will need to address.

5.2.1 Communications Plan: The contractor shall provide a Communications Plan for Governance and Strategy.

5.2.2 CYBR Five Year Strategy: The contractor reviews the CYBR strategy, planned objectives and current accomplishments of the CYBR Programs to determine if the strategy will help meet DOD CIO and JFHQ-DODIN requirements while supporting the DSCA Mission and protecting agency information.

5.2.3 CYBR Eight Year Vision: The contractor shall work with DSCA CISO to produce a forward-looking strategy and roadmap for the vision of the branch designed to incorporate future technologies and capabilities to move DSCA Cybersecurity Program forward incorporating new technologies and approaches to CYBR Programs for the best protection possible for agency information.

5.2.4 CYBR Ops: The contractor will review the current CYBR Ops Programs to determine compliance with DOD requirements and identify any gaps that should be addressed by CYBR Ops Lead.

5.2.4.1 Cyber Risk Objectives: One to three-year program-based capabilities that CYBR is currently working to accomplish. These objectives are tied to Program Lead Performance Plans and actively tracked in Jira and during regular Branch meetings and in one-on-one team check-ins with CYBR Chief.

5.2.4.2 CYBR Compliance Objectives: One to three-year program-based capabilities that CYBR is currently working to accomplish. These objectives are tied to Program Lead Performance Plans and actively tracked in Jira and during regular Branch meetings and in one-on-one team check-ins with CYBR Chief.

5.2.6 CYBR Contract Deliverables: The contractor shall maintain contact with CYBR Chief and team leads to ensure contract delivery is well tracked and communicated.

5.2.6.1 CYBR Team Performance: The contractor shall provide strategic and programmatic input in order to leverage performance goals to meet stated vision, strategy, and objectives. These efforts are to assist with the task of supporting annual objectives that are developed by CYBR Program Leads and tied to CYBR objectives and strategy for the Branch. These are tracked and discussed regularly with work tracked via Jira.

5.2.6.2 Objectives and Key Results Support: The contractor shall provide input so that CYBR can effectively plan for and address IM&T Objectives and Key Results (OKRs). The OKRs are currently these tracked in the form of program-led objectives and performance plan key elements.

5.2.6.3 CYBR Work Tracking: The contractor will provide a plan for tracking contract staff work on a regular basis as agreed upon by the Contract Project Manager (PM) and CYBR Chief. Tracking will need to be done in ServiceNow which will be provided in the form of something similar to Kanban for near term reporting. Work plan for the life of the contract will also need to be reported as agreed upon by Control PM, CYBR Chief and COR to determine that contract work has been completed.

5.2.7 SCRUM/ Retroactive Process: The contractor shall participate in meetings as needed to support.

Program Lead driven scrum teamwork. CYBR utilizes an Agile approach to major projects within the branch which includes these approaches, reports and deliverables tracked in Jira and Confluence.

5.2.7.1 Lessons Learned Process: The contractor shall provide support and participate in meetings as needed to help deliver lessons learned related to the Agile process.

5.2.7.2 Inspections and Audits Remediation: The contractor shall participate in meetings as needed to support CYBR’s cybersecurity-related inspections, audits, and assessments for DSCA. Gap (vulnerability) remediation at the branch level is handled by the CYBR Chief to address overarching issues identified because of these activities.

5.2.8 CYBR Training: The contractor shall assist with the management of the NINJIO Cybersecurity awareness campaign strategy and delivery of monthly training content.

5.2.9 DoD Requirement Planning: The contractor shall assist with the with input of Government Leads and Chief as new requirements or issues are identified. This includes ensuring DSCA CYBR work aligns with DoD requirements.

5.2.9.1 DODIG Requirement Planning: The contractor shall support audits of systems and networks from the Information System Security Officer (ISSO) perspective providing needed evidence and responding to requests.

5.2.9.2 JFHQ Orders and Metrics: The contractor shall help ensure that JFHQ-DODIN requirements are in alignment with DSCA CYBR work.

5.2.9.3 Voice of CYBR: The contractor shall provide input to the CYBR Communications plan. This expertise will help CYBR deliver messaging that helps protect IT systems and networks, provide awareness of emerging threats, and protect agency staff.

5.2.9.4 CYBR Charter: The contractor shall provide input to CYBR Charter to help ensure the CYBR Charter meetings requirements outlined in the Service Catalogue.

5.2.9.5 External Communications: The contractor shall provide support for external communications from CISO and CYBR. This support will protect DoD Information Network and ensure audit, inspection and assessment requirements are met.

5.2.10 CSWF Requirements and Tracking (OPTIONAL): The contractor shall support the development of a comprehensive CYBR Communications plan to document internal and external requirements.

5.3 Task 3: Cybersecurity Compliance: Tasks in this task area will be completed by ISSO Role. The contractor shall Provide ISSO Support (6 ISSO FTEs) for the 5 IM&T Portfolios in direct support of portfolio Information Systems Security Managers (ISSMs) producing all required DOD compliance documentation for Risk Management Framework (RMF), Audit Response and Remediation, Cyber Task Orders, Required Scorecards, Privacy documentation, and other compliance requirements as communicated and required by DOD and as detailed in the DSCA CYBR Service Catalog.

5.3.1 Support Policy, Process, and Procedure development by drafting and coordinating cybersecurity related documentation to meet required standards, controls, and metrics in support of ISSO role as documented in DOD regulations.

5.3.2 Provide support to assigned portfolio ISSM for all steps of the RMF process (Steps 0-6) required to gain and maintain DOD Information Network (DODIN) and agency commercial network authority to operate. This includes categorization, control selection, implementation, and tailoring support as well as support of assessments from the ISSO role. ISSM and ISSO roles are well defined in DOD policy and vendor is requested to support from the ISSO role which will be assigned to contractor staff. DSCA authorizes systems with traditional assess and authorize, assess only, and continuous authorization to operate (ATO) requirements are defined by DOD. All processes and procedures expected from an ISSO at the assigned system level will need to be supported and many of these are unplanned work communicated by DOD to include Order, operations, Taskers, and similar requests that require an ISSO to use available system package information and access to system/network points of contact (POCs) to respond.

5.3.3 Provide Controls validation support in the form of ISSO and Control Validator staff which are responsible for preparing and validating controls in eMASS packages for assessment and review. Control requirements are well defining so that ISSO and Control Validator know what needs to be produced or gathered for validation and assessment. Control implementation and validation requirements are defined in the DSCA CYBR Service Catalog and DOD Policy. The contractor will provide personal to fill the ISSO and Control Validator roles which involves work in the DOD GRC tool Enterprise Mission Assurance Support Service (eMASS).

5.4 Task 4: IT Enterprise Risk Management Support: Tasks in this Task area will be completed by Security Control Assessor (SCA), Lead Validator, and Controls Validators. The contractor shall support the DSCA CYBR RMF activities in the form of Security Control Assessor Support, Controls Validation Support (RMF, IT, and Federal Information System Controls Audit Manual (FISCAM), Support of the Cybersecurity DevSecOps Pipeline as related to the CYBR responsibilities, and the activities detailed in the Service Catalog.

5.5 Task 5: Cybersecurity Operations: Tasks in this task area will be completed by Information Security Continuous Monitoring (ISCM) role, Incident Response (IR) role, Information Systems Security Engineering (ISSE) role, and Watch Officer role. The contractor shall support the Cybersecurity Operations Team with Information Systems Continuous monitoring support, Cybersecurity Service Provider (CSSP) Alignment Support, Incident Response Support, Watch Officer Support and Branch Communications planning both internal and external to DOD and other entities, as well as the duties outlined in the Service Catalogue.

5.5.1 Incident Response Program: The contractor shall deliver an updated Incident Response program policy, processes and procedures as determined by Vendor Contract PM and CYBR Ops Lead.

5.5.2 Scanning: The contractor shall provide support to the Cyber Operations Lead in maintaining required configurations for CSSP provider and assist with performance of daily and ad hoc/on-demand vulnerability scans, monthly audit scans, and monthly discovery scans.

5.5.3 Weekly Compliance Reports: The contractor shall support the Cyber Operations Lead in maintaining required configurations for CSSP provider to help with weekly vulnerability compliance reporting is provided to ISSMs.

5.5.4 Scan and Policy Management: The contractor shall support the Cyber Operations Lead in maintaining required configurations for CSSP provider to review as part of efforts to review and adjust assets, subnets, credentials, and policies necessarily to properly manage C5ISR provided Assured Compliance Assessment Solution (ACAS) solutions.

5.5.5 The contractor will assist the Cybersecurity Operations Lead in tracking and configuration compliance of Enterprise Security Services (ESS) Suite as it relates to the duties of CYBR which is responsible for compliance with RMF, ATO, and Inspection compliance and readiness. CYBR works with TSD for these requirements who completes the needed hands on work. Detailed support needed is in the CYBR Service Catalog.

5.5.6 SonarQube Support in the form of KPI Implementation: The contractor shall support the maintenance of an accurate Key Performance Indicators (KPI) list for the implementation and modification of KPI’s within SonarQube. Security Waivers: The contractor shall support the maintenance of completed security waiver form in coordination with EADSD and ISSM (PMO). These will be used for processing waivers/exceptions to standardize KPI’s within SonarQube.

5.5.7 Prisma Cloud Support in the form of : Working with TSD to implement effective Scanning, Cyber Operational Attribute Management System (COAMS) System Registration, and Continuous Monitoring Scoring (CMRS) Tagging.

5.5.7.1 COAMS System Registration: The contractor shall support the maintenance of Proper data protection management system (DPMS) registration (unsure external entity), standardized naming convention for tags (unsure external entity as part of the management of system level COAMS tags.

5.5.7.2 CRMS Tagging: The contractor shall support the maintenance of Complete asset and internet protocol (IP) list (TSD), Creation of configuration file based on criteria provided by ISSM (Cyber Ops) for the deployment of Denial of Authority to Test (DATT) client and applicable configuration files to ensure CMRS compliance.

5.5.8 PPS Record Addition: The contractor shall provide maintenance of a completed Ports, Protocols, and Services Management (PPSM) bulk upload spreadsheet (ISSM) which includes system name, key system personnel, ATO/Authorization Termination Date (ATD) information, application name, service name, protocol, port, source and destination IP, host name, boundary traversal information. This will be used for the completion of PPSM documentation necessary to implement standard/permanent PPSM record changes.

5.5.8.1 PPSM Record Removal: The contractor shall support the maintenance a completed PPSM bulk upload spreadsheet (ISSM) which includes system name, key system personnel, ATO/ATD information, application name, service name, protocol, port, source and destination IP, host name, boundary traversal information, which will help with the completion of PPSM documentation necessary to remove standard/permanent PPSM record changes.

5.5.8.2 Emergency Request: The contractor shall support the maintenance of a completed PPSM emergency request form (ISSM): all record creation, configuration description, implementation justification, Plan of Action and Milestones (POA&M) strategy, migration plan, expiration timeframe, AO/AODR signature for the completion of PPSM documentation necessary to temporarily implement emergency changes to PPSM records.

5.5.8.3 Exception Request: The contractor shall support the maintenance of a completed PPSM Exceptions request form (ISSM): all record creation, configuration description, implementation justification, POA&M strategy, migration plan, expiration timeframe. This will assist with the completion of PPSM documentation necessary to temporarily implement an exception to PPSM records.

5.5.8.4 PPSM Records: The contractor shall support the maintenance of concurrence from ISSMs on accuracy of reports provided, which will help with efforts to review and report current PPSM records entries to ISSMs.

5.5.9 Addition of DoD Allow List Entry: The contractor shall support the maintenance system name, key system personnel, ATO/ATD information, application name, service name, protocol, port, source and destination IP, host name, Message Authentication (MAC) level, Certified Cloud Security Professional (CCSP), data sensitivity, connection type, SO signature, ISSM signature. This will help with the completion of DoD Allow Listing paperwork necessary to implement standard/permanent DOD Allow Listing of sites/URLs.

5.5.9.1 Removal of DoD Allow List Entry: The contractor shall support the maintenance of the system name, key system personnel, ATO/ATD information, application name, service name, protocol, port, source and destination IP, host name, Message Authentication (MA) Code level, CCSP, data sensitivity, connection type, System Owner (SO) signature, ISSM signature for the completion of DoD Allow Listing paperwork necessary to remove standard/permanent DOD Allow Listing of sites/URLs.

5.5.9.2 DoD Allow List Records: The contractor supports the maintenance of and confirm accuracy the current DoD allow list record entries in CISO.

5.5.10: Research and Identify: The contractor shall support the maintenance of organizational mandate info, initiative name/requirements, request description, and goal description (IM&T). This will help for the Solutions oriented research of organizationally defined information security requirements.

5.5.11: Detection and Analysis: The contractor shall support the maintenance and configuration needed to maintain accurate ingestion of logs from all assets (TSD), SME POC (C5ISR).

5.5.11.1 Reporting: The contractor shall provide summaries of event/incident to include time of event/incident, anomalous activity identified, asset names and IPs, affected users, POC for outreach/additional actions, affected system name for required incident reports.

5.5.11.2 Investigation: The contractor shall complete Cybersecurity Incident Reporting Form (reportee), dependent upon type of event or incident additional inputs may be required such as personnel logs, system logs, event logs, accurate software and hardware inventory list (TSD, DISA, technical teams for impacted system) for the detection and analysis of cybersecurity events and incidents.

5.5.11.3 Triage Coordination: The contractor shall support accurate IR POC list, accurate hardware/software and IP inventory, accurate summary of event/incident. These will document efforts involved in mitigating cybersecurity related events/incidents that occur within the enterprise.

5.5.11.4 Asset Utilization Reporting: The contractor shall support the generation of performance monitoring reports to monitor asset availability.

5.5.11.5 Security Posture/Health Reviews: The contractor shall support the Generation of system health and security posture reports for system owners and ISSMs.

5.5.11.6 Trend Analysis: The contractor shall support accurate hardware and software inventory (TSD), accurate ingestion of logs from all assets (TSD), accurate system performance and security posture baselines, specified areas of focus/detail.

5.5.12 VDP Support and Coordination: The contractor shall support migration information provided by affected system ISSM and report vulnerability to appropriate system ISSMs/POCs.

5.5.12.1 Reporting: The contractor shall support the reporting to outside agencies to include but not limited to JFHQ, battle stations, external leadership, and other DOD Agencies.

5.5.12.2 POA&M Coordination: The contractor shall support the correlated agency level POA&Ms (PM0/ISSMs) with the coordination of POAMs from DSCA to outside entities.

5.5.12.3 SIGACT Reports: The contractor shall help complete the Cybersecurity Incident Reporting Form (reportee), dependent upon type of event or incident additional inputs may be required such as personnel logs, system logs, event logs, accurate software and hardware inventory list (TSD, DISA, technical teams for impacted system).

5.5.13 Cybersecurity Architecture Support (OPTIONAL): The contractor shall provide cybersecurity architecture advisory services to ensure that the stakeholder security requirements necessary to protect the organization’s mission and business processes are adequately addressed in all aspects of enterprise architecture including reference models, segment and solution architectures, and the resulting systems supporting those missions and business processes.

5.5.13.1 System and Network Design Support (OPTIONAL): The contractor shall provide support the develop/integrate cybersecurity designs for systems and networks with multilevel security requirements or requirements for the processing of multiple classification levels of data primarily applicable to government organizations (e.g., UNCLASSIFIED, SECRET, and TOP SECRET).

5.5.13.2 Acquisition Lifecycle Support (OPTIONAL): The contractor shall support documenting and addressing the organization's information security, cybersecurity architecture, and systems security engineering requirements throughout the acquisition life cycle.

5.5.13.3 Secure Configuration Management Support: The contractor shall support the change Management Program as it relates to assigned roles to secure configuration of management processes.

5.5.13.4 Cybersecurity Enterprise Alignment: The contractor shall support the CYBR Chief with completion of ensuring that acquired or developed system(s) and architecture(s) are consistent with organization's cybersecurity architecture guidelines.

5.5.13.5 Risk Management Program: (OPTIONAL): The contractor shall provide support to the CYBR Chief with identifying and prioritizing critical business functions in collaboration with organizational stakeholders.

5.5.13.6 Cybersecurity Architecture Enterprise Risk Management Program (OPTIONAL): The contractor shall support performing security reviews, identify gaps in security architecture, and develop a security risk management plan.

5.5.13.7 (OPTIONAL): Cybersecurity in Acquisitions Risk Management Program: The contractor shall support the definition and documentation of how the implementation of a new system or new interfaces between systems impacts the security posture of the current environment.

5.5.13.8 Cybersecurity Review of Planned Acquisitions Risk Management Program (OPTIONAL): The contractor shall support efforts to evaluate security architectures and designs to determine the adequacy of security design and architecture proposed or provided in response to requirements contained in acquisition documents.

5.5.13.9 Cybersecurity Enterprise Risk Management Program: The contractor shall support the efforts to determine the protection needs (i.e., security controls) for the information system(s) and network(s) and document appropriately.

PART 6

APPLICABLE PUBLICATIONS

6. APPLICABLE PUBLICATIONS (CURRENT EDITIONS)

6.1. The Contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures:

• https://www.whs.mil/COVID-19

• https://comptroller.defense.gov/Portals/45/documents/fmr/current/10/10_12.pdf

• https://www.ecfr.gov/current/title-5/chapter-XVI/subchapter-B/part-2635/subpart-H/section-

2635.807

• https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-73/subpart-G/section-73.735-

• https://www.acquisition.gov/far/part-35 https://www.ecfr.gov/current/title-5/chapter-XVI/subchapter-B/part-2635/subpart-H/section-https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-73/subpart-G/section-73.735-https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-73/subpart-G/section-73.735-

PART 7

ATTACHMENT/TECHNICAL EXHIBIT LISTING

7. Attachment/Technical Exhibit List:

7.1 Attachment 1/Technical Exhibit 1 – Performance Requirements Summary

7.2 Attachment 2/Technical Exhibit 2 – Deliverables Schedule

7.3 Attachment 3/Technical Exhibit 3 – Estimated Workload Data

7.4 Attachment 4/Technical Exhibit 4 – Projected Level of Effort

7.5 Attachment 5/Technical Exhibit 5 – Security Requirements

TECHNICAL EXHIBIT 1

Performance Requirements Summary

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success. Offeror will propose thresholds for measurements of performance as part of the RFP response.

Performance Objective

(The Service required usually a shall statement)

Performance

Standards

Performance Threshold

KPI

Method of

Surveillance

PRS# 1. Provide support personnel to meet PWS requirements.

All contractor personnel possess the skills needed to perform the required tasks as specified in the

PWS.

All contractor personnel possess the needed skills needed to perform services for this PWS.

The contractor's work products are suitable to support the full range of analysis as specified in the PWS.

The contractor's personnel are qualified and proficient with information systems and information technology.

% of personnel meeting stated qualifications.

Excellent:

- 100% of Key Pers

(KP)

- 95% of non KP Very Good:

- 100% of KP -90% of non KP

Satisfactory:

- 100% of KP

- 80% of non KP

100% Inspection by the Government

PRS#2 Submit a weekly status report.

The Status Report accurately reflects progress, status;

proactively identifies and addresses any problems or issues encountered;

and recommended resolutions are feasible and likely to succeed in resolving issues.

Report is submitted on Thursdays (Weekly).

Reports are grammatically correct and professional in appearance.

Weekly reports are submitted on time and with minimal errors.

Excellent: 100% submitted on time and contain minimal errors

Very Good: 95% submitted on time and contain no more than 5 errors

Satisfactory: 90% submitted on time and contain no more than 10 errors

PRS#3.

Timeliness and quality of work.

The contractor shall ensure its personnel accomplish the assigned tasks within agreed upon schedules, and at an acceptable level of quality.

Key deliverables as identified in deliverable schedules are submitted on time and with minimal errors.

Excellent: 95% submitted on time and contain minimal errors

Very Good: 90% submitted on time and contain no more than 5 errors

Satisfactory: 80% submitted on time and contain no more than 10 errors

PRS#4.

Retention of Key Personnel The contractor shall ensure that key personnel are onboarded and retained as identified in the staffing plan.

The contractor ensures that key personnel are available throughout the period of performance to proactively interact with clients and complete the requirements specified in the PWS.

Key Personnel vacancies are filled with qualified personnel within ten (10) of fewer business days of vacancy unless approved in writing or otherwise directed in advance by the KO AND there is no mission impact due to position vacancies or unqualified

Excellent: 2 business days Very Good: 5 business days

Satisfactory: 10 business days.

100% Inspection by the

Government

TECHNICAL EXHIBIT 2

DELIVERABLES SCHEDULE

PWS

SECTIO

N

DELIVERABLE TITLE FREQUENCY # OF

COPIES

MEDIUM/

FORMAT

SUBMIT TO

1.5.1 Quality Control Plan 30 days after award 3 MS Word COR and KO

1.5.8 Annual Training 10…