ASH-IV SIR SEC C_POSTED.pdf

SCREENING INFORMATION REQUEST

NUMBER 693KA9-24-R-00004

C-1

SECTION C

DESCRIPTION/SPECIFICATION/STATEMENT OF WORK

THE OFFICE OF SECURITY AND HAZARDOUS MATERIALS SAFETY (ASH)

C-2

TABLE OF CONTENTS

C.1 Definition of Need C.2 Purpose ………………………………………………………………………………………………………………………………………………. 3 C.3 Relevant Orders, Notices, and Directives C.4 Scope of Work C.5 Requirements C.6 Applications………………………………………………………..………………………………..…………………………………….……..18

C-3

PART I - SECTION C

STATEMENT OF WORK

C.1 DEFINITION OF NEED

The Office of Security and Hazardous Materials Safety (ASH) provides services to ensure and promote aviation safety in support of national security and the national aerospace system (NAS). The ASH vision is to be recognized as the global leader having maximum impact on enhancing national security and aviation safety. ASH responsibilities include ensuring the FAA's critical infrastructure protection, emergency operations, contingency planning, and the safe transportation of hazardous materials in air commerce. The protection of our critical infrastructure is a national and homeland security concern which continues to receive a high level of attention. In recognition of the impact that the NAS has on our country's transportation infrastructure, ASH develops and implements policy to protect our employees, contractors, facilities, and assets.

C.2 PURPOSE

ASH has the primary responsibility for security and critical-infrastructure protection, emergency operations, contingency planning, intelligence activities, and the safe transportation of hazardous materials in air commerce. ASH has seven major program areas and staff offices that assist in carrying out these functions, which are vital to both its mission and the FAA's mission. These are the Office of National Security Programs & Incident Response (AXE); the Office of Infrastructure Protection (AXF); the Office of Hazardous Materials Safety (AXH); the Office of Investigations and Professional Responsibility (AXI); the Office of Business & Mission Services (AXM); the Office of Personnel Security (AXP); and the Office of Unmanned Aircraft Systems (UAS) and Emerging Entrants Security (AXU).

This contract will provide program support services for all ASH offices.

The FAA Information & Technology Services (AIT) organization provides AIT core services which include FAA Email, internet access, helpdesk support, software licenses, onboarding, printing capabilities, and information security. These AIT services therefore will not be covered under this ASH Program Support Services contract.

C.3 RELEVANT ORDERS, NOTICES, AND DIRECTIVES

The current versions of the following documents are identified as relevant information to the mission of the ASH Program office:

• FAA Order 1100.2, Organization – FAA Headquarters

• FAA Order 1270.1A, Freedom of Information Act (FOIA) Program

• FAA Order 1320.1E, FAA Directives Management

• FAA Order 1350.4B, Records Management

• FAA Order 1370.121B - FAA Information Security and Privacy Policy

• FAA Order 1600.1, Personnel Security Program

• FAA Order 1600.2, Safeguarding Classified National Security Information

• FAA Order 1600.6, Facility Security Policy

• FAA Order 1600.8, Communications Security (COMSEC)

• FAA Order 1600.12, Technical Surveillance Countermeasures Program

• FAA Order 1600.24, Listening-in To or Recording Conversations on Telephone or

Telecommunications Systems

• FAA Order 1600.25, FAA Official Credentials

• FAA Order 1600.55, Reporting Threats Against the President, Other Government Officials, and

Visiting Dignitaries

• FAA Order 1600.61, International Travel Security Briefing and Contact Reporting Requirements for

FAA Employees and Contractors

• FAA Order 1600.69, FAA Facility Security Management Program

• FAA Order 1600.71, Civil Aviation Security Special Agent Credentials and Shield

• FAA Order 1600.72, Contractor and Industrial Security Program

• FAA Order 1600.75, Protecting Sensitive Unclassified Information (SUI)

• FAA Order 1600.78, Personal Identity Verification (PIV) Card and Other Identification (ID) Cards

• FAA Order 1700.6D, FAA Branding Policy, Use of the FAA Logo, FAA Signature and DOT Seal

C-4

• FAA Order 4600.27C, Personal Property Management

• FAA Order 4665.4A, Federal Aviation Administration (FAA) Administrative and Technical Space

Standards

• FAA Order 1100.1C, FAA Organization – Policies and Standards

• FAA Order 2150.3, FAA Compliance and Enforcement Program

• FAA Order 8000.373, FAA Compliance Program

• FAA Order 8000.72, FAA Integrated Oversight Philosophy

• FAA Order 1600.83A, Law Enforcement Assistance Program Handbook

• OMB memo, NIST Publications, and Presidential Directives related to ASH security mission and business functions

• FIPS 201

C.4 SCOPE OF WORK

The scope of this contract is to provide a variety of operational and administrative support services to ASH. The contractor must provide support services, as ordered, primarily in seven functional areas

1. Executive Support Services,

2. Infrastructure Protection Program Support Services,

3. Business and Mission and Program Support Services,

4. Unmanned Aircraft Systems (UAS) Program Management Support Services,

5. Personnel Security and ID Media Program Support Services,

6. Security Applications Support Services,

7. Security Solutions Development Support Services,

8. Transition Support Services

C.5 REQUIREMENTS

The contractor must provide executive, infrastructure protection, business and mission, program management, personnel security and ID media, security applications and solutions, and transition services, as ordered, in the following functional areas. The contractor must also provide administrative services that include Monthly Status Reports (MSR) including work performed, milestones reached, problems encountered, and projected work. The contractor must provide personnel with appropriate and relevant knowledge and skills, including ongoing relevant contractor-provided training to maintain currency across its workforce, to successfully complete all required tasks. Appropriate and relevant knowledge includes but is not limited to knowledge of all technical and security governing directives; of security concepts, principles, and practices, including but not limited to program planning and security-classification methods; and knowledge of FAA management systems such as DELPHI, PRISM, REGIS, and US Bank. Appropriate and relevant skills include but are not limited to analysis of business processes and intra-office communication. The personnel must, as ordered, support more than one functional area.

C.5.1 EXECUTIVE SUPPORT SERVICES

The contractor must support office administration and collect, analyze, interpret, prepare, correlate, and disseminate data and information. This support includes but is not necessarily limited to the following:

Support ASH Front Office in the following ways:

• Schedule meetings and conferences and support completion of relevant logistical, contractual, and travel arrangements.

• Maintain appointment schedules for ASH executives.

• Training support provided to ASH Leadership team and/or groups designated by ASH-1.

• Receive visitors at reception desk.

• Support the FAA ASH FOIA management program and facilitate an FAA response to a FOIA request by performing activities such as receiving and documenting a new request, obtaining records, reviewing records for responsiveness, perform an initial review with proposed redactions, draft response letters, prepare the FOIA worksheet/checklist. The contractor shall draft and maintain the FOIA Standard Operating Procedure (SOP).

C-5

The following support is required to achieve and maintain the ASH Strategic Management Program.

The work includes:

• Conduct research and collect data by applying complex quantitative and qualitative analyses to identify business challenges/questions and offer prioritized solutions.

• Assist with development of the long-term strategic goals and objectives for the ASH organization and its six program offices. Successful performance necessarily includes recommending strategic alternatives and co-creating and maintaining short term operational business plans.

• Conduct regular audits of performance data to support the agency and maintain performance reporting standards and requirements ASH-wide.

• Serve as a Facilitator when assigned to workgroup discussions on strategic matters.

• Co-create and continuously monitor the Program Management Maturity Model (PM3) framework for ASH.

• Participate in developing lifecycle processes to include, but not limited to: requirements gathering, specifications and design development, data model reviews, testing and implementation of assigned data projects.

• Build and maintain communication tools that illustrate ASH strategic efforts and standardize measures across the ASH organization.

• Create, format and publish information to our internal stakeholders and SharePoint sites as an authority on knowledge management practices.

• Maintain an awareness and understanding of data analytic methodologies, trends, and vendor product offerings as a member of several Communities of Practice.

• Support development and publication of management-policy documents to improve business processes and communication within ASH and between ASH and other organizations.

• Support ASH in developing reports, including, but not limited to, business plans, work plans, emergency response plans, and accomplishment documents.

The contractor may be required to support any program deemed critical or significant by ASH-1/2 that affects the safety or security of the National Aerospace System. This may require subject matter expertise in one or more ASH major program areas and staff offices that assist in carrying out these functions, which are vital to both its mission and the FAA's mission. This support may include:

• Participate in both internal and external interagency policy discussions pertaining to any ASH security program, to include but not limited to:

o Integration of unmanned aircraft within the NAS, o Implementation of technology to detect and defend critical aviation infrastructure within the NAS, o Interagency discussions involving review and validation of technology to defeat errant and hostile UAS operations, o Interagency discussions involving development of rules of use for UAS technology.

• Directly support ASH activities by teaming with other FAA, DOT or interagency partners to account for changes in threats in the aviation domain. This may include participating in activities involved in updates to the National Strategy for Aviation Security and its subordinate plans, as well as any other national strategy/plan with an intersection to Aviation Security.

• Build and maintain liaison relationships within FAA lines of business DOT, along with counterparts in other national level agencies, including those in the Intelligence Community (IC), Department of Defense (DOD), Department of Justice (DOJ), Department of Homeland Security (DHS), as well as any other identified Departments/Agencies involved in Aviation safety and security.

• Work independently, as well as participate in various team environments. Perform daily interaction and share information, participate in daily interagency teleconferences, coordinate via secure video teleconferencing systems, and participate in working groups as needed.

• Support the FAA subject matter expert and/or central POC for assigned security program, threat assessment or response. Facilitate exchange of information within ASH, and respond to queries from other FAA offices, DOT modes, and/or other agencies. Provide relevant security data and analysis relating to activity in the NAS to those stakeholders in support of interoffice or interagency situational awareness and unified incident response.

• Support ASH organizational assessments that both review organizational needs and shape the organizational direction across functional areas. Examples of assessments previously conducted include Active Shooter for AXF; FAA Reauthorization Section 552 Assessment for AXF; Fingerprints Transmission Assessment for AXP; WOCC Program Assessment for AXE; Organizational

C-6

Improvement Assessment for ASH-4; Cloud and CRM Technology Assessment for AXM; and Strategic Assessment of ASH Mission and Priorities for 5 Years. During performance period, ASH- 1/2 may require any special, ad-hoc assessment across any ASH security program area(s) to address an emerging mission need or improve any operations or functions.

C.5.2 INFRASTRUCTURE PROTECTION PROGRAM SUPPORT SERVICES

As ordered, the contractor must provide support in all areas of security. This support includes but is not necessarily limited to the following:

5.2.1. General Infrastructure Protection Program Support:

• Maintain a library of current Executive Orders, Federal Directives, instructions, regulations, and official correspondence relating to the security of FAA programs, facilities, and personnel; and provide materials from the library upon request.

• Compile data and prepare analytical reports regarding program activities.

• Maintain a library of data and reports regarding division programs and activities, including but not limited to incoming foreign visitors to FAA facilities; suspicious-contact reports; and inquiries and incident reports regarding possible or actual unauthorized access, loss, or compromise of classified information.

• Support the processes of strategic planning and budget-submission preparation.

• Support the development, coordination, and delivery of ASH-approved security-awareness and education products and education courses, as directed.

• Report all suspected security violations, including suspected unauthorized access and other threats to safeguarding CNSI/SUI/CUI.

• Support ASH in conducting security-assistance visits to other offices. Support random security evaluations for compliance with security policies.

• With ASH oversight, provide comprehensive, risk-based technical-security advice, guidance, and general security support to program offices and contractor-facility security offices.

• Prepare written correspondence, including but not limited to facility file reports, approvals, status and technical briefs, and inspections reports, and maintain a database of such correspondence.

• Provide technical support to projects in other areas such as training, logistics, and acquisition.

• Support ASH in developing and monitoring Program tasks and schedules.

• Review, analyze, and propose resolutions of complex security problems for ASH programs.

• Support the provision of security program-policy guidance, oversight, and evaluations.

5.2.2. Facility Security Program:

• Support the Active Shooter Program, including but not limited to planning, analysis, development, implementation, operations, training, documentation, and administration. May require coordination of active shooter exercise(s) with FAA offices nationwide.

• Maintain electronic records of approved/accredited areas and oversight of the Facility Security Management Program (FSMP) as well as all administrative information regarding national reporting requirements for programs.

• Provide coordination and operational and administrative support for new security measures initiated for FAA staffed facilities.

• Provide coordination and operational and administrative support for new resiliency measures initiated for FAA critical NAS operational facilities.

5.2.3. Information Safeguards (INFOSEC) and Contractor and Industrial Security Programs:

• Support the development of security measures for classifying and safeguarding classified information.

• Support safeguarding and destruction services and physical-security-equipment upgrades and repairs.

• Maintain electronic records of approved and accredited areas and oversight of program areas

(Classified National Security Information, Sensitive Unclassified Information, and Controlled Unclassified Information (CNSI/SUI/CUI), etc.) as well as all administrative information regarding national reporting requirements for programs.

C-7

• Support the reduction of unnecessary classified holdings as appropriate, with record-specific ASH approval, by destroying or retiring unneeded records.

• Support the development of procedures for and oversight of visits involving access to classified information.

• Assess the physical security of Secure Open Storage Areas and Secure Office Environments, recommend for or against approval or accreditation based on ASH-provided requirements, and document any required security enhancements.

C.5.3 BUSINESS AND MISSION PROGRAM SUPPORT SERVICES

5.3.1. Inventory and Property Management Support

As ordered, the contractor must support ASH program management, including logistics and property management, using the FAA Real Estate and Asset Management Enterprise System (FRAMES) methods and guidelines. This support includes but is not necessarily limited to the support of inventory planning, tracking, analysis, maintenance, training, documentation, and administration for all accountable property. Perform some functions of Property Delegate. Dispose of property in accordance with FAA Order 4600/27C.

5.3.2. Financial-Management Services Support

The contractor supports ASH via program, contract, and financial management services support;

program planning; scheduling; financial tracking; budget formulation; budget execution; business management; contracts administration; reimbursable support; and logistics. The contractor shall support the following functions:

• Support data analytics for budget views.

• Assist in producing Financial Data updates that involve analysis of data (not simply raw data) to report to Senior ASH Management.

• Create products that support analyzing labor efforts and assist in shaping of staffing decisions;

and

• Support government purchasing by assisting approved government credit card holders in their financial decisions and procurements.

5.3.3. Purchasing Services Support

The contractor must procure goods and services under this contract as directed by the CO. All purchases must be made only following receipt of written CO approval. These purchases may include but are not necessarily limited to the following:

• COTS software, customized-software-development services, and other integration services;

• Hardware, e.g., servers, firewalls, routers, storage devices, and other specialized devices;

• PIV cards and services, card printers, cameras, badge holders, and lanyards;

• PKI digital certificates installed on PIV cards;

• Fingerprint readers and systems;

• Facial-recognition systems and equipment;

• Tri-bureau credit reports;

• Physical-access systems and equipment;

• Security-risk-management systems;

• Fingerprinting services;

• Training services for ASH Leadership team and/or groups designated by ASH-1; and

• Any third-party professional services needed to support items outlined in Section C.4

C-8

The contractor must document and track the purchases made by itself and by ASH, including but not limited to purchases via purchase cards, the SAVES contract, purchase orders, FAA strategic-source vehicles, other mandatory sources, and other contracts, to support coordination. The contractor must also support data entry, tracking, and coordination via PRISM, DELPHI, REGIS, and other FAA financial and purchasing systems.

5.3.4. Workforce Services Support

The contractor shall support the ASH AXM Workforce Services Division to deliver comprehensive workforce service programs for the ASH organization. Support is generally required for project management, program management, as well as development of policy and guidance, to include technical writing.

Support services shall be provided to ASH, with certain elements necessarily supporting at the Agency level. The services shall cover the following functional areas:

• ASH Business Plan o Develop, track and maintain targets and milestones;

o Draft instructional guidance, standard operating procedures (SOPs), track and maintain timelines, and create other technical documentation as needed;

o Analyze data and create reports for senior leadership;

o Coordinate with different divisions within ASH to consolidate and track their Business

Plan targets and non-Business Plan projects;

o Initiate and monitor change requests;

o Attend meetings to align ASH initiatives with DOT and FAA strategic goals.

• Assist in development of the Staffing Dashboard;

• Serve as lead focal point for AXM-300 SharePoint site;

• Telework o Gather data on teleworking to support operations using proven techniques and approved methods.

• Length of Service o Act as focal point between ASH and Agency Human Resources to collect, review and share data with and between Program Offices;

o Print, prepare and distribute certificates.

• Retirement o Act as focal point between ASH and DOT o Work closely with Administrative Officers, Managers or Directors to initiate and complete retirement devices (e.g., retirement plaques, shadow boxes, crystals, et. al.)

Complete appropriate retirement paperwork for graphics support;

Collect required signatures for approval;

Coordinate closely with AXM-100 budget team;

Collaborate with DOT printer manager to meet requirements and timelines;

Deliver device(s) to the appropriate ASH Program Office in a timely manner;

Maintain tracking database in SharePoint and close out all actions with AXM-

100 budget team.

• Technical Documentation o Develop and draft policy, implement guidance and SOPs for the AXM Program Office o Respond to and support higher management and Subject Matter Experts’ requests to draft technical documents;

o Review and edit various technical documents as requested;

o Research, draft, publish upon approval, and maintain documented processes, policy and other related documents.

• Other related service support duties o Provide administrative support to ensure efficient operations within the AXM-300 Program Office;

o Manage office by assisting leadership with daily operations, coordinating and establishing meetings, answering telephones, greeting visitors, distributing incoming and outgoing mail;

o Support managers and employees in organization- and communications-related tasks.

C-9

5.3.5. Learning and Development Support

The contractor must provide training design, development, and administration services to support the ASH Learning and Talent Development Division. The contractor provides coordination and support for employee external training requests, training registrations/enrollments in the agency Learning Management System, as well as running of training reports and analysis of report data. The contractor engages with external training vendors, supporting scheduling, enrollments, recording of training completions, and general coordination of employee training.

The following Training Support Services shall be provided:

• Assist in training administration and coordination functions;

• Support the Training Needs Assessment process and assist with ASH’s full utilization of the agency’s Electronic Learning Management System (eLMS);

• Assign training within the eLMS system;

• Give completion credit in eLMS system when individuals complete (pass) training courses;

• Manage various types of training related requirements, such as analyzing raw data and providing data analysis to various levels of management within ASH;

• Training support provided to ASH Leadership team and/or groups designated by ASH-1;

• Support training coordinators, managers, and others involved with training who are within the various ASH program offices in ways such as o Enrolling individuals into training courses;

o Assigning online classes;

o Working with employees and managers to coordinate training that might be provided by external vendors;

o Researching and drafting ASH-wide communications that relate to training; and o Supporting the local training approval process as necessary.

• Use internal SharePoint-based tools to track requests and training;

• Coordinate with the Federal Law Enforcement Center to support training requests, requirements, and enrollments;

• Support anticipated assignments in the following manner o Perform instructional design, as well as actual design and development of training programs, whether instructor-led or thru eLMS;

o Design and draft course materials;

o Develop training material, such as instructor guidebooks and student guidebooks; and o Support instructional technology, such as creating online courses.

• Facilitate the annual Training Needs Assessment to include the annual call for training requirements, utilizing the SharePoint tool and other FAA resources; and

• Support converting in-person instruction to virtual offerings, including designing and developing any training portions that must be covered differently due to use of a virtual training environment.

5.3.6. Documentation

The contractor must create and maintain documentation on application-support procedures, call-resolution procedures, call-escalation procedures, standard operating procedures, and reporting procedures for ASH applications and classified systems. The contractor must submit all documentation in an editable, Microsoft Office-compatible format. The contractor must update all documentation after all major system changes or every two months, whichever occurs sooner.

5.3.7. Multi-media Support

The contractor must provide a range of multi-media support services including graphics, banners, posters, presentation materials/briefings (with integrated graphics, audio & video), and transcription services. Services may need to be optimized for print media and digital media as appropriate.

• Design, organize, format, and track web content and associated files, including but not limited to style guides and technical documentation that make data available to end users;

• Design web content and documentation to give presentations to clients;

C-10

• In collaboration with web developers and requirements analysts, create custom banner graphics, web buttons, widget interfaces, forms, templates and other design elements used throughout the ASH Portals web site; and

• Support the development of procedures, policies, and guidelines to accommodate the addition of new materials, information, and resources on the ASH Portals web site and sub-sites.

• Record, edit, format and publish video content for ASH executives and programs, in accordance with AOC guidance and directives;

• Provide digital marketing/communication resources

• Provide graphic support services to ASH workgroups and ASH programs

5.3.8. Mobility Services Support

The contractor must:

• Support the coordination of purchases and activations of wireless devices (including but not necessarily limited to cell phones, iPads, and air cards) for users within ASH.

• Support coordination between ASH and the National Wireless Program Office (NWPO) for new activations, cancellations, feature changes, and deactivations.

• Support coordination between ASH, NWPO and AIT to connect iPhones and iPads with electronic mail (e-mail) and device management products.

• Coordinate with ASH Property Delegates and Custodians to add or remove wireless devices for ASH offices.

5.3.9. Policy Support

The contractor must support all security program areas within ASH in providing program-policy guidance, oversight, and evaluations. This support includes but is not necessarily limited to program planning, administrative support, data entry, statistical reporting, accounting reports, business-plan support, editing, and technical writing.

5.3.10. Organizational Effectiveness Support and other Mission Services Support

Additional ASH supporting activities include but are not limited to:

• Assisting with elements of strategic communication, informed by such activities as o Results of formal exit interviews;

o Results of formal retention interviews (e.g., what motivates an employee to remain in

FAA ASH);

o Developing and drafting workforce information articles for publication, such as

“employee spotlight” and “functional perspective” articles – generally at a rate of one article per month o Results of OPM FedView Surveys. Contractor personnel are expected to coordinate activities such as analyzing results, developing action plans, and following up on plans that FAA ASH implements as a result of these surveys.

o Supporting the Employee Advisory Council and any such similar organizations that are designed to provide enhanced support to the FAA ASH workforce.

• Assisting with engagement and outreach activities for the benefit and support of the FAA employee workforce.

• Assist with engaging on Leadership Outlook. This includes support activity for ASH-1/2, to provide assistance on realizing the ASH Strategic Direction

• Assist both ASH and AXE on the FAA-level Incident Management Team.

• Support organizational planning and resource utilization to improve organizational structures, management policies, and work distribution.

C-11

• Analyze and report on matters affecting the efficiency of ASH, including but not limited to analysis of national databases, evaluation of existing programs and policies, and identification of discrepancies in labor-distribution reporting.

• Support publication of information through a variety of communications methods (including but not necessarily limited to email, websites, and print newsletters) to keep employees informed on issues relevant to ASH.

• Compile proposals, studies, reports, and other documentation as requested.

• Travel to support offsite meetings and other work efforts.

• Provide technical-writing support.

• Process timesheets and labor distribution reports (LDRs).

5.3.11. Space Coordination Services Support

The contractor shall coordinate administrative space for use by ASH personnel, programs and offices.

Support activities include:

• Validate ASH staffing, space and parking requirements.

• Respond to APM space-related planning data calls.

• Coordinate with APM design and construction team as needed.

• Coordinate space lease renewal decisions for ASH offices with APM.

• Coordinate closure of ASH offices, if required.

• Coordinate disposal of ASH furniture, equipment, document shredding or storage as required to close down any facility.

C.5.4 UNMANNED AIRCRAFT SYSTEMS (UAS)_ PROGRAM MANAGEMENT SUPPORT SERVICES

As ordered, the contractor must support the program management and evaluation division in finalizing critical elements of AXU strategy, including individual division level roadmaps and project plans. This will establish clear objectives, workstreams, roles and responsibilities, current resourcing and gaps for the Program.

5.4.1 Communications

Support the development of AXU knowledge management, communications and support through consistent use of tools and templates. This includes support for defining and articulating the critical mission and responsibilities of the office, key stakeholders, and influencers, to help communicate the important responsibilities and work activities of the Program. The contractor must conduct analysis resulting in appropriate role of stakeholder drivers and incentives. The contractor must develop an engaging high-level communications plan that supports AXU critical objectives and activities. The contractor will provide support in developing communications tools and templates for AXU.

5.4.2 Program Operations Support

Support AXU leadership and the Program Management and Evaluation division in finalizing the charter for the Program and developing the elements to support the Program’s initial operating model.

The contractor will provide support to AXU in finalizing an initial Program Charter leading to Government review and acceptance.

5.4.3 Technical Analysis

Provide experienced technical expertise and provide technical studies with deep knowledge in UAS security topics in the following areas: specific emerging technology topics such as Advanced Air Mobility (AAM), current state or emerging C-UAS technologies, and key technical challenges being

C-12 observed in or by other agencies in the C-UAS or AAM area. Support project management activities including kick off, regular status meetings and monthly progress reports. The contractor must participate in the initial kick off meeting, review detailed project plans and provide monthly status reports.

5.4.4 UAS Program Management Support

This program management support may include:

• Participate in both internal and external interagency policy discussions pertaining to any ASH security program, to include but not limited to:

o Integration of unmanned aircraft within the NAS, o Implementation of technology to detect and defend critical aviation infrastructure within the NAS, o Interagency discussions involving review and validation of technology to defeat errant and hostile UAS operations, o Interagency discussions involving development of rules of use for UAS technology.

• Directly support ASH activities involved in any aviation safety/security policy creation by teaming with other FAA, DOT or interagency partners to either modify current policies or draft new national policy to account for changes in threats in the aviation domain. This may include participating in activities involved in updates to the National Strategy for Aviation Security and its subordinate plans, as well as any other national strategy/plan with an intersection to Aviation Security.

• Build and maintain liaison relationships within FAA lines of business DOT, along with counterparts in other national level agencies, including those in the Intelligence Community (IC), Department of Defense (DOD), Department of Justice (DOJ), Department of Homeland Security (DHS), as well as any other identified Departments/Agencies involved in Aviation safety and security.

• Work independently, as well as participate in various team environments. Perform daily interaction and share information, participate in daily interagency teleconferences, coordinate via secure video teleconferencing systems, and participate in working groups as needed.

• Support the FAA subject matter expert and/or central POC for assigned security program, threat assessment or response. Facilitate exchange of information within ASH, and respond to queries from other FAA offices, DOT modes, and/or other agencies. Provide relevant security data and analysis relating to activity in the NAS to those stakeholders in support of interoffice or interagency situational awareness and unified incident response.

C.5.5 PERSONNEL SECURITY AND ID MEDIA PROGRAM SUPPORT SERVICES

As ordered, the contractor must support the implementation of HSPD-12 throughout DOT. This support includes but is not necessarily limited to the following:

5.5.1. Support Security Service Centers

Provide security support services to ASH at HQ, Regional Offices and both centers (William J. Hughes Technical Center (the Tech Center) and Mike Monroney Aeronautical Center (MMAC)). ASH operates Security Service Centers in the main lobby of the FAA HQ facility in Washington DC, at the Tech Center, at MMAC, and in Regional Offices where FAA employees and contractors submit their applications to obtain permanent badges. The contractor must review application information, fingerprint candidates, enter applicant information into Investigation Tracking System (ITS) and Card Management Systems (CMS), and print badges. The contractor must provide these services at ASH-staffed locations at FAA HQ, in the field, and anywhere else that PIV and other ID cards are processed or issued. This support includes, but is not necessarily limited to, the following:

• Complete all duties relating to PIV ID processing (enrolling, issuing, troubleshooting, remote canceling, reinstating, etc.) for FAA employees and contractors.

C-13

• Complete all duties relating to Non-PIV ID processing (enrolling, issuing, troubleshooting, mailing the field Non-PIV IDs, etc.).

• Support processing of FAA Affiliate employees.

• Fingerprint FAA employees and contractors and scan and submit the fingerprints to the Office of

Personnel Management and/or the Defense Counterintelligence and Security Agency.

• Process Physical Security Service requests.

• Assist customers in completing Incident Reports for lost and stolen IDs and maintain and update

CMS database for these IDs.

• Support employee out-processing.

• Complete all recordkeeping for PIV ID cards.

• Audit CMS records weekly and monthly and make appropriate corrections.

• Perform additional duties related to ID processing and personnel security program support.

5.5.2. HSPD-12 Program Support for FAA

• Provide tier 3 support for HSPD-12 and Identification Management System (IDMS) related applications on a 24x7x365 basis for all DOT employees and contractors.

• Support the integration of the PIV Authentication Database (PAD) system with agency PACS systems at selected FAA facilities.

• Provide administrative, analytical, system integration, project management, program management, and portfolio management services to support the HSPD-12 program.

• Provide subject matter expertise to support application development and maintenance. When tasked, the contractor must work with ASH, FAA LOBs, DOT OAs, and other vendors to provide administrative, analytical, system integration, project management, program management, and portfolio management services to support proofs of concept, pilot projects, development, deployment, operations, and maintenance for the HSPD-12 applications used to support PIV cards.

• Support ASH in ensuring that PIV cards comply with NIST and OMB requirements and guidance, including but not necessarily limited to the following:

o Certification – In accordance with the most current version of NIST Special Publication 800-79, the contractor must ensure certification, re-certification, and authorization of the processes for issuing FAA PIV cards.

o Certification – In accordance with NIST Special Publication 800-53, the contractor must assist the ASH ISSM and BPM to ensure certification, re-certification, and authorization for the PIV card management system (CMS) and that needed actions and corrective actions specified in plans of actions and milestones (POAM) are completed as scheduled.

o Privacy Impact Assessment – In accordance with OMB M-06-06, the contractor must assist the ASH ISSM and BPM to periodically update, as necessary, the Privacy Impact Assessment (PIA) and SORN the FAA developed for the IDMS and PAD.

o RA Audit - Ensure that FAA operated PKI components (e.g., CMS and RAs) are operated in compliance with CPS and the FPKI. Perform an annual audit to assess compliance with the practices identified within the corresponding CPS. The Audit Letter resulting from such audit must be submitted annually to FAA within 60 days of the end of the audit.

• Testing – Ensure that all PIV cards issued comply with OMB memo M-07-06 to have the General Services Administration (GSA) test the PIV cards being issued by FAA to ensure that the FAA PIV cards comply with FIPS 201 requirements.

• Topology – Ensure that all PIV cards issued conform to OST/M-40 and all other DOT policies regarding card topology.

• Third-party Contractual Support – Provide the procurement support to purchase PIV cards, manage the PIV card and digital certificate life cycles, maintain Public Key Infrastructure (PKI) Certificate Authority (CA), and provide specialized professional services as needed.

• Key Administration – Provide key management and key storage in accordance with industry best practices and agency policies for digital certificates issued by the PIV Certificate Authority for the agency card holders.

C-14

• Emergency Response Official – If required by FAA, provide Support for electronically sending the Emergency Response Official (ERO) information that is stored in the Card Management System to the Federal Emergency Management Administration (FEMA) at the required frequency.

• Conduct Onsite Training as directed for new contractors and trusted agents at any offices located within the United States.

• Provide administrative, analytical, system integration, project management, program management, and portfolio management services in support of the DOT Public Key Infrastructure

(PKI).

• Support a lifecycle walk-through of PIV processes and procedures annually to ensure compliance with NIST 800-79.

• Review and propose updates to PIV documentation (e.g. Operations Plan, SOP etc.) as needed.

5.5.3. Personnel Security Program Support

• Support the initiation and adjudication of employee and contractor suitability determinations, reinvestigations, and security clearances.

• Provide operational support, including but not limited to program planning, and administrative support, including but not limited to data entry, applicant tracking using E-QIP, statistical reporting, accounting reports, and business-plan updates.

• Respond to applicant questions and questions about entering data in E-QIP.

• Complete all duties relating to PIV ID processing (enrolling, issuing, troubleshooting, remote canceling, reinstating, etc.) for FAA employees and contractors.

• Complete all duties relating to Non-PIV ID processing (enrolling, issuing, troubleshooting, mailing the field Non-PIV IDs, etc.).

• Support processing of FAA Affiliate employees.

• Fingerprint FAA employees and contractors and scan and submit the fingerprints to the Office of

Personnel Management.

• Process Physical Security Service requests.

• Assist customers in completing Incident Reports for lost and stolen IDs and maintain and update

CMS database for these IDs.

• Support employee out-processing.

• Complete all recordkeeping for PIV ID cards.

• Audit CMS records weekly and monthly and make appropriate corrections.

• Perform additional duties related to ID processing and personnel security program support.

C.5.6 SECURITY APPLICATIONS SUPPORT SERVICES

AXM supports a number of ASH security applications and security solutions. The contractor must administer and manage security systems and security solutions for major ASH programs including Facility Security, Personnel Security and ID Media, Investigations, Hazardous Materials Safety, and Business Services and Mission Support. Contractor must work with internal ASH customers, AIT, vendors, and ASH business partners to support ASH systems.

5.6.1. Application Support

The contractor must provide support to end-users for all national, local and specialized ASH applications. Areas of support will include telephone assistance, problem tracking, initial triage and problem resolution, call escalation, and limited training. See attachment C.6 for a current list of ASH applications.

5.6.2. Technical Support

The Contractor must provide technical support for all phases of system planning and design through deployment to help ensure that ASH solutions enable their internal and external users to meet their mission, goals, and objectives. These efforts include the full range of infrastructure engineering design, enterprise architecture standards, prototyping, and integration, including, but not limited to, concept development, planning, requirements definition and analysis, systems design, integration, and deployment.

C-15

Contractor must perform project management and provide technical oversight to support ASH business systems. Representative technical work performed includes, but not limited to, analysis, design, testing, training, implementation, documentation, maintenance, enhancements, modifications, and problem triage and resolution necessary to host, administer, monitor and manage ASH security application systems.

Contractor must provide oversight to legacy ASH web applications and databases that operate on Microsoft and Linux based technologies and tools and are hosted in the FAA Enterprise Service Center.

Contractor must work with ASH and AIT to support migration of legacy ASH applications to FAA Cloud Services using Amazon or Microsoft cloud solutions. Contractor must ensure that the Commercial-Off-the-Shelf (COTS) products used to support ASH Identity Management System and case management systems are fully functional.

5.6.3. Information Security and Privacy Support

The Contractor must maintain ongoing awareness of ASH information security, vulnerabilities, and threats to support organizational privacy and risk management policies and procedures. Contractor must support ASH efforts to address the security of information and computing resources including, but not limited to, the identification, evaluation and proposal of candidate technical security solutions for both existing and future ASH systems and services.

5.6.4. Emerging Technology Support

The Contractor must research new and emerging technologies offered by AIT for adoption within ASH.

These emerging technologies include cloud services, robotics process automation, low-code technologies, and enterprise information management. The Contractor must evaluate off-the-shelf software to improve ASH systems, ability to integrate with FAA cloud services, application architecture changes, database architecture changes, costs, risks and vulnerabilities, and make recommendations.

5.6.5. Engineering Support

The Contractor must provide 24/7 engineering support services for both on-premises and cloud based applications, systems, and databases to ASH. These include, but are not limited to, data communication infrastructure; telecommunications architecture; collaboration architecture; network design; virtualization; network engineering; PKI; disaster recovery; fault tolerance; software and hardware inventory; Data Center Environment maintenance and monitoring; Information System Security support; Big IP products; Storage and NetApps; video teleconferencing capabilities; secure remote access capabilities; monitoring; complete environment documentation; reporting on activities and performance; capacity planning of network resources; and advising the ASH management on recommended actions.

Attachment C.6.2. summarizes the list of products and technologies that the contractor will be required to support. The contractor may be required to support different products and technologies according to any changes in the ASH business requirements and operating environment during the period of performance.

C-16

5.6.6. Service Levels

5.6.7. Database Administration and Support

The Contractor must provide ASH Program Office with Database Administration and Support which includes data migration and backups, continuous health checking and database monitoring, database installation, maintenance, and database products upgrades. The Contractor must also provide support needed to deploy high availability database solutions that include utilizing both failover clustering and database replication technologies. Database support must be provided for multiple ASH Programs application development efforts. Database support tasks must be provided for Microsoft SQL Server, or any similar database products included within FAA Technology Roadmap.

5.6.8 Sharepoint Online Support

ASH uses SharePoint Online, which is supported by AIT, to host all Sharepoint sites. The Contractor must support SharePoint design, functionality and data management requirement for ASH Program Office Sharepoint sites. The Contractor must analyze the existing Sharepoint structure to deliver the optimal visual, graphic format and maintain the optimized data storage/reporting structure. Facilitate process optimization workshops for key ASH contributors and stakeholders. Develop Sharepoint recommendations and enhancements. Contractor is responsible for working with POCs from all ASH Program Offices to ensure that their content on the Sharepoint community sites on ASH Portals meets business requirements, including:

• Support creating different ASH Portal applications and communities

• Prepare and lead SharePoint meetings for ASH Director, Deputy Director, and Managers as needed;

• Implement ASH Director, Deputy Director, and Managers’ requests within SharePoint;

• Revise SharePoint site as necessary both to keep pace with software iterations, and to evolve with internal customers’ needs;

• Collaborate with SharePoint POCs and AIT to solve technical issues and errors.

C.5.7 SECURITY SOLUTIONS DEVELOPMENT SUPPORT SERVICES

ASH Security Services rely on a number of secure, web-based, mission-critical applications to support national security programs that are unique to ASH. ASH relies extensively on these major applications to perform functional work and support its daily operations. All web applications used by the ASH organization have been developed by using ASP.net 4.8 framework, Dot Net Core 6.0, JavaScript, VBScript, Ajax, Telerik controls, Kendall UI, Bootstrap, SQL databases, stored procedure, SQL, and web

Priority Code Customer Impact Response Time

Resolution Time

1 – Critical Significant problem affects an entire office unit (multiple users). A critical business function or entire application is inaccessible.

Office unit is at a complete work stoppage.

Critical Service Report.

15 minutes 2 Business Hours

2 - Important Individual Impacted (Inability to perform job). 1 Hour 4 Business Hours

3 - Non-Critical Low/No Impact (Able to perform work functions), Non-critical Service Request.

2 Hours 16 Business Hours

4 - Request New Service Scheduled/Planned Work 2 Hours As Scheduled

C-17

Reports and operate on MS IIS webserver on a Windows database server. Other software currently in use that the contractor must support includes the following: Appian Low Code Development, JIRA, CICD Pipeline Experience (Continuous Integration/Continuous Delivery), Visual Studio, GIT, AWS Cloud development skills, Telerik Tools, TLS, and .net Certified Developers. The contractor must provide maintenance support for the ASH web applications.

Applications/Product and Technology Attachment C.7.1 includes the list of major ASH web applications that the contractor will be required to support. The list of applications may change according to any changes in the ASH business requirements and operating environment during the period of performance.

Application and website development services required by ASH may include, but are not limited to, the capability to perform system analysis, design, development, training, data conversion,…