Attachment 01c1 PWS Task Order 2.docx

PERFORMANCE WORK STATEMENT (PWS)

Pentagon Force Protection Agency (PWS) Integrated Security Services Contract 4 (ISSC) Task Order Two

PART 1

GENERAL INFORMATION

1.0 GENERAL: This is a non-personal services contract to provide Integrated Security Services. The Government shall not exercise any supervision or control over contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Prime Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The Joint Provider (JP) Pentagon Force Protection Agency (PFPA) (JPP), Force Protection Technology Support (FPTS) services provides operations, sustainment, and security for the Life Safety Backbone (LSB) systems architecture. The LSB systems architecture consists of desktops, servers, and network components and are the foundation in which the PFPA Electronic Security Systems (ESS) and other mission systems and applications function and communicate. This requirement includes applications which are not directly connected to the Coral or parts of the LSB. These systems and applications are stand-alone which the vendor will be responsible for including the LSB architecture. These applications reside on the Joint Service Provider (JSP) NIPRNet or are connected externally on the Coral network.

This is a Task Order and the Contractor shall abide by all contractual and PWS requirements defined within. The Contractor shall provide personnel, transportation, tools, supervision, and other items and non-personal services necessary to perform IT Support Services – Service Delivery as defined in this PWS except for those items specified as Government-furnished property and services. The Contractor shall perform to the standards in this contract.

1.2 Background: FPTS in previous years was supported by a separate contract. Due to some shared services and component dependencies, the Government determined it advantageous to integrate the FPTS contract with ISSC. This ensures that the Contractor is not only responsible for the end devices for ESS, but also the supporting network architecture.

1.3 Objectives: The Government’s objectives for the LSB and Coral networks includes:

· LSB Systems Architecture Operations and Availability: Ensure the PFPA Life Safety Systems infrastructure is Operational through daily systems monitoring and reporting, Available to allow PFPA to meet their mission goals using technology, and Secure and reduce risk to the PFPA mission systems using the cybersecurity defense lifecycle to identify, protect, detect, respond, and recover from any vulnerability or threat.

· LSB Network Availability: Ensure availability through monitoring and maintenance all LSB network devices connected to CORAL network. The Coral transport network falls under the responsibility of JSP/ JPP. Some of these devices are legacy LSB network devices within the PFPA Server room 3B559 and other locations throughout the Pentagon reservation to include Raven Rock Mountain Complex (RRMC). CORAL network devices located at the Defense Health Headquarters (DHHQ) are included in the requirements of this PWS.

· Cybersecurity Compliance: Maintain a Cybersecurity compliance posture of the LSB systems architecture that meets requirements as defined by the Department of Defense Chief Information Officer (DODCIO), National Institute of Standards Technology (NIST), Joint Forces Headquarters DoD Information Network (DODIN) and United States Cyber Command (USCC).

1.3.1 The Government’s inter-related high-level objectives include:

· Scalability and Interoperability – Systems shall be capable of scaling to accommodate additional users, sensors, capabilities, and facilities. Similarly, systems shall be able to adjust down as facilities are closed, suites are decommissioned, or requirements adjusted. Systems and their components shall, to the maximum extent possible, utilize open standards and commercial-off-the-shelf (COTS) technology. Standard network protocols shall be used to traverse the Government’s network.

· Availability and Resiliency – The Government has a goal of operating systems at or near a 100% operational level. Systems shall be designed and implemented to be resilient to failure such that a failure of a single component should not incapacitate the entire system. To achieve this goal, the Contractor shall leverage industry best practices for assuring resiliency and availability, including but not limited to:

· Built-in redundancy

· Automatic failover

· Fault tolerance

· Virtual environments

· Data backup

· Data archiving

· Automatic updates of operating systems (OS) and applications

· Notification of software/hardware approaching end of life

· Power-on replacement i.e. hot swapping components or peripherals

· Continuous i.e., uninterruptible power supplies (UPSs)

· Backup power i.e. batteries and generators

· Surge suppressors

· Reliability and Cost Sustainability – Systems and services shall be affordable across the full lifecycle while meeting the Government’s requirements, minimize the use of custom and proprietary solutions, and remove systems, hardware, and software before they incur excessive sustainment costs or reach end of service.

· Accountability and Customer Satisfaction – Systems and services shall be designed and implemented to be user friendly, mindful of the impact and sensitivities of the customer workspace, high performing, and to meet contractual service requirements.

1.4 Scope: The scope of this requirement is specific to LSB mission systems and the LSB systems architecture components. See Appendix “A”, Environment Document for complete list of LSB Mission Application and Systems Architecture components. The work to be performed is in accordance with (IAW) the Defense Information Systems Agency (DISA) and Joint Service Provider (JSP) processes, policies and program management specific to seven major support categories:

· Program Management

· Project and Architecture Engineering

· Operations and Maintenance

· Cybersecurity

· Configuration Management

· Change Management

· Continuity of Operations (COOP)

1.5 Period of Performance: The period of performance shall for one (1) Base Year of 12 months and four (4) 12-month option years.

1.6 General Information:

1.6.1 Place(s) of Performance and Stakeholders:

1.6.1.1 Place of Performance: The Government-designated locations to be serviced include the Pentagon Reservation and Department of Defense (DoD) occupied facilities (not under the jurisdiction of a Military Department) within the National Capital Region (NCR) to include, but not limited to:

· Suffolk Building

· Pentagon Operations Center (POC)

· Mark Center Security Operations Center (SOC)

· Raven Rock Mountain Complex (RRMC)

· PFPA Police Cruisers/Vehicles

· PFPA Mobile Command Centers (MCC) (MCC-1 and MCC-2)

· Federal Law Enforcement Training Center Cheltenham, MD

· Other leased facilities throughout the NCR

1.6.1.2 Stakeholders: Primary stakeholders includes other Government Employees (OGE) and other Government Contractors (OGC). This is not an all-inclusive list:

· PFPA Headquarters (Rm 5B890)

· Pentagon Operations Center (POC)

· Mark Center Security Operations Center (SOC)

· Enterprise Physical Security Division (EPSD)

· CBRNE Protection Division (CPD)

· Security Services Division (SSD)

· Pentagon Police Department (PPD)

· Office of Emergency Management (OEM)

1.6.2 Phase In/Phase Out Period: A smooth and orderly Phase In/Phase Out process between the incoming and outgoing vendors is necessary to ensure no disruption to vital services and Government activities. The Contractor shall ensure all existing and applicable services and support are successfully transitioned from the incumbent Contractors to the awarded contractor. At time of proposal, the Contractor shall provide a Phase In plan defining the strategy to expedite onboarding personnel and participate in the knowledge transfer process. In Turn the Contractor shall also provide their Phase Out plan defining the strategy to continue to meet contractual requirements and participate in the knowledge transfer process at the end of this contract. The Contractor shall ensure Continuity of Services, so that no disruptions to program services and support occurs during the transition period. Immediately following contract award, and throughout the execution of the transition plan, both Contractors are fully accountable and responsible for successful performance of all objectives and requirement on the contract. The Phase In/Phase Out Plan shall include, but not limited to:

· Day-by-day transition schedule with key milestones identified

· Review and evaluation of current support systems/services

· Transition of historic data and knowledge transfer to new contractor systems

· Acknowledgement that Knowledge transfer of historical data has occurred

· Recruitment, onboarding, training, and identification of key and non-key personnel

· Transition incumbent personnel, re-badging/ re-issue of credentials and access, user agreements, and conduct orientations

· Acknowledge and confirm the Transfer of hardware/software warranties, licenses, and service maintenance agreements has occurred

· Acknowledge and confirm the Transfer of all necessary business and/or technical documentation in the JPP’s Knowledge base repositories, consists of SharePoint and Coral network information has occurred

· Acknowledge and confirm the Transfer of compiled and un-compiled source code, to include all version, maintenance updates, and patches, if applicable

· Acknowledge and confirm the Coordination with Government to account for government keys, ID/access cards, and security codes

· All other issues associated with the appropriate transition of the FPTS requirement

MEETINGS:

· Program Award Kickoff Meeting

· Periodic Transition Updates

DELIVERABLES:

· Phase In/Phase Out Plan

· Kickoff Presentation

· Stakeholder Presentation

1.6.3 Program Management (PM): The Contractor shall implement a Program Management structure to efficiently and effectively administer, report and oversee the FPTS Contract. Program Management must include a central point-of- contact (POC) responsible for the management, oversight, administration, risks, and substantive communication of all activities performed by Contractor personnel, including subcontractor personnel, to satisfy the requirements in this PWS. The Primary POC (Program Manager) shall provide the program management leadership authority to respond to all types of requests, critical or standard, and deploy the appropriate resources to address any issue pertaining to the scope of support for this requirements.

The Contractor shall provide a monthly Program Management Review (PMR) of the overall performance status of all FPTS performance categories listed above in section 2.0 Scope narrative. The Contractor shall provide a breakout of, but not limited to, the work schedule of the Contractor’s staff, achievements, monthly metrics summary, deliverables, finance and invoices, risk management, projects, and any updated program information. This status report shall be given in the form of a monthly PMR presentation by the Contractor to the TM, COR, and Contracting Officer.

1.6.3.1 Program Management Plan: The Contractor shall deliver and implement a detailed Program Management Plan (PMP) within 90 days of date of award. The Program Management Plan must be a comprehensive overview and living document describing all aspects as required of the overall contract. It will provide the Contractors overall approach to the management of the FPTS program requirement. The goal of the PMP is to fuse the functional activities and human resources into one program oversight and communication strategy. The PMP shall Identifying Key Personnel team members’ roles and responsibilities, identifying the key activities the Contractor will focus on and specify how all program objectives will be met. Additionally, the PMP will provide a summary of the appropriate level of quality assurance and risk mitigation as part of the program oversight, this document will be critical to effective management of the FPTS program.

The PM Plan shall include, but not limited to, the following:

· Program Description: Description specific to the FPTS program objectives and the seven major support categories.

· Project Scope: Provide a scope statement or guidelines to the scope of the PMP.

· Roles and Responsibilities: Define the roles and responsibilities of the FPTS program key personnel and describe their mission objectives as they pertain to the major support categories.

· Roles and responsibilities of support personnel: Define the roles and responsibilities of the FPTS program support personnel and describe their mission objectives as they pertain to the major support categories.

· Staffing Strategy: Includes key personnel, staffing matrix aligned with this PWS to include roles and description; subcontractors; resource backup plan; attendance reporting as described within the COOP or during emergencies; telework assignments, if agreed to by the Government; and any additional information deemed relevant.

· Risk Management Strategy: Describe risk management to include, but not limited risk register, risk assessment, root cause analysis, corrective action, reporting, monitoring, and communication.

· Communications Strategy: Define the PM’s role managing communication. Include the type and frequency of communication, escalation procedures, backup procedures, and other guidelines or expectations.

· Document Management Strategy: Define the documentation management strategy, including the role of the Key and how they will manage documentation for their functional areas.

· Quality Assurance and Risk Strategy: Acknowledge all contract deliverables for the FPTS program and define how contract deliverables will be met and how risk will be managed for the FPTS program.

· Integrated Battle Rhythm: Maintain, status, and report all FPTS program activity including maintenance activities, patching, updates, Authorized System Interruptions (ASIs) or other activity that would have an impact to the LSB. Maintain an outlook calendar with daily updates and battle rhythm. Ensure all projects are resourced and that no scheduled or unscheduled activities will conflict with other ongoing projects or tasks. The Contractor shall document and report action items relevant to tasks.

MEETING(S):

· Monthly Programmatic Review Meetings

DELIVERABLE(S):

· Program Management Plan

· Monthly Program Management Review (PMR)

1.6.4. Key Personnel: The Contractor shall employ key personnel to administer, oversee and execute the FPTS Contract. The positions in the following paragraphs are considered key personnel for this contract. Resumes shall be provided for the Government’s review and acceptance prior to assigning the personnel in these categories. The Government’s review and approval is also required prior to replacing any key personnel. The replacement’s resume must be submitted to the Contracting Officer (KO) and Contracting Officer Representative (COR) for approval. Personnel not meeting these requirements may be accepted for these positions upon review and concurrence by JSP JPP Program Management in coordination with the COR and the KO.

DELIVERABLE(S):

· Resume for Key Personnel

1.6.4.1 Program Manager:

The qualified individual for this position must have:

· Minimum fifteen (15) years of experience in the implementation and sustainment of complex security systems, and a Baccalaureate Degree in I/T Management, Engineering, Cybersecurity, Computer Science, or other related technical fields, or

· Minimum fifteen (15) years of experience in the implementation and sustainment of complex security systems, in related technical fields to include I/T Management, Engineering, Project Management, Cybersecurity, and Computer Science.

· Project Management Professional (PMP) Certification.

· Active or current Top Secret (TS) security clearance adjudicated by DIA or DoD CAF at the time of proposal and maintain the TS continuously thereafter.

The Program Manager shall:

· Serve as the single focal point accountable for the quality of all FPTS services, projects, risks, personnel, activities and deliverables.

· Brief FPTS services, activities, and deliverables to a wide range of individuals to include United States Government personnel up to Executive Service level.

· Assure the right mix of management, technical, engineering, and maintenance personnel. Assure all personnel have the necessary qualifications, including training, security clearance, badging, and access privileges.

· Manage and de-conflict multiple ongoing baseline support and technical tasks.

· Lead the monthly PMR presentation to the Government.

· Manage, control and report FPTS program costs.

· Identify FPTS system dependencies or of non-FPTS systems dependent on FPTS systems. Document concerns and findings and present to the Government.

· Communicate to the Government emerging trends and technologies in the information technology industry.

1.6.4.2 Engineering Manager:

The qualified individual for this position must have:

· Minimum twenty (20) years of demonstrated experience in the development of enterprise-wide or large-scale information systems

· Minimum ten (10) years of demonstrated experience in a senior leadership engineering position

· Minimum Ten (10) years of demonstrated experience manage a team of IT engineers implementing IT projects involving networks, including network infrastructure, information assurance engineering, and software applications;

· Current DoD 8570.01-M IAM Level II certification;

· Active or Current Top Secret security clearance adjudicated by DIA or DoD CAF; and

· A Bachelor’s degree from an accredited college or university in Engineering, Information Systems, Information Technology or a technical discipline.

The Engineering Manager shall:

· Establish system information requirements using analysis of the information engineer(s) in the development of enterprise-wide or large-scale information systems.

· Determine and identifies high-level functional and technical requirements based on interactions with the user community and knowledge of the enterprise architecture.

· Design architecture to include the software, hardware and communications to support the total requirements as well as provide for present and future cross-functional requirements and interfaces.

· Identify, assess, and present options for meeting the functional and technical requirements including hardware and software updates or upgrades.

· Be responsible for developing high-level system design diagrams.

· Ensure these systems are compatible and in compliance with the standards for open systems architectures, the Open Systems Interconnection (OSI) and International Standards Organization (ISO) reference models, and profiles of standards - such as Institute of Electrical and Electronic Engineers (IEEE) Open Systems Environment (OSE) reference model.

· Ensure that the common operating environment is compliant.

· Evaluate analytically and systematically problems of workflows, organization, and planning and develop appropriate corrective action.

· Provide daily supervision and direction to staff.

· Audit policies and controls continuously.

· Ensure the Government is continuously updated on enterprise cybersecurity posture.

1.6.4.3 Operations Manager:

The qualified individual for this position must have:

· Minimum fifteen (15) years of demonstrated experience in IT Operations utilizing ITSM best practices in a Federal Government or DoD environment;

· Minimum ten (10) years of demonstrated experience in a senior IT management role in a Federal Government or DoD environment;

· Current DoD 8570.01-M IAM Level II certification;

· Meet requirements IAW DoDD 8140.10 451-System Administrator Core Competencies;

· Active or Current Top Secret security clearance adjudicated by DIA or DoD CAF; and

· Bachelor’s degree from an accredited college or university in Engineering, Information Systems, Information Technology or a technical discipline.

The Operations Manager shall:

· Manage LSB Systems operations and maintenance (O&M).

· Ensure production schedules are met (e.g. deployments, imaging, patching schedules).

· Ensure LSB Systems resources are used effectively.

· Coordinate the resolution of production-related problems.

· Ensure proper relationships are established between customers, teaming partners and vendors to facilitate the delivery of information technology services.

· Provide users with computer output.

· Supervise O&M staff (i.e. Desktop Administration, Systems Administration, Network Administration, etc.)

1.4.6.4 Senior Cybersecurity Team Lead:

The qualified individual for this position must have:

· Minimum twenty (20) years of progressive demonstrated experience in Information Security, with a good working knowledge of both DoD and Federal Government Cybersecurity/Information Assurance Security policies and procedures.

· Minimum fifteen (15) years of demonstrated experience leading Cybersecurity Teams.

· Minimum fifteen (10) years demonstrated Risk Management Framework (RMF) experience. Includes experience performing DoD authorizations, Accreditations, and Assessments.

· Minimum five (5) years demonstrated experience accrediting systems using Enterprise Mission Assurance Support Service (eMASS), McAfee Host Based Security System (HBSS) and Assured Compliance Assessment Solution (ACAS).

· Valid current training Certificates for eMASS, HBSS and ACAS.

· Minimum five (5) years demonstrated experience as a System Administration for Windows and Linux Operating Systems.

· Valid current Certificates for Windows and Linux Administration.

· Current DoD 8570.01- M IAM Level III certification;

· Active Top Secret security clearance adjudicated by DIA or DoD CAF.

· Preference: Bachelor’s degree from an accredited college or university in Engineering, Information Systems, Information Technology or a technical discipline.

The Senior Cybersecurity Team Lead shall:

· Be the contract Subject Matter Expert (SME) all matters related to Cybersecurity and the Risk Management Framework (RMF), eMass, ACAS, HBSS, Splunk and Tanium;

· Provide daily supervision and direction to Cyber staff

· Ensure Risk Assessments, Exemption/Exception requests and RMF Packages meet compliance

· Monitor, report and assess Cyber compliance for all Operations and Infrastructure

· Maintain, monitor, report and assess Cyber compliance on all security tools and technology

· Monitor, report and assess Cyber internal and external policy compliance

· Monitor, report and assess Cyber regulation compliance; and

· Work to mitigate risk across security system’s infrastructure

1.6.4.5 Master Project Scheduler:

The qualified individual for this position must have:

· Active or Current Top Secret security clearance adjudicated by DIA or DoD CAF; and a Bachelor’s degree from an accredited college or university in Engineering, Information Systems, Information Technology or a technical discipline.

· PMP certification or related experience desired

· Expert level skills with MS Project, MS Project Server, or MS Project Professional Project.

· Ability to work collaboratively with all team members and be proactive in organizing PMO outreach to PMs to gather and report on schedule critical information

The Master Project Scheduler shall:

· Prepare comprehensive project schedules and assist with the management of project milestones and deliverables

· Develop and maintain integrated master schedules using MS Project

· Ensure issues are called out to the appropriate decision-making authority in a timely manner so that decisions can be made that minimize impact to critical path

· Partner with Project Managers to identify schedule dependencies and ensure those are clearly linked across projects or programs

· Identify and analyze schedule risks and mitigation strategies

· Update project schedules to conform to current schedules and submit the updated Project Schedules

· Utilizes Gantt, PERT, milestone charts, other project management techniques to gauge progress and identify performance variances

· Manage both baseline work and remaining work

· Identify and manage resource over-allocation

1.6.5 Major Support Categories:

1.6.5.1 Projects and Architectural Engineering (P&AE)

The objective of IT Projects and Architectural Engineering (P&AE) includes the following:

1.6.5.2 Architectural Engineering and Analysis: The overarching strategy for Architectural Engineering and Analysis is to provide a dedicated pool of resources whose responsibility is to provide agency-wide analysis, planning, design, implementation, documentation, assessment, architectural planning and implementation, project management, and project engineering of the enterprise structural framework of the Coral/LSB network to align IT strategy, plans, and systems with the mission, goals, structure, and processes of PFPA.

The goal of Architectural Engineering and Analysis is to develop Technical Solution Identification (TSI) documents for all new project requirements to allow PFPA to determine the feasibility to fund and execute the TSI. Project types can include, but are not limited to, Life Cycle Replacement (LCR), network infrastructure analyses, equipment upgrades, desktop and servers operating systems upgrades, mission system and application integrations/migrations.

DELIVERABLE(S):

· Two Assessments or I/T Technical Solution Identification (TSI) recommendations per quarter submitted to COR and Government Lead.

1.6.5.3 Current and Ongoing Projects: Upon Task Order Award, the Contractor shall develop a TSI of any Current/Ongoing projects listed in Table 4 of the IT Environment Document. The projects listed in Table 4 are listed in order of priority and the Contractor shall deliver each respective TSI in order of priority. The assessments may be conducted concurrently, but no single assessment shall take longer than 10 business days to complete. Upon completion of the TSIs, the Government may generate Task Orders to exercise the recommended technical solutions.

The TSI shall consist of, but not limited to:

· Evaluation of the current state

· A recommendation to proceed in current state or implement an alternative solution

· Implementation plan for either solution

· Notional project schedule

The projects listed in Table 4 are as follows:

· NTP Servers Upgrade

· OCSP Load Balancer

· Shield Domain Consolidation

· Platform as a Service (PaaS) LCR Implementation

DELIVERABLE(S):

· TSI

· Project Charter

1.6.5.4 Project Management: The objectives of Project Management are the successful development of the project's procedures of initiation, planning, execution, regulation and closure as well as the guidance of the project team's operations towards achieving all the agreed upon goals within the set scope, time, quality and budget standards. Each project shall meet the critical success factors for projects to include, but not limited to, clearly defined project objectives, development of a realistic schedule, project change management, effective problem solving, defining work breakdown structure and reporting.

All projects shall have a project schedule, initiated, maintained, and reported from using MS Project for tracking all projects. Each project shall contain the elements to meet all P&AE reporting requirements. Each project schedule shall be updated on a weekly basis. The project updates shall feed into the Integrated Master Schedule.

1.6.5.5. Integrated Master Schedule: The Master Project Scheduler shall maintain an Integrated Master Schedule (IMS) linked to all LSB active project schedules. The IMS shall show all ongoing project to include milestones, timeline, and completion dates. The Contractor shall ensure that all projects are resourced to ensure that no scheduled activities will conflict with other ongoing projects or tasks.

DELIVERABLE(S):

· Project schedules

· Weekly schedule updates

· Integrated Master Schedule

· Baseline Report

· Milestone Report

1.6.5.6 P&AE Standard Operating Procedures (SOP) and Work Instructions (WIs):

· The Contractor shall create SOPs and WIs for new, revised, or missing requirements; ensure continuous review and maintenance of all P&AE SOPs and WIs to ensure content remains current; and accurate.

1.6.6 Operations and Maintenance (O&M): The Contactor shall provide Operations and Maintenance (O&M) services for the LSB mission systems and the LSB systems architecture components. To achieve this goal, the Contractor shall leverage industry best practices for assuring resiliency and availability, including but not limited to the following requirements:

· Patching

· Network Monitoring

· Server Monitoring

· Built-in redundancy

· Automatic failover

· Fault tolerance

· Virtual environments

· Data backup

· Data archiving

· Automatic updates of operating systems (OS) and applications

· Notification of software/hardware approaching end of life

· Power-on replacement i.e. hot swapping components or peripherals

· Continuous i.e., uninterruptible power supplies (UPSs)

· Backup power i.e. batteries and generators

· Surge suppressors

· Service Desk – Tiers 2 and 3

The LSB environment includes applications which solely fall under PFPA control (e.g. CENS, JABS, ADORE, ACTIVU). This includes LSB servers, LSB workstations, the Pentagon Operations Center (POC) and Mark Center Security Operations Center (SOC) Video Wall Displays, storage, etc. A list of the software and hardware are listed within the IT Environment Document.

1.6.6.1 Operations (OPS) and Maintenance Contract Personnel: The Contractor shall provide a workforce possessing the skills, knowledge, and training to perform the services required by this Contract. The O&M staff should consist of System Administrators/Engineers and Network Administrators/ Engineers with advanced knowledge and experience to maintain and support the LSB IT infrastructure.

The LSB environment shall be maintained at or near a 100% operational level 24 hours per day, 7 days per week, 365 days per year (24x7x365). The Contractor shall support Mission Applications through the use of the JSP Service Desk for maintenance and operations. Systems shall be maintained and supported to be resilient to failure such that a failure of a single component should not incapacitate the entire environment.

The Contractor shall ensure personnel assigned to perform O&M possess a minimum of six (6) years IT experience working with multiple operating systems and network platforms (e.g. Microsoft, LINUX, UNIX, Cisco, Juniper, etc.). Contractor personnel preforming O&M services for the LSB mission systems and LSB systems architecture components are required to meet core competency requirements IAW DoDD 8140.10 appropriate with their role and possess a current DoDD 8570 IAT Level II certification. Contractor personnel will possess the necessary certification(s) and experience prior to onboarding to support the FPTS contract.

1.6.6.2 Operations and Maintenance: LSB Operations and Maintenance (O&M) controls the full range of services pertaining to sustaining the LSB information delivery system and network availability, and information protection of capabilities that support LSB and PFPA mission. The Operations team ensures standards-based configuration, operation of all infrastructure, and controls the runtime aspects of services to ensure services function correctly and meet the performance requirements identified within the Quality Assurance Surveillance Plan (QASP) of this PWS. The team administers and controls security policies, identifies incidents and infrastructure issues, performs problem resolution, and implements metrics that track the overall progress of the operations Domain. The Contractor is required to:

1. Ensure the data within the Management System Database are current and remain updated (e.g. SolarWinds, SCCM, BelArc, etc.).

2. Verify and maintain Security Technical Implementation Guides (STIG) compliance across all assets.

DELIVERABLE(S):

· Management System Database accuracy check confirmation

1.6.6.2.1 Access Management: Access Management is the process of granting authorized users the right to use a service while preventing access to non-authorized users. The Contractor shall control and track who has access to data and services within the LSB environment. (“Who” may be another system, service, or process, as well as an individual) It contributes to achieving the appropriate confidentiality, availability, and integrity of the LSB data and includes levels of access for requesting services, access to data, and access to facilities. The Contractor shall:

· Ensure only authorized personnel assigned to the FPTS program perform O&M duties appropriate to their assigned role.

· Authorized Personnel - Individuals specifically assigned to the FPTS program and authorized by JPP Government to be permitted in performing assigned duties in a safe and effective manner.

· Maintain an accurate identity and rights registry (Active Directory) that undergoes periodic maintenance and review

· Maintain and make available to authorized personnel an auditable record of access attempts

· Ensure data necessary to demonstrate compliance relative to service and information access is available

· Ensure security vulnerabilities and incidents are identified, monitored and reported

· Ensure and report of unauthorized access to information, applications and infrastructure is detected, reported, and resolved

· Ensure access-related security incidents are defined and access controls are regularly tested

· Create, modify, and/or delete all approved accounts within specified timelines identified in the PRS.

DELIVERABLE(S):

· Create, Delete, or Modify approved accounts as required.

1.6.6.2.2 Event Management: Event Management is used to identify and prioritize all events that occur which could have impact to the LSB IT infrastructure and establish the appropriate response to those events (e.g. JSP ASI’s, Pentagon Building Management Office (PBMO) Power). Operations shall be notified of events that may cause service degradation enabling operations to take steps to perform contingency planning. The Contractor shall:

· Ensure all planned events are coordinated with government stakeholders, other government Contractors, and other government agencies to ensure collaboration and preparedness for planned events. (e.g. Integrated Systems Test (IST))

· Ensure resources are scheduled and available for support if and when required.

1.6.6.2.3 Incident Management and Response: The purpose of Incident Management is to restore normal service operation as defined under the PFPA Mission Systems Incident Response Posture within the FPTS JPP LSB IT Environment document and minimize the adverse impact on mission partner operations, thus ensuring that the best possible levels of service quality, security, and availability are maintained. The focus is on communicating and reducing the duration and consequences of unplanned outages. The Contractor shall:

· Review and validate the current Incident Management Process and Standard Operating Procedure (SOP). Follow current SOP or make recommendations for SOP improvements

· Provide the ability to detect and resolve incidents more efficiently

· Support the PFPA infrastructure, applications, and systems to ensure the specifications of the three (3) mission criteria (Critical, Essential, and Support) requirements are met.

· Review and follow current Incident Management and Outage Management procedures and provide recommendation for improvement.

· Acknowledge all Incidents within ten (10) minutes of receiving a ticket(s) from JSP Remedy or notification of an incident. This includes any alerts received from monitoring tools impacting any LSB system or application.

· Notify the Government team immediately of any Incidents resulting in extensive or widespread LSB system or application impact.

· Respond to outage or degradation in line with the Mission Critical, Mission Essential, or Mission support requirements defined in the I/T Support Structure below and within the IT Environment Document.

· Notify the Government team if unable to resolve Incidents within timeline standards for Mission Critical, Mission Essential, or Mission support requirements defined in the I/T Support Structure below and in accordance with the “PFPA Mission Systems Incident Response Posture” within the IT Environment Document.

1.6.6.3 I/T Support Structure: PFPA leverages best practices along with the use of the Information Technology Infrastructure Library (ITIL) IT Service Management (ITSM) model; IT support for incident and service management; and network and equipment services for tier/ level management. The Contractor is responsible for Tier 2/Tier 3 support and shall use a tier/ level approach to support call triage and routing for IT priorities supporting LSB/Coral and non-LSB/Coral services above.

1.6.6.3.1 Mission Critical Support Response Posture: Tickets generated for Mission Critical Applications should be categorized as URGENT - CRITICAL IMPACT (Priority One) tickets. The JSP Tier I Service Desk shall take the call, record into Remedy and route to Tier 2 within ten minutes. Critical tickets shall be monitored and tracked by following-up with Tier 2/3 SME to insure ticket assignment.

1.6.6.3.2. Mission Critical Systems/Applications:

· AMAG 7 - Physical Security System (critical)

· Exterior Modeling System (EMS) - STAR (RHEL on Physical)

· E911

· Computer Emergency Notification System (CENS)

· C-CURE 9000 - Physical Security System by Software House

· Bosch Video Management System (BVMS) - Bosch CCTV system(Camera)

1.6.6.3.3 Mission Essential Applications: Support Response Posture: These applications are not considered basic and required to be available for mission accomplishment. They must have a disaster recovery and a continuity of operations plan. Tickets for Mission Essential Applications should be categorized as HIGH - SIGNIFICANT IMPACT (Priority Two). JSP Tier I service shall take the call, record into Remedy, and route to the Contractor’s Tier 2 within ten minutes. Mission essential tickets shall be monitored and tracked by following-up with Tier 2/3 SME to insure ticket assignment.

1.6.6.3.4 Mission Essential Systems/Applications:

· ACTIVU - CAC Authentication (OCSP) -

· Physical Security Information Management (PSIM) -

· Privilege Management Program (PMP)

· SENTRY/ Pentagon Shield - CBRNE Environmental Monitoring

· Computer Aided Dispatch (CAD)

· PIMI (MS Access - SQL Server)

· Records Management System (RMS)

1.6.6.3.5 Mission Support Applications: Support response posture: SME during business hours. Tickets for Mission Support Applications should be NORMAL - MINOR IMPACT (Priority Three). Tier I service shall take the call, record into Remedy and route to Tier 2 within ten minutes. Mission support tickets shall be monitored and tracked by following-up with Tier 2/3 SME to insure ticket assignment.

1.6.6.3.6 Mission Support Systems/Applications (This list is not all-inclusive):

· Joint Automated Booking (JABS)

· VCIN

· ADORE

· LIDAR

· VMware - vCenter Software

· WEBEOC

· Static Vehicle Screening System (SVSS)

· Mobile License Plate Recognition (MLPR)

1.6.6.3.7 Mission Application Maintenance:

· Mission Applications currently include the following applications on JSP’s NIPR network (known as “Resource”) which are separate from PFPA’s physical security systems on the LSB: Computer Aided Dispatch (CAD), Records Management System (RMS), WebEOC, Workforce TeleStaff, and Mobile License Plate Recognition.

· Support shall include systems engineering, information technology, and help desk support to ensure continued operations and maintenance. This support will include on-site subject matter expertise during business hours in the Pentagon Operations Center to assist with, or otherwise track and report issues that users may be experiencing.

· Contractor shall ensure system availability of these applications through proactive measures (e.g. monitoring disk drive space and overall application functionality, testing Operating System patches prior to the JSP introducing them in the Production environment) and reactive measures (e.g. restarting a server that has crashed, repair response after application failures).

· Contractor shall ensure software versions are up to date with the current vendor releases.

· Contractor shall configure the software and its environment to maximize the inherent capability of all systems in order to deliver the best customer experience to the PFPA users (e.g. PPD, POC). Note: Contractor may not have account permissions to all aspects of the system (e.g. database servers), as JSP controls these items. Additionally, any hardware requirements to be fulfilled by the Contractor will be codified via separate task orders.

· Contractor shall maintain up-to-date architectural drawings of all systems and other content (e.g. Ports, Protocols, and Services Management (PPSM), hardware software lists) needed for the Risk Management Framework submittals. Note: because these systems are housed by JSP, most cyber related activities that touch systems, such as scans and OS patches, are JSP responsibilities.

· The Contractor shall acknowledge system outages 24/7/365 within 10 minutes of being reported from the Service Desk. An After Action Report (AAR) shall be completed within 24 hours of service restoration for system outages or incidents exceeding the response posture times define within the Environment document, which shall include an event log showing time, date, actions taken, and root cause.

· Each month a “State of the System” overview will be produced that reviews issues and mitigations with the system (if any) that have occurred that month and goals for the next month with respect to enhancements.

· Future upgrades and strategic priorities include: deployment of ProQA software modules for CAD, deployment of Mobile CAD, environment upgrade of RMS, and version upgrade of RMS.

· Note: Mission Application licensing is currently purchased and maintained by the Government; if at some later date PFPA would like the Contractor to purchase licenses, PFPA will modify the appropriate documents.

DELIVERABLE(S):

· State of the System Dashboard

· AARs (incidents and outages exceeding response posture times, and ad hoc)

1.6.6.4 Security Patching and Vulnerability Management: Timely patching is critical to maintain the operational availability, confidentiality, and integrity of the LSB system’s architecture. Proactively managing vulnerabilities of systems will reduce or eliminate the potential for exploitation. The Contractor shall implement a Security Patching and Vulnerability Management program to reduce or eliminate vulnerabilities and prevent the exploitation of vulnerabilities within the CORAL network and LSB systems architecture. The Contractor shall follow Federal Government best practices outlined in NIST 800-40 Rev 2 & NIST 800-40 Rev 3 and follow procedures below for an effective Patching and Vulnerability Management program.

· Inventory IT resources to determine which hardware equipment, operating systems, and software applications are used

· Monitor security sources (e.g. Microsoft) for vulnerability announcements, patch and non-patch remediation’s, and emerging threats that correspond to the software within the inventory

· Prioritize the order in which vulnerabilities and remediation should be addressed. Provide the Government with delays in remediation recommendations by the application/system vendor manufacturer.

· Conduct testing of patches and non-patch remediation’s on IT components that use standardized configurations

· Oversee vulnerability remediation process

· Distribute vulnerability and remediation information to local administrators

· Perform automated deployment of patches to IT devices using enterprise patch management tools

· Configure automatic update of applications whenever possible and appropriate

· Verify vulnerability remediation through network and host vulnerability scanning

· Train administrators on vulnerability mitigation procedures.

1.6.6.4.1 Security Patch Verification: The Contractor shall build, test, apply, and verify required information systems security requirements (STIGS, scripts, credentialing, patches, policies (e.g. group policy), updates, and configuration changes) as directed by the Government within the specified time frame. This verification includes ensuring that patches present no adverse effect to the functionality of LSB Mission Systems or applications.

· The Contractor shall ensure all infrastructure components are compliant in accordance with DOD policies and guidance < https://cyber.mil/policies-guidance/>.

1.6.6.4.2 Credentialing and Scanning: During patching, the Contractor shall validate that all devices are within the inventory that require patching are confirmed to have received the patch and reboot performed if required. This validation will ensure credentialing of all LSB devices is achieved. The Contractor shall maintain the DOD mandated system credentialing rate at 95% or better.

Assured Compliance Assessment Solution (ACAS) and DoD Security Content Automation Protocol (SCAP) scans will be performed weekly and periodically by the Contractor Cybersecurity team. The results and findings of these scans reveal Critical/High, Medium, and Low vulnerabilities. The scan results generate a Command Cyber Readiness Inspection (CCRI) Weighted Average Score, which represents the security posture for the LSB systems architecture. DOD mandates that the CCRI score for all system connected to the DODIN be maintained below 2.5%.

1.6.6.4.3 Patching Report: The Contractor shall provide weekly patching report, no later than 1200 every Friday or upon Government request. Report shall have planned install dates, automated method (e.g. WSUS, SCCM, or manual patch), planned package creation with completion dates, collections/assets targeted, systems/applications targeted, testing results, and any risk or mission impacts associated with implementation. The report shall include prior week’s accomplishment.

DELIVERABLE(S):

· Weekly Operations Patching Report – 1200 every Fridays

1.6.6.5 Failover Testing: The current LSB environment has failover capability within the Pentagon locally between PFPA & JSP managed server rooms. (e.g.3B559 & 3B957). The Contractor shall perform a quarterly failover test no later than the end of each calendar quarter (i.e. March, June, September, and December) to ensure continuity of operations (COOP) readiness. The Contractor shall document and deliver the quarterly failover results to the Government.

DELIVERABLE(S):

· Quarterly Failover Report

1.6.6.6 System Monitoring: The Contractor shall be responsible for continuous monitoring and oversight of the LSB Systems Architecture. The Contractor shall establish an automated, continuous method to electronically track the status of LSB systems, devices, and end points and record statistics on uptime and availability.

· The Contractor shall log, review, acknowledge, and track Incidents and Problem tickets received from the JSP Service Desk and other users using the JSP Remedy Ticketing System.

· The Contractor shall perform 24/7 monitoring, detection, and analysis of alerts and events to determine and execute the appropriate action(s). This monitoring will allow a proactive approach to incidents and unplanned outages prior to being notified by the customers and stakeholders. Monitoring shall be performed using Government provided tools (e.g. SolarWinds) and procedures. This includes the acknowledgement of alerts within the monitoring system and taking action to resolve the alerted issue.

DELIVERABLE(S):

· Problem Resolution After-Action Reports

1.6.6.7 System Backup and Restoration: The Contractor shall provide Backup and Restoral management services to include, but not limited to:

· Review of the current backup and restoral plan within 30 days following contract award date.

· Submit to the Government Operations team any recommendations for improvements.

· Ensure all daily system backups are properly performed and successfully completed according to the plan.

· Coordinate and assist external stakeholders with backup requirements on infrastructure components, applications, and systems maintained by Other Government Agency’s (OGAs) or Other Government Contractors (OGCs). The level of effort is dependent on the customer’s requirements (e.g. types of backups, how often, retention period, etc.).

· Provide and deliver a daily server backup report not later than (NLT) 0900 Eastern Time to the Government Operations team. The report shall include incremental and full backup server and backup copy status along with any errors encountered and actions to be taken.

· Restore systems and data as requested by the Government.

· Perform quarterly tests of data recovery solution(s) no later than the end of each calendar quarter (i.e. March, June, September, and December) within established mission criteria; validate the accuracy and reliability of all recoveries performed; deliver results to Government.

DELIVERABLE(S):

· System Backup Plan

· Daily Backup Report

· Quarterly Data Recovery Test Results

1.6.6.8 End User Service Requests: The Contractor shall receive, address, and track service requests for LSB and other Infrastructure support from JSP Remedy. This includes requests for:

· Deployment or removal of software and hardware, to include any baseline applications, workstations, servers, and networking components.

· Conducting software and hardware upgrades and testing.

· Management of over 800 accounts and passwords currently. This includes receipt, validation, creation, and testing.

· Creation and management of server, workstation, laptop, and tablet images. Images will be obtained via the DoD Secure Host Baseline Repository, configured, tested, and approved before implementation into live environment.

· Coordination with internal and external stakeholders in the transition of new services into the production environment.