Attachment 1 DDWG ESS PWS.docx

SP4701-18-C-0088

Electronic Security System (ESS) at the Defense Supply Center Richmond (DSCR)

Performance Work Statement (PWS)

ELECTRONIC SECURITY SYSTEM MAINTENANCE SUPPORT SERVICES

DLA Distribution Warner Robins, GA

BACKGROUND

The Defense Logistics Agency (DLA) is a United States (U.S.) Department of Defense (DoD) agency providing worldwide logistics support to the missions of the Military Departments and the Combatant Commands.

Electronic Security Systems (ESS) encompasses Intrusion Detection Systems (IDS), Access Control Systems (ACS), Closed Circuit Television (CCTV) systems, Electronic Key Control Systems (EKC), intercoms, and other alert type systems. EKC includes various type key control systems for DLA facilities, personnel, and property.

SCOPE

This Performance Work Statement (PWS) outlines requirements for the project management, operations and sustainment maintenance support, hardware and software procurement, installation and configuration, application, and cyber security requirements.

Specifically, for this effort the Contractor will provide technical service for DLA Distribution Warner Robins, GA (DDWG). At DLA Distribution Warner Robins, GA (DDWG) the Contractor shall provide services for the Lenel OnGuard ACS, ADT IDS, Pelco CCTV, and Morse Key Watchman systems. The Contractor shall provide installation and/or maintenance support to include, but not limited to: daily operations testing, DoD 8140 cybersecurity support and artifacts, upgrades, patches, migrations, enhancements, inspections, and corrective and preventive maintenance. DLA Distribution Warner Robins, GA (DDWG) is a tenant at Robins Air Force Base, GA. The DDWG footprint totals approximately 3,274,478 sq. ft. which spans across 13 warehouse buildings, one of which is the DLA Distribution Main Warehouse and Administration Building (Bldg. 385). Five (5) of the 13 buildings include Controlled Access (Open Storage) spaces, which have restricted access. The Contractor shall assist with supporting information protection needs and system security requirements for Commercial Off the Shelf (COTS) ESS solutions.

When the DLA networks are utilized, all servers, switches, and workstations are provided by the Government. Software/firmware, in all instances, shall be approved in writing by the DLA J6 Technical Point of Contact (TPOC) in coordination with the Contracting Officer Representative (COR) before procurement and installation.

TASK REQUIRMENTS

The Contractor shall adhere to the following requirements and definitions for all Tasks within this PWS:

TASK 1 – PROJECT MANAGEMENT

The Contractor shall provide sufficient project management to ensure that all contract task requirements are performed efficiently, accurately, on time, and in compliance with the requirements of this PWS. The Contractor shall support the following:

Contract Project Manager (CPM) The Contractor shall provide a Contract Project Manager (CPM) who shall be responsible for the performance of the work. The CPM shall provide project management support for all contract personnel and all items detailed in this PWS. This support includes providing planning, direction, coordination, and the control necessary for effective and efficient accomplishment of all contract requirements. The CPM shall be the senior subject matter expert and monitor, control and report status on cost, schedule, and performance. The CPM will coordinate with the Contracting Officer (KO), the COR, and the J6 TPOC. The CPM shall attend meetings and provide support on task requirements as needed to meet the requirements of this contract. The CPM or alternate shall have full authority to act for the Contractor on all contract matters relating to the operations of this contract. The CPM or alternate shall normally be available as required Monday through Friday, excluding Federal holidays, between the hours of 0700-1530 local time. The CPM or alternate shall be available as required Monday through Friday, excluding Federal holidays, between the hours of 0600-1500 EST to support DLA Distribution Warner Robins Most systems are “next business day” for support; however, in emergency situations support may be required within four hours (emergency repairs). Upon request of the KO or COR, the Contractor shall provide personnel to meet on the installation as required to discuss problem areas. Most systems are “next business day” for support; however, in emergency situations support may be required within four (4) hours (emergency repairs). Upon request of the KO or COR, the Contractor shall provide personnel to meet on the installation as required to discuss problem areas break fix solutions and permanent solutions during the installation and testing period.

Work Effort The Contractor shall manage the total work effort associated with the PWS herein to assure fully adequate and timely completion of all Tasks including, but not limited to, planning, developing, and implementing project plans, scheduling, report preparation, communication and coordinating with stakeholders, escalation procedures, establishing and maintaining records, monitoring, and quality control. The Contractor shall provide fully qualified personnel with the necessary management expertise, training, and certifications to assure the performance of the work in accordance with sound and efficient management practices.

Work Control The Contractor shall implement all necessary work control procedures to ensure timely accomplishment of work requirements, as well as to permit tracking of work in progress. The Contractor shall plan and schedule work to assure material, labor and equipment of all contracted items are available to complete work requirements within the specified time limits and in conformance with the quality standards established herein.

Enterprise Configuration Management (ECM) The Contractor shall adopt DLA Enterprise Configuration Management (ECM) plans ensuring all hardware and software changes are approved by the J6 TPOC and coordinated with the COR. The Contractor shall use the DLA Business Capability Management (BCM) ServiceNow, Change Implementation Plans (CIPs), and provide technical expertise in Enterprise Change Requests (ECRs) that addresses product management and version control for software (changes) and hardware (changes). The Contractor shall support business processes documentation such as Scheduled Maintenance Requests and Information Technology Operations Center (ITOC) notice (INFOSPOT) and all other control items such as customer notifications. The Contractor shall evaluate all changes to the approved system requirements baseline for risk to security, and for schedule and cost impact, provide evaluations in writing and with sufficient detail to allow for review and approval by the configuration governance structure as required. CIPs and ECRs are normally required 21 business days in advance of required change.

Configuration Audit A configuration audit is an inventory of all hardware, software, data, drawings, devices, and technical documentation and is a function of configuration management. The Contractor shall perform a configuration audit and provide to the COR within ten (10) business days of performance start. Asset lists shall be provided upon request and include product details such as hosting location, model, versioning, product type, serial numbers, machine address code (MAC), and other available details about the product, software, hardware, or device. The Contractor shall report updates to asset list(s) within the monthly status reports. Additionally, a data dictionary is required.

Work Schedule The Contractor shall schedule and arrange work to cause the least interference with the normal occurrence of Government business and mission. In those cases where some interference may be essentially unavoidable, the Contractor shall make every effort to minimize the impact of the interference, inconvenience, equipment downtime, interrupted service, and/or customer discomfort. “Site visits for any Preventative Maintenance activities will be coordinated with the COR at least five (5) working days in advance” Non-scheduled visits will be coordinated with the COR at least five (5) working days in advance and notify the COR if the work being performed may cause interference. Notification shall include the type of work to be done and the estimated completion date/time. The Contractor shall reschedule any work that the KO/COR deems necessary to avoid unacceptable disruptions in the Government's business.

Work Records/Reports The Contractor shall maintain management, maintenance, repair records, and reports as set forth herein. All records and copies of reports shall be turned over to the COR within (7) seven calendar days prior to contract completion.

Staffing Contractor shall maintain a certified work force to complete work in accordance with the time and quality standards specified.

Project Schedule/Plan The Contractor shall create, maintain, and submit project plan(s)/schedule(s). Initial plans and schedules are due within five (5) business days after award and will be updated monthly (on 1st Monday of month) until the final inspection is completed. The Contractor shall create, maintain, and submit project plan(s)/ schedule(s) 15 business days following a request for any upgrade, installation, or replacement of device(s) and or application(s). Microsoft Project is the preferred software/format for project plans/schedules. Project plans/schedules shall include Task ID, Task Name, Actual Start, Actual Finish, Baseline Start, Baseline Finish, % complete, resource name/title, with the critical path defined utilizing predecessors and/or successors. The Government may return unacceptable plans and schedules for re-work, and the Contractor shall update and re-submit project plans and schedules within five (5) business days of request.

Meetings The Contractor shall coordinate a post award Kickoff meeting prior to the initiation of work and conduct monthly In Process Review (IPR) meetings. These meetings will be held with the Contractor, CPM, KO, Contract Specialist (KS), COR, and the J6 TPOC to discuss an overview of Contractor’s plans to manage scope, schedule, and resources. The Contractor will discuss stakeholders’ expectations, details of contract execution including incident management, triage support, technology road map plans including current and future software/hardware landscape general conditions, project schedule/plan, work schedules, coordination, security, safety, deliverables, permits, and other matters pertinent to work accomplishments shall be discussed in this meeting. Contractor shall attend other meetings as required in support of contract tasks.

Phase In Training A phase-in period shall be established to allow the Contractor sufficient time to integrate personnel and transition into duties required to perform the requirements of the contract and ensure employees who will require access to the Installation and Government Information Technology (IT) systems obtain a Common Access Card (CAC) In Accordance With (IAW) this PWS. Instructions for all Phase in Training are available upon request.

The phase-in period shall begin at the effective date of the contract and shall not exceed one (1) month, at which time full performance shall commence.

The Contractor shall ensure that all Contractor personnel are ready to begin working on the first day of full performance including obtaining any account access, permissions, and/or roles required to administer the application software/hardware. Training and documentation such as rules of behavior and cyber awareness may be required for accesses.

During the phase-in period, Contractor personnel shall complete security and safety training on site. Training will be scheduled through the DDWG site training office and will at a minimum include the following classes. Estimated time to complete is three (3) hours.

Active Shooter Briefing Safety Briefing Shelter in Place/Evacuation Awareness Briefing During the one-month phased-in period to ensure all Contractor personnel know and understand regulations and policy pertaining to physical, information, operations, and personnel security. The Contractor shall provide security and antiterrorism training to all employees in accordance with applicable DOD regulatory requirements. At a minimum, estimated in class time is eight (8) hours, security training requirements as required by the DLA Issuances and other applicable DOD guidance, will be completed annually for the following on-line training. If the Contractor has previously taken this training valid copies of completion is allowed. The current mandatory training courses are:

Cyber Awareness Challenge Safety Briefing Shelter in Place/Evacuation Awareness Briefing

d. Antiterrorism (AT) Level 1

e. Operations Security (OPSEC)

f. Counterintelligence Awareness Training

g. Personally Identifiable Information Awareness

h. Trafficking in Persons The security training is web-based, and access will be provided by the Government. The Contractor shall ensure Contractor personnel have taken the required security training to meet DoD guidance and that the personnel continue to maintain their certifications. The Government may add, delete, or change the annual training requirements.

Transition Support The Contractor shall provide knowledge transfer and training to any follow-on provider to include all the necessary documentation, orientation, collaboration, and training to facilitate the comprehensive understanding and execution of tasks, processes, procedures, schedules, and deliverables in a timely and orderly fashion. All transition activities shall be coordinated with and approved by the COR. This task may start up to ninety days before the end of a base or option period.

The support services provided under this contract are critical to the DLA mission. It is vital that to ensure continuation of services without interruption or dramatic effort be provided. To maintain continuity of services the following requirements will be provided by the Contractor:

1. Continue to perform all services as prescribed within the PWS and existing Task Orders without reduction of manpower, quality of services and interruption to customers.

2. Provide a transition plan to include risks and costs associated with the transition of Contractor support within fifteen (15) business days of request for a transition plan from the COR. The transition plan shall address impacts including:

1. Provide current active project transition services associated with any upgrade, migration, and/or enhancements planned or in-process.

Assist secure required permission, roles, account accesses required for administration of software/hardware.

Provide landscape and asset documentation, data dictionaries, or other system documentation for DLA equipment, hardware, software, processes, and overall environment.

Provide transition cost analysis, propose schedules, and document risks associated with such transition.

TASK 2 – OPERATIONS, SUSTAINMENT, AND MAINTENANCE SUPPORT

The Government’s overall functional and technical requirements for operational sustainment and maintenance support for DLA ESS and EKC systems are listed in this section.

The Contractor shall provide the equipment, spares, and hardware for CCTV NVR HW support, and the personnel software/firmware required for all sustainment of the ESS and EKC applications including support to version upgrades, enhancements, and migrations required for ESS and EKC systems and subsystems.

Preventative Maintenance (PM) includes a recurring set of scheduled services and actions which the Contractor shall provide to keep the application servers and workstations fully operational and compliant. This includes but is not limited to logging into the system application every fourteen (14) days to ensure access remains active, checking the health of the application and systems at least once monthly, and a review of the Secure Technical Implementation Guide (STIG) annually. All required cyber updates and patches shall be done through Preventative Maintenance including Information Assurance Vulnerability Alert (IAVAs), Cyber Task Order (CTO), Assured Compliance Assessment Solution (ACAS) scan remediations or any other cyber requirements to include updating or creating any supporting cybersecurity documentation required for assessment and accreditation.

Corrective Maintenance (CM) is the non-recurring unscheduled repairs or services required to make systems fully operational and maintain compliance. This includes but is not limited to addressing newly identified vulnerabilities on the system, addressing issues with the service accounts, and root cause analysis with a detailed report sent to the TPOC and COR for permanent resolution.

The Contractor shall provide application sustainment and maintenance support for DLA ESS and EKC systems to ensure they remain operational IAW the Government’s requirements. For the legacy ESS software, the Contractor shall be responsible for providing all technical support/software maintenance and, if available, documentation for this software until the Contractor completes the upgrades to supported versions.

3.2.1 Operations

The Contractor shall support daily operations of systems including system monitoring, break/fix triage support, incident management, project management, configuration management and PM/CM required in day-to-day operations support. While a dedicated, onsite, full time equivalent (FTE) is not required - the Contractor may coordinate with the site to provide the necessary operations support for all ESS systems remotely, or onsite as needed, to meet the site’s requirements. The Contractor shall provide an Incident Response Plan (IRP) for incident management to the COR and J6 TPOC for approval

3.2.2 Sustainment

The Contractor shall develop and implement a Sustainment Plan for all systems, subsystems, and equipment IAW with original equipment manufacturer and/or Federal/DoD/DLA policies and procedures. The Sustainment Plan shall include the periodic maintenance such as patching vulnerabilities, planned version upgrades of the application and Operating System (OS) in coordination with the J6 TPOC. The Contractor shall provide the Sustainment Plan which includes the technology road map, the PM schedule, and Corrective Maintenance (CM) approach to the COR for approval within five (5) days of contract award. The Sustainment Plan should include:

1. Position qualified and certified personnel, test equipment, and other pertinent information needed to quickly diagnose and make repairs.

2. Plan, perform, and document system confidence tests, periodic inspections, and preventive maintenance of the application and servers.

3. Identify critical system operations and implement strategies to prevent potential failures or administrative downtime from creating a critical system outage.

4. Provide after-hours support response times within 4 hours for tickets/issues

5. Since these applications are health and safety systems, they require high uptime ~ 99.6%, 24/7, 365 and the Contractor should maintain and support as such. Contractor shall include uptime statistics in the Monthly Status Report.

6. Analyze fault histories and fault trends to proactively predict and mitigate repetitive issues.

7. Respond to and take corrective action to resolve vulnerabilities identified by the Contractor or the Government. Lead the efforts to resolve the vulnerabilities associated with the ESS applications, servers, clients, or equipment, coordinate resolution with appropriate DLA Technical Reps that support OS, hardware, etc. as required.

8. Provide ongoing training for Government personnel as requested in support of the existing ESS/EKC.

9. As a software upgrade becomes available, the Contractor shall develop a plan for the upgrade and present that plan to the COR for approval. The COR will present this plan to the J6 TPOC for routing for J62 approval. Once approved, the Contractor shall execute their plan to install the upgrade(s) and return the ESS system(s) to an operational state.

The Contractor will be responsible for all version upgrades, patching, device enhancements, device replacements that reach end of life/support and for device replacements of hardware equipment that does not meet cyber standards/requirements including migrations required for ESS and EKC systems compliance.

TASK 3 – APPLICATION, NETWORK, AND INFRASTRUCTURE SUPPORT

The Contractor shall support application network and infrastructure requirements including:

Application System and Network Requirements All system/network components and applications shall be compatible with all applicable Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs). Any STIG exceptions must be identified as part of the Contractor’s proposal to the Government and approved by J6 Cybersecurity. Exceptions incurring risk found unacceptable to the DLA Authorizing Official are not permitted.

All network components and applications shall be IPv4 and IPv6 compatible.

Network components shall allow configuration of IEEE 802.1x or port security for authentication.

The Contractor shall provide a complete list of all ports, protocols and services required for any computer system running control system applications or required to interface the control system applications. The listing shall include all ports and services required for normal operation as well as any other ports and services required for emergency operation. The listing shall also include an explanation or cross reference to justify why each service is necessary for operation.

i. The Contractor shall identify any system wireless communication capability, enabled, or disabled. All wireless communications shall meet applicable STIG requirements to include FIPS 140-2 certification. Any requirement to use wireless or cellular must be approved in writing by DLA J6, coordinated with the J62B PM and documented with the DLA Frequency Manager.Information and Operational Technology Infrastructure Requirements In general, DLA is expected to furnish the IT Infrastructure to host the Operational Technology (OT) solution(s) and/or system(s) (including VLANs, and Virtual Machines (VMs)) unless there is a hardware, compatibility, or mission issue preventing it. As such, the Contractor must clearly identify “what” anticipated Government IT Infrastructure is required to host and operate the OT solution(s) and/or system(s) within the design documentation submitted for Government approval at time of award. These anticipated designs will be incorporated into the system CONOPs. The Contractor will be responsible for all installation, configuration, and deployment of the OT solution(s) and/or system(s) (including but not limited to) its subsystem(s), application(s), and patch cabling, if required.

Any requirement for the Contractor to provide their own IT Infrastructure, standalone server, or management workstation hardware due to compatibility issues must be documented in the Contractor’s proposal and approved by J6 prior to contract award. All Contractor provided IT Infrastructure must meet DoD STIG requirements. If the Contractor provides their own IT Infrastructure for the OT solution(s) and/or system(s), upon AO approval of the security authorization package (and prior to final OT solution(s) and/or system(s) acceptance or go-live), all Contractor provided IT Infrastructure will become the property of the Government.

All specialized software provided by the Contractor to the Government must have the applicable license key(s) as well as sales/transaction records, ownership control(s), manuals, technical publications, documentation, and any other information supporting ownership accompanying it. At the time of Contractor hand-off of Contractor owned IT Infrastructure to the Government, all design information for Enterprise Architecture (EA) for the “as built” OT solution(s) and/or system(s) will be provided. Any Contractor provided OS, software, and firmware throughout the duration of the contract will be upgraded by the Contractor prior to the Contractor’s end of mainstream support for the OS, software, or firmware.

DLA’s preference is for maximized virtual IT Infrastructure. As such, the Government will provide the virtual infrastructure to support deployment of Contractor supplied virtual servers or virtual appliance (OVA files). DLA will provide a virtual server up to the following:

1. CPU: 12 Cores

2. RAM: 32GB

3. Disk 1 (OS Drive): 150 GB

4. Disk 2 (Data Drive): 150 GB

Any requirements exceeding these specifications shall be submitted in writing and approved by the DLA J6 with supporting documentation prior to contract award.

Other PWS contractor content considerations as applicable:

1. Level 1-2 OT and Level FRCS Role-based authorization tools requirements and integration

2. Level 2 Challenge/response authentication

3. Physical/token authentication

4. Location/local-based L 0 -2 authentication

5. Password distribution and management technologies requirements

6. Device-to-device authentication and switching

7. Filtering/blocking/access control technologies

8. Host-based firewalls/firewall

9. FRCS Network Segmentation and Firewalls as applicable

a. Unidirectional Gateways

b. Local Area Networks (VLAN)

c. Software-Defined Networking (SDN) Network Monitoring/Security Information and Event Mangement (SIEM)The Contractor will be responsible for the implementation including meeting all required STIG compliance.

The Contractor shall be responsible for all configuration and deployment which meet DoD, NIST and USG regulatory and cybersecurity policy requirements.

Any OT solution(s) and/or system(s) with IT Infrastructure provided by the Contractor must be upgradeable and remain compliant to cybersecurity specifications during the lifecycle of the solution. Contractor supplied systems must meet DoD STIG requirements, with any exceptions noted in the design documentation.

The Contractor is responsible for all software maintenance activities for any/all appliances including but not limited to, firmware updates, OS patching, software patches etc. for the duration of the contract period.

The Contractor will be responsible for all physical maintenance activities for any/all appliances including but not limited to, replacement of defective components such as hard drives (to be destroyed onsite per DoD policy, guidance), motherboards, daughterboards etc. for the duration of the contract period.

(NOTE 1: The maintenance service provider can be an organization within the asset owner’s organization.)

(NOTE 2 There can be one or more maintenance service providers maintaining the Automation Solution at the same time or in sequence.)

Maintenance activities start after handover of the DLA Automation Solution to the DLA asset owner and may continue until the asset owner no longer requires them.

Activities are typically short and frequently recurring, and may include one of more of the following:

a. Patching and anti-virus updates

b. Equipment upgrades and maintenance, including small engineering adjustments not directly related to control algorithms

c. Component and system migration

d. Change management

e. Contingency plan management All maintenance activities will include completion of identified DoD/DLA Security Awareness training, independent of other training received.

System(s) shall operate using a Contractor fully supported operating system (OS), software, and firmware throughout the duration of the contract. All operating systems, software, and firmware shall be upgraded prior to the Contractor’s end of mainstream support for the operating system, software, or firmware. The solution must be upgradeable and remain compliant to DoD cybersecurity specifications during the lifecycle of the solution.

Any removable flash media required for system operation must be reviewed and approved in writing by the DLA J6 Flash Media Approval Program prior to implementation.

All FRCS OT solution(s) and/or system(s) must use the PERA Model for Control Hierarchy (reference ISBN 1-55617-265-6) to provide logical and/or physical architecture for networking, security hardware, software, and methods. The PERA Model is an industry standard for manufacturing and/or industrial control systems that segments hardware, devices, and equipment into a hierarchical based design.

TASK 4 - CYBERSECURITY REQUIREMENTS

The Contractor shall provide cybersecurity (CS) in accordance with all current policies, procedures, and statutes, to include (but not restricted to) the following, as applicable, to specific task orders (most current version):

System Identification Reference Documents:

a. Committee on National Security Systems Instruction 1253, Security Categorization and Control Selection for National Security Systems, July 29, 2022

b. Federal Information Processing Standards Publication 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004

c. Federal Information Processing Standards Publication 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

d. Federal Information Security Management Act (P.L. 107-347, Title III), December 2002

e. Department of Defense Instruction 5000.02, Operation of the Defense Acquisition System, January 23, 2020

f. Department of Defense Instruction 5200.39, Critical Program Information (CPI) Identification and Protection within the Research, Development, Test, and Evaluation (RDT&E) Incorporating Change 3, Effective October 1, 2020 System Compliance, Instructions and Guidelines Reference Documents:

a. 44 U.S.C. § 3542, January 2012

b. Department of Defense Instruction 8500.01, Cybersecurity, Incorporating Change 1, Effective October 7, 2019

c. Department of Defense Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology, July 19, 2022

d. Department of Defense Instruction 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems & Networks, Incorporating Change 3, October 15, 2018

e. DoD Program Manager’s Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System Acquisition Lifecycle

f. Defense Acquisition Guidebook (DAG)

g. Department of Defense Directive 8140.01, Cyberspace Workforce Management, October 5, 2020

h. Department of Defense Instruction 8330.01, Interoperability of Information Technology (IT), Including National Security Systems (NSS), September 27, 2022 System Cybersecurity Implementation Reference Documents:

a. Department of Defense Instruction 8580.1, Information Assurance (IA) in the Defense Acquisition System, July 9, 2004

b. National Institute of Standards and Technology Special Publication 800-82 Revision 2, Guide to Industrial Control Systems (ICS) Security, February 2015

c. UFGS-25 50 00.00 20 Cybersecurity of Facility-Related Control Systems

d. United Facilities Criteria (UFC) 4-010-06, Cybersecurity of Facilities-Related Control Systems Personnel Requirements Reference Documents:

a. DoD Manual (DoDM) 8140.03 Cyberspace Workforce Qualification & Management Program, dated 15 Feb 2023

FRCS Guidelines Reference Documents:

a. Deputy Under Secretary of Defense (Installations and Environment) Memo dated 19 Mar 14, subject: Real Property Related ICS Cybersecurity

b. Defense Logistics Agency Risk Management Framework Standard Operating Procedures, April 2021

c. Office of the Assistant Secretary of Defense Facility Related Control Systems (FRCS) Master List Memo, October 2020

d. Department of Defense Control Systems Security Requirements Guide Version 1, Release 1, July 14, 2021 The Contractor shall provide the following accreditation artifacts:

a. System Diagrams Architecture Network Diagram Authorization Boundary Diagram Data Flow Diagram Purdue Diagram

b. Comprehensive Hardware Inventory Report

c. Comprehensive Software Inventory Report

d. Concept of Operations (CONOPS)

e. Plan of Actions and Milestones (POAM)

f. Software Upgrade and Support Plan (SUSP)

g. Ports, Protocols, and Services Management (PPSM) Documentation for Registration

h. Federal Information Processing Standard 199 (FIPS-199) Cybersecurity Strength Requirements

i. PII Confidentiality Impact Level (PCIL) Categorization Worksheet

j. Enterprise Configuration Management Plan

k. Security Technical Implementation Guide (STIG) and Security Requirement Guides (SRG) Mitigations

Cybersecurity Strength Requirements The Contractor shall provide the following cybersecurity strength requirements including, but not limited to the following:

1. The Contractor shall adhere to all existing authorities and policies of the Director of National Intelligence regarding the protection of sensitive compartmented information (SCI), as directed by Executive Order 12333 and other laws and regulations.

2. The Contractor shall satisfy the Risk Management Framework (RMF) requirements of subchapter III of chapter 35 of Title 44, United States Code (U.S.C.), also known as the “Federal Information Security Management Act (FISMA) of 2002”.

3. The Contractor shall enable DLA to meet the standards required by the Office of Management and Budget (OMB) and the Secretary of Commerce, pursuant to FISMA and section 11331 of Title 40, U.S.C.

4. FIPS 199 / CNSSI 1253 Security Categorization: The Contractor shall participate in categorization discussions with the DLA J6 TPOC, functional lead, and the Information System Security Manager (ISSM) and provide all required FIPS 199 documentation as requested to support security categorization.

5. The Contractor shall provide a recommendation on system categorization based on sound technical expertise in accordance with FIPS 199 then work in coordination with the prescribed DLA System Owner (SO) and ISSM to support the categorization IAW FIPS 199, CNSSI 1253 and OSD Facility Related Control Systems (FRCS) Master List including DLA specific systems, then document the results of the security categorization in the System DLA FIPS 199 document and the Concept of Operations (CONOPs).

6. Assigned DLA PM will coordinate with the Contractor to identify and document Confidentiality, Availability, Integrity (CIA) of the system in a DLA FIPS 199 document for approval by DLA J6 ISSM personnel.

Completion Of System Hardening (Scan/Fix/Scan) Testing and Analysis The Contractor shall harden systems using a scan, fix, scan methodology remediating findings IAW current DOD, DLA, and Defense Information Systems Agency (DISA) standards. This includes automated and manual STIG application, Assured Compliance Assessment Solution (ACAS) scanning, Web Inspect, and any other hardening efforts required to make the system ready to connect to a DOD network. Whenever findings occur, as required periodically, and/or following any major system change, the Contractor shall scan/fix/scan until all issues have been fixed and/or properly and acceptably mitigated. Any Critical or High impact level findings that cannot be fixed are to be reported to the J6 TPOC/ISSM immediately along with a valid reason the vulnerability cannot be fixed and a POAM. Once the Contractor has completed hardening efforts, system monitoring and audits shall occur to ensure STIG compliance is maintained.

Cybersecurity Assurance Requirements The Contractor shall design, develop, and integrate cybersecurity solutions supporting the Department of Defense and all other applicable Government agencies. This will be achieved through abiding by all applicable cybersecurity policies, regulations, and directives to ensure a favorable Assessment and Authorization (A&A), Assessment and Incorporate (A&I), or FRCS Assess Only Risk Assessment decision, as well as obtaining an Authority to Connect (ATC) to DLA’s network. The Contractor shall mitigate risk identified through the RMF authorization process down to a level acceptable to the DLA Authorizing Official (AO).

Coding for Security. The Contractor shall provide documentation of development practices and standards applied to Government approved Contractor-written control system software, including firmware, used to ensure a high level of defense against unauthorized access.

The solution shall comply with the security control requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r4, “Security and Privacy Controls for Federal Information Systems and Organizations” and NIST 800-82r2, “Guide to Industrial Control Systems (ICS) Security”. The Contractor shall provide details of any alternative but equally effective security measures used to compensate for the inability to satisfy a particular derived security requirement (mitigation to control compliance findings). This information shall be submitted in writing to the DLA J6 for cybersecurity approval as soon as the alternative is identified.

Typical Contractor services activities include:

a. Analyzing DLA physical, electrical, computerized, and mechanical environments the identified FRCS solution will control (e.g., the physical Operational process to be controlled, such as those used in manufacturing, metering and robotics)

b. Developing a DLA Automation Solution FRCS architecture in terms of devices, dataflow, and control loops, outlining interconnectivity with engineering and operator workstations, and Safety Instrumented Systems (SISs) for testing; testing shall be in accordance with DoD Control Systems Security Requirements Guide (SRG), and other identified DLA test processes.

c. Defining how the DLA FRCS Automation Solution will connect to external (e.g., plant) and networks, by system description, concept, and dataflow diagram on Perdue Levels. Guidance on the applicability of Purdue Enterprise Reference Architecture (PERA) levels are found in the United Facilities Criteria (UFC) 4-010-06, Cybersecurity of Facilities-Related Control Systems.

d. Installing, configuring, patching, backing up, and testing for DLA handover of the Automation Solution to the DLA asset owner for operation.

e. Gaining approval of the DLA asset owner for many of the decisions made and outputs generated during the execution of these activities.

The Contractor shall protect unclassified DoD data from unauthorized access or disclosure in accordance with DoDI 8582.01, “Security of Unclassified Information on Non-DoD Information Systems.” Controlled Unclassified Information: All Government controlled unclassified information obtained by the Contractor shall be protected in accordance with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations”.

Agencies or Military Services providing external information system services must comply with DLA information security requirements and employ overlayed security controls in accordance with applicable federal laws, Executive Orders, directives, instructions, policies, regulations, standards, and guidance.

To support cybersecurity assessments and monitoring, the contractor may be required to obtain access to eMASS in order to review and/or input information in eMASS..

3.5 TASK 5 – HARDWARE PROCUREMENT, INSTALLATION AND CONFIGURATION

3.5.1 PROCUREMENT

The Contractor will be responsible to procure all materials and equipment required for fulfillment of task items within 30 calendar days of written request for the duration of this contract. All materials and equipment for this project shall be new, not refurbished, and shall be submitted in the Hardware/Software Inventory Report to the COR, TPOC, and approval by the Government Information System Security Manager (DLA ISSM) prior to procurement to ensure it can be supported and complies with the National Defense Authorization Act (NDAA). The Contractor shall be responsible to ensure all equipment can be configured/programmed to make the security system of this contract operational.

3.5.2 INSTALLATION AND CONFIGURATION

When installs are required as part of maintenance and sustainment, then the Contractor shall furnish all labor needed to support the installation, configuration, cybersecurity, testing, and other related support required for this PWS effort that cannot be completed by the onsite security personnel. Upon completion of work, Contractor shall turn over a complete and fully operational integrated system as described in this PWS. The Contractor shall procure, install, configure, integrate, and test all devices at the application level. All items purchased must have approval by the DLA ISSM prior to procurement to ensure it can be supported and complies with the NDAA. If any device/equipment fails after the Contractor has commenced work on that device/equipment necessary corrections shall be performed to this equipment in a timely manner or replaced. Responsibility for repair costs due to negligence or abuse of Government equipment shall be the responsibility of the Contractor.

1. The Contractor shall install and configure NVR/DVR appliance hardware, software, client workstation software/monitors and all other items required to deliver a fully operational CCTV/VSS.

2. The Contractor shall work with the COR and other DLA Representatives to coordinate for network connectivity, IP addresses, firewall rules/access and other related support.

3. The Contractor shall provide an Operational Test Plan for the ESS, EKC and CCTV. The Contractor shall test all components and interconnections to ensure proper configuration and operation. The Contractor shall ensure the Government Representative witnesses the Operational Testing and the Contractor shall provide a Test Acceptance Report to the Government for signature.

4. Cybersecurity Support for all ESS/EKC application systems (ACS/IDS/CCTV). The Contractor shall complete the security scanning, STIG compliance processes including repeating scan, STIG, scan until vulnerabilities are remediated or accepted in a Plan of Action and Milestones (POAM) provided by the Contractor. The Contractor will provide all associated documentation to obtain a favorable Risk Management Framework (RMF), or other accreditation assessment determined by the DLA ISSM. The Contractors shall complete the assessments identified by the DLA ISSM and those may include but are not limited to the DVR/NVR hardware, application software; workstation hardware and other items.

GENERAL REQUIREMENTS

This Section provides general information relating to the conditions of operation and general requirements relating to this PWS.

1. This is a non-personal services contract to provide implementation of maintenance and sustainment of the DLA Distribution Warner Robins ESS and EKC systems. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government. The Government and the Contractor understand that the services to be provided under this contract by the Contractor are non-personal services and that no employer-employee relationship exists between the Government and the Contractor. The Government may provide technical direction which will assist the Contractor in accomplishing the PWS; however, the Government will not control the methods used by the Contractor to perform the service requirements set forth in the PWS.

2. The services shall include:

a. Maintenance and Sustainment of ESS and EKC applications (LENEL OnGuard ACS/IDS, Key System GFMS, and PELCO Video Expert Suite CCTV)

b. Installation, configuration, testing of CCTV NVR HW and SW and migration to an approved OT network.

3. The Contractor shall furnish all labor, supervision, tools, materials, equipment, transportation, and management necessary for maintenance and support listed in this PWS.

4. The Contractor shall be an authorized, licensed service representative of LENEL OnGuard, Key System GFMS, and PELCO Video Xpert Suite and comply with all applicable DoD, Federal, State, and local laws in addition to their 8140 certifications. The Contractor shall maintain updated copies of any applicable licenses and certifications for all employees and make them available to the Government upon request.

5. With the ongoing efforts keeping up with cyber and enterprise infrastructure updates, the Government reserves the right to ADD to or DELETE from the ESS and EKC maintenance contract anytime during the period of the contract as the need arises.

6. The Contractor shall submit an Accident Prevention Plan to the Contracting Officers Representative (COR). No work shall start prior to COR receiving the approved Accident Prevention Plan.

7. The Contractor shall turn over any equipment or material removed through this task to the Government at the completion of work, or after COR approval, properly dispose of in accordance with regulations and/or local codes.

8. The Contractor shall maintain a separate set of drawings, elementary diagrams, and wiring diagrams of the system to be used for As-Built Drawings and shall keep this set accurately and neatly up to date with all changes and additions throughout the contract. As-Built Drawings shall be developed and maintained by the Contractor and depict actual conditions. As-Built Drawings are to be submitted to the COR in original Auto Computer Aided Design (AutoCAD) and Adobe Portable Document Format (PDF) format and shall not be overlays. A complete As-Built Drawing will be submitted to the Government within fourteen calendar days of completed work.

9. The Contractor will provide a monthly status report which shall include, but not limited to:

a. Contract number

b. Brief task description

c. Review of project plans including work accomplished during the reporting period and/or significant events

d. Project progress

e. Problem areas

f. Anticipated activity for the next reporting period

g. Project Schedule/Plan

h. Configuration Management Plan

i. Configuration Audit

j. 8140 Report Spreadsheet

k. Contractor Quality Control Plan

l. Data Dictionary

m. Dashboard

n. Badge Statistics

o. Server and System Uptime Statistics

p. Software Version

q. Licenses and SUSP

r. Phone and Email Support

s. Maintain communications with the Government as to the status of site status/issues/activities in achieving operational, cost, and schedule.

10. The Contractor shall follow all applicable National Electrical Code (NEC), Unified Facilities Criteria (UFC), United Technologies Corporation (UTC), National Fire Protection Association (NFPA), and Security Standards.

11. The Contractor will follow all Security Technical Implementation Guides (STIGs), Data Encryption standards, Intelligence Community Directive (ICD)/ Intelligence Community Standard (ICS) 705, DLA Physical Security Manual and DLA building codes.

12. The Contractor shall obtain written COR approval if any digital or physical media is required. All video, still photos, digital photos, all usernames, passwords, and any other documentation obtained and developed during the execution of this contract shall be turned over to the Government with all digital and hard copy files and associated negatives at the completion of this project. Digital photographs shall be submitted to the Government on Compact Disk (CD) in Joint Photographic Experts Group (JPG) format, and the Contractor shall delete all associated files from their records.

TASK OPTIONAL – EXTERNAL SYSTEM CHANGES

This PWS includes requirements for an Optional Task that the Government may fund in the future after contract award. Distribution has a requirement for the Contractor to provide maintenance and sustainment services for United States Army Corps of Engineers (USACE) planned FY24 system replacements and upgrades to the site’s ACS, IDS, CCTV, EKC, and intercom systems and equipment in accordance with (IAW) all other general requirements of this PWS. As-Built packages will be provided for all completed system changes conducted by USACE. The Contractor shall support all hardware, software cabling and components associated with USACE ESS work. The Contractor shall support any ESS HW, SW, and equipment installed by USACE regardless of how it is installed or configured.

*Integrate J6 keybox/system into existing site EKC system.

SOFTWARE AND HARDWARE UPDATES, APPLICATION UPDATES AND PASSWORDS

The Contractor shall provide all software and hardware updates when an upgrade/patch is released from the Original Equipment Manufacturer (OEM). The Contractor shall maintain an accurate software and hardware configuration and coordinate through authorized sources, such as a Lenel Value Added Reseller (VAR), for all equipment and any other authorized application. Any software or hardware updates will need to be coordinated directly with the J6 TPOC prior to procuring. This includes any utilities required to develop, communicate, and make configuration updates to a system. All hardware must be National Defense Authorization Act (NDAA) compliant. The Contractor shall provide all STIG documentation for application upgrades. The Contractor shall provide documentation identifying they changed all appliance passwords and disabled or removed all unnecessary accounts. The Government should receive a complete listing of all new passwords. Significant hardware and/or software changes, such as server operating system or application software upgrades, will result in a requirement for the Contractor to deliver new or updated/revised artifacts in support of a complete cybersecurity assessment of the system.

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

In fulfillment of this effort, the Contractor shall provide the deliverables identified in this section. All deliverables shall be submitted to the COR for acceptance unless otherwise directed by the Government.

Unless otherwise specified, the Government will review draft deliverables and provide comments back to the Contractor or approve or disapprove the deliverable(s) within ten working days.