Attachment 1 - IDIQ Draft PWS 2024-09-10.pdf

Defense Advanced Research Projects Agency

(DARPA)

Information Technology Directorate (ITD)

ManAged eNterprise Network sUpport serviceS (MANNUS)

Indefinite Delivery/Indefinite Quantity (IDIQ)

Performance Work Statement (PWS)

Dated: 10 September 2024

1.0 GENERAL

1.1 INTRODUCTION

The Defense Advanced Research Projects Agency (DARPA) is the research and development agency for the U.S. Department of Defense (DoD). The DARPA mission is to maintain U.S.

technological superiority over potential adversaries by identifying, developing, and supporting breakthrough technologies of interest to the military. DARPA is located at 675 North Randolph Street, Arlington, VA 22203-1714.

The key to DARPA’s success has been, and continues to be, its ability to attract the brightest minds from Government, industry, and academia and provide them an environment that facilitates their ability to turn ideas into practical, leading-edge technology. DARPA requires Information Technology (IT) services that facilitate this creativity by providing world-class Government service, state-of-the-art tools and services, and rapid, flexible and innovative response to mission essential and evolving Government requirements.

1.2 BACKGROUND

DARPA’s operational environment (OE) is dynamic, where distributed and decentralized operations are the norm in order to support agile, finite research and development (R&D) program objectives in both enterprise-connected and disconnected, or platform IT (PIT), environments. The largest area of influence and concern to the DARPA OE are the commercial and academic entities within the Defense Industrial Base (DIB), who perform the vast majority of DARPA-funded research programs using a myriad of both DARPA and non-DARPA furnished IT services. These IT services can operate as stand-alone IT systems or within the global DOD Information Network (DODIN), of which encompasses DARPA's cyberspace area of operations and are bound by IT systems authorized by and aligned with forces by DARPA.

DARPA’s Information Technology Directorate (ITD) is responsible for providing and managing administrative networks to the Agency for typical IT administrative requirements such as back-office applications, collaboration, project management, reporting, financial, and other such day-to-day operational requirements. These IT requirements are known as either common use or episodic IT solutions which are essential to DARPA’s mission objective. Additionally, ITD provides mission critical research networks, systems, and services to the Agency and for its performers.

ITD provides Unclassified, Secret, Secret/SAR, TS/SCI, and TS/SCI/SAR networks and IT services utilizing traditional data centers, cloud services, and DOD enterprise services for the Agency and its performers.

DARPA is a Department of Defense (DoD) organization and therefore must comply with the NIST Special Publication (SP) 800-53 Risk Management Framework (RMF) in order to operate.

Therefore, DARPA prescribes to an iterative lifecycle for all services to be provided by the

Contractor. The DARPA services lifecycle is an ongoing process of continual improvement, “state-of-the-shelf” products, initial assessments and continuous monitoring of the security posture and compliance of all services to ensure that DARPA networks maintain their authority to operate (ATO).

DARPA’s classified IT environment provides users with an array of both collateral and compartmented Windows-based networks, an enterprise cross domain solution (CDS) administrative network, and an enterprise multi-compartmented platform IT (PIT) network.

DARPA categorizes the classified networks it supports by “Protection Levels (PL)” 2-4, as defined in the latest version of the DoD Joint Special Access Program (SAP) Implementation Guide (JSIG).

DARPA’s PL-4 enterprise CDS network combines cross domain (CD) technology and traditional Windows interfaces that allows a user to access single level PL-2 and PL-3 networks, transfer data between networks and domains of varying levels and/or compartments and collaborate at commonly shared levels and compartments. This provides DARPA users with a single window interface that reduces complexity of navigation through file systems and email, including but not limited to e-mail, files, and web and collaboration services within a CD, secure environment. The CDS instantiations are jointly assessed and authorized by DARPA and a mission partner in accordance with JSIG, Committee for National Security System (CNSS) Instruction 1253, and NIST Special Publication (SP) 800-53 [latest version] and tailored security controls for impact levels of High/High/Moderate, as well as CNSSI 1253 overlays for Intelligence and CDS, and the JSIG overlay for Accessibility. The CDS technologies are compliant and registered with the National Cross Domain Strategy & Management Office (NCDSMO) as a baseline CDS. Users are able to access applications and information, perform data transfers, and exchange e-mails and files, at multiple levels of security, from a single computer workstation. Connectivity with other DoD and Intelligence Community IT networks, systems, and databases are available.

The following definition of “DARPA Cyberspace” characterizes the span of IT capabilities scope within any of the preceding scope of work categories that this IDIQ can support. DARPA Cyberspace. DARPA Cyberspace is the set of DARPA-owned, leased, or authorized information capabilities and associated processes for collecting, processing, storing, disseminating, and managing information persistent or episodically to Agency leadership, program managers, research performers, mission partners, and support personnel, whether interconnected or stand-alone. This includes communications and computing systems and services, hardware, software, data, security services, other associated services, and national security systems. DARPA Cyberspace includes common enterprise service networks, intelligence networks, special access program networks, research program systems, mobile systems, electromagnetic and radio frequency systems, industrial control systems, isolated laboratory networks, platform information technology (PIT) hardware and software, and other special-purpose systems. DARPA increasingly relies on commercial and government cloud services for on-demand data processing, data storage, and application hosting, without active management by the DARPA user.

1.3 OBJECTIVE

This is a non-personal services contract to provide the DARPA IT Enterprise, DARPA Technical Offices (TO), and Support Offices (SO) with all IT services and product lifecycle support, to include commodity and episodic mission IT. The primary objective of this PWS is to provide an enhanced organizational capability that allows ITD to support DARPA’s operational and research requirements. This enhanced capability must have the flexibility to programmatically and contractually incorporate episodic IT requirements. DARPA mission and research networks, new IT services, technologies and other episodic IT requirement capabilities provided by ITD will in part be managed through this PWS.

DARPA may use other Government or commercial third parties to advise and/or assist in independent verification and validation and performance monitoring of the Contractor. The Contractor shall participate and provide timely, reliable and effective input in the contract oversight process.

1.4 SCOPE OF WORK

DARPA’s IT services consist of standalone systems, local area networks (LANs) and wide area networks (WANs) that are located in DARPA, DIB, Government Partner facilities, commercial cloud services providing Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) solutions to the Agency. These include:

• IT planning, engineering, execution, operations, sustainment, and assessment services.

• IT product and services management.

• Common operational picture services, to include Enterprise picture and System tactical picture.

• Secure voice and video services.

• Communications resiliency, redundancy, failover.

• Communications system services.

• Business, operations, data, and research intelligence services.

• Cross-domain information-sharing services.

• Controlled interface services with mission partner networks.

2.0 SCOPE OF WORK CATEGORIES

A description of each Category follows with a list of technologies and services the contractor shall provide in the event a task order is issued. Each task order shall identify the base IDIQ category or categories which apply to the task order. Once a task order is completed, documentation, transition of knowledge and training shall be conveyed in accordance with task order transition plan.

2.1 TECHNICAL OFFICE IT REQUIREMENTS

2.1.1 ADVANCED WINDOWS SYSTEM INTEGRATION AND SERVERS’

APPLICATION SUPPORT

The contractor shall provide advanced Windows systems support including the pre-installation planning activities, installation, and problem determination, resolution, documentation, securing and transition of knowledge of new applications or services. This category shall also include technology trials, pilots, prototypes and proofs of concept, residing on Windows based operating systems that have not been previously used in the DARPA enclave. These applications and services may require subject matter expertise through product vendors, to provide state-of-the-art support and implementation of the next generation of services. Examples include but are not limited to:

a. General COTS/GOTS applications

b. Exchange

c. SharePoint

d. Network Security Design and Implementation (e.g., Internet Security Appliance (ISA))

e. Domain migration and configuration (e.g., Active Directory)

2.1.2 ADVANCED NON-WINDOWS SYSTEMS INTEGRATION, APPLICATIONS AND

SERVERS SUPPORT

The contractor shall provide non-Windows systems support including pre-installation planning activities, installation, and problem determination, resolution, documentation, securing and transition of knowledge of new applications or services. This category shall also include technology trials, pilots, prototypes and proofs of concept, residing on non-windows based operating systems that have not been previously used in the DARPA enclave. Technologies and services included, but are not limited to:

a. Virtualization platforms

b. Network Appliances

c. UNIX flavors such as Solaris, Linux, HP-UX, etc.

d. Non-Windows based Web Servers

2.1.3 APPLICATION ANALYSIS, DESIGN AND PROGRAMMING SUPPORT

The contractor shall provide analysis and programming for systems applications development, which shall include requirements, detailed specifications, programming, and deployment, of computer applications whether web-based or distributed (client-server). Application development includes the complete software development lifecycle (SDLC) involved in producing a computer application in addition to following the standard release and deployment process. Examples include but are not limited to:

a. Logical and physical database design

b. Web application programming

c. Web application user interface programming (thin or thick clients)

d. Client-server application analysis and programming

e. Object-oriented language analysis and programming

f. SQL programming (SQL or Oracle)

g. Visual Basic Net Programming

h. Publishing technologies (e.g., PHP and Drupal)

2.1.4 EMERGING TECHNOLOGIES RESEARCH SUPPORT

The contractor shall provide assistance in researching and evaluating future and emerging technologies in support of program office and agency missions. The Contractor shall provide appropriate subject matter expertise to evaluate the emerging technologies.

2.1.5 CYBERSECURITY GOVERNANCE, RISK AND COMPLIANCE SUPPORT

The contractor shall provide cybersecurity governance, risk analysis and assessment, and compliance support to be integrated and actioned throughout the lifecycle of any IT system;

whether on-premises, cloud or hybrid. The Contractor shall provide services to develop, operate, and maintain an effective and regulatory-compliant cybersecurity program. The Contractor shall ensure that all areas of IT work meet mandated cybersecurity requirements per applicable DARPA and DoD regulations, policies, instructions, memos and guidance.

The requirements include maintaining existing Information system authorizations, continuous monitoring; mandatory reporting (e.g., JFHQ-DoDIN, DISA, DIA, WHS, etc.); network intrusion detection, prevention and monitoring; incident response handling and reporting;

continuity of operations planning and testing; cybersecurity policies and guidance; continuous cybersecurity awareness training; and protection of PII. The Contractor shall maintain open communication on all cybersecurity–related incidents and activities with federal IT/Cyber staff.

The Contractor shall establish a structure to capture costs consistent with capital planning budget guidance tracked at Identify, Protect, Detect, Respond and Recover detail level for IT Security and Compliance. The objective is to provide cybersecurity planning, reporting, and implementation to ensure the adherence to Federal and Departmental cybersecurity requirements.

2.1.6 ENTERPRISE RISK MANAGEMENT & NETWORK OPERATIONS &

SECURITY CENTER (NOSC) SUPPORT

The Contractor shall provide or integrate with an existing Network Operations and Security Center which shall operate 24x7x365. The NOSC shall provide network, server, IA and availability monitoring services, information, and reporting, incident management and perform other tasks as specified in the task order.

2.2 PPMO

The Contractor Program Planning and Management Office (PPMO) shall be responsible for providing overarching program management personnel, processes, and tools, as necessary, to manage and oversee all PWS activities within TO-specified price, schedule, performance, and quality requirements. The PPMO shall assist the Government PMO with managing the disposition of government-validated IT requests funneled through existing Government intake processes into existing or new TOs and ensure compliance with the terms and conditions of the Contract and task order required outcomes are being delivered.

2.3 SUPPORT OFFICE IT REQUIREMENTS

2.3.1 ADVANCED WINDOWS SYSTEM INTEGRATION AND SERVERS’

APPLICATION SUPPORT

The contractor shall provide advanced Windows systems support including the pre-installation planning activities, installation, and problem determination, resolution, documentation, securing and transition of knowledge of new applications or services. This category shall also include technology trials, pilots, prototypes and proofs of concept, residing on Windows based operating systems that have not been previously used in the DARPA enclave. These applications and services may require subject matter expertise through product vendors, to provide state-of-the-art support and implementation of the next generation of services. Examples include but are not limited to:

a. General COTS/GOTS applications

b. Exchange

c. SharePoint

d. Network Security Design and Implementation (e.g., Internet Security Appliance (ISA))

e. Domain migration and configuration (e.g., Active Directory)

2.3.2 RESERVED

2.3.3 APPLICATION ANALYSIS, DESIGN AND PROGRAMMING SUPPORT

The contractor shall provide analysis and programming for systems applications development, which shall include requirements, detailed specifications, programming, and deployment, of computer applications whether web-based or distributed (client-server). Application development includes the complete software development lifecycle (SDLC) involved in producing a computer application in addition to following the standard release and deployment process. Examples include but are not limited to:

a. Logical and physical database design

b. Web application programming

c. Web application user interface programming (thin or thick clients)

d. Client-server application analysis and programming

e. Object-oriented language analysis and programming

f. SQL programming (SQL or Oracle)

g. Visual Basic Net Programming

h. Publishing technologies (e.g., PHP and Drupal)

2.3.4 EMERGING TECHNOLOGIES RESEARCH SUPPORT

The contractor shall provide assistance in researching and evaluating future and emerging technologies in support of program office and agency missions. The Contractor shall provide appropriate subject matter expertise to evaluate the emerging technologies.

2.3.5 SECURITY OPERATIONS

The Contractor shall implement a Cybersecurity team structured based on the requirements provided in the latest DoD Cybersecurity Services Evaluator Scoring Metrics (ESM) and in support of DARPA’s Tier II Cybersecurity Service Provider (CSSP) role. The team shall be scaled to support the Identify, Protect, Detect, Respond, and Recover requirements across all DARPA enterprise and connected performer systems. The team shall be integrated with all actions being performed as specified in the task order, to include Engineering, Service Operations, and Configuration Management. Additionally, the Contractor shall ensure compliance with DoD STIG, IAVA and Task Order requirements ensuring successful results in a Command Cyber Readiness Inspection (CCRI), Command Cyber Operational Readiness Inspection (CCORI), or other DoD Inspection or Audit DARPA is required to support.

2.3.6 TRUSTED CONTROLLED INTERFACE

The Contractor shall implement and maintain cross domain-controlled interfaces between the MLSSAV system boundary and other classified internal and external Single Level Domain (SLD) and MLS CDS systems that are required by DARPA. These tasks include, but are not limited to, configuration of hardware and software, establishing accounts, upgrading and modifying database applications, and supporting the required security accreditation paperwork to maintain required security authorization for deployed controlled interfaces. Services that are required to traverse the Interfaces include but are not limited to E-Mail, Web, Remoted Desktop connections, and File Upload.

2.3.7 SECURITY INFORMATION AND EVENT MANAGEMENT (SIEM)

The Contractor shall recommend and implement a Government approved Security Information Management System to act as a central repository for the collection of all security data (e.g., event logs), provide trending, reporting, charts and graphs both in real time and extending to a period of no less than 13 months. The SIEM shall conduct real-time monitoring, correlation of events, notifications and console viewing, as well as, long-term storage, analysis and reporting of log data. Additionally, the SIEM shall be responsible for the monitoring of user and service privileges, directory services, network incident review and response.

2.3.8 PUBLIC KEY INFRASTRUCTURE (PKI) INTEGRATION

The Contractor shall support PKI certificates and its integration, where possible, throughout all networks. The Contractor shall develop the means to use PKI certificates within the MLS SAV System.

2.3.9 ITD SECURITY SERVICES

The Contractor shall interface with the Government to provide Defense-in-Depth by being an active and engaged partner in planning, designing, architecting and engineering security products and tools to meet IA and security initiatives. The Contractor shall support the Government’s lead for Incident Response Teams comprised of the applicable skill sets to respond to incidents when they occur. Overall, the Contractor shall ensure the Government’s security requirements are met, complying with applicable DoD policies and providing Computer Network Defense Services to meet all CSSP requirements to protect the Government’s Information Systems (IS).

The Contractor shall coordinate CSSP services with the Government. As detailed in the task order, the Contractor shall support the application, implementation and execution of required Response and Recover actions. The requirements of the CND Services are detailed in the latest version of CJCSI 6510.01F, “Information Assurance (IA) and Computer Network Defense (CND)” and the latest version of the DoD Cybersecurity Services ESM.

The Contractor shall provide specific security services for the Government’s Information Systems (IS), Information Systems Domains (Communities of Interest), and Information Content (at rest, in use, and in transit) that will include at a minimum, the following or equivalents:

1. Network boundary/perimeter protection, including firewalls and intrusion detection systems (IDSs).

2. Security monitoring and response for DARPA enterprise and connected DIB systems.

3. Incident Management, including emergency response and forensic analysis.

4. Vulnerability assessment and penetration testing and analysis of computers and networks.

5. Anti-Virus and content filtering Services.

6. Information Security Risk Assessments.

7. Facilitate security information sharing and workflow across traditional organizational and functional lines.

8. The Contractor shall provide support personnel for general Security Operation Services and to properly address or escalate an event, if necessary. This may include, but is not limited to, event analysis and resolution, calling in additional support personnel and alerting or escalating to Government oversight.

9. Monitoring and analysis of the network infrastructure, and detection and rapid response commensurate with the threat’s potential harm or damage to the Government’s IT systems.

10. An expert level of proficiency in tools, techniques and counter- measures in network vulnerabilities.

11. Assistance in the development and maintenance of security policies and procedures.

12. Assurance that policies and procedures are implemented and enforced, through both manual and automated controls.

13. Management status reports and escalations on all security operation requests and problems.

14. Participation in the remediation of audit findings.

15. Implement procedures and metrics for security operations as specified by the

Government.

16. Implementation of automated tools for security operations.

17. Surge capabilities.

18. Collect data from a variety of cyber defense tools (e.g., IDS alerts, firewalls, network traffic logs.) to analyze events that occur within their environments for mitigating of threats, investigation, and reporting.

19. Identify potential conflicts with implementation of any cyber defense tools (e.g., tool and testing and optimization).

20. Assess the effectiveness of cybersecurity measures utilized by system(s), and develop appropriate requirements, dashboards, or improvements of the overall network security.

21. Analyze the security of new or existing computer applications, software, or specialized utility programs and provides actionable results.

22. Identify access and collection gaps that can be satisfied through cyber collection and/or preparation activities.

Due to the dynamic nature of IT-based attacks, significant advances are expected in Cybersecurity tools and practices over the life of this contract. The Contractor shall offer the best-of-breed defense products and services, and employ industry best practices; therefore, the requirements listed above shall be considered as a baseline.

2.3.10 ITD HUNT TEAM

The Contractor shall provide proactive cyber security services to monitor, detect, mitigate, and counter internal and external cyber threats posed to DARPA data and personnel. The Contractor shall perform information threat analysis and conduct intelligence and profiling for DARPA information systems through passive and active monitoring, data sharing and collaboration, and advanced technical analysis. Information Defense services shall include but are not limited to:

1) Detection and mitigation of threats to DARPA information systems.

2) Investigative and organic Cyber Intelligence (CI) activities.

3) Malware analysis.

4) Monitoring, via active and passive activities, of cyber threats to the DARPA information infrastructure both internally and externally.

5) Advanced technical expertise and analysis of security incidents.

6) Authorized penetration testing of DARPA assets/networks.

7) Coordination and sharing of information regarding cyber threats between DARPA staff, US Government Agencies, and, with Government approval, other Contractors.

8) Recommendations for improved and innovative solutions and methodologies for detecting and mitigating cyber threats.

9) Incident Response Support – The Contractor shall provide advanced technical analysis during and after security incidents.

10) Cyber Threat Analysis and Coordination – The Contractor shall, with proper Government oversight, coordinate, communicate, and collaborate with external Government entities to provide an independent assessment of the current information threat landscape and report and recommend appropriate defensive measures.

The Contractor shall support the following capabilities:

1) E-Mail Analysis – A review of reported emails, tracking the following information to determine if it is indicative of a larger attack initiative:

o E-mail origin.

o Delivery vectors.

o Payload usage.

o Social engineering patterns.

o Timing.

o Recipients.

o Crafting methodology.

o Security Tools Monitoring.

o Coding Skills.

o Technical writing and Reporting.

o Any other perceived patterns that could potentially provide information for identifying trends of malicious activity.

2) Malware Analysis – A review of detected or reported malware to garner information including command and control information, attribution, detection characteristics, and capabilities. Specific data captured shall include: MD5/SHA1 hash, date/time of collection, source, and attributes collected. This data will be retained for trending and future analysis

3) Threat Profiling – The Contractor shall monitor sensors and other data collection toolsets on DARPA networks. Data collected will include passive DNS collection, network flows, and a malicious code database.

2.3.11 INSIDER THREAT MANAGEMENT

The Contractor shall comply with DoD requirements for Insider Threat monitoring and reporting.

Additionally, the Contractor shall provide technical solutions to support the following as detailed in the task order:

o Review and report on privileged user across Contractor managed systems to ensure o Continuing need for the access granted to each privileged user, o Required training has been completed and maintained, o Verification of required security clearances for access.

o Ensure all methods for sharing data (portals, file shares, etc.) are monitored and provide logging in support of enterprise audit systems (currently Splunk).

o Implement PKI capabilities across all networks.

o Maintain a list of privileged user roles relevant to each network, ensuring each role limits the scope to only the permissions required (least privileged model).

o Develop and maintain two stage control for system administration where possible.

o Create reports, dashboards and other methods for disseminating audit information as required by the DARPA Insider Threat Working Group.

o Act as a technical advisor to the DARPA Insider Threat Working Group to assist in

DARPA with implementing tools and configurations that meet DARPA and DoD insider threat requirements.

2.3.12 AUTHORIZATIONS AND COMPLIANCE MANAGEMENT - ASSESSMENT AND

AUTHORIZATION (A&A)

The Contractor is responsible for maintaining and delivering systems that can be assessed and authorized in accordance with DoD security requirements and the Risk Management Framework processes.

The Contractor shall assist the Government in managing the RMF lifecycle of DARPA information systems between the various operations, security, and SCA personnel of this contract, to include successfully completing system Assessment and Authorization (A&A) events and managing the continuous monitoring of security control implementations. The Contractor shall review policy and procedure changes that have occurred since the system was last authorized and recommend appropriate actions to address any deltas. The Contractor shall assist the Government with the Risk Management Framework Implementation Plan, assignment of security controls, and completion of required security artifacts. The Contractor shall assist the Government with risk and security-related documents as detailed in the task order such as a:

1. Risk assessment.

2. Privacy impact assessment.

3. System interconnection agreements.

4. Contingency plan.

5. Security configurations.

6. Configuration management plan.

7. Incident response plan.

8. Continuous monitoring strategy.

3.0 OVERALL IT REQUIREMENTS

3.1 SENSITIVE INFORMATION SUPPORT (CLASSIFIED)

Under current Federal guidelines, all officially held information is considered sensitive to some degree and must be protected by the Contractor as specified in the task order. Types of sensitive information that may be found on DARPA systems include, but are not limited to:

1) Privacy Act information.

2) Information that is proprietary to companies or Contractors other than the subject

Contractor.

3) Information protected by International Traffic in Arms Regulation (ITAR).

4) Technology restricted from foreign dissemination.

5) DARPA administrative communications, including those of senior Government officials.

6) Procurement and budget data.

7) Information related to Equal Employment Opportunity (EEO).

8) Labor relations.

9) Legal actions.

10) Disciplinary actions.

11) Complaints.

12) IT security pending cases.

13) Civil and criminal investigations.

14) Information not releasable under the Freedom of Information Act (FOIA) (e.g.e.g., payroll, personnel, and medical data).

Performance under this contract shall involve access to and/or generation of sensitive information or systems. The Contractor shall perform an assessment to determine position sensitivity and management controls to prevent the individuals in these positions from bypassing controls and processes such as individual accountability requirements, separation of duties, access controls, and limitations on processing privileges. Ongoing re-evaluations of the position and suitability requirements shall be necessary during the life of the contract as positions and assignments change. Due to the sensitivity of the information, Contractor personnel who exhibit characteristics of mental impairment or characteristics that indicate a lack of integrity, conduct, or attitude that brings into question their trustworthiness, shall be immediately reported to the Director Security & Intelligence Directorate, DARPA.

The Contractor shall conduct risk assessments, document the results, and develop and maintain internal security plans on-line and in accordance with applicable IC and DoD guidelines and the

NISPOM.

3.2 CLASSIFIED INFORMATION SUPPORT

In accordance with the National Industrial Security Program Operating Manual, DoD 5220.22- M, and its Overprint, the Contractor shall utilize a Top-Secret SCI/SAP Facility to perform the requirements of this contract. Security requirements relating to the handling and safeguarding of classified information are identified in the DD Form 254 provided as part of the contract.

Contractor personnel, whose duties require access to systems processing classified information, must be eligible to possess a security clearance at least equal to the highest degree of classification involved and have a validated need-to-know prior to beginning work on the classified system. All personnel must have a final DoD Secret clearance. Task orders may include additional security and/or certification requirements.

3.3 PRIVACY AND SECURITY SAFEGUARDS

The Contractor shall not publish or disclose in any manner, without written consent of the Government, the details of any security safeguards designed, developed, or implemented by the Contractor under any task orders issued under this contract. This restriction is also applicable to the Contractor’s off-site corporate offices.

The Contractor shall develop procedures and implementation plans to ensure that IT resources leaving the control of the assigned user, such as being reassigned, removed for repair, replaced, or upgraded, is cleared of all DARPA data and sensitive application software by a technique approved by the Government. For IT resources leaving DARPA use, applications acquired via a "site-license" or "server license" shall be removed. Damaged IT storage media shall be degaussed or destroyed in accordance with the appropriate IC, DoD, or DARPA security requirements.

DARPA will carry out a program of inspection and audit to safeguard against threats and hazards to the confidentiality, integrity, and availability of Government data. The Contractor shall afford DARPA access to the Contractor's facilities, installations, technical capabilities, operations, documentation, records, system databases, and personnel to facilitate the audits and inspections.

DARPA will conduct an audit on a periodic event-driven basis of the Contractor’s security management processes and procedures.

3.4 SECURITY INCIDENT REPORTING

The Contractor shall immediately report any act or circumstance in which there is a deviation from the requirements of the governing security regulations to the Government Program Manager (GPM), Program Security Officer (PSO), Chief Information Security Officer (CISO), and Authorizing Official (AO). Security incident examples include, but are not limited to, compromise, inadvertent disclosure, need-to-know violation, and administrative deviation. The Contractor shall provide real time or near real time data feed supporting Government oversight of security functions.

3.5 CONTINUOUS MONITORING

The Contractor shall perform continuous monitoring of task order specified networks with Authorities to Operate (ATO). Continuous monitoring shall include, but is not limited to, automated and manual audits of all relevant RMF controls over the lifecycle of each ATO.

1) In conjunction with 4.14.1.26 Cybersecurity Compliance, the Contractor shall be vigilantly aware of compliance requirements associated with:

a. JFHQ-DODIN IAVA process.

b. JFHQ-DODIN DODIN Cyberspace Tasking Cycle (D-CTC).

c. IC SCC ICVM process.

d. DISA STIG Compliance (where applicable).

e. Common security practices across all networks.

f. IC and DoD policies for RMF: ICD 503, JSIG, and 8510.01.

g. Ensure continuous monitoring practices based on RMF SP/SCTM and Insider Threat requirements.

h. CSSP.

i. CCRI.

j. CCORI.

k. HBSS and ACAS compliance.

l. Internal SharePoint IAVA and DRA process.

3.6 DOMAIN NAME SERVER (DNS)

The Contractor shall provide DNS services to the Government networks providing both internal and external name to IP resolution. DNS, where applicable, shall be integrated with Directory Services to take advantage of DNS features such as secure dynamic updates, record aging, DNS Security Extensions (DNSSEC) and scavenging features. The DNS services shall meet all functionality of the current DNS service, to include flexible support for offsite locations.

4.0 KEY PERSONNEL AND TRAINING

The personnel listed below are considered essential to the work being performed under this IDIQ. Prior to substituting, removing, replacing, or otherwise diverting the activity of any of the key personnel specified below or any key personnel identified at the task order level, the Contractor shall notify the DARPA Contracting Officer and Contracting Officer’s Representative in writing at least 15 calendar days in advance, unless compelling circumstances exist otherwise, and include information supporting the need for change. The proposed substitution of personnel must meet or exceed the qualifications of the current key personnel, as determined and agreed to by the Contracting Officer and Contracting Officer’s Representative. Hiring timelines to fill or backfill key personnel shall not exceed 90 calendar days from time that the Contracting Officer and Contracting Officer’s Representative (COR) are notified in writing of the key personnel change. Each task order may identify additional key personnel as required.

1) Program Manager

2) Requirements Manager

All candidates for positions designated as key personnel shall submit resumes to the Contracting Officer and COR for review prior to assignment to any task order. The Government may refuse to accept the candidate if the resume does not indicate that the proposed person meets the applicable key personnel requirements identified below and/or within the task order. The Government may request to meet the candidates as part of the review process. The burden for proving ta person who meets the specified key personnel requirements on the Contractor.

4.1 PROGRAM MANAGER

The Contractor’s Program Manager shall be responsible for the overall management of tasks performed under this contract and shall be the primary point-of-contact for contract issues. The Program Manager shall be responsible for ensuring that practical and effective systems are developed to meet the contract requirements. The Program Manager shall also be responsible for ensuring the quality and timeliness of the work performed and implementing process improvements. The Program Manager shall provide oversight for financial, contractual, project management, technical and security actions on behalf of the Contractor. Education and experience requirements will be specified at the task order level. The contractor must demonstrate their proposed key personnel’s ability to fulfill the key personnel tasks for each task order and how the proposed key personnel’s skills, experience and/or education meets or exceeds the task order key personnel requirements.

4.2 REQUIREMENTS MANAGER

Requirements management is the process of analyzing, formulating, and prioritizing project requirements, upon which a plan is laid out which ensures all requirements are confirmed to as needed. A requirements manager is responsible for the efficient development of complex systems that meet the requirements of a project or product. Additionally, they are also responsible for the optimization of the required processes. The requirements manager formulates requirement specifications, which create a common understanding of processes and systems to be developed between contractor and the Government. Education and experience requirements will be specified at the task order level. The contractor must demonstrate their proposed key personnel’s ability to fulfill the key personnel tasks for each task order and how the proposed key personnel’s skills, experience and/or education meets or exceeds the task order key personnel requirements.

The Requirements Manager is responsible for overseeing the process of gathering, analyzing, and managing the technical requirements for IT projects within the organization. This role ensures that business needs are accurately translated into detailed requirements, facilitating effective communication between stakeholders, developers, and project teams.

5.0 TRAVEL

Travel around the primary place of performance may be required throughout the period of performance. Local Travel (mileage, parking, tolls, etc.) in support of this requirement to attend meetings and/or coordinate multi-site, multi-agency projects within 50 miles of the Washington, D.C. Metropolitan area may be required and will be specified at the task order level. Non-local travel may be required and will be specified at the task order level. All Contractor travel must be approved by the task order COR via the travel approval process contained in the task order. In the event of an emergency, the Contractor may obtain approval from the Contracting Officer (KO) or COR by phone with a follow-on approval by the COR via the methods stated above.

Detailed requirements will be defined at the task order level.

6.0 PLACE OF PERFORMANCE

The Contractor shall perform work at the Government facility located at is located at 675 North Randolph Street, Arlington, VA 22203-1714 and task order requirements will provide details for specific task order places of performance. The Agency will make space available for tasks and activities that require frequent face-to-face interaction with numerous stakeholders. The Contractor shall use individually reserved desks or hoteling of desks to meet performance requirements. At the discretion of the Government, on-site spaces at the Government facilities may be revoked at any time. Detailed requirements will be defined at the task order level.

7.0 GOVERNMENT FURNISHED INFORMATION/EQUIPMENT

As required by the task order, the Government will furnish any NSA Type I encryption devices and associated keying material (KEYMAT) necessary to support encryption of external network connections, which are unable to support NSA-approved commercial national security algorithm

(CNSA) suite encryption, also known as "Type II" or "Suite B", in accordance with CNSS Policy # 15, "Use of Public Standards for Secure Information Sharing. Detailed requirements will be defined at the task order level.

8.0 DELIVERABLES

The Contractor shall provide all deliverables to designated individuals as indicated in deliverable table of each task order. The Contractor shall electronically post all deliverables for online and/or secure WEB access by designated DARPA personnel. Deliverables shall be in Government-approved format. The Contractor shall recommend the format of each deliverable to the task order COR for approval prior to submission.

8.1 CONTRACT DELIVERABLE TABLE

Deliverable Title Recipient s

Frequency Location Review Status

1 End of Task Order Transition Plan

KO/COR/

GPM

Within 90 days of Task Order Start and update as required.

Vault and Confluence, or similar location, as decided by the Government.

2 IDIQ Level - Contractor Self- Assessment

KO/COR/

GPM

Semi- Annually (6 months after start and 15 business days before the end of the period)

Vault and Confluence, or similar location, as

3 Monthly Management Report (MMR)

KO/COR/

GPM

Monthly Vault and Confluence, or similar location, as

4 Continuity of Operations Plan

- The Contractor shall ensure alignment with agency requirements for Disaster Recovery Plan (DRP) and COOP policies.

COR/GP

M

As updated Vault and Confluence, or similar location, as

5 Disaster Recovery Plan

COR Annually Vault and Confluence, or similar location, as

6 Non-Disclosure Agreement

KO/COR As required Vault and Confluence, or similar location, as

7 Task Order Transition-in Report

KO/COR/

GPM

Within 14 business days of Task Order Award

Vault and Confluence, or similar location, as

Task orders may include additional deliverables not included in the 8.1 Contract Deliverable Table

9.0 QUALITY MANAGEMENT

9.1 QUALITY ASSURANCE PLAN

Quality assurance plans will be implemented at the task order level.

9.2 SERVICE IMPROVEMENT

The Contractor shall develop a methodology for managing continual service improvement with particular attention given to operational efficiencies through the use of Service Delivery Maturity models. The Contractor shall provide flexible and innovative solutions to the Government.