Attachment 1- Performance Work Statement.pdf

Performance Work Statement (PWS) Electronic Security/Key Systems Maintenance Support Services

Defense Logistics Agency (DLA) Distribution Warner Robins, GA

1.0 BACKGROUND

The Defense Logistics Agency (DLA) is the largest logistics support agency in the United States (U.S.) Department of Defense (DoD). The DLA Director reports to the Under Secretary of Defense for Acquisition, Technology and Logistics (USD AT&L) through the Assistant Secretary of Defense for Logistics and Materiel Readiness (ASD L&MR). DLA provides worldwide logistics support, acquisition, and technical services the military services, other federal and civilian agencies, and partner nations in peacetime and wartime.

DLA Distribution Warner Robins, GA is one of four strategic distribution platforms for ~ 7 million items of supply, equipment, or property supporting all branches of the Military Services and several Federal agencies at locations globally. More than half the work completed at the distribution center is in support of the Warner Robins Air Logistics Center.

The organization's $11 billion inventory includes parts and equipment for F-15, C-130, C-5 and C- 17 aircraft, target acquisition systems, and most airborne electronic warfare systems.

DLA Distribution Warner Robins maintains a state-of-the-art Consolidation, Containerization Point for processing operations.

Specifically, for this contract, the DLA Distribution Warner Robins has a requirement for hardware and software/firmware sustainment and operations support of Electronic Security Systems (ESS) and Electronic Key Systems (EKC). ESS consists of Access Control Systems (ACS), Intrusion Detection System (IDS), Closed Circuit Television (CCTV) systems, intercom systems, and EKC consists of all hardware and software for electronic key boxes.

In support of these missions, DLA Installation Management (DM) serves as the doctrinal system owners for these life, health, and safety systems. DM serves as the functional proponent for all ESS/EKC requirements, policy, and procedures.

In support of DM, DLA Information Operations Enterprise Capabilities Portfolio (J62B) executes program management, provides acquisition support, and cybersecurity support.

2.0 SCOPE

Specifically, for this effort the Contractor will provide all personnel, hardware, software/firmware, and technical services for maintenance and sustainment of DLA Distribution Warner Robins ESS and EKC to include those required upgrades, migrations, and enhancements required for compliancy both operationally and from a cybersecurity perspective.

This Performance Work Statement (PWS) outlines requirements for the scheduled Preventive Maintenance (PM), unscheduled Corrective Maintenance (CM)/Service Calls, and systems support including cybersecurity to ensure that DLA Distribution Warner Robins maintains an operational security posture consistent with DLA and Host Installation requirements.

As part of this Sustainment effort, the vendor will be expected to plan and complete software upgrades of the various ESS applications (ACS/IDS, EKC, & CCTV) during the lifecycle of this contract in order to maintain current supported software versions. As such, The Contractor shall plan and complete a software upgrade of the LENEL OnGuard system to Version 8.X during the first performance year of this contract.

During the lifecycle of this contract, DLA may require a migration of the ESS applications, devices, and systems to an approved DLA Operational Technology network. The Contractor will provide all necessary support to successfully build out the new environment and complete the migration efforts.

This Section provides general information relating to the conditions of operation and general requirements relating to the maintenance and repair services for the following types of ESS:

• Lenel OnGuard ESS, the Contractor shall upgrade to an approved version 7.6.x

• ADT Intrusion Detection Systems

• Pelco Closed Circuit Television Systems

• Morse Watchman Keywatcher Systems

The Contractor shall provide all PM and CM to maintain operational ESS and EKC. The Contractor will provide a PM schedule to the COR. CM shall be coordinated with the COR as required. Cybersecurity shall be coordinated closely with the assigned Information System Security Manager (ISSM). The complete list of equipment items covered under this Scope of Work is identified on the DLA Distribution Warner Robins Equipment Inventory List (Attachment 2). The DLA Distribution Warner Robins Equipment Inventory List is subject to change based on equipment additions and/or deletions due to the acquisition of new equipment, replacement of existing equipment, or disposal of obsolete equipment.

With the ongoing effort of building consolidation and expansion, the Government reserves the right to ADD to or DELETE from the maintenance and repair contract anytime during the period of the contract as the need arises. The Contractor is responsible for DLA base wide ESS and EKC systems.

2.1 SCOPE OF WORK

A. This is a non-personal services contract to provide ESS and EKC scheduled PM, unscheduled CM/Service Call maintenance support services, and cybersecurity for DLA Distribution Warner Robins. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government. The Government and the Contractor understand that the services to be provided under this contract by the Contractor are non-personal services and that no employer-employee relationship exists between the Government and the Contractor. The Government may provide technical direction which will assist the Contractor in accomplishing the PWS; however, the Government will not control the methods used by the Contractor to perform the service requirements set forth in the PWS.

B. The Contractor shall furnish all labor, supervision, tools, materials, equipment, transportation, and management necessary to provide preventive maintenance services, service calls and all repair and or replacement of parts necessary to keep all portions of ESS/EKC, and all associated components located within the DLA Distribution Warner Robins facility covered by this requirement, in good operating condition and in compliance with the DoD/DLA cybersecurity requirements during the contract period.

3.0 TASK REQUIREMENTS

The Contractor shall adhere to the following requirements and definitions for all Tasks within this PWS:

1. The Contractor shall submit an accident prevention plan to the Contracting Officers Representative (COR). No work shall start prior to COR receiving the approved accident prevention plan.

2. The Contractor shall turn over any equipment or material removed through this Task Order (TO) to the Government at the completion of work, or after COR approval, and properly dispose of in accordance with regulation and/or local codes.

3. The Contractor shall maintain a separate set of drawings, elementary diagrams, and wiring diagrams of the system to be used for As-Built Drawings and shall keep this set accurately and neatly up to date with all changes and additions throughout the contract. As-Built Drawings shall be developed and maintained by the Contractor and depict actual conditions. As-Built Drawings are to be submitted to the COR in original Auto Computer Aided Design (AutoCAD) and Adobe Portable Document Format (PDF) formats and shall not be overlays. A complete As-Built Drawing will be submitted to the Government within 14 calendar days of completed work and/or not later than five (5) days before the end date of the contract.

4. The Contractor will provide a monthly status report which shall include, but not limited to:

a) Contract number

b) Brief task description

c) Review of project plans including work accomplished during the reporting period and/or significant events

d) Project progress

e) Problem areas

f) Anticipated activity for the next reporting period

g) Project Schedule/Plan for any planned upgrades or tech refresh efforts (3.1.8)

5. The Contractor shall follow all applicable National Electrical Code (NEC), Unified

Facilities Criteria (UFC), United Technologies Corporation (UTC), National Fire Protection Association (NFPA), and Security Standards.

6. The Contractor will follow all Security Technical Implementation Guides (STIGs), Data Encryption standards, Intelligence Community Directive (ICD)/ Intelligence Community Standard (ICS) 705, DLA Physical Security Manual and DLA building codes.

7. The Contractor shall obtain written COR approval if any digital or physical media is required. All video, still photos, digital photos, all usernames, passwords and any other documentation obtained and developed during the execution of this contract shall be turned over to the Government with all digital and hard copy files and associated negatives at the completion of this project. Digital photographs shall be submitted to the Government on Compact Disk (CD) in Joint Photographic Experts Group (JPG) format, and the Contractor shall delete all associated files from their records.

3.1 TASK 1 – PROJECT MANAGEMENT

3.1.1 PROJECT MANAGER

The Contractor shall provide a Contract Project Manager who shall be responsible for the performance of the work. The Contractor shall provide project management support for all items detailed in this PWS. This support includes providing planning, direction, coordination, and control necessary for effective and efficient accomplishment of all requirements. The Contractor shall be the senior subject matter expert and monitor, control and report TO status, cost, schedule, and performance; coordinate with KO, COR, PMO, Users and other representatives, attend meetings and provide other support as needed. The Contract Project Manager or alternate shall have full authority to act for the Contractor on all contract matters relating to the operations of this contract. The Contract Project Manager or alternate shall be available Monday through Friday, excluding Federal holidays, between the hours of 0700 and 1530 hours local time and within two (2) hours after normal working hours (emergent repairs) upon request of the KO or COR to meet on the installation as required to discuss problem areas.

3.1.2 WORK EFFORT

The Contractor shall manage the total work effort associated with the PWS herein to assure fully adequate and timely completion of all Tasks. Included in this function are a full range of management duties including, but not limited to, planning, developing and implementing project plans, scheduling, report preparation, communication and coordinating with stakeholders, escalation procedures, establishing and maintaining records, monitoring, and quality control. The Contractor shall provide an adequate staff of personnel with the necessary management expertise to assure the performance of the work in accordance with sound and efficient management practices.

3.1.3 WORK CONTROL

The Contractor shall implement all necessary work control procedures to ensure timely accomplishment of work requirements, as well as to permit tracking of work in progress. The Contractor shall plan and schedule work to assure material, labor and equipment of all contracted items are available to complete work requirements within the specified time limits and in conformance with the quality standards established herein.

3.1.4 CONFIGURATION MANAGEMENT

The Contractor shall develop and execute a written configuration management plan and technology road map that addresses product management and version control for software (changes), hardware, business processes documentation and all other control items and recreate all baseline deliveries from any point in time. The Contractor shall evaluate all changes to the approved system requirements baseline for risk to security, and for schedule and cost impact, provide evaluations in writing and with sufficient detail to allow for review and approval by the Configuration Control governance structure as required.

3.1.5 WORK SCHEDULE

The Contractor shall schedule and arrange work to cause the least interference with the normal occurrence of Government business and mission. In those cases where some interference may be essentially unavoidable, the Contractor shall make every effort to minimize the impact of the interference, inconvenience, equipment downtime, interrupted service, customer discomfort, Non-scheduled visits will be coordinated with the COR at least five (5) working days in advance and notify the COR if the work being performed may cause interference. Notification shall include the type of work to be done and the estimated completion date. The Contractor shall reschedule any work that the Contracting Officer deems necessary to avoid unacceptable disruptions in the Government's business.

3.1.6 WORK RECORDS/REPORTS

The Contractor shall maintain management, maintenance, repair records, and reports as set forth herein. All records and copies of reports shall be turned over to the COR) five (5) calendar days before contract completion.

3.1.7 STAFFING

The Contractor shall continuously maintain an adequate staff with expertise to assure work is scheduled and completed in accordance with these specifications. The Contractor shall maintain a certified work force to complete work in accordance with the time and quality standards specified. .

3.1.8 PROJECT SCHEDULE/PLAN

The Contractor shall create, maintain, and submit project plan(s) and schedule(s) within five (5) business days after award, at the Kickoff meeting and will be updated weekly until the final inspection is completed. (Microsoft Project is the preferred software).

3.1.9 MEETINGS

Contractor shall attend a post award Kickoff meeting prior to the initiation of work, this meeting will be held with the Contractor, Contracting Officer (KO), Contract Specialist (KS), COR, , Project Manager (PM), On-Site Representatives (OSRs) and any other individuals designated by the Government to discuss overview of Contractor’s plans, manage scope, schedule and resources. The Contractor will discuss with stakeholders’ expectations and details of contract execution and resulting delivery order. General conditions, project schedule/plan, work schedules, coordination, security, safety, deliverables, permits and other matters pertinent to work accomplishments shall be discussed in this meeting. Contractor shall attend any meetings requested/required to ensure the project is successful.

3.1.10 PHASE IN

A phase-in period shall be established to allow the Contractor sufficient time to integrate personnel and transition into duties required to perform the requirements of the contract and ensure employees who will require access to the Installation and Government Information Technology (IT) systems obtain a Common Access Card (CAC) In Accordance With (IAW) this

PWS.

1. The phase-in period shall begin at the effective date of the contract and shall not exceed one (1) month, at which time full performance shall commence.

2. The Contractor shall ensure that all Contractor personnel are ready to begin working on the first day of full performance.

3. During the phase-in period, Contractor personnel shall complete security and safety training on site. Training will be scheduled through the DLA Distribution site training office and will at a minimum include the following classes. Estimated in class time is 3 hours.

a) Active Shooter Briefing

b) Safety Briefing

c) Shelter in Place/Evacuation Awareness Briefing

4. During the one month phased-in period to ensure all Contractor personnel know and understand regulations and policy pertaining to physical, information, operations and personnel security, the Contractor shall provide security and antiterrorism training to all employees in accordance with applicable DOD regulatory requirements. At a minimum, security training requirements as required by the DLA Issuances and other applicable DOD guidance will be completed annually for the following on-line training: Estimated in class time is 8 hours.

a) Cyber Awareness Challenge

b) Antiterrorism (AT) Level 1

c) Operations Security (OPSEC)

d) DLA Annual Security and Counterintelligence Awareness Training

e) Personally, Identifiable Information Awareness

f) Trafficking in Persons

The security training is web-based, and access will be provided by the Government. The Contractor shall ensure Contractor personnel have taken the required security training to meet DoD guidance and that the personnel continue to maintain their certifications.

3.2 TASK 2 – SUSTAINMENT AND MAINTENANCE

The Government’s overall functional and technical requirements for operational sustainment and maintenance support for DLA Warner Robins ESS and EKC systems are listed in this section.

The Government’s specific technical requirements include providing all routine, testing, inspection, and maintenance required IAW Federal, State, Local, Tribal, DoD and DLA policies, procedures, and statues.

Specifically, the Contractor shall provide the personnel, equipment, spares, hardware, software/firmware required for all Preventative Maintenance (PM), Corrective Maintenance (CM), and Information Technology sustainment including support to version upgrades, enhancements, and migrations required for ESS and EKC systems and subsystems.

The Contractor shall provide sustainment and maintenance support for DLA ESS systems to ensure they remain operational IAW the Government’s requirements. DLA currently operates multiple disparate brands of ESS systems. The Contractor shall support all ESS hardware and associated infrastructure, as detailed in the TO PWS. The Contractor shall support ESS software from the DLA Enterprise ESS Software Contract Vehicle or other legacy ESS software brands that may not be available through that vehicle, as detailed in the TO PWS. For the legacy ESS software, the Contractor shall be responsible for providing all technical support/software maintenance and, if available, documentation for this software.

3.2.1 SUSTAINMENT PLAN

The Contractor shall develop and implement a Sustainment Plan for the newly installed ESS solution and/or existing solutions to ensure that the systems and equipment meet the Government’s operational requirements. The Sustainment Plan shall include the periodic maintenance, repair, replacement, and overhaul of existing systems, hardware, and software inclusive of Information Assurance Vulnerability Alerts (IAVA patching) as well as a vulnerability management plan. The Contractor shall provide the Sustainment Plan which includes the PM schedule to the COR for approval within 30 days of contract award. The Sustainment Plan shall include the Contractor’s approach to:

1. Position qualified and certified personnel, test equipment, and other pertinent information needed to quickly diagnose and make repairs.

2. Plan, perform, and document system confidence tests, periodic inspections, and preventive maintenance

3. Identify critical system operations and implement strategies to prevent potential failures or administrative downtime from creating a critical system outage.

4. Analyze fault histories and fault trends to proactively predict and mitigate repetitive issues.

5. Respond to and take corrective action to resolve vulnerabilities identified by the Contractor or the Government.

6. Provide ongoing training for Government personnel as requested in support of the existing ESS.

7. As a software upgrade becomes available, the Contractor shall develop a plan for the upgrade and present that plan to the COR for approval. Once approved, the Contractor shall execute their plan to install the upgrade(s) and return the ESS system(s) to an operational state.

3.2.2 CONFIGURATION AUDIT

A configuration audit is an inventory of all existing hardware, software, drawings, and technical documentation and is a function of configuration management. The Contractor shall perform the initial configuration audit, provide this information to the Government in an agreed upon format within timeline designated and perform updates as required by cybersecurity. The Contractor shall report the updates they complete in the status reports.

3.3 TASK 3 – GENERAL TASKS

The Contractor shall manage the total work effort associated with the maintenance, repair, and all other services required herein to assure fully adequate and timely completion of these services. Included in this function are a full range of management duties including, but not limited to, planning, scheduling, report preparation, establishing and maintaining records, and quality control. The Contractor shall provide an adequate staff of personnel with the necessary management expertise to assure the performance of the work in accordance with sound and efficient management practices.

The Contractor shall implement all necessary work control procedures to ensure timely accomplishment of work requirements, as well as to permit tracking of work in progress. The Contractor shall plan and schedule work to assure material, labor, and equipment are available to complete work requirements within the specified time limits and in conformance with the quality standards established herein. Based on the devices identified in the Attachment 1 – Equipment List, the Contractor shall establish a detailed PM schedule. The detailed PM schedule shall clearly indicate by device the dates the contractor plans to perform PM. Within 14 calendar days after the date of contract award, the Contractor shall submit the detailed PM schedule to the COR. The COR will accept or propose an alternate PM schedule within 5 calendar days. Verbal scheduling and status reports shall be provided when requested by the Contracting Officer. The status of any item of work must be provided within four (4) hours of the inquiry during regular working hours, and within 48 hours after regular working hours.

The Contractor shall schedule and arrange work to cause the least interference with the normal occurrence of Government business and mission. In those cases where some interference may be essentially unavoidable, the Contractor shall make every effort to minimize the impact of the interference, inconvenience, equipment downtime, interrupted service, customer discomfort, etc. The Contractor shall notify the COR at least five (5) working days in advance of any work to be performed. Notification shall include the type of work to be done and the estimated completion date. The Contractor shall reschedule any work that the Contracting

Officer deems necessary to avoid unacceptable disruptions in the Government's business.

The Contractor shall maintain management, maintenance, and repair records and prepare management, maintenance, and repair reports as set forth herein. All records and copies of reports shall be turned over to the Contracting Officer within seven (7) calendar days after contract completion. A complete work (history) file for each building security system shall be maintained by the Contractor. Files shall contain a listing of all equipment in each building and structure by nomenclature and manufacturer's model number, as well as all manufacturer's literature, brochures, and pamphlets; maintenance, operator's, and parts list manuals; warranty information; a copy of all completed Service Call Work Authorization forms, and Preventive Maintenance checklist forms; and other information pertaining to the security protection systems. All documents shall be filed within ten (10) working days of the completed transaction, with the exception of Preventive Maintenance Inspection Record forms, which shall be filed within two (2) working days after the completion of each preventive maintenance inspection. The Government will have access to these files upon request. The entire file shall be turned over to the Government upon completion of the contract.

All workmanship shall meet the standards specified herein and shall be accomplished in conformance with approved and accepted standards of the industry; equipment manufacturers; all applicable activity, local, state, and federal standards; and all applicable building and safety codes.

When the Contractor completes work on a system or piece of equipment, that system or piece of equipment shall be free of missing components or defects which would prevent it from functioning as originally intended and/or designed. Corrective or repair/replacement work shall be carried to completion including operational checks and cleanup of the job site. Except where otherwise noted, replacements shall match existing in dimensions, finish, color, and design.

During and at completion of work, debris shall not be allowed to spread unnecessarily into adjacent areas nor accumulate in the work area itself. All such debris, excess material, and parts shall be cleaned up and removed at the completion of the job and/or at the end of each day work is in progress.

Upon completion of work, the Contractor shall contact the COR to report the status of the system and document details of the service in the on-site service request log.

During the term of the contract, the Government may replace, renovate, or improve systems and equipment at the Government's expense and by means not associated with this contract. All replaced, improved, updated, modernized, or renovated systems and equipment shall be maintained and/or repaired by the Contractor at no additional cost to the Government unless such changes result in an increase or decrease in contract requirements.

Changes, replacements, or deletions which result in an increase or decrease in contract requirements will result in adjustments to the contract price in accordance with the "CHANGES" clause.

Equipment, components, and parts, other than that installed under this contract, shall not be removed, or replaced or deficiencies corrected while still under warranty of the manufacturer or the installer without prior approval of the COR. All defects in material or workmanship, defective parts, or improper installation and adjustments found by the Contractor shall be reported to the COR so that necessary action may be taken. The Contractor shall be knowledgeable of the equipment, parts, and components that are covered by warranty and the duration of such warranties. The COR. will furnish available warranty information to the Contractor.

All changes to or additions to the depot security systems and equipment made by the Contractor shall be recorded by the Contractor and provided to the Contracting Officer within fourteen (14) calendar days of the completed work. This data shall include, but is not limited to, dimensioned drawings and for sketches.

The Contractor shall maintain sufficient off-the-shelf materials and equipment on hand to support all scheduled PM and unscheduled CM/Service Calls. Lack of availability of materials or equipment shall not relieve the Contractor from the requirement to complete the PM or CM/Service Call work within the scheduled/agreed upon time limits. Replacement parts required in the performance of CM shall be invoiced to the Government in accordance with the terms and conditions of this contract (FAR 52.212-4 Alternate I).

3.4 TASK 4 – NETWORK AND INFRASTRUCTURE SUPPORT

3.4.1 SYSTEM NETWORK REQUIREMENTS

The Contractor shall support the following system network requirements including, but not limited to:

1. All network components and applications shall be compatible with all applicable Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs). Any STIG exceptions must be identified as part of the Contractor’s proposal. Exceptions incurring risk found unacceptable to the DLA Authorizing Official (AO) are not permitted.

2. All network components and applications shall be Internet Protocol (IP)v4 and IPv6 compatible.

3. All wiring and cabling shall be in Electric Metal Tubing (EMT) type conduit.

4. All network components shall be connected using copper 10/100/1000 or fiber optic

Small Form Factor Pluggable (SFP)-based Gigabit Ethernet ports.

5. Network components shall allow configuration of Institute of Electrical and

Electronics Engineers (IEEE) 802.1x or port security for authentication.

6. Web servers, human-machine interface (HMI) and controller systems must be on separate Virtual Local Area Network (VLAN)s.

7. Any external network connections must be permanently disconnected.

8. The Contractor shall provide a complete list of all ports, protocols, and services (PPS) required for any computer system running control system applications or required to interface the control system applications. The listing shall include all ports and services required for normal operation as well as any other ports and services required for emergency operation. The listing shall also include an explanation or cross reference to justify why each service is necessary for operation.

9. The Contractor shall identify any system enabled or disabled.

10. All wireless communications shall meet applicable STIG requirements.

The Contractor shall provide Bill of Materials (BOM) and other network documentation to the COR in support of these requirements.

3.4.2 INFORMATION TECHNOLOGY INFRASTRUCTURE REQUIREMENTS

The Contractor shall support the following IT technology infrastructure requirements to include, but not limited to:

1. DLA shall furnish all server and laptop/workstation hardware if required. Any requirement for the Contractor to provide their own server or laptop/workstation hardware due to compatibility issues shall be documented in the proposal. Contractor supplied systems must meet DoD STIG requirements, with any exceptions noted in their proposal.

2. The Lenel OnGuard System shall be capable of operating on DLA’s approved operating systems, virtual environments, and databases listed below:

a) Workstations/laptops shall operate on Windows 10, with minimum system requirements not to exceed: processor: Intel i5 -6200u @ 2.3 GHZ, 2 Cores, RAM: 8GB, Hard Drive: 256 GB.

b) Windows Server 2016 Operating System (OS) (or higher versions).

c) For virtualized appliances or virtualized servers, the system shall be capable of running on VMware ESXi hosts v6.0 or VMware vSphere v6.0 virtual server environment (or higher versions).

d) Database shall operate using Structured Query Language (SQL) Server 2016 or Oracle Database v19c (12.2.0.3) (or higher versions).

e) System must be capable of operating with McAfee ePolicy Orchestrator enabled.

3. Any removable flash media required for system operation must be reviewed and accepted by the DLA Flash Media Approval Program.

4. In some instances (such as video surveillance) where there is a requirement for a large amount of storage, the preferred solution will be available as an appliance that includes compute/storage in one physical appliance that meets DoD, National Institute of Standards and Technology (NIST) and Under Secretary General (USG) regulatory and cybersecurity policy requirements.

5. The appliance will not be used as a combined server and shall be sized adequately to store video feed data as specified elsewhere in the solicitation.

6. The Contractor shall be responsible for configuration and deployment.

7. The Contractor shall be responsible for all software maintenance activities for the appliance including but not limited to, firmware updates, OS patching, software patches etc. for the duration of the contract period.

8. The Contractor will be responsible for all physical maintenance activities for the appliance including but not limited to, replacement of defective components such as hard drives (to be destroyed onsite), motherboards, daughter cards etc. for the duration of the contract period.

9. System(s) shall operate using a Contractor fully supported operating system (OS), software, and firmware throughout the duration of the contract. All operating systems, software, and firmware shall be upgraded prior to the Contractor’s end of mainstream support for the OS, software, or firmware. The preference is for a virtualized solution.

The solution must be upgradeable and remain compliant to cyber security specifications during the lifecycle of the solution.

3.5 TASK 5 - CYBERSECURITY REQUIREMENTS

The Contractor shall provide the following cybersecurity support including, but not limited to the following:

1. The Contractor shall not permit user credentials to be transmitted in clear text.

Encryption shall at a minimum meet Advanced Encryption Standard (AES) 256 and comply with Federal Information Processing Standard (FIPS) 140-2. If this is not technically feasible, the Contractor shall provide the strongest encryption method commensurate with the technology platform and response time constraints and document the encryption used. The Contractor shall not allow multiple concurrent logins, applications to retain login information between sessions, provide any auto-fill functionality during login, or allow anonymous logins. The Contractor shall provide user account-based logout and timeout settings.

2. The Contractor shall not permit user credentials to be transmitted in clear text.

Encryption shall at a minimum meet AES 256 and comply with Publications FIPS 140-2. If this is not technically feasible, the Contractor shall provide the strongest encryption method commensurate with the technology platform and response time constraints and document the encryption used. The Contractor shall not allow multiple concurrent logins, applications to retain login information between sessions, provide any auto-fill functionality during login, or allow anonymous logins. The Contractor shall provide user account-based logout and timeout settings.

3. The Contractor shall provide cybersecurity that is in accordance with current policies, procedures, and statutes, to include (but not limited to) the following (most current):

a) The Federal Information Security Management Act (FISMA)

b) Committee on National Security Systems, Policy No. 11

c) Federal Information Processing Standards

d) Defense Information Systems Agency (DISA) Secure Technical

Implementation Guides (STIGs)

e) DOD Instruction 8510.01, Risk Management Framework (RMF) for DOD

Information Technology (IT)

f) DOD Directive 8140.01, Cyberspace Workforce Management

g) IA policies and DOD Directive 8500.1, Information Assurance

h) Global Information Grid (GIG) Concept of Operations (CONOPS)

4. Heartbeat Signals. The Contractor shall identify heartbeat signals or protocols and recommend whether any should be included in network monitoring. The Contractor shall provide packet definitions of the heartbeat signals and examples of the heartbeat traffic if the signals are included in the network monitoring.

5. Disabling, Removing, or Modifying Well-Known or Guest Accounts. The Contractor shall recommend which accounts need to be active and those that can be disabled, removed, or modified. The DLA KO or COR shall approve in writing the Contractor’s recommendation. The Contractor shall disable, remove, or modify all the accounts pursuant to the approved recommendation. The Contractor shall disable or remove all default and guest accounts. Once changed, new accounts will not be published except that new account information and passwords will be provided by the Contractor via protected media. At delivery, the Contractor shall disable, remove, or modify all Contractor-owned accounts or negotiate account ownership with the DLA KO and COR. Contractor updates shall not re-enable or re-install any of these accounts.

6. Session Management. The Contractor shall not permit user credentials to be transmitted in clear text. Encryption shall at a minimum meet Advanced Encryption Standard (AES) 256 and comply with Federal Information Processing Standards (FIPS) 140-2. If this is not technically feasible, the Contractor shall provide the strongest encryption method commensurate with the technology platform and response time constraints and document the encryption used. The Contractor shall not allow multiple concurrent logins, applications to retain login information between sessions, provide any auto-fill functionality during login, or allow anonymous logins.

The Contractor shall provide user account-based logout and timeout settings.

7. Password/Authentication Policy and Management. The Contractor shall implement two-factor authentication using DoD Common Access Card where technically feasible, with exceptions noted in the proposal. The Contractor shall provide a configurable account password management system that allows for selection of password length, frequency of change, setting of required password complexity, number of login attempts, inactive session logout, screen lock by application, and denial of repeated or recycled use of the same password. The Contractor shall not store passwords electronically or in Contractor-supplied hardcopy documentation in clear text unless the media is physically protected.

8. End Devices. The Contractor shall provide physical and cyber security features for end devices (i.e. the source or destination of network traffic) including, but not limited to, authentication, encryption, access control, event and communication logging, monitoring, and alarming to protect the device and configuration computer from unauthorized modification or use. The Contractor shall clearly identify the physical and cyber security features and provide the methodology for maintaining the features including the methods to change settings from the Contractor-configured or manufacturer default conditions. The Contractor shall verify that the addition of security features does not adversely affect connectivity, latency, bandwidth, response time, and throughput. The Contractor shall remove or disable all software components that are not required for the operation and maintenance of the device prior to delivery. The Contractor shall provide documentation on what is removed and/or disabled. The Contractor shall provide, within a pre-negotiated period, appropriate software, and service updates and/or workarounds to mitigate all vulnerabilities associated with the product and to maintain the established level of system security.

9. Physical Access of Cyber Components. The Contractor shall provide a detailed plan for physical security mechanisms appropriate for the type of devices being installed (enclosures, etc.).

10. System Security Plan. The Contractor shall provide a System Security Plan with the following artifacts:

a) Site Configuration Management Plan

b) Continuity of Operation Plan (COOP) or Contingency and Business

Continuity Plan (BCP)

c) COOP Exercise Evidence

d) Logical and Data Flow Diagrams

e) Disaster Recovery Plan (DRP)

f) Formal Agreement (e.g. Service Level Agreement (SLA), Memorandum of

Understanding/Association (MOU/MOA), Letter of Agreement LOA))

g) Security Personnel Appointment Memorandum(s)

h) Hardware Baseline Inventory

i) Software Baseline Inventory

j) Incident Response Plan (IRP)

k) System Key Management Standard Operating Procedure (SOP)

l) System Media Protection and Sanitization SOP

m) System Access Control and Account Creation SOP

n) System Audit and Accountability SOP

o) System Maintenance SOP

p) System Security Concept of Operations

q) System Design Document

r) Ports, Protocols, and Service Management (PPSM)

3.5.1 CYBERSECURITY STRENGTH REQUIREMENTS

1. The Contractor shall adhere to all existing authorities and policies of the Director of National Intelligence regarding the protection of sensitive compartmented information (SCI), as directed by Executive Order 12333 and other laws and regulations.

2. The Contractor shall satisfy the RMF requirements of subchapter II & III of chapter 35 of Title 44, United States Code (U.S.C.), also known as the “Federal Information Security Management Act (FISMA) of 2014”.

3. The Contractor shall enable DLA to meet the standards required by the Office of Management and Budget (OMB) and the Secretary of Commerce, pursuant to FISMA and section 11331 of Title 40, U.S.C.

a) FIPS 199 / FIPS 200 / FIPS 201/ Committee on National Security Systems Instruction (CNSSI) 1253 Security Categorization: The Contractor shall participate in categorization discussions with the DLA program manager / User Technical and the ISSM, and as requested to support security categorization.

b) The Contractor shall in coordination with the prescribed System Owner (SO) and Authorizing Official (AO) support categorization IAW FIPS 199, FIPS 200, FIPS 201 and CNSSI 1253 of the CS and document the results of the security categorization in the security plan.

c) The Contractor shall ensure that a written subsection of the security plan covers FIPS 199 / FIPS 200 / FIPS 201 CNSSI 1253 Security Categorization and Threat Assessment. DLA and or the SO will provide a C-I-A concurrence memorandum from SO respective AO agreeing with their determination of controls (Confidentiality, Integrity, and Availability with any overlays and tailoring).

3.5.2 CYBERSECURITY ASSURANCE REQUIREMENTS

1. The Contractor shall design, develop, and integrate Cyber Security (CS) solutions supporting the Department of Defense and all other applicable Government agencies.

This will be achieved through abiding by all applicable CS regulations and directives to ensure a favorable Assessment and Authorization (A&A) / Assessment and Incorporate (A&I) decision (an Authority to Operate (ATO)) as well as obtaining an Authority to Connect (ATC) to all requisite Government networks as required per specific task requirements. The Contractor shall mitigate risk identified through the RMF authorization process down to a level acceptable to the DLA Authorizing Official.

Coding for Security. The Contractor shall provide documentation of development practices and standards applied to Government approved Contractor-written control system software, including firmware, used to ensure a high level of defense against unauthorized access.

All control systems shall be considered low-moderate-low (Confidentiality-Integrity- Availability) for the SSP unless otherwise notified in writing. The solution shall comply with the security control requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r4, “Security and Privacy Controls for Federal Information Systems and Organizations” and NIST 800- 82r2, “Guide to Industrial Control Systems (ICS) Security”. The Contractor shall provide details of any alternative but equally effective security measures used to compensate for the inability to satisfy a derived security requirement (mitigation to control compliance findings). Guidance on the applicability and enforcement of controls by Purdue Enterprise Reference Architecture (PERA) level can be found in the United Facilities Criteria (UFC) 4-010-06, Cybersecurity of Facilities-Related Control Systems. The NIST SP 800-82r2 overlay for Industrial Control Systems (ICSs) shall be used as appropriate for the system.

3.5.3 RISK MANGEMENT FRAMEWORK SUPPORT

The Contractor shall support any new system not currently categorized and assessed for network accreditation including, but not limited to the following Risk Management Framework (RMF) steps:

1. RMF Step 1 – Categorize System

a) The System Security Engineer (SSE) shall assess cybersecurity risk per criteria in Analysis of Alternatives (AoA) study plan and cybersecurity capability requirements from the Initial Capabilities Document (ICD) in collaboration with the Information System Security Manager (ISSM) and incorporate the cybersecurity risk assessment into the AoA Study Plan for sponsor approval.

2. RMF Step 2 – Select Security Controls

a) The SSE shall select security control baseline including overlays in collaboration with the ISSM and PM for DLA Authorizing Official (AO) approval.

b) The Chief Engineer (CE) and SSE shall ensure that initial security controls baseline traces to the preliminary system performance specifications that comprise the preliminary functional baseline. The approving authority for this action is this the PM.

c) The CE and SSE shall conduct Trusted Systems and Networks (TSN) Analysis focused at mission level, including Criticality Analysis (CA) to identify critical functions, Threat Assessment (TA), Vulnerability Assessment (VA), TSN Risk Assessment, and countermeasure selection and document in the Program Protection Plan (PPP). The approving authority for this action is this the PM.

The Contractor shall develop and update mission criticality analysis(-es), vulnerability assessment(s), risk assessments(s), and identification and counter measurement implementation(s) for Mission-Critical Functions, the failure of which would result in either Level I (Catastrophic) or Level II (Critical) compromise of mission capability.

d) Adapting the MIL-STD-882 (System Safety) definitions of criticality to mission criticality, the Contractor shall define the following criticality levels:

Level I (Catastrophic) protection failure that results in total compromise of mission capability Level II (Critical) protection failure that results in unacceptable compromise of mission capability or significant mission degradation Level III (Marginal) protection failure that results in partial compromise of mission capability or partial mission degradation Level IV (Negligible) protection failure that results in little or no compromise of mission capability.

e) For each Level I and Level II Mission-Critical Function identified by the

Contractor in the criticality analysis, the Contractor shall identify the associated logic-bearing system components (e.g., hardware, firmware, and software) that implement, protect, or introduce vulnerability, to that function (hereafter referred to collectively as the “critical components”).

f) The Contractor shall demonstrate that the Contractor has mechanisms in place to effectively monitor the supply chain for critical components, understands how supply chain risk can be introduced through those components, and has implemented or plans to implement countermeasures to mitigate such risks.

g) The Contractor shall plan for and implement countermeasures that mitigate the risk of foreign intelligence or foreign influence, technology exploitation, supply chain and battlefield threats, and vulnerabilities that result in Level I and Level II protection failures of the system; countermeasures include the following:

The application of supply chain risk management best practices applied as appropriate to the development of the system. Supply Chain Risk Management Practices for Federal Information Systems and Organizations may be found in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-161 (http:// https://csrc.nist.gov/publications/detail/sp/800-161/final), and the National Defense Industrial Association (2008) guidebook, Engineering for System Assurance, both publicly available (http://www.acq.osd.mil/se/docs/SA-Guidebook-v1-Oct2008.pdf ).

The enumeration of potential suppliers of critical components, as they are identified, including cost, schedule, and performance information and proposed selection decisions for the purposes of obtaining approval from the Government and engaging in the development of mutually agreeable risk management plans for the selected suppliers of critical components.

The processes to control access by foreign nationals to program information, including, but not limited to, system design information, DoD-unique technology, and software or hardware used to integrate commercial technology.

The processes and practices employed to ensure that genuine (i.e., not counterfeit) information and communications technology (ICT) are employed in the solution and that processes and requirements for genuine ICT are levied upon subcontractors. ICT includes all categories of ubiquitous technology used for gathering, storing, transmitting, retrieving, or processing information (e.g., microelectronics, printed circuit boards, computing systems, software, signal processors, mobile telephony, satellite communications, and networks). ICT is not limited to information technology (IT), as defined in section 11101 of title 40, U.S. Code. Rather, this term reflects the convergence of IT and communications.

The processes used to protect both unclassified and classified DoD information, technical data (e.g., source code), and computer software in the development and support environments (e.g., Government- or Contractor-owned facilities and the integrated development environment) from entities without a need to know.

h) The Contractor shall ensure that updated assumptions, rationale, and results related to the criticality analyses, vulnerability assessments, risk assessments, supply chain risk information, and risk mitigations are made available for Government review at each Systems Engineering Technical Review (SETR).

i) The Contractor shall use Government-provided foreign intelligence and technology exploitation threat information, along with the traditional acquisition and battlefield threat information, to inform system security engineering (SSE), systems engineering, and procurement decision processes.

j) The Contractor shall develop a set of secure coding standards and secure design features drawing upon the “top 10 secure coding practices” (https://www.securecoding.cert.org/confluence/display/seccode/Top+10+Secu re+Coding+Practices), the CWE/SANS top 25 most dangerous software errors http://www.acq.osd.mil/se/docs/SA-Guidebook-v1-Oct2008.pdf http://www.acq.osd.mil/se/docs/SA-Guidebook-v1-Oct2008.pdf http://www.securecoding.cert.org/confluence/display/seccode/Top%2B10%2BSecu

(http://cwe.mitre.org/top25/index.html), and the secure design patterns (www.cert.org/archive/pdf/09tr010.pdf - 2009-10-23) to use with all Level I Mission-Critical Function components.

k) The Contractor shall provide documentation of coding practices used in developing the delivered software. The Contractor shall provide the results of Code Reviews.

l) The Contractor shall protect unclassified DoD data from…