Attachment 1 PWS.docx

PERFORMANCE WORK STATEMENT (PWS)

Contract Number:

Task Order Number:

Contractor Name

Tracking Number:

1. Contracting Officer’s Representative (COR).

a. Primary COR.

Name:

Organization:

Department of Defense Activity Address Code (DODAAC):

Address:

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR.

Name:

Organization:

DODAAC:

Address:

Phone Number:

Fax Number:

E-Mail Address:

c. Property Administrator

Organization:

DODAAC:

Address:

Phone Number:

Fax Number:

E-Mail Address:

2. Contract or Task Order Title. PHNSY&IMF Code 109 Information Technology (IT) and Cybersecurity Contractor Support.

3. Background. The purpose of this IT and Cybersecurity services contract is to provide the Government with IT and cybersecurity support capabilities in compliance with Department of Defense (DoD), Department of Navy (DoN), Naval Sea Systems Command (NAVSEA), and Department of Energy (DoE) regulatory requirements.

4. Objectives: As part of its mission, the Pearl Harbor Naval Shipyard and Intermediate Maintenance Facility (PHNSY&IMF) provides critical network, data, and cybersecurity enhanced services to the Pacific Area of Operations (PAC AO). The PHNSY&IMF Information Technology and Cybersecurity department, otherwise referred to as Code 109, supports this mission through the delivery of IT and cybersecurity services in compliance with DoD, DoN, DoE (to include the Atomic Energy Act of 1954, 42 U.S.C. §§ 2011-2021, 2022-2286i, 2296a-2297h-13), and USCYBERCOM security standards and mandates to protect the confidentiality, integrity, and availability of Government information systems and networks.

5. Scope. The Contractor shall provide 100%, performance of tasks professional IT and Cybersecurity services, including any general support tasks as further defined in this Performance Work Statement (PWS).

Performance of services occur at the PHNSY&IMF located at Joint Base Pearl Harbor Hickam Hawaii, but also include on-site support at PHNSY&IMF’s Area of Responsibility (AOR) on Naval Base Guam. Work requirement may include work within INDOPACOM AOR as required. At PHNSY&IMF the contractor personnel will have frequent access to all spaces including but not limited to Code 109’s Controlled Nuclear Information Area. The Government may require optional CLIN support during the base or any option period, and optional CLIN modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. In addition, the Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined, non-optional CLIN task areas of this PWS. Surge support over the life of the contract will not exceed 10% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

6. Performance Requirements. Contractor’s performance requirements and tasks for each functional area are detailed in the following subsections. Definitions of terms and acronyms used within the PWS can be found in Attachment A.

6.1 PROGRAM MANAGEMENT SUPPORT

Program management support includes the management and oversight of all activities performed by Contractor’s personnel and its subcontractors to ensure Contractor’s services are performed on time and satisfy the requirements identified in the PWS.

The Contractor shall have an on-site Program Manager (PM) and an alternate by name, who will serve as the primary interface and point-of-contact (POC) to the Government Contracting Officer Representative (COR) and Code 109. The Contractor PM shall possess the authority to act for Contractor on all matters relating to the daily operations of the contract; the alternate PM serves when the PM is absent. The PM or alternate PM shall be on-site and available to Government during the daily business hours.

Program management support also includes the facilitation of communications between the Government and Contractor’s personnel to ensure tasks are clear and activities are performed in accordance with the requirements contained in this PWS.

6.1.1 Key Personnel:

Program Manager: The contractor shall provide a program manager who will be on-site and shall be responsible for the performance of the work. An alternate shall act for the contractor when the program manager is absent. The program manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The program manager or alternate shall be available on-site between 6:30 a.m. to 3:00 p.m., Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons and available after hours if any issues arise.

Section 6.1 tasks performed by the PM include, management and supervision, direction, administration, quality assurance, and leadership within the Contractor’s personnel for execution of each task in support of the PWS requirements. The PM shall apply industry best practices and proven methodologies in program management to ensure all activities and tasks under this PWS are identified, documented, tracked, and accomplished.

Master Oracle Database Consultant (two positions): Master-level experience managing multiple application Oracle databases and all required interfaces to and from non-standardized, local applications to support a heavy industrial industry or maintenance mission. Leverages specialized knowledge of Government Off the Shelf (GOTS) naval ship maintenance applications and information systems to design and implement optimized enterprise database solutions for tasks in Section 6.3.7. These solutions must provide for the high availability in Oracle database operations of mission critical and mission essential ship maintenance systems typically deployed in a Naval Shipyard. Extensive knowledge of Network Attached Storage (NAS) systems and possess the ability to manage these systems to efficiently store and manipulate data for the application databases listed below. Extensive knowledge in the following applications is required:

· Corporate Shipyard Application Suite (CSAS)/Maritime Systems Environment (MSE) Applications:

· Naval Maintenance Suite (NMS).

· Advanced Industrial Management (AIM).

· Advanced Industrial Management Express (AIMXP).

· Material Requirements Reporting & Tracking (MRQT).

· Project Scheduling and Sequencing (PSS).

· Execution Priority (EP).

· Automated Training Management System (ATMS).

· Navy Workload and Performance System (NWPS).

· Strategic Planning and Forecasting (SPF).

· Performance Measurement and Control (PMC).

· Quality Performance System (QPS).

· Material Access Technology (MATMF).

· Query Database (QDB).

· Supplemental Administration (SAEM).

· Supervisors Desk (SUPDESK).

· Shipyard Automated Budget Reporting System (SABRS).

· Pre and Post Payroll Processes (PPPP).

· Shipyard Cost Financial Management System (COST).

· Medical Exam Scheduling (MES).

· Non-CSAS/MSE Shipyard Mission Essential Applications (SYME)

· Enterprise Facilities and Equipment Management System (eFEM).

· Automated Radiological Control Management Information System (ARCMIS).

· Advanced Technical Drawing System (ATIS).

· Laboratory Information Management System (LIMS).

Financial and Material Business Objects Consultant: Journeyman level experience in developing customized financial and logistics ad hoc reporting using Business Objects to support a heavy industrial industry, maintenance mission or financial institution. This includes possessing extensive functional knowledge of all financial and material transactions derived from Government-Off-the-Shelf (GOTS) naval ship maintenance applications and information systems to support all specialized data mining operations from MS SQL or Oracle application databases used in the enterprise for tasks in Section 6.3.14. Extensive knowledge in the following applications is required:

· Corporate Shipyard Application Suite (CSAS)/Maritime Systems Environment (MSE) Applications:

· Naval Maintenance Suite (NMS).

· Advanced Industrial Management (AIM).

· Advanced Industrial Management Express (AIMXP).

· Material Requirements Reporting & Tracking (MRQT).

· Project Scheduling and Sequencing (PSS).

· Execution Priority (EP).

· Automated Training Management System (ATMS).

· Navy Workload and Performance System (NWPS).

· Strategic Planning and Forecasting (SPF).

· Performance Measurement and Control (PMC).

· Quality Performance System (QPS).

· Material Access Technology (MATMF).

· Query Database (QDB).

· Supplemental Administration (SAEM).

· Supervisors Desk (SUPDESK).

· Shipyard Automated Budget Reporting System (SABRS).

· Pre and Post Payroll Processes (PPPP).

· Shipyard Cost Financial Management System (COST).

· Medical Exam Scheduling (MES).

VMware/Citrix Consultant: Journeyman-level experience comprising minimum 5 years of VMware ESXI administrator experience to include installation, setup, and maintenance of a VMware vSphere ESXi 5.5/6.0 environments running vCenter and minimum 5 years of Windows Server Administration. Leverages specialized knowledge of Government-Off-the-Shelf (GOTS) naval ship maintenance applications and information systems to design and implement optimized enterprise virtualization solutions for tasks in Section 6.3.4. These solutions must provide for the high availability of operations of mission critical and mission essential ship maintenance systems typically deployed in a Naval Shipyard.

Network Storage Consultant: Journeyman-level experience comprising minimum 5 years of NetApp Network Attached Storage administration. Leverages specialized knowledge of Government policies and procedures to meet data protection and retention requirements in support of mission critical and mission essential ship maintenance systems typically deployed in a Naval Shipyard for tasks in Section 6.3.3.

Backup Consultant: Journeyman-level experience comprising minimum 5 years of experience with Data Backup Administration using Veritas NetBackup software and minimum 5 years of *NIX Server Administration. Leverages specialized knowledge of Government policies and procedures to meet data protection and retention requirements in support of mission critical and mission essential ship maintenance systems typically deployed in a Naval Shipyard for tasks in Section 6.3.3.

Senior Software Engineer (APEX) Journeyman-level experience comprised of the following qualifications for tasks in Section 6.5.12:

· Minimum 10 years designing, developing, and maintaining C#.NET web applications.

· Must have extensive experience (5 years or more) in designing, developing, and maintaining SQL databases in SQL Server 2012 R2 or higher.

· Must have extensive experience (5 years or more) in designing, developing, and maintaining SQL databases in Oracle 11g or higher.

· Must have extensive experience (5 years or more) designing, developing, and maintaining Oracle APEX applications.

· Must have experience working with corporate data from the following applications: AIM, AIMxp, ATMS, COST, PMC, PSS, QDB, and SupDesk.

Navy Qualified Validator Master-level experience comprised of the following qualifications for tasks in Section 6.4.15:

· DoD 8570.01-M IAM/IAT Level III

· College degree in a technical or managerial related discipline

· High School Diploma or HS equivalency certificate plus seven (7) years of experience

· Completion of Navy Validator Course CBT-NQV-100 Series and ILT-NQV-201 Series

· DISA eMASS Training (Instructor-led session)

· DISA Assured Compliance Assessment Solution (ACAS) Training; or Tenable Compliance Auditing Training; or Tenable Nessus Advanced Capabilities Training. (Instructor-led session)

· Greater than five (5)* years practical experience in a Cybersecurity, Engineering, T&E or A&A (formerly C&A) related field Navy A&A: Experience independently performing the NQV Level III activities defined in Appendix (A) (of the NQV Memo, Enclosure 1) and successfully completing all required validator tasks for one or more Security Authorization Packages through the SCA within the past year (or equivalent direct DoD RMF A&A experience as approved by the IA TA)

· Test & Evaluation: Experience in allocating assigned security controls into assessment objectives and procedures, developing and executing Security Assessment Plans by selecting and tailoring appropriate assessment methods, depth and coverage, and applying sequencing to reduce duplication of effort and provide cost effective assessment solutions (or equivalent direct DoD RMF A&A experience as approved by the IA TA).

6.1.2 Deliverables

Title

Distribution /Copies Frequency and Remarks

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

Weekly Personnel Status Reports:

The Contractor PM shall develop and provide weekly personnel status reports by close of business (COB) every Wednesday via electronic mail to the COR and TPOC (CDRL B003). The weekly personnel status report provides a comprehensive list, including but not limited to, all contractor personnel gains, losses, start dates, departure dates, and staffing status to include security clearance updates, and upcoming leave. Summary of contractor personnel gains, losses, and staffing status (e.g. security clearance, upcoming leave).

Management Reports: Monthly Status Reports (MSR):

· The Contractor PM shall develop and provide a MSR by the tenth (10th) business day of each month via electronic mail to the CO, COR, and TPOCs (CDRL B002). The MSR summarizes by task area, the management and technical work conducted during the month. The Contractor shall provide at a minimum, the status of activities during the reporting period to include: Service Integration and Management (SIAM) request numbers (total for month, period of performance, open and closed tickets)

· Risks and risk mitigation techniques

· Milestones and deliverables completed

· Deliverables submitted during the month

· Deliverables awaiting Government approval

· Recommendations for change, modifications, or improvements in task or processes

· Projected activities for the upcoming month

· Subcontractor performance (if applicable)

Meetings held with Government representatives, as applicable to include subject, attendees, and the outcome.

6.2 GENERAL REQUIREMENTS

6.2.1 Work Environment

PHNSY&IMF maintains clean and safe office and work areas.

The following housekeeping actions are necessary to support a clean and safe work environment in Code 109 workspaces. Contractor shall maintain a clean and safe work environment using the appropriate Shipyard-supplied cleaner in accordance with shipyard health and safety guidelines. Empty the common area (i.e., lunch/break rooms) trash receptacles to ensure that food/perishables do not remain in the receptacles overnight and over the weekend.

6.2.2 Data Call Support

External and internal agencies often request information and data from Code 109. These requests are referred to as “data calls.” Contractor support for data calls requires querying, aggregating, and summarizing data.

Contractor will provide data, information, reports, in support of all data calls, using provided systems and tools as further defined and described in each functional area. There is an average of 50 data calls each calendar year.

6.2.3 Metrics Support

Code 109 generates several metrics and associated reports. Contractor support for metrics requires querying, aggregating, and summarizing data. Contractor will provide metrics and associated reports as further defined in each functional task area.

Table 6.2.3.1 Metrics gathered and required in Section 6.4 Information Assurance task areas:

6.2.4 Documentation

Code 109 codifies processes, requirements, and guidelines in various types of documents, such as, the ITACS Manual, Standard Operating Procedures (SOP), Desk Guides, Standard Forms (SF), Policy, PHNSY&IMF Forms, Reports, and Checklists. Contractor will provide documentation as further defined in each functional task area.

Table 6.2.4.1 Create and update applicable documents in these areas referenced under Section 6.4 Information Assurance task areas:

6.2.5 Meetings

Contractor will attend all functional meetings, recurring and ADHOC specified under each functional task area.

Contractor employees shall identify themselves as Contractor personnel by introducing themselves or being introduced as Contractor personnel and displaying distinguishable badges or other visible identification for meetings with Government personnel.

Table 6.2.5.1 Meetings required in Section 6.4 Information Assurance task areas:

6.2.6 Call-Back Options

For all Unauthorized Service Interruption, acceptable Service Level Agreement (SLA) response times for PHNSY&IMF systems are listed in the Performance Standards for each functional task area.

Under Section 6.4 Information Assurance, acceptable SLA response times for PHNS&IMF systems, applications, and functions; including HBSS, ACAS, Splunk, IT Service Performance Monitoring Application, RedSeal, Varonis, and Incident Response for PHNSY&IMF locations (JBPHH, Guam,) are listed in Table 6.2.6.1 and further detailed in Section 6.4 Performance Standards.

Table 6.2.6.1

(Sunday through Saturday) Response Time

On-site: 120 minutes

On-site: 120 minutes

On-site: 120 minutes

6.2.7 Procurement Research

Contractor will perform, at least annually, market research, including coordinating with vendors for price quotations, for service and license renewals, and expansions/additions. This includes validating and evaluating licenses and their associated coverage (e.g., installation counts).

Table 6.2.7.1 Systems, Applications, Networks for research under Section 6.4 Information Assurance when requested:

6.3 TECHNICAL SUPPORT

6.3.1 Windows Server Administration

Contractor will perform system administration operations on all Windows server systems to maintain a functional and secure operating environment for each network in compliance with Government policies and regulations.

Refer to PWS Attachment B, Section 6.3.1 for information on the service environment.

Functional Servers:

· Maintain service levels of system availability and uptime as defined in the Performance Standards. A system outage does not equal an adequate service level.

· Maintain availability, confidentiality, and integrity of server systems.

· Manage systems resources including performance, capacity, availability, serviceability, and recoverability.

· Troubleshoot and repair system outages to maintain applicable Service Levels.

· Communicate status of outages to PHNSY&IMF (e.g., system-down notifications, status reports on expected restoration, system-up notifications).

· Perform daily checks for servers per established DoN, NAVSEA, Shipyard and local SOPs/desk guides.

· Develop, generate, maintain, and contribute to documentation (e.g., procedures, instructions) that pertain to and are applicable to managed systems.

Sub-Tasks Included:

6.3.1.1 Troubleshoot and repair system outages to maintain service levels indicated in the performance standards.

6.3.1.2 Respond to trouble calls of outages during 1st shift, 2nd shift, and 3rd shift.

6.3.1.3 Notify Government on the status of system outages. Status notifications include system-down notifications, status reports on expected restoration, and system-up notifications.

6.3.1.4 Build, maintain, troubleshoot, and repair Windows server hardware and software.

6.3.1.5 Manage server account access to systems, equipment, and file shares.

6.3.1.6 Maintain structure of rights for accounts, groups, and file shares.

6.3.1.7 Maintain domain system policies to administratively enforce application and security settings for users and computers.

6.3.1.8 Maintain, monitor, and provide performance tuning (e.g. CPU, memory, load-balancing).

6.3.1.9 Monitor and manage use of disk space, permissions, and network connections.

6.3.1.10 Resolve hardware/software interface and interoperability problems.

6.3.1.11 Provide technical support for Windows server related issues.

6.3.1.12 Perform backup and recovery actions per established DoN, NAVSEA, Shipyard and local guidance.

6.3.1.13 Create and maintain server backups for disaster recovery.

6.3.1.14 Develop and update disaster recovery documentation on when requested.

6.3.1.15 Develop and maintain Systems Administration SOPs.

6.3.1.16 Develop and maintain configuration documentation of systems and equipment.

6.3.1.17 Maintain the environment of the computer data center(s) (temperature, humidity, cleanliness,).

6.3.1.18 Support change and configuration management.

6.3.1.19 Coordinate, collaborate, and work with other branches and stakeholders to complete tasks.

6.3.1.20 Coordinate, collaborate, and work with others in identifying processes that can be automated to save man-hours, be more efficient, and have more consistent results.

6.3.1.21 Assist /Mentor other System Administrators (SAs) (Contractor/Government upon request).

6.3.1.22 Coordinate, collaborate, and work with others in capturing metrics to assist Government on visibility of the server environment.

Secure Servers:

· Maintain compliant, secure systems for each network through the availability, confidentiality, and integrity of server systems. Meet all cybersecurity deadlines for compliance, which includes the tasks below.

· Protect Naval Nuclear Propulsion Information (NNPI) and other Confidential Data as stated in OPNAV Instruction N9210.3 series.

· Vulnerability Management (e.g. patches, security technical implementation guidelines (STIGs), monitor and evaluate ACAS reports, TASKORDS).

· Maintain server compliance to PHNSY&IMF, and higher level, configuration requirements

Sub-Tasks Included:

6.3.1.23 Maintain server compliance with local and higher-level configuration requirements.

6.3.1.24 Create and document auditable records of configurations, including configuration changes and updates.

6.3.1.25 Complete daily checks on each server, which includes event logs, log files, and audit logs. Create and maintain auditable records of periodic checks.

6.3.1.26 Apply vulnerability management requirements, which includes patches, (STIGs), and the review of vulnerability reports.

6.3.1.27 Manage the installation and integration of system fixes, updates, and enhancements.

6.3.1.28 Implement physical and data security per established DoN, NAVSEA, Shipyard and local guidance.

6.3.1.29 Review, plan, test, and implement applicable STIGs on technologies under AOR.

6.3.1.30 Review, plan, test, and implement fixes per vulnerabilities identified in security scan tools (e.g., ACAS)

6.3.1.31 Coordinate, collaborate, and work with other branches to create and maintain vulnerability documentation per established DoN, NAVSEA, Shipyard and local guidance (e.g., plan of action and milestones, mitigation statements, accreditation and authorization packages).

6.3.1.32 Complete reports including monthly CO Cybersecurity Report, NOSCC monthly metrics, and NAVSEA 04 IT Metrics.

6.3.1.33 Monitor and analyze audit logs, report any irregularities per established DoN, NAVSEA, Shipyard and local guidance.

6.3.1.34 Complete IT-specific project management tasks when project identified. This includes participating on project teams responsible for system hardware and application software implementation and upgrades; determining project scope and additional staff resources required to complete projects; preparing project-specific work plans and timelines; monitoring project milestones; and reporting project progress to Government management. Work closely with other technical staff, vendors, and contacts from other Government agencies to ensure timely and efficient completion of assigned IT projects.

6.3.1.35 Communicate effectively with all department levels to ensure project success, and user needs identified and met.

6.3.1.36 Participate in and provide technical evaluations in various meetings, groups, committees on the following:

6.3.1.37 Communicate and confer on existing procedures and systems in process analysis;

· Determine cost/benefit and complexities of new processes and projects;

· Prepare for testing;

· Discuss the roll-out of new projects and software upgrades,

· Discuss other applicable issues.

6.3.1.38 May participate in computer audits and perform testing for disaster recovery process to ensure a secure processing environment that protects the integrity and availability of information.

6.3.1.39 Conduct initial market research to facilitate vendor quotes for direct Government technical point of contact (TPOC) evaluation and acceptance.

6.3.1.40 Analyze new technologies and system enhancements. Prepare project proposals and budgets for TPOC review and approval.

6.3.1.41 Assist with data calls and metrics within time frame and frequency requested by Government, including the CO Cybersecurity Report, NOSCC monthly metrics, and NAVSEA 04I IT metrics.

6.3.1.42 Attend all meetings required by Government.

Performance Measures:

Response time will be checked for each trouble call.

Deliverables:

Title

Distribution /Copies Frequency and Remarks

Standard Operating Procedures

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.3.2 Unix Server Administration

Contractor will perform system administration operations on all Unix server systems to maintain a functional and secure operating environment for each network in compliance with Government policies and regulations.

Refer to PWS Attachment B, Section 6.3.2 for information on the service environment.

Functional Servers:

· Maintain service levels of system availability and uptime defined in the Performance Standards. A system outage does not equal an adequate service level.

· Maintain availability, confidentiality, and integrity of server systems.

· Manage systems resources including performance, capacity, availability, serviceability, and recoverability.

· Troubleshoot and repair system outages to maintain applicable Service Levels.

· Communicate status of outages to PHNSY&IMF (e.g., system down notifications, status reports on expected restoration, system up notifications).

· Perform daily checks for servers per established DoN, NAVSEA, Shipyard and local SOPs/desk guides.

· Develop, generate, maintain, and contribute to documentation (e.g., procedures, instructions) that pertain to and are applicable to managed systems.

Sub-Tasks Included:

6.3.2.1 Troubleshoot and repair system outages to maintain service levels indicated in the performance standards.

6.3.2.2 Respond to trouble calls of outages during 1st shift, 2nd shift, and 3rd shift.

6.3.2.3 Notify Government on the status of system outages. Status notifications include system-down notifications, status reports on expected restoration, and system-up notifications.

6.3.2.4 Build, maintain, troubleshoot, and repair Unix server hardware and software.

6.3.2.5 Manage server account access to systems, equipment, and file shares.

6.3.2.6 Maintain structure of rights for accounts, groups, and file shares.

6.3.2.7 Maintain domain system policies to administratively enforce application and security settings for users and computers.

6.3.2.8 Maintain, monitor, and provide performance tuning (e.g., CPU, memory, load-balancing).

6.3.2.9 Monitor and manage use of disk space, permissions, and network connections.

6.3.2.10 Resolve hardware/software interface and interoperability problems.

6.3.2.11 Provide technical support for Unix server related issues.

6.3.2.12 Perform backup and recovery actions per established DoN, NAVSEA, Shipyard and local guidance.

6.3.2.13 Create and maintain server backups for disaster recovery.

6.3.2.14 Develop and update disaster recovery documentation when requested.

6.3.2.15 Develop and maintain Systems Administration SOPs.

6.3.2.16 Develop and maintain configuration documentation of systems and equipment.

6.3.2.17 Maintain the environment of the computer data center(s) (temperature, humidity, cleanliness).

6.3.2.18 Support change and configuration management.

6.3.2.19 Coordinate, collaborate, and work with other branches and stakeholders to complete tasks.

6.3.2.20 Coordinate, collaborate, and work with others in identifying processes that can be automated to save man-hours, be more efficient, and have more consistent results.

6.3.2.21 Assist/Mentor other SAs (Contractor/Government when requested).

6.3.2.22 Coordinate, collaborate, and work with others in capturing metrics to assist Government on visibility of the server environment.

Secure Servers:

· Maintain compliant, secure systems for each network through the availability, confidentiality, and integrity of server systems. Meet all cybersecurity deadlines for compliance, which includes the tasks below.

· Protect NNPI and other Confidential Data as stated in OPNAV Instruction N9210.3 series.

· Vulnerability Management (e.g. patches, STIGs, monitor and evaluate ACAS reports, TASKORDS).

· Maintain server compliance to PHNSY&IMF, and higher level, configuration requirements.

Sub-Tasks Included:

6.3.2.23 Maintain server compliance with local and higher-level configuration requirements. Create and document auditable records of configurations, including configuration changes and updates.

6.3.2.24 Complete daily checks on each server, which includes event logs, log files, and audit logs. Create and maintain auditable records of periodic checks.

6.3.2.25 Manage the installation and integration of system fixes, updates, and enhancements.

6.3.2.26 Implement physical and data security per established DoN, NAVSEA, Shipyard and local guidance.

6.3.2.27 Review, plan, test, and implement applicable STIGs on technologies under AOR.

6.3.2.28 Review, plan, test, and implement fixes per vulnerabilities identified in security scan tools (e.g., ACAS)

6.3.2.29 Coordinate, collaborate, and work with other branches to create and maintain vulnerability documentation per established DoN, NAVSEA, Shipyard and local guidance (e.g., plan of action and milestones, mitigation statements, accreditation and authorization packages).

6.3.2.30 Complete reports including, but monthly CO Cybersecurity Report, NOSCC monthly metrics, and NAVSEA 04 IT Metrics.

6.3.2.31 Monitor and analyze audit logs, report any irregularities per established DoN, NAVSEA, Shipyard and local guidance.

General Secure and Functional Server Tasks:

6.3.2.32 Complete IT-specific project management tasks when project identified. This includes participating on project teams responsible for system hardware and application software implementation and upgrades; determining project scope and additional staff resources required to complete projects; preparing project-specific work plans and timelines; monitoring project milestones; and reporting project progress to Government management. Work closely with other technical staff, vendors, and contacts from other Government agencies to ensure timely and efficient completion of assigned IT projects.

6.3.2.33 Communicate effectively with all department levels to ensure project success, and user needs identified and met.

6.3.2.34 Participate in and provide technical evaluations in various meetings, groups, committees on the following:

· Communicate and confer on existing procedures and systems in process analysis;

· Determine cost/benefit and complexities of new processes and projects;

· Prepare for testing;

· Discuss the roll-out of new projects and software upgrades,

· Discuss other applicable issues.

6.3.2.35 May participate in computer audits and perform testing for disaster recovery process to ensure a secure processing environment that protects the integrity and availability of information.

6.3.2.36 Conduct initial market research to facilitate vendor quotes for direct Government TPOC evaluation and acceptance.

6.3.2.37 Analyze new technologies and system enhancements. Prepare project proposals and budgets for TPOC review and approval.

6.3.2.38 Assist with data calls and metrics within time frame and frequency requested by Government, including the CO Cybersecurity Report, NOSCC monthly metrics, and NAVSEA 04I IT metrics.

6.3.2.39 Attend all meetings required by Government.

Performance Measures:

Response time will be checked for each trouble call.

Title

Distribution /Copies Frequency and Remarks

Standard Operating Procedures

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.3.3 Storage and Backup Administration

Contractor will perform system administration operations on all Network Attached Storage (NAS) systems and tape libraries to maintain a functional and secure operating environment for each network in compliance with Government policies and regulations.

Refer to PWS Attachment B, Section 6.3.3 for information on the service environment.

Functional System:

· Maintain service levels of system availability and uptime, as defined in the Performance Standards. A system outage does not equal an adequate service level.

· Maintain availability, confidentiality, and integrity of NAS systems and tape libraries.

· Manage systems resources including performance, capacity, availability, serviceability, and recoverability.

· Troubleshoot and repair system outages to maintain applicable Service Levels.

· Perform data backup, recovery, and off-site task actions for all servers and applications.

· Communicate status of outages to PHNSY&IMF (e.g., system-down notifications, status reports on expected restoration, system-up notifications).

· Perform daily checks for servers per established DoN, NAVSEA, Shipyard and local SOPs/desk guides.

· Develop, generate, maintain, and contribute to documentation (e.g., procedures, instructions) that pertain to and are applicable to managed systems.

Sub-Tasks Included:

6.3.3.1 Troubleshoot and repair system outages to maintain adequate service level.

6.3.3.2 Respond to trouble calls of outages during 1st shift, 2nd shift, and 3rd shift.

6.3.3.3 Notify Government on the status of system outages. Status notifications include system-down notifications, status reports on expected restoration, and system-up notifications.

6.3.3.4 Build, maintain, troubleshoot, and repair NAS systems and tape library hardware and software.

6.3.3.5 Manage NAS systems and tape library account access to systems, equipment, and file shares.

6.3.3.6 Maintain structure of rights for accounts, groups, and file shares.

6.3.3.7 Maintain system policies to administratively enforce application and security settings for users and file shares.

6.3.3.8 Maintain, monitor, and provide performance tuning (e.g., CPU, memory, load-balancing).

6.3.3.9 Monitor and manage use of disk space, permissions, and network connections.

6.3.3.10 Resolve hardware/software interface and interoperability problems.

6.3.3.11 Provide technical support for NAS systems and tape library related issues.

6.3.3.12 Perform data and tape backup and recovery actions per established DoN, NAVSEA, Shipyard and local guidance.

6.3.3.13 Create and maintain system back-ups on a daily, weekly, monthly, and annual basis per established DoN, NAVSEA, Shipyard and local guidance.

6.3.3.14 Coordinate, collaborate, and work with designated personnel to send backup tapes per established DoN, NAVSEA, Shipyard and local guidance.

6.3.3.15 Develop and update disaster recovery documentation when requested.

6.3.3.16 Develop and maintain NAS Administration Standard Operating Procedures.

6.3.3.17 Develop and maintain Tape Library Standard Operating Procedures

6.3.3.18 Develop and maintain configuration documentation of systems and equipment.

6.3.3.19 Develop and maintain documentation of disaster recovery scenarios per DoN, NAVSEA, Shipyard and local guidance.

6.3.3.20 Maintain the environment of the computer data center(s) (temperature, humidity, cleanliness).

6.3.3.21 Support change and configuration management.

6.3.3.22 Coordinate, collaborate, and work with other branches and stakeholders to complete tasks.

6.3.3.23 Coordinate, collaborate, and work with others in identifying processes that can be automated to save man-hours, be more efficient, and have more consistent results.

6.3.3.24 Assist/Mentor other admins (Contractor/Government when requested).

6.3.3.25 Coordinate, collaborate, and work with others in capturing metrics to assist Government on visibility of the NAS environment.

Secure System:

· Maintain compliant, secure systems for each network through the availability, confidentiality, and integrity of storage systems. Meet all cybersecurity deadlines for compliance, which includes the tasks below.

· Protect NNPI and other Confidential Data as stated in OPNAV Instruction N9210.3 series.

· Ensure systems availability, functionality, integrity, and efficiency.

· Vulnerability Management (e.g., patches, STIGs, monitor and evaluate ACAS reports, TASKORDS).

· Maintain server compliance to PHNSY&IMF, and higher level, configuration requirements.

Sub-Tasks Included:

6.3.3.26 Validate successful completion of backups in compliance with local policy and configuration requirements. Maintain auditable records or logs of backup events.

6.3.3.27 Validate successful delivery of off-site media in compliance with local policy and configuration requirements. Maintain auditable records or logs of backup events.

6.3.3.28 Maintain server compliance with local and higher-level configuration requirements. Create and document auditable records of configurations, including configuration changes and updates.

6.3.3.29 Complete daily checks on each storage system, which includes event logs, log files, and audit logs. Create and maintain auditable records of periodic checks.

6.3.3.30 Apply vulnerability management requirements, which includes patches, STIGs, and the review of vulnerability reports.

6.3.3.31 Manage the installation and integration of system fixes, updates, and enhancements.

6.3.3.32 Implement physical and data security per established DoN, NAVSEA, Shipyard and local guidance.

6.3.3.33 Review, plan, test, and implement applicable STIGs on technologies under AOR.

6.3.3.34 Review, plan, test, and implement fixes per vulnerabilities identified in security scan tools (e.g., ACAS)

6.3.3.35 Coordinate, collaborate, and work with other branches to create and maintain vulnerability documentation per established DoN, NAVSEA, Shipyard and local guidance (e.g., plan of action and milestones, mitigation statements, accreditation and authorization packages).

6.3.3.36 Complete reports including monthly CO Cybersecurity Report, NOSCC monthly metrics, and NAVSEA 04 IT Metrics.

6.3.3.37 Monitor and analyze audit logs, report any irregularities per established DoN, NAVSEA, Shipyard and local guidance.

General Storage and Backup Administration Tasks:

6.3.3.38 Complete IT-specific project management tasks when project identified. This includes participating on project teams responsible for system hardware and application software implementation and upgrades; determining project scope and additional staff resources required to complete projects; preparing project-specific work plans and timelines; monitoring project milestones; and reporting project progress to Government management. Work closely with other technical staff, vendors, and contacts from other Government agencies to ensure timely and efficient completion of assigned IT projects.

6.3.3.39 Communicate effectively with all department levels to ensure project success, and user needs identified and met.

6.3.3.40 Participate in and provide technical evaluations in various meetings, groups, and/or committees on the following:

· Communicate and confer on existing procedures and systems in process analysis;

· Determine cost/benefit and complexities of new processes and projects;

· Prepare for testing;

· Discuss the roll-out of new projects and software upgrades, and/or

· Discuss other applicable issues.

6.3.3.41 May participate in computer audits and perform testing for disaster recovery process to ensure a secure processing environment that protects the integrity and availability of information.

6.3.3.42 Conduct initial market research to facilitate vendor quotes for direct Government TPOC evaluation and acceptance.

6.3.3.43 Analyze new technologies and system enhancements. Prepare project proposals and budgets for TPOC review and approval.

6.3.3.44 Assist with data calls and metrics within time frame and frequency requested by Government, including

6.3.3.45 the CO Cybersecurity Report, NOSCC monthly metrics, and NAVSEA 04I IT metrics.

6.3.3.46 Attend all meetings required by Government.

Performance Measures:

Cybersecurity deadlines will be checked per month.

Response time will be checked for each trouble call.

Title

Distribution /Copies Frequency and Remarks