Attachment 18 - FINAL PWS SRF Attachment 4.docx

Attachment 18

PERFORMANCE WORK STATEMENT

TITLE: Ship Repair Facility Japan Regional Maintenance Center (SRF-JRMC) Yokosuka Code 109 Information Technology

REFERENCES:

(a) DoD 8140.01, Cyberspace Workforce Management Directive

TECHNICAL SPECIFICATIONS

1. SCOPE: The objective of this Performance Work Statement (PWS) is to provide Information Technology (IT) support in the form of an Computer Specialist II to the IT and Cyber Security Department (Code 109) in support of Ship Repair Facility – Japan Regional Maintenance Center (SRF-JRMC), Yokosuka missions.

2. PLACE OF PERFORMANCE:

a. Applicable Ships: SEVENTH FLEET Forward Deployed Naval Force (FDNF) ships, Yokosuka, Japan

b. Location of Majority of Work: SRF areas and aboard ships berthed or dry docked at Yokosuka Naval Base, Japan.

3. SPECIFIC TASKS:

Task 1: Account Management Contractor will administer the command user cybersecurity, Virtual Private Network (VPN), and Video Teleconferencing (VTC) Manager briefs, assists users with account creation documentation, and guide through the account approval process from start to finish. Contractor will maintain user account database and manage expired or dormant accounts per Ship Repair Facility and Japan Regional Maintenance Center (SRF-JRMC) promulgated guidance. Contractor will manage and maintain authentication tokens related to user accounts following established guidelines.

Task 2: IT Customer Support Contractor will provide Tier I and II troubleshooting, coordination and support to services to all customers in support of the Ship Repair Facility and Japan Regional Maintenance Center (SRF-JRMC) Service Desk. Contractor will create trouble tickets, install work stations and computer applications, assist in problem isolation and resolution, and perform local workstation updates. Contractor will act as IT Help Desk support coordinator between SRF-JRMC and Naval Computer and Telecommunication Station Yokosuka. Contractor will support the resolution of customer issues and request services via the Request for Change (RFC) process. Contractor will report to the asset manager when any equipment is relocated. Contractor will ensure that all SRF-JRMC and ONE-NET computers are connected and receiving required updates. Contractor will diagnose ICT/AV hardware issues, contact coordinate with support vendors, in order to ensure ICT/AV equipment is being repaired by the vendor. If the repair is outside of warranty, contractor will be followed SRF-JRMC Life Cycle Management SOP. Contractor will maintain the workstation imaging area, including image workstations, and make it available to be used for replacing troubled workstations, loaners, or for mass deployments.

Task 3: Cybersecurity Administrative Support Contractor will be familiar with all Navy Cyber Defense Operations Command directives, such as DoD 5200.01 and SECNAVINST 5239.3C, and support associated tasks and provide support for the development of cybersecurity related customer support policies, procedures, and standards. Contractor will use professional judgment to recommend mitigation strategies to reduce/correct any security vulnerabilities. Contractor will implement response actions in reaction to security incidents, assist in data collection for cybersecurity reports, draft reports for submission, and follow up on results and mitigations. Contractor will ensure that hardware, software, data and facility resources are archived, sanitized, or disposed of in a manner consistent with system security plans and requirements. Contractor will research, evaluate, and provide feedback on problematic cybersecurity trends and patterns in user account databases.

Task 4: Risk Management Framework (RMF) Certification and Accreditation Contractor is responsible for the full range of activities necessary to accredit Platform IT systems (PIT) under RMF in NIST SP 800-37 as promulgated DoD/DoN, and Ship Repair Facility and Japan Regional Maintenance Center (SRF-JRMC) Commander’s Cybersecurity Handbook This includes all 6 steps of RMF: System categorization, select security controls, implement security controls, assess security controls, authorize system, and monitor security controls. Contractor should be familiar with the Enterprise Mission Assurance Support System (eMASS), as it will be used as the primary repository for maintaining, archiving, and reporting on all aspects of the accreditation process. Contractor will ensure artifacts are current and updated, and vulnerabilities are assessed, mitigated, or documented.

Task 5: Naval Messaging

Contractor will process Naval messages in accordance with modified Communications Instructions ACP 126 and JANAP 129 directives, and release and route per SRF-JMRC promulgated policy. Contractor will verify that all addressees are correct, notify the originator of any errors, and suggest corrections. Contractor will verify all sensitive and restricted messages are routed appropriately. Contractor will ensure messages are archived in accordance with mandated policy and periodicity. Contractor may be on call for after-hours support.

Performance Goals Task 1: Process an average of (2) transactions per hour, or 16 transactions per day - An estimated 2000 per period of performance.

Task 3: Process an average of (2) transactions per hour, or 16 transactions per day - An estimated 2000 per period of performance.

Task 4: Process an average of (8) transactions per day - An estimated 1000 per period of performance.

4. OVERTIME: The Contractor should anticipate working more than 40 hours per week 3% of the time during the period of performance (overtime hours nor anticipated to exceed 10 per week). Authorization must be obtained from the PCO, COR or ACOR prior to any hours worked over 40 hours per week.

5. SECURITY: The highest level of security required for this task is SECRET IT-II. Access to classified information and spaces onboard the Forward Deployed Naval Forces (FDNF) ships may be required. Due to the nature of data handling requirements personnel must be US citizens and possess at a minimum Secret clearance.

6. SAFETY PROCEDURES/ REGULATIONS: There are rare instances where work will be performed in an industrial environment as well as on board a US Navy vessel in which industrial work in ongoing. The industrial environment work regularly involves use of personal protective equipment (PPE), frequent exposure to hazardous electrical voltages, large rotating machinery elements, and electromagnetic radiation from high powered transmitters, explosives, flammable or incendiary materials, potentially hazardous material, work inside enclosed spaces, In Danger to Life and Health (IDLH) spaces, and work on masts and antenna platforms. The contractor is responsible for the safety of their employees.

7. PRODUCTS/DELIVERABLES: The contractor shall submit the following products/ deliverables as stated below and confer with ACOR on format of reports.).

8. PERFORMANCE GOALS:

Contractor performance objectives are summarized in the following table. Additional performance requirements may be added for individual PWS.

METHOD

9. SPECIAL REQUIREMENTS: Cyberspace Workforce Contractor Training and Certification

a. The Contractor shall ensure that personnel accessing information systems have the proper and current cyber workforce certification to perform cybersecurity functions in accordance with reference (a). The Contractor shall meet the applicable cyber workforce certification requirements, including:

1) DoD-approved cyber workforce certifications appropriate for each category and level as listed in the current version of reference (a);

2) Appropriate operating system certification for cybersecurity technical positions as required per reference (a).

b. Upon request by the Government, the Contractor shall provide documentation supporting the cyber workforce certification status of personnel performing cybersecurity functions.

c. Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing cybersecurity functions.

10. GOVERNMENT FURNISHED EQUIPMENT: SRF-JRMC Yokosuka will provide sufficient government office space and IT/communications to execute assigned tasks.