Attachment A - PWS.pdf

Performance Work Statement

DS/CTS/CMO/CO/IP

Solution Recompete for Deep Packet Capture and Inspection

Last updated on 7/7/2020

BACKGROUND:

The Bureau of Diplomatic Security, Directorate of Cyber and Technology Security, Office of Cyber

Monitoring and Operations, Cyber Operations (DS/CTS/CMO/CO) uses numerous tools and products to ensure the cybersecurity posture of the Department’s Sensitive but Unclassified (SBU) data network. The

Department of State (DOS) has deployed these tools according to a comprehensive defense-in-depth strategy, and is continuously looking to augment that strategy with new or upgraded cyber capabilities.

This document outlines the requirements to upgrade one of these capabilities: deep packet (also called full packet) capture and inspection.

Among the critical capabilities required by CTS is the ability to record every packet of traffic traversing the DOS’ network border for later analysis and reconstruction, while incurring the least impact on network bandwidth to SBU network services. DOS requires a deep packet capture and inspection solution that is easy to deploy in order to combat the next generation of Internet-based threats, including zero-day and targeted Advanced Persistent Threat (APT) attacks, while interoperating well with the existing DOS security tools infrastructure. This solution will be needed to optimize the efficiency of the DOS’ Cyber

Network Defenders (CNDs), and must be able to generate detailed, actionable intelligence resulting from analyzed and reconstructed sessions.

The Cyber Protection (CP), a program within DS/CTS/CMO/CO division requires a solution refresh of the Deep Packet (also called Full Packet) Capture and Inspection system in order to ensure continued service.

CURRENT ENVIRONMENT:

Current Cyber Security Architecture

The DOS has deployed many different devices at its network borders to provide comprehensive cybersecurity. These devices include, but are not limited to, the following: stateful and application-layer firewalls, network intrusion detection/prevention systems, email gateways, and enterprise anti-virus scanners.

Specifically, the Department makes use of the following capabilities with which the upgraded Deep

Packet Capture and Inspection (DPCI) solution must interface:

1. Security Information and Event Manager (SIEM) – The DOS utilizes a SIEM system that collects logs / data sources from various security tools and strategic assets, to provide real-time event correlation and alerting capabilities.

2. Log Aggregation – captures, indexes and correlates real-time network data in a searchable repository, from which it can generate graphs, reports, alerts, dashboards and visualizations.

SCOPE:

The scope of the envisioned DPCI solution is to provide the following high-level functionality:

Architecture

Solution Recompete for Deep Packet Capture and Inspection

Last updated on 7/7/2020

Analyst Tools: Packet capture, Rapid Classification and Analysis, Select Packet Recall, Data/Metadata creation and manipulation, Query creation, and Reporting

Engineering Performance

Services and Support

Outsourced or “cloud-based” traffic monitoring services are outside the scope of this solution are not a requirement and will not be pilot tested, however the vendor should describe any such capabilities in their proposal.

SUMMARY OF REQUIREMENTS:

DS/CTS/CMO/CO requires the following:

1. Replacement of the existing Deep Packet (also called full packet) Capture and Inspection solution.

2. Option to increase the quantities of listed requirements due to growth in order to ensure continuity of service throughout the prospective contract period of performance.

3. Capture 100 % of all network packets traversing the borders of the DOS Points of Presence (POPs).

The packet capture and analysis activity must take place within the perimeter of DOS’ SBU network, at DOS facilities. Outsourced or “cloud-based” traffic monitoring services are outside the scope of this solution.

4. Perform rapid classification and analysis of these packets, for access by DOS Security Analysts.

5. Recall selected network packets for Analyst to reconstruct sessions of interest.

6. Apply signatures/patterns/queries to metadata, raw packet contents, and decoded session contents, to allow for investigating whether malcode is attempting to be infiltrated into the network.

7. Create many sorts of queries and automated alerting on the collected packets, either ad hoc or predefined, to discover anomalous network traffic.

8. Generate both low-level and high-level reports on network traffic based on a wide range of criteria, such as time period, source and/or destination IP address, IPv4 and IPv6 protocols, ports, and services, Internet domains, and e-mail addresses.

9. The Contractor will provide on-site support with project management, engineering design, documentation, and implementation of the solution.

Security Solution Requirements:

Solution Recompete for Deep Packet Capture and Inspection

Last updated on 7/7/2020

This section outlines the requirements from DOS for a DPCI solution. These are separated into four groups: Architecture; Analyst Functions; Engineering & Performance; and Services and Support. The features described below pertain to the infrastructure, the application, and the vendor.

For the purpose of these requirements, “captured network packets” refers to that traffic which has been cloned or duplicated by passive network taps at the network borders, and sent to DPCI appliances. In addition, the term “shall” will be construed as follows: the Contractor is required to demonstrate how its

DPCI solution provides essential functions directly, or else how those functions are fulfilled by other modalities.

Architecture:

The Architecture set of requirements of the DPCI solution encompasses those functions which are built-in or organic to the device(s) within the solution, and do not directly concern the interface between analysts and the solution.

The DPCI solution shall:

1. Provide rapid (5 minutes or less), accurate ingestion and classification of incoming data packets at wire speeds based on TCP/IP protocol/service. Permit extraction of packet captures from those packets in 15 minutes or less.

2. Capture 100 % of all network traffic traversing the network border, and reconstruct network applications and artifacts from the captured packets.

3. Function successfully across 2 geographically separate points of presence (POPs)

4. Provide a single console/interface by which to perform analysis, monitoring, and management of the

DPCI infrastructure, to include central policy management, device management, and report creation capabilities.

5. Allow for the configuration of data retention objectives (see Engineering and Performance).

6. Solution shall be architected to support 99% availability and uptime Disaster Recovery (DR) requirements for DOS stakeholders utilizing the solution on a 24 x 7 x 365 basis.

7. Provide for close integration--either by native Application Programming Interface (API), system server, database connection, or other means--with DOS’ current enterprise tools, Splunk & Syslog log aggregation solution.

8. Furnish a Data Access API which exposes services for import, playback, and regeneration of captured network traffic, as well as for automated query and search capability from outside the application.

9. Make accessible to analysts the full range of all DPCI data collected within the network, regardless of the analysts’ geographic location.

Solution Recompete for Deep Packet Capture and Inspection

Last updated on 7/7/2020

10. Have the ability to queue up data when a network link is down; the Contractor’s solution shall state explicitly the time range or storage capacity for this scenario.

11. After outages in network links have been resolved by the responsible third party, the solution shall attain a rapid, complete reconciliation/normalization of DPCI metadata across POPs, ensuring that analysts always have access to an unbroken continuum of 30 days’ worth of DPCI packet capture data.

12. Interoperate with solutions which intercept and decrypt Secure Socket Layer/Transport Layer

Security (SSL/TLS) packets. The Contractor’s solution shall demonstrate how increasing use of SSL in the Internet, coupled with higher bit levels in server SSL certificates (e.g. sites migrating from 512-bit to 1024-bit and 2048-bit certificates), will impact the overall performance of the DPCI solution.

13. The solution shall support the ability to ingest 3rd party threat feeds and time-sensitive custom signature updates that can improve detection and alerting capabilities of interesting traffic.

14. Decode and search files, such as those sent as e-mail attachments, encoded in any kind of Base64 or other schemes.

15. Permit a minimum of 50 concurrent ad hoc queries on captured packets to be launched by analysts in parallel, without any significant degradation or latency.

16. Allow and support a minimum of 75 automated, continuously running custom scripted queries with alerting.

Additional Architectural Features beyond the Requirements:

The proposal should include a description of features that go above and beyond our organization’s stated requirements, including:

1. Vendor supplied threat feeds and signature updates that improves detection, utility and performance of the product over time.

2. Any other integration with other 3rd party solutions that may improve the performance and/or cost of the product. This would include support for 3rd party SAN storage solutions and integration with major security vendor’s tools.

3. Any cloud features or integration that the solutions is capable of.

4. Alternative methods to packet capture.

5. Selective packet capturing options by the type of traffic and alerts.

6. Demonstration of how to handle cloud ingress/egress points.

Solution Recompete for Deep Packet Capture and Inspection

7. Indication of how to leverage network tap technology.

Analyst Functions:

The Analyst Functions set of requirements includes those functions and operations, of which DOS cybersecurity analysts are expecting to make use as part of their daily work.

1. Include tools for analysis of the captured packets, including anomaly detection capabilities.

2. Furnish a complete toolkit with which to create comprehensive rules and custom alerts, of varying degrees of severity, for analysts.

3. Identify and alert on traffic using inherently insecure TCP/IP protocols, such as FTP and Telnet, as well as on traffic employing packets crafted for potentially malicious purposes.

4. Discern ways in which IPv4 and IPv6 protocols and their associated services are being misused for potentially malicious purposes, apart from those defined in Internet Engineering Task Force (IETF)

Requests for Comments (RFCs).

5. Allow the export of any set of captured packets to generic Packet Capture (pcap) format.

6. Provide the ability to export discrete files, based on captured network data as their source.

7. Give analysts the ability to search captured network traffic by multiple metadata types including IPv4 address, IPv6 address, Web site Uniform Resource Locator (URL), or Internet domain as well as

URLs contained within traffic streams, e-mail messages, or documents. The content search syntax shall support Boolean logic in addition to regular expressions, in order to simplify certain queries.

8. Enable analysts to search on content hash values (MD5 or SHA-1) of email messages, as well as any files attached to those messages.

9. Allow scripted queries to be created, deployed, and saved by analysts.

10. Provide reputation scoring of Internet domains, URLs, email attachments and other sources of potential malware.

11. Permit assignment of DPCI users into hierarchical roles or groups, which allows various levels of access or management capability. RBAC

12. Feature documentation, in either HTML or fixed-file format (e.g. PDF), detailing its advanced features, such as how to create/modify custom rules and signatures.

13. Provide drill-down capability into captured network data which is ambiguous (i.e. is not immediately recognizable from metadata).

Solution Recompete for Deep Packet Capture and Inspection

14. Furnish reporting tools within the application to allow analysts to create their own reports on selected data sets.

15. Generate reports/export datasets in multiple formats (e.g. Comma Separated Value (CSV), JavaScript

Object Notation (JSON) and Extensible Markup Language (XML)), according to various criteria including source or destination IP address, or e-mail address.

16. NetFlow anomaly analysis

17. Include 80% of the metadata requirements listed in the “DPCI Functional-Operations Requirements” spreadsheet.

18. Customizable “don’t store packets ” function based on data type and source (for example: don’t store streaming video packets, don’t store files from YouTube)

19. Customizable “store packets” function based on data type (for example: store packets involving medium, high and critical security alerts)

Engineering and Performance:

The Engineering and Performance set of requirements defines the minimum acceptable levels of operation for the overall DPCI solution, as defined by industry-standard criteria and the anticipated future needs of the

DOS network. The Contractor’s proposed solution performance shall meet or exceed described performance requirements identified below. The Contractor’s unique solution shall demonstrate how any deviations in described processes achieve the same results.

1. Solution shall have an interface speed, sustained ingest rate, and application throughput inspection rate of a minimum of 40 gigabits per second (Gbps) at each of the 2 points of presence (POPs)

(validated by third party).

2. Solution shall provide analysts access to a minimum of 30 (thirty) calendar days’ worth of captured packets. To accommodate the storage capacity required for this time period, the Contractor’s solution shall include one or more options demonstrating scalability and versatility in DPCI storage with cost-effective hardware configurations. Preference will be shown to storage solutions emphasizing low cost throughout the DPCI solution 5 year lifecycle, and minimum number of hardware components.

3. Storage solution shall provide 30 days of on-hand packet capture for analysis at existing bandwidth rate of 20 gigabits per second (Gbps) at each of the 2 points of presence (POPs). Contractor shall demonstrate storage solution scalability supporting 30 days of on-hand packet capture for analysis at

40 gigabits per second (Gbps) traffic rate.

4. Afford 99.9 % or better uptime of DPCI systems, achieved through a well-planned, resilient architecture and through high-quality hardware components which allow for redundant solution

Solution Recompete for Deep Packet Capture and Inspection

Last updated on 7/7/2020 hardware configurations, network connectivity, hot swapping of defective components, etc. Examples of such components include power supplies, RAID controllers, and hard drives. The Contractor’s solution shall demonstrate how this is to be achieved.

5. Furnish root-level access to operating system, application, and all components to DOS for full system lifecycle management and administration.

6. Solution shall function between 2 points of presence (POPs) and monitor 100% of traffic internal and external.

7. Preference will be shown to storage solutions emphasizing scalability of solution to support collection and storage of up to and or exceeding unbroken 6-months (180 days) of packets.

8. The management solution shall provide a management interface at each of the 2 points of presence

(POPs), supporting solution management redundancy, to allow for the configuration, monitoring, and reporting for all components of the DPCI solution from either POP location.

9. The new equipment/components shall be of the newest available model, without being on any end-of-maintenance, end-of-sale, or end-of-life list for a minimum of 5 years from date of purchase.

10. Solution shall be able to support soft client access to management capabilities at both POPs as a backup solution. In addition to this, the solution should have a federated dashboard where the analyst can work from both POPs.

Solution Recompete for Deep Packet Capture and Inspection

Services and Support

The Services and Support set of requirements describes how the Contractor will provision its professional resources to DOS for the DPCI solution, throughout the acquisition, installation and operations phases of the solution lifecycle.

The Contractor shall:

1. Include US-based support accessible 24 hours a day x 7 days a week, by phone, web, email, and include a dedicated account subject matter expert (SME) for DOS, as well as a clearly defined escalation and resolution process included within the solution.

2. Deliver detailed description of warranty, license, and maintenance support services to include service level agreements and mean time to resolution projections for standard and severe support incidents.

3. Furnish specialized training options to include, classroom and web-based training, for analysts and security engineers, to include:

a. Administration of system for security engineering staff, to include full life-cycle support of all components

b. Junior / Mid-level analyst training

c. Senior analyst training

4. Formulate a detailed installation / integration / implementation plan, accompanied by a schedule and resource allocation plan.

5. Provide access to a secure customer web portal with the following minimum characteristics:

a. Inventory of all assets and versioning details;

b. Standard Operating Procedures (SOPs), administration guides, installation guides, white papers;

c. A repository of queriable knowledgebase articles (KBAs) for engineers and analysts;

d. Online ticketing for break/fix requests and historical tracking

6. Outline clearly defined Returned Merchandise Authorization (RMA) processes, with 4-hour drop shipment of replacement components

a. Vendor shall assume and accept that DOS will not return any hard drives.

7. Issue notices of recurring software system updates via email; these updates to be accessible by a secure download method to provide:

a. New feature updates

b. Bug fix and security updates

c. New knowledge base documents

d. Updated risk signatures, security content, threat intelligence, and indicators of compromise

Solution Recompete for Deep Packet Capture and Inspection

Deliverables

Subject Matter Expert(s) (SME) Requirements:

1. Onsite support & solution optimization at the DOS Security Operations Center (SOC).

2. Lead on-site Contractor discovery effort to support creation of architecture, installation, and implementation plans

3. Engineering, configuration, and installation of system

4. Integration with Department of State Log Analytics Solution – Splunk

5. Initial tuning of signatures, parsers, IOCs

6. Detailed documentation of finalized architecture

Status Meetings

The contractor shall meet with the COR or Government Task Lead (GTL) weekly to discuss the following:

1. Program status, including work completed, and work that remains outstanding

2. Issues or obstacles impeding progress and recommended solution

3. Status of deliverable(s) and milestone(s)

4. Issues and resolutions Resource planning and status.

5. Topics or issues identified by the Government COR Reports from DOS systems and applications

Deliverables shall be submitted in a format and file type as specified by the COR and GTL. When a file type is not specified, the Contractor shall use Microsoft Office Suite products, or the automatic reporting capabilities of the specific DOS software or system.

Monthly Performance and Progress Reports

In addition to the status meetings, the Contractor shall prepare and submit a Monthly Performance and Progress

Report in final draft on the 5th day of the following month. The report shall identify key, relevant activities and accomplishments, risks, issues, and proactive risk mitigation actions undertaken by the Contractor, and a summary of cost and price status. The Contractor shall propose and coordinate the format for the monthly performance and progress report with the COR upon award. This report shall, at a minimum, summarize data both monthly and cumulative for the overall current period of performance. Additionally, the vendor will come prepared to the monthly meetings with an analysis of the data provided in the reports.

Solution Recompete for Deep Packet Capture and Inspection

Last updated on 7/7/2020

Specific Deliverables

Deliverable Description Due Date and

Frequency

Government

POC

Transition Kick off

Meeting and

Planning

Contractor will outline project objectives and provide orientation on mapped implementation and solution.

To be presented at the initial contract Kick off

Meeting

COR

Discovery Session On-site support and discovery session with DPCI SME. Completion notification to COR.

To be completed within 10 business days after kick-off meeting

COR

Final Installation;

Engineering, Configuration, and

Installation of System

Post-Discovery implementation plan, including phases, resource management, etc.

To be presented within

15 business days after

Discovery session

COR

Compliance Report Requirements and Metrics accepted by the contractor and approved by the

COR

Monthly By 5th day of the month

COR

Contractor

Monthly Status

Report

Documents notable performance areas, including any software updates

Monthly By 5th day of the month

COR

Incident Summary Summary of Support Maintenance, Service Interruptions, and degradation

Monthly By 5th day of the month

COR

Project Operations

Plan/status report

Status Report identifying activities and work completed, progress against plan, and risk management, List of all the resources, timelines and tasks on a project

Monthly By 5th day of the month

COR

Asset Inventory Show all existing assets and acquired assets

Monthly By 5th day of the month

COR

Plan for Patching and Upgrades rolled out through baseline

Update or Overhaul of current strategy for pushing out patches, security updates, and changes

One Time, 90 Days from Contract award

COR

Solution Recompete for Deep Packet Capture and Inspection

Last updated on 7/7/2020

Specific Deliverables

Deliverable Description Due Date and

Frequency

Government

POC

Baseline Images Update current Baseline Image configuration of all software, and versions

Prior to project close-out.

COR

Maintenance of

Hardware and

Infrastructure documents, policies, and procedures

Report of updates to documentation surrounding Desktop applications, processes, procedures, virtualization pilot, users, help desk operations, and project plans.

Monthly By 5th day of the month

Technical

Lead/ PM

Desktop

Configuration /

Backup and

Recovery Plan

A plan that includes processes adhering to Office of the Chief Information

Officer (OCIO) policies that shows how the contractor will recover lost data assets, desktop element(s), or corrupted images in the event the data is lost through a crash or major system error, etc. Plan should also include industry and OCIO accepted backup procedures and suggested storage solutions.

Annually June 1st Government

Supervisor

Uptime Report Contractor shall report any system outages or issues, including date/time, frequency, length of time, resolution and lessons learned

Monthly By 5th day of the month

COR

Training Provide training to specified

Government personnel.

Upon Request COR

System Delivery Delivery of total solution, including all software and license keys, RMA processes, Warranties, terms of service, complete maintenance support plan information, and all product literature

Go-Live COR

Government Furnished Information (GFI) and Property/Equipment (GFE)

Solution Recompete for Deep Packet Capture and Inspection

Upon Task Order award and throughout the life of the Task Order, DOS shall provide the Contractor with relevant documents and information. Relevant information includes documents such as: SLAs, SLOs, metric(s) information and documentation, DOS policies and procedures, existing Project Plans, Standard Technical Implementation

Guidelines (STIGs), existing Plan of Action and Milestones (POA&Ms).

The Government shall provide Contractor personnel performing work on Government premises: office space, furniture, telephone service, computers, internet access, and any other supplies and equipment the COR deems necessary. At no time shall the contractor transport any Government –owned property using non-Government vehicles.

Protection of Information:

Safeguarding customer and agency Personally Identifying Information (PII) is paramount and our first priority for providing any level of support. In the event a customer cannot be safeguarded the contractor will immediately reach out to the COR, the task manager, the Government supervisor or the contract supervisor for direction.

The Contractor shall, at the request of the Government, have its staff sign formal non-disclosure and conflict of interest agreements to guarantee the protection and integrity of Government information and documents. The

Contractor shall use any information that is subject to the Privacy Act in full accordance with the rules of conduct as applicable to Privacy Act information. The Contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure that the security and confidentiality of DOS information, data, and equipment are properly protected.

Applicable Standards

Contractor shall follow the System Development Life Cycle (SDLC), NIST SP 800-64.

Data Rights

Any requests for modification to core software code must be approved by and provided to the Government. The

Government will own unlimited data rights to all efforts and products developed in direct support of the applications development tasks, without any restrictions whatsoever by the contractor.

Section 508 of the Rehabilitation Act

All electronic and information technology (EIT) procured through this effort must meet the applicable accessibility standards at 36 CFR 1194. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended, and is viewable at http://www.section508.gov.

Travel

Travel to Government facilities or other contractor facilities may be required. All travel requirements (including plans, agenda, itinerary, or dates) shall be reviewed by the Contracting Officer’s Representative (COR) and approved by the Contracting Officer (CO) in advance, in writing prior to the initiation of any travel preparations or reservations.

Solution Recompete for Deep Packet Capture and Inspection

The contractor is required to travel to Beltsville, MD and Denver, CO to accomplish the tasks contained in this

Task Order. Costs for transportation shall be reimbursed based upon actual costs incurred. The contractor shall provide a completed travel request sheet in advance of all travel reservations, giving the Government at least Two

(2) weeks’ notice when feasible. Travel costs shall not exceed the maximum per diem rates for the associated locality in effect at the time of the travel. Federal Acquisition Regulation (FAR) 31.205-46 “Travel Costs” shall provide the basis for the determination as to whether travel costs are reasonable and allowable.

Maximum use is to be made of the lowest available customary standard coach or equivalent airfare accommodations available during normal business hours. Travel upgrades (such as full-size rental cars, business or first class travel, or luxury accommodations) shall not be reimbursed. For multiple contractor travelers with shared travel dates and destinations, it is preferred that a single rental vehicle (up to full size for Two or more travelers) may be used for carpooling. All necessary travel meeting the above criteria shall be approved in advance by the

COR. Exceptions to these guidelines shall be approved in advance, in writing, by the Contracting Officer.

Expenses for travel shall be billed in accordance with the regulatory implementation of Public Law 99-234 and

FAR 31.205-46, “Travel Costs.”

Local travel, within a 50-mile radius is not reimbursed. Contractor employees must have the capability to travel between sites, as requested by the Government. The Government expects the Contractor to maintain liability insurance on behalf of their employees to enable travel between sites. The Government will not reimburse the contractor for expenses incurred for contractor personnel traveling to and from the place of performance to their residence in another location in the commuting area of the place of performance.

Training of Contractor Personnel

Contractor personnel are expected to possess the described and required knowledge, skills, and expertise to fulfill the requirements of this Task Order. Training of contractor staff to maintain and continuously improve knowledge, skills, and expertise shall be at the Contractor’s expense. In the event a Contractor employee is removed from or no longer supports the resultant Task Order, the Contractor shall ensure knowledge transfer to the new contractor employee to ensure proficiency to successfully perform the required duties. Contractor employees must take DOS’s end-user computer security awareness training prior to being granted access to DOS data or being issued a user account and training must be renewed annually.

Background Checks

All contractor personnel and any subcontractor personnel who will need access to Government facilities or information for the performance of work under this Task Order must first have a favorably adjudicated background investigation (BI) conducted by the Office of Personnel Management (OPM). A minimum Secret clearance is required under this task order.

Hours spent by any individual, contractor employee or otherwise, to complete the forms and any other paperwork required by the Government to process background clearances, or for the purpose of obtaining required fingerprints, are not billable to the Government.

Time spent by any individual to participate in interviews conducted by OPM, or its designees, for the purpose of completing background investigations is not billable to the Government. The Government considers these costs to

Solution Recompete for Deep Packet Capture and Inspection

Last updated on 7/7/2020 be overhead and estimates that between 3 and 10 hours may be required on the part of an individual to complete background clearance processing.

The contractor shall assist with background investigations and security clearances to ensure that all contractor personnel associated with the project have a security clearance commensurate with the data being processed.

Appropriate background investigations and security clearance-related documentation shall be submitted by the contractor no later than ten calendar days after award or ten calendar days prior to any new employee starting work under this order.

Contractor Personnel Security and Suitability Requirements

Performance of this Task Order requires contractor personnel to have a Federal Government -issued Personal

Identity Verification (PIV) credential before being allowed unsupervised access to a DOS acility and/or information system. The COR will be the requesting official, and will make arrangements through a DOS Access Card Sponsor for personal identity verification and DOS Access Card issuance.

Immediately upon award, the Contractor must identify all contractor and subcontractor personnel who will require physical or logical access for performance of work under this order and begin the screening process by working with the COR. Physical Access means routine, unescorted or unmonitored access to nonpublic areas of a federally-controlled facility. The clearance process may take up to eight (8) weeks and no work may be performed in support of the resultant order until the quoted personnel have successfully completed the process. Logical Access means routine, unsupervised access to a Level three (3) or four (4) federally controlled information system. The Contractor must make their personnel available at the place and time specified by the COR or Access Card Sponsor in order to initiate screening and background investigations. The following forms and inquiries, or their equivalent, will be used to initiate the credentialing process:

Contractor Personnel BI Info form

OF 306 – Declaration of Federal Employment

National Criminal History Check (NCHC) (local procedures may require the fingerprinting to be done at a police station; in this case, any charges are to be borne by the contractor)

Release to Obtain Credit Information

2 forms of Identification

Resume

Before starting work under this order, a National Criminal History Check (NCHC) will be initiated to verify the identity of the individual applying for clearance and to determine the individual’s suitability for the position (this shall include a COR level verification of the education and experience level of the candidate prior to the initiation of the NCHC check). If the COR determines that the candidate possesses the education and experience required of the position, the NCHC can be initiated. If the NCHC adjudication is favorable, an Access Card will be issued for that individual. If the adjudication is unfavorable, the credentials will not be issued and the contractor must make other arrangements for performance of the work. In the event of a disagreement between the Contractor and the

Government concerning the suitability of an individual to perform work under this order, the Government shall have the right of final determination.

Contractor employees must give, and authorize others to give, full, frank, and truthful answers to relevant and material questions needed to reach a suitability determination. Refusal or failure to furnish or authorize provision

Solution Recompete for Deep Packet Capture and Inspection

Last updated on 7/7/2020 of information may constitute grounds for denial or revocation of credentials. Government personnel may contact the contractor personnel being screened or investigated in person, by telephone or in writing, and the Contractor agrees to make them available for such contact.

Alternatively, if an individual has already been credentialed by another agency through OPM, and that credential has not yet expired, further investigation may not be necessary. In that case, the contractor must provide the COR with documentation that supports the individual’s credentialed status.

During performance of the order, the Contractor must keep the COR apprised of changes in personnel to ensure that performance is not delayed by compliance with credentialing processes. Cards that have been lost, damaged, or stolen must be reported to the COR and Issuing Office within 24 hours. If reissuance of expired credentials is needed, it will be coordinated through the COR.

Other Direct Costs (ODCs)

Other Direct Costs (ODCs) other than travel are not authorized and will not be reimbursed under this order.

Incident Reporting The contractor must report computer security incidents affecting DOS data or systems. Report via emailed to

CIRT@state.gov or call 1-301-985-8347.

SECURITY REQUIREMENT(S):

A minimum Secret clearance is required under this task order.