Attachment B_Sample Task Order_W912HZ23R00002.pdf

W912HZ23R00002

SAMPLE TASK ORDER 0001

1.0 Performance Requirements

This is a sample task order is Performance Based, Firm Fixed Price (FFP), On-site in Vicksburg, MS for a 6-month period of performance. No travel is required.

1.1 Host Based Security

The contractor shall perform activities related to host-based security leveraging the Department of Defense (DoD) mandated Host-Based Security System (HBSS).

Activities include the management, configuration and implementation of various HBSS modules on 375 Research and Development Environment (RDE) servers, 850 desktops and 1325 laptops assets; suggest modifications and improvements to current HBSS module settings; analyze HBSS status reports and provide courses of action suggestions to RDE management.

Deliverables A001 Task Completion A002 Daily Report

1.2 Virtualization Management

The contractor shall manage a virtual environment utilizing VMWare suite that includes up to 500 virtual servers on a shared storage backend. The contractor shall provide a method for implementing and maintaining a virtual desktop infrastructure (VDI) for up to 1000 systems. The VDI solution is implemented using a conventional server/storage platform for persistent and non-persistent desktops. VDI is maintained on premise for internal, DMZ, and public access. The contractor shall provide a method for ensuring that the virtual infrastructure is compliant with DoD Security Technical Implementation Guides (STIG). The contractor shall follow the response/resolution matrix as outlined in section 1.4.

Deliverables:

A001 Task Completion A005 Technical Report A009 Repository

1.3 Network Management

The contractor shall manage a research and development wide area network that spans four geographical locations and includes the management of eight firewalls with failover capability, approximately 50 Cisco core routers, 300 Cisco switches, and 400 Cisco wireless access points. The contractor shall operate and maintain the network-monitoring tool Cisco Prime (or future tool at the Government’s discretion). The contractor shall provide a method for implementing and maintaining secure websites through the use of reverse proxy or other technologies. The contractor should manage hardware proxy appliances which are implemented to provide complete control over all web traffic delivering threat protection, user authentication, data loss prevention, content caching, and bandwidth management. The contractor shall follow the response/resolution matrix as outlined in section 1.4.

Deliverables:

A001 Task Completion A005 Technical Report A015 Network Diagram

1.4 Response/Resolution Time

The contractor shall follow the response/resolution matrix as outlined below for user support services. The contractor shall meet the below metrics 90% or more of the time.

Respond Resolve Emergency 1 Hour 4 Hours High 4 Business Hours 2 Business Days Normal 1 Business Day 1 Week Low 3 Business Days 3 Weeks

User Support (Helpdesk) Services – Emergency priority ticket resolution:

Respond to emergency priority requests within 1 hour from receipt of request and resolve within 4 hours from receipt of request during normal business hours, 90% or more of the time. Ticket may be temporarily suspended if replacement parts need to be ordered and/or equipment needs to be sent out for warranty service.

User Support (Helpdesk) Services – High priority ticket resolution:

Respond to high priority requests within 4 hours from receipt of request and resolve within 2 business days from receipt of request during normal business hours, 90% or more of the time. Ticket may be temporarily suspended if replacement parts need to be ordered and/or equipment needs to be sent out for warranty service.

User Support (Helpdesk) Services – Normal priority ticket resolution:

Respond to normal priority requests within 1 business day from receipt of request and resolve within 1 week from receipt of request during normal business hours, 90% or more of the time. Ticket may be temporarily suspended if replacement parts need to be ordered and/or equipment needs to be sent out for warranty service.

User Support (Helpdesk) Services – Low priority ticket resolution:

Respond to low priority requests within 3 business days from receipt of request and resolve within 3 weeks from receipt of request during normal business hours, 90% or more of the time. Ticket may be temporarily suspended if replacement parts need to be ordered and/or equipment needs to be sent out for warranty service.

2.0 Certifications

The tasks above require all personnel to have the following certifications:

• CyberSecurity Fundamental Training

• Information Assurance Awareness Training

• Complete the baseline Cert IAT II+. Details can be found at https://public.cyber.mil/cw/cwmp/dod-approved-8570-baseline-certifications/

3.0 Clearances

A secret clearance is required for these tasks.

4.0 Deliverable Description

The contractor shall provide the following deliverables.

Identifier Name Task Deliverable Description A001 Task Completion Task 1.1 - Services complete

IAW requirements A001 Task Completion Task 1.2 - Services complete

IAW requirements A001 Task Completion Task 1.3 - Services complete

IAW requirements A002 Daily Report Task 1.1 - Status of identified rogue systems A005 Technical Report Task 1.2 - Periodic utilization reports of virtualized systems, as requested by the COR or Technical POC.

A005 Technical Report Task 1.3 - Monthly reports demonstrating network utilization, VLAN structure, changes in access to the network, and uptime statistics

A009 Repository Task 1.2 - Virtualized systems

A015

Network Diagram Task 1.3 – Network Diagram https://public.cyber.mil/cw/cwmp/dod-approved-8570-baseline-certifications/

Performance Requirements Summary

Statements Deliverables Standards/AQLs Inspections Ratings

1.1 The contractor shall

perform activities related to host-based security leveraging the Department of Defense (DoD) mandated Host- Based Security System (HBSS). Activities include the management, configuration and implementation of various HBSS modules on 375 Research and Development Environment (RDE) servers, 850 desktops and 1325 laptops assets; suggest modifications and improvements to current HBSS module settings; analyze HBSS status reports and provide courses of action suggestions to RDE management.

A001 Task Completion A002 Daily Report

Compliant with applicable standards

Complete/Accurate/ Timely

Meets technical specifications

Identifies and corrects deficiencies

Clear, accurate documentation

COR and Technical POC review

EXCEPTIONAL – 100%

of the requirements are properly documented.

VERY GOOD – 90-99%

of the requirements are properly documented.

SATISFACTORY – 80-

89% of the requirements are properly documented.

MARGINAL – 65-79% of the requirements are properly documented.

UNSATISFACTORY –

Below 65% or failed to complete any requirements

1.2 The contractor shall

manage a virtual environment utilizing VMWare suite that includes up to 500 virtual servers on a shared storage backend. The contractor shall provide a method for implementing and maintaining a virtual desktop infrastructure (VDI) for up to 1000 systems. The VDI solution is implemented using a conventional server/storage platform for persistent and non-persistent desktops.

VDI is maintained on premise for internal, A001 Task Completion A005 Technical Report A009 Repository

Compliant with applicable standards

Complete/Accurate/ Timely

Meets technical specifications

Identifies and corrects deficiencies

Clear, accurate documentation

COR and Technical POC review

EXCEPTIONAL – 100%

of the requirements are properly documented.

VERY GOOD – 90-99%

of the requirements are properly documented.

SATISFACTORY – 80-

89% of the requirements are properly documented.

MARGINAL – 65-79% of the requirements are properly documented.

UNSATISFACTORY –

Below 65% or failed to complete any requirements

DMZ, and public access. The contractor shall provide a method for ensuring that the virtual infrastructure is compliant with DoD Security Technical Implementation Guides

(STIG).

1.3 The contractor shall

manage a research and development wide area network that spans four geographical locations and includes the management of eight firewalls with failover capability, approximately 50 Cisco core routers, 300 Cisco switches, and 400 Cisco wireless access points. The contractor shall operate and maintain the network-monitoring tool Cisco Prime (or future tool at the Government’s discretion). The contractor shall provide a method for implementing and maintaining secure websites through the use of reverse proxy or other technologies.

The contractor should manage hardware proxy appliances which are implemented to provide complete control over all web traffic delivering threat protection, user authentication, data loss prevention, content caching, and bandwidth management.

A001 Task Completion A005 Technical Report A015 Network Diagram

Compliant with applicable standards

Complete/Accurate/ Timely

Meets technical specifications

Identifies and corrects deficiencies

Clear, accurate documentation

COR and Technical POC review

EXCEPTIONAL – 100%

of the requirements are properly documented.

VERY GOOD – 90-99%

of the requirements are properly documented.

SATISFACTORY – 80-

89% of the requirements are properly documented.

MARGINAL – 65-79% of the requirements are properly documented.

UNSATISFACTORY –

Below 65% or failed to complete any requirements

PERFORMANCE RATINGS

Performance

Rating Criteria

Excellent / Outstanding

Performance meets contractual requirements and exceeds many to the government’s benefits. The contractual performance of the element or sub-element being assessed was accomplished with no problems and contractor actions were highly effective.

Very Good Performance meets contractual requirements and exceeds some to the government benefits. The contractual performance was accomplished with few minor problems for which corrective actions taken by the contractor were effective.

Good Performance meets contractual requirements. The contractual performance contains some minor problems for which corrective actions taken by the contractor were satisfactory.

Marginal Performance does not meet some contractual requirements.

The contractual performance reflects a serious problem for which the contractor has not yet identified corrective actions.

The contractor’s proposed actions appear marginally effective or were not fully implemented.

Unsatisfactory Performance does not meet most contractual requirements and recovery is not likely in a timely manner. The contractual performance contains serious problem(s) for which the contractor’s corrective actions appear or were ineffective.

4.0 Deliverable Description