B1 Attachment 2 - SOW.docx

UNCLASSIFIED

Statement of Work (SOW)

1. Background & Overview

Project Overview: This is a non-personal services contract for data feeds and associated licenses for the Joint Cyber Intelligence Tool Suite (JCITS), which supports the Defense Counterintelligence and Security Agency (DCSA) Cyber Mission Center (CIC).

Business Objectives: CIC conducts cyber analysis and counterintelligence production in support of the National Industrial Security Program (NISP) to identify, assess, and disrupt foreign intelligence entity threats to cleared contractors. CIC works closely with DCSA elements, Department of War (DoW) Components, U.S. Government departments and agencies to identify and mitigate cyber threats.

The CIC identifies, integrates, and shares threat information across the enterprise to help drive risk-based, data-driven decisions and actions through the following objective(s):

· Identifying, assessing, and disrupting threats to cleared industry, cleared personnel, DoW, and DCSA.

· Modernizing cyber capabilities and processes that illuminate threats, enhance awareness, and enable customer response.

Developing actionable cyber threat and vulnerability information, intelligence, and indications and warnings to protect against or deter Foreign Intelligence Entities (FIE) activities targeting Cleared Contractors (CC) and DoW equities.

· Analyzing suspected malicious activities, to enable counterintelligence personnel and cleared contractors to identify malware and potential FIE targeting activity.

Scope of Work Data Feed Licensing: The Contractor shall provide licensing for data feeds.

License Subscription Details:

Augury: This tool is the graphical user interface (GUI) front end to access multiple petabytes of insightful data. Each file is available for download either in Excel, eXtensible Markup Language (xml), JavaScript Object Notation (JSON) or Comma-Separated Values (CSV).

Augury Subscription type: Augury Platinum – unlimited User Interface (UI) queries/account/day, 15 individually named accounts (seats) with both UI and Application Programming Interface (API) (30 queries/user/day) access, largest Classless Inter-Domain Routing (CIDR) block per query is /8, 3TB Results storage on hosted system, and 3M Rows per result per query type.

Augury add-on (now Torrent) High Tier: The Augury Add-on Service is a network meta-data telemetry service.

Augury header data: Incorporating Hypertext Transfer Protocol (HTTP) and Hypertext Transfer Protocol Secure (HTTPS) header fields in data help ensure DCSA is receiving only the data directed at the companies that we have security purview over. Headers contain the requested domain name, allowing DCSA to discard network records not applicable to their mission, and keep records that are routed to their facilities.

Scout-Ultimate: This is an additional charge to an Augury subscription that provides a quick search tool within the Augury portal for single (Internet Protocols (IPs), domains, or entire CIDR ranges related to observed activity. Results are tagged as infrastructure, malicious, suspicious, or device. It includes 1,000 monthly total queries (simple and advanced, shareable), up to 30 days search in 90 days traffic history for all datasets available, 1,000 max communication results and API access.

2. Period of Performance

3. Service Level Agreement (SLA)

Uptime Guarantee: The data feed should be accessible and function at 99.9% uptime Support & Maintenance: The Contractor shall provide technical support during the support hours defined below. The method of technical support and maintenance may be Contractor determined (i.e., phone, electronic mail, or virtual/online) but must be accessible to the Government during the defined business hours, 06:00 am to 06:00 pm, to minimize service interruptions.

Support Hours: The Contractor shall provide support Monday through Friday, during the defined business hours.

Response Times: The Contractor shall resolve support requests, by priority (e.g., High, Medium, Low), but shall provide response within 2 hours of help request initiation(s) received during the defined business hours.

Remedies for SLA Breaches: The Contractor may provide a service credit or subscription license period of performance extension if it fails to meet the agreed-upon service levels.

4. Data Management & Security

Data Rights: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

Data Security: Contractor will not have unsupervised access to systems and networks.

The contractor shall coordinate with the responsible DCSA OCIO or Program staff prior to any visit. Contractor personnel must be U.S. persons. If the contractor needs to visit a DCSA facility they must be escorted at all times, by the responsible DCSA OCIO staff.

Controlled Unclassified Information (CUI) / Receive, Store, or Generate Controlled Unclassified Information (CUI): Contractor will be provided and will abide by DoD Regulation 5400.07, DoD Freedom of Information Act Program, and DoD 5200.01-M, Information Security Program. Guidance provided under separate cover. In accordance with DoD Instruction 5200.48 (DoDI 5200.48) dated March 6, 2020, the Contractor is responsible for ensuring all personnel understand the requirements for handling and protecting CUI.

To support this requirement, personnel may complete CUI education and training through the Center for Development of Security Excellence (CDSE). For additional protection and handling guidance, please reference the DCSA CUI Homepage (https://www.dcsa.mil/Industrial-Security/Controlled-Unclassified-Information-CUI/). DCSA CUI Program office for industry support is available at (571) 305-4878 and dcsa.quantico.ctp.mbx.eso-cui@mail.mil.

OPERATIONS SECURITY (OPSEC) REQUIREMENTS

The contractor shall comply with OPSEC requirements contained in the contract, addendum thereto, or identified herein. The contractor will comply with all security and OPSEC policies, directives, instructions or mandates as directed. OPSEC and other security guidance issued to the Prime Contractor shall also apply to subcontractors working on this effort.

The contractor will ensure compliance with the Agency’s OPSEC Policy Statement, Critical Information and Indicators List (CIL), and unclassified document destruction procedures. Items of critical information are those facts, which individually, or in the aggregate, reveal sensitive details about the mission, operation, etc., and thus require protection from adversarial collection or exploitation.

Include OPSEC as part of the security awareness program. The contractor shall be familiar with OPSEC and will be required to take government furnished initial and annual refresher OPSEC training and will be reminded of their continued responsibility to protect sensitive information as directed by DoDM 5205.02. Sensitive unclassified information includes, but is not limited to, agency identified critical information, legacy “For Official Use Only” (FOUO), Controlled Unclassified Information (CUI), Privacy Act of 1974, Personally Identifiable Information (PII), Department of Defense Unclassified Controlled Nuclear Information (DoD UCNI) and company proprietary information.

The contractor shall take the necessary precautions to ensure employees with access to the sensitive and critical information are instructed not to disclose or disseminate any information relating to the conduct and performance of the contract to any individual not authorized to perform on this contract. Assigned personnel shall be knowledgeable of the designated critical information and measures in place to protect it.

For programs protected by a Program Protection Plan (PPP) and have identified Critical Program Information (CPI) and/or Critical Technologies Information (CTI), must be identified and protected in accordance with DoD Instruction 5200.39, CPI Identification and Protection within RDT&E. The contractor shall ensure that any program with CPI or CTI has the corresponding supplements and associated plan, such as an OPSEC plan, approved and in effect in support of the PPP.

The contractor shall comply with OPSEC content review policies within the Agency. A content review is an evaluation of all information, to include all CUI, intended for release outside the control of the organization or release to the public. OPSEC focuses on identifying and protecting the organization’s unclassified information that may individually or in the aggregate lead to the compromise of classified information and sensitive activities. The contractor will ensure that these reviews are conducted according to agency guidance in accordance with mandates from DoDD 5205.02E, DoD OPSEC Program, DoDM 5205.02-M, DoD OPSEC Program Manual, DoDI 5230.09, Clearance of DoD Information for Public Release, DoDI 5230.29, Security and Policy Review of DoD Information for Public Release, DoDI 5400.04, Provision of Information to Congress, DoDM 5400.07, DoD FOIA Program, and DoDI 8170.01, Online Information Management and Electronic Messaging.

Further OPSEC guidance may be obtained by the Prime contractor contacting the OPSEC PM by group e-mail: dcsa.quantico.dcsa-hq.mbx.operations-security@mail.mil.

All programs and materials developed at government expense during the performance period of this contract are the property of the US Government.

Contractor personnel shall utilize US Government or official company e-mail for transmitting official US Government business. Official US Government business shall NOT be transmitted via personal, private, and/or commercial e-mail accounts, i.e., YAHOO, HOTMAIL, GMAIL, JUNO, AOL, COMCAST, KNOLOGY, VERIZON, etc.

5. Roles & Responsibilities

Vendor Responsibilities:

The Contractor shall provide technical support and any respective data feed upkeep as required by the provider and/or the Government for associated licensing.

The Contractor shall provide timely (i.e., 48-hours) notice(s) (e.g., support resolution, maintenance, license renewal) to the Government. The Contractor shall determine the method of notice(s) (i.e., phone, electronic mail, or virtual/online) as required.

The Contractor shall provide a point-of-contact (POC) to the Government for support, notice(s), and/or license renewal inquiries. The Contractor may determine the best POC (i.e., Program/Project Manager, Business/Sales Manager).

Government Responsibilities:

The Government shall provide timely (i.e., 48-hours) service request(s) as needed.

The Government shall provide timely acceptance of notice(s) received from the Contractor; the Government may determine the method of notice(s) (i.e., phone, electronic mail, or virtual/online) as required.

The Government shall provide a POC to the Contractor to receive notice(s) and other respective communication. The Government may determine the best POC (i.e., Contracting Officer Representative, Program/Project Manager).

6. Fees & Payment Schedule

Recurring Fees: Annual subscription fees Payment Schedule: Annual payment based on subscription period of performance (POP)

7. Acceptance Criteria

This SOW is for data feeds and associated licenses only; therefore, notice for renewal of the subscription POP is the only acceptance criteria.

8. Deliverables & Milestones

This SOW is for data feeds and associated licenses only; therefore, there are no deliverables and milestones.

9. Section 508 Compliance

On August 7, 1998, Section 508 of the Rehabilitation Act of 1973 was amended to require that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology, that they shall ensure it allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees.

· Section 508 required the Architectural and Transportation Barriers Compliance Board (Access Board) to publish standards setting forth a definition of electronic and information technology and the technical and functional criteria for such technology to comply with Section 508. These standards have been developed and are published with an effective date of December 21, 2000.

· Federal departments and agencies shall develop all Electronic and Information Technology requirements to comply with the standards found in 36 CFR 1194.

· The Section 508 standards established by the Architectural and Transportation Barriers Compliance Board (Access Board) are incorporated into, and made part of DCSA orders, solicitations and purchase orders developed to procure Electronic and Information Technology (EIT). These standards are found in their entirety at: http//www.section508.gov and http://www.access- board.gov/sec508/standards.htm. A printed copy of the standards will be supplied upon request. The following are identified for this requirement:

· E202.2 Legacy ICT - Any component or portion of existing ICT that complies with an earlier standard issued pursuant to Section 508 of the Rehabilitation Act of 1973, as amended (as republished in Appendix D), and that has not been altered on or after January 18, 2018, shall not be required to be modified to conform to the Revised 508 Standards.

· E202.3 National Security - The Revised 508 Standards do not apply to ICT operated by agencies as part of a national security system, as defined by 40 U.S.C. 1103(a).

· E202.5 ICT Functions Located in Maintenance or Monitoring Spaces - Where status indicators and operable parts for ICT functions are located in spaces that are frequented only by service personnel for maintenance, repair, or occasional monitoring of equipment, such status indicators and operable parts shall not be required to conform to the Revised 508 Standards.

· Justifications: There is no ICT. Functional Performance Criteria:

· Scope - The requirements of Chapter 3 shall apply to ICT where required by 508 Chapter 2 (Scoping Requirements), 255 Chapter 2 (Scoping Requirements), and where otherwise referenced in any other chapter of the Revised 508 Standards or Revised 255 Guidelines.

· Without Vision - Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that does not require user vision.

· With Limited Vision - Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited vision.

· Without Perception of Color - Where a visual mode of operation is provided, ICT shall provide at least one visual mode of operation that does not require user perception of color.

· Without Hearing - Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that does not require user hearing.

· With Limited Hearing - Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited hearing.

· Without Speech – Where speech is used for input, control, or operation, ICT shall provide at least one mode of operation that does not require user speech.

· With Limited Manipulation - Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that does not require fine motor control or simultaneous manual operations.

· With Limited Reach and Strength - Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that is operable with limited reach and limited strength.

· With Limited Language, Cognitive, and Learning Abilities - ICT shall provide features making its use by individuals with limited cognitive, language, and learning abilities simpler and easier.

UNCLASSIFIED

image1.png