C17 Draft PWS.pdf

(DRAFT) PERFORMANCE WORK STATEMENT

Public Key Infrastructure (PKI) Support Services

Marine Corps Cyberspace Operations Group 2025-2030

Table of Contents

1. SCOPE

APPLICABLE DOCUMENTS

GENERAL REQUIREMENTS

TASKS/SPECIFIC REQUIREMENTS

5. KEY PERSONNEL

6. SECURITY CONSIDERATIONS

7. CYBER SECURITY

8. OTHER DIRECT COSTS (ODC) (TRAINING/ TRAVEL/ MATERIALS/ HOLA/ COLA)

9. GOVERNMENT-FURNISHED PROPERTY, FACILITIES, EQUIPMENT, INFORMATION (GFP, GFF, GFE, GFI)

10. PERFORMANCE REQUIREMENTS SUMMARY (PRS)

APPENDIX A…

1. SCOPE

This Performance Work Statement (PWS) describes the technical support services required of the Marine Corps Cyberspace Operations Group (MCCOG) and provides descriptions of Public Key Infrastructure (PKI) technical requirements definition, operations, and sustainment support for authorized systems and personnel located at United States Marine Corps (USMC) installations worldwide.

Required support includes sustainment of the USMC portion of the established Department of Defense (DoD) Information Network (DoDIN): Non-classified Internet Protocol Router Network (NIPRNET) Public Key Infrastructure (PKI), National Security Systems (NSS) Secret Internet Protocol Router Network (SIPRNET) PKI, and Defense Information Systems Agency (DISA) Gray PKI.

1.1. Background

The mission of the USMC PKI Program is to provide the resources, manpower, and equipment (hardware and software) dedicated to the management (i.e.: generation, production, distribution, control, accounting, and destruction) of keys and certificates used by public key-based security services to include Non-classified Internet Protocol Router Network (NIPRNet) and SIPRNet both garrison and deployed. The PKI program operates the USMC Certificate Validation Infrastructure (CVI) and USMC organizational Certificate Authorities (CA) necessary to ensure that only authorized users and server-based applications can operate on the MCEN. These services are required for user access to all information system components on the MCEN including network accounts, applications, and web sites.

PKI must be operable in garrison and tactical/deployed environments. USMC PKI is operationally attached to the MCCOG aboard Marine Corps Base Quantico, VA and sponsored by Headquarters Marine Corps Deputy Commandant, Information (HQMC DC I) as a USMC Representative to DoD

PKI.

2. APPLICABLE DOCUMENTS

Unless otherwise supplemented or superseded, directives applicable to the performance of this work shall be as follows:

a. Information Technology Infrastructure Library (ITIL) version 4 framework established guidelines for the Information Technology Service Management discipline for managing IT systems

b. DoD Instruction 8520.02, PKI and Public Key Enabling, 18 May 2023

c. DoD Instruction 8520.03, Identity Authentication for Information Systems, 19 May 2023

d. DoD PKI Registration Authority/Local Registration Authority Certificate Practice Statement, 13

Jul 2022

e. NSS PKI DoD Registration Authority Practice Statement, Update 08 May 2024

f. Department of Defense Directive 8570-1 (DoDD 8570-1) - Information Assurance. Training, Certification, and Workforce Management. 12-2005 with Incorporated change of 4-20-2010

g. MARINE CORPS ORDER (MCO) 5510.18B, 30 Jan 2017 - United States Marine Corps

Information and Personnel Security Program Manual

h. Secretary of the Navy-SECNAVINST 5510.30B - Department of the Navy (DON) Personnel

Security Program (PSP) Instruction

i. Secretary of the Navy (SECNAV M-5510.30) - DON PSP

j. SECNAVINST 5510.36A - DON Information Security Program (ISP) Instruction

k. Secretary of Navy (SECNAV) M-5510.36 - DON ISP Manual, 1 Jul 06

l. Marine Corps Base Order (MCBO) 5510.1C - Information and Personnel Security Program (IPSP)

m. Marine Administrative Message (MARADMINS) and USMC Operational Directives as tasked

n. MCCOG policies, procedures and Standard Operating Procedures (SOP)

o. Additional Regulatory Guidance: The Contractor shall apply, as appropriate, Marine Corps, Department of the Navy and the Department of Defense Information Assurance policies, procedures, and technical communication requirements, which can be found through the Defense Information Systems Agency (DISA) portal at cybercom.mil, and United States Cyber Command, https://www.cybercom.mil, under the orders and Directives tab.

p. Commercial Solutions for Classified (CSfC) Enterprise Gray Implementation Requirements Annex v1.1 19 May 2022

q. Commercial Solutions for Classified (CSfC) Key Management Requirements Annex V2.1 19 May 2022

r. United States Department of Defense X.509 Certificate Policy, Version 10.7 June 2021

s. United States Department of Defense S-Interoperability Domain X.509 Certificate Policy, 30

Nov 2018

t. Committee National Security System (CNSS) Instruction No. 1300 (Instruction for National

Security Systems PKI X.509 CP Under CNSS Policy No. 25), 6 Jan 2021

u. Marine Corps Order 3070.2a, The Marine Corps Operations Security Program

v. United States Marine Corps Enterprise Cyber Security Manual 007

3. GENERAL REQUIREMENTS

The MCCOG requires support for operations, management, and sustainment of PKI and related programs. Contractor support shall include PKI registration support for authorized systems and personnel located at USMC installations worldwide. The contractor shall sustain the USMC portion of the established DoD PKI to include USMC Only-Locally-Trusted (OLT) PKI.

3.1 Objectives

The objective of this PWS is to achieve effective, reliable, and secure PKI capability across the Marine Corps Information Environment (MCIE).

Achieving the objective requires the following:

a. Staff augmentation is maintained with the required qualifications, skill sets, and certifications such that services are effectively delivered

b. Contractor personnel must have sufficient knowledge in both the technical aspects of PKI and how PKI is employed within the U.S. Federal Government and Department of Defense.

c. All contractor personnel are fully compliant with DoD Cyber Security Work Force certification standards. Personnel shall continuously maintain annual DoD training requirements

d. Projects and tasks are delivered on time and within cost controls

3.2 Overview of general operational support to USMC PKI programs is synopsized below:

a. Post-deployment applications software PKI support

b. Certificate generation and issuance in support of Zero Trust

c. Operate and maintain Marine Corps Only Locally Trusted (OLT) PKIs on the Marine Corps portion of the DoDIN

d. Operate and maintain Marine Corps Commercial Solutions for Classified PKIs

e. DoD/NSS/Gray Certificate Validation support

f. DISA DoD/NSS/Gray Registration Authority operations

g. Integration Support for fielded systems

h. Field technical support

3.3 Place of Performance.

The contractor shall provide support for the MCCOG PKI section at the following locations:

- MCB Quantico, Virginia – Primary Site

- Okinawa, Japan – Local Registration Authority (LRA)

- Camp Pendleton, California – Secondary site, Local Registration Authority (LRA)

- Camp Lejeune, North Carolina - Local Registration Authority (LRA)

- Commandant of the Marine Corps, HQ USMC, Washington, DC - Local Registration Authority (LRA)

3.4 Personnel Qualifications

All contractor personnel working this effort must meet the minimum qualifications listed at XX prior to award and for the duration of their participation of this effort.

PKI -- TASK REQUIREMENTS

The tasks identified below, when integrated and supported with the contractor’s direct DoD/NSS PKI experience shall achieve the PWS objective.” These tasks enable the Marine Corps PKI to fulfill its role within the DoD’s operational hierarchy, quickly adapting to near-term changes and continuously evolving to meet long-range technology trends.

The Contactor shall provide PKI support services under the following subtasks.

4.1 Program Management.

The contractor shall identify a Program Manager (PM), by name, who shall provide management, technical supervision, direction and guidance, administration, quality assurance, and leadership for all contractor personnel effort in the execution of this contract. The PM shall schedule meetings and provide deliverables. The PM shall serve as the Government’s primary point-of-contact, maintaining regular communication with MCCOG and keeping MCCOG apprised of all contract issues and status.

The contractor shall apply and maintain their proven and successful program management practices throughout the life of this contract.

4.1.1 Kick-off Meeting

The contractor shall attend a Kick-off Meeting at a location determined by the Government no later than five (5) business days after contract award. The meeting will provide an introduction between key contractor personnel and relevant Government personnel who will be involved with the effort. The purpose of the Kick-off Meeting is to achieve a clear and mutual understanding of all contract requirements and identify and resolve potential problems.

During the Kick-off Meeting, the contractor shall be prepared to discuss its draft Project Management Plan to be implemented under this contract. Other topics of discussion may include contract deliverables, sub-contracting plan compliance (as applicable), government furnished equipment, travel procedures, and other topics as warranted. The Contractor shall deliver Meeting Minutes in accordance with Section 11 of the PWS.

4.1.2 In-Progress Review (IPR)

The contractor shall host a monthly IPR with the Government’s Technical Point of Contact (TPOC), COR, contracting officer, and other vital Government stakeholders. The purpose of this meeting is to ensure all stakeholders are informed of the monthly activity, provide opportunities to identify other activities and establish priorities, and coordinate resolution of identified problems or opportunities. The contractor shall provide an agenda no later than one day prior to the meeting, with written minutes of the meeting, including attendance, issues discussed, decisions made, and action items assigned in accordance with add the Deliverable section #.

Minimum IPR content shall include the following:

a. Activities during reporting period, i.e. previous month, by task (include on-going activities, new activities, activities completed; progress to date on all above-mentioned activities). Start each section with a brief description of the task.

b. Problems and corrective actions taken. Also include issues or concerns and proposed resolutions to address them.

c. Contract status which will include task leads information and staffing update/changes (vacant, transition in/out, gains, losses).

d. Security clearance status or issues.

e. Government actions required.

f. Financial Status of non-firm fixed price line items up to the previous month and projected cost for the current month.

g. Any recommendation or issues regarding the contract.

4.1.3 Project Management Plan (PMP)

The contractor shall document all support requirements in a PMP. The PMP provides the Government insight into the contractor’s process and methods of ensuring PWS objectives are satisfactorily achieved. The draft PMP (provided in response to the solicitation and incorporated into the contract) is subject to changes pending Government comments and recommendations after the Kick-Off Meeting.

The PMP is an evolutionary document that shall be updated as required. (See Sec xx Deliverables) The contractor shall work from the latest Government-approved version of the PMP.

Minimum PMP content shall include:

a. Transition Plan: Content shall include all necessary steps and processes to achieve full performance within 30 days of contract award without service degradation.

b. Proposed management approach to ensure successful execution of all tasks, to include a staffing matrix.

c. SOPs for all tasks.

d. Milestones, tasks, and subtasks.

e. Provide for an overall Work Breakdown Structure (WBS) and associated responsibilities and partnerships between or among Government organizations.

4.1.4 Transition-Out Plan -

The transition-out period, if required, shall commence 60 days prior to the end of the contract; the Transition-Out Plan is due at this time. The contractor shall maintain full personnel staffing up to the contract end date. The Plan shall facilitate a seamless transition from the current contractor to the incoming contractor and identify how it will transfer the following:

a. Project management processes

b. Points of contact

c. Location of technical and project management documentation

d. Status of ongoing technical initiatives

e. Transition of Key Personnel, if applicable

f. Schedules and milestones

g. Actions required of the Government

h. Submit a “turnover binder” for each functional area which shall include, but is not limited to, passwords, permissions, SOPs, documentation, etc.

The current contractor shall establish and maintain effective communication with the incoming contractor and Government personnel for the period of the transition via weekly status meetings.

The contractor shall also complete or perform transfer of all tangible and intangible (intellectual) property and licenses.

4.1.5 Quarterly Meeting

The contractor shall plan and conduct a quarterly contract status meeting. The primary purpose of these meetings is to review contract performance status and address contract-related issues. These meetings are expected to last no longer than one (1) hour. At a minimum, the meeting will include appropriate contractor representative(s), the contracting officer, the COR, and Government technical personnel, as appropriate; however, the contracting officer may choose to include other Government attendees. The meeting will be held virtually, via a phone conference call, or at a location determined by the contracting officer.

Each meeting will cover the following topics, as appropriate:

• Contract Performance Status (interim draft CPARS rating)

• Status of contract deliverables/tasks (updates since last meeting)

• Performance issues encountered or expected (e.g., potential delays)

• Required Government actions (e.g., delivery of Government Furnished Information and/or Property)

• Compliance with staffing (See Sections 11 and 12)

• Discussion on contractor performance against QASP metrics

• CLIN-related issues.

• Address new or in process modifications, requests for out-of-scope work, requests for equitable adjustment, claims, or disputes

• Clause compliance (e.g., FAR 52.245-1, Government Furnished Property; FAR 52.219-9, Small Business Subcontracting Plan)

• Invoice submission and payment status

• Continuous improvement ideas for current contract and/or future contract

4.2 Registration Authority (RA) Operations

The Contractor shall provide PKI RA support for the implementation, maintenance and upkeep of the DoD/NSS/USMC PKI by: BROAD

a. Creation and removal of Local Registration Authority (LRAs)

b. Issuance and revocation of Role Based, Code Signing, End user, administrator and server certificates Alternate token issuance

c. NIPR/SIPR key recovery

d. SIPRNet Token and Common Access Card (CAC) PIN resets

e. Manage the production and issuance of USMC Alternate Tokens using the NIPRNet Enterprise

Alternate Token System (NEATs)

f. Manage the production and issuance of the DoD/NSS SIPRNet tokens using the Token Management System

(TMS)

The PKI RA section is a fast-paced work environment and serves as the only PKI Enterprise help desk in the USMC providing professional and courteous support to customers located throughout the world to include tactical environments.

The contractor shall use PKI RA skills to enhance the network security by the use of PKI while working with internal MCCOG divisions, external USMC organizations, various other DoD organizations, and a myriad of Government and civilian organizations.

Task include:

a. Certificate Issuance/Revocation

b. Help Desk Support

c. CAC PIN Reset Support

d. Purebred/Mobile Device PKI certificate support

e. PKI Key Recovery

f. New/Emerging technologies testing support

g. Serve as RAs and Key Recovery Agents

h. Maintain support for creation and removal of LRAs.

i. Issue end user certificates.

j. Coordinate installation of DoD certificates on to Mobile devices.

k. Execute certificate revocation within 12 hours of notification.

l. Download, format, and install PKI certificates.

m. CAC PIN Reset and Key recovery.

n. SIPR Token PIN Reset and Key recovery.

o. Resolve customer issues related to PKI certificate use and system configuration.

p. Serve as the Liaison between the MCCOG and the field LRA staff for the resolution of issues elevated to the

MCCOG call center.

q. Submit and update Remedy tickets in accordance with established metrics.

r. Execute certificate disposition for USMC casualties.

s. Assist in the execution of LRA, Trusted Agent and end user PKI training.

t. Manage the production and issuance of DoD SIPR Tokens using a TMS and peripherals provided by the

Government at the MCCOG Manage the production and issuance of USMC Alternate PKI Tokens using NEATs.

u. Maintain and sustain the central repository of PKI records specified by the Government, to include records required to establish the validity of a signature and the proper operation of the PKI as specified in the DoD PKI Certificate Policy.

v. Perform ah-hoc metric collection and reporting (please see deliverable task ####).on selected activities directed by the Government. Shall maintain a daily log of user assistance calls, SIPR token and Alternate token certificate issuance, revocations, and server certificate issuance

w. Shall maintain a daily physical logbook consisting of all RA certificate activities as specified in the DoD RA LRA Certificate Practice Statements (CPS)/NSS RPS.

x. Maintain and update required PKI certificate issuance, revocation, and key recovery actions in appropriate existing or future SharePoint lists/Databases.

y. Provide data requirements for future SharePoint lists/databases for issuance activities from new DoD capabilities.

z. Direct calls from customers of the DoD and USMC PKI to appropriate MCCOG sections.

aa. Provide both internal and external USMC PKI customers with knowledgeable, problem-solving resolutions, in the shortest time possible to minimize any customer downtime or work stoppage.

bb. Assist Program of Record (POR) application owners with integration of current USMC PKI enabling technologies.

cc. Provide general administrative support tasks to the execution of PKI logistics activities such as controlled distribution of SIPR Tokens, ALT Tokens, and PKI peripherals.

dd. Provide input for operational metrics and analysis to improve the enterprise PKI related customer experience and reduce Help Desk calls.

ee. Provide desktop and network support.

ff. Perform operational testing of beta tokens, new certificate types and Token Management Testing along with operational capability testing of all new versions of PKI certificate and systems.

4.2.1 Local Registration Authority (LRA) Audit

The contractor shall provide LRA Audit support as directed by the Government for the development, updating and execution of comprehensive audit procedures and reports for all LRA field operations.

Tasks include:

a. Develop, modify, and execute comprehensive audit procedures for all LRA field operations

b. Conduct and ensure performance of field LRA operations audits are in accordance with the most current

DoD RA/LRA CPS, NSS RPS, CNSS Certificate Policy (CP) the USMC Training User’s Guide, and USMC RA guidance

c. Maintain all procedures, reports, and Automated Message Handling System (AMHS) messages to ensure the USMC RA maintains a prepared state for the successful completion of the LRA audits directed by the DoD CPS and NSS RPS

d. Draft and submit LRA Audit reports within 10 business days of audit completion for signature and delivery to audited Command

e. Recommend improvements to procedures and processes related to the audits to PKI Leadership

The contractor shall provide two personnel for each audit: one Registration Authority and one RA Workstation System administrator. The audit will take place over one week at a minimum of every three years at each of the following locations:

a. Camp Lejeune, NC

b. Camp Pendleton, CA

c. Okinawa, Japan

d. HQMC, Arlington, VA

Audit periodicity is a minimum of once every three-years, but out-of-cycle audits may be directed by the Government as necessary.

4.3 Local Registration Authorities

The contractor shall provide LRA support at each MEF location and HQMC to assist in Communications General Staff (G6) PKI mission. The contractor LRA shall assist in all PKI implementations, server builds and installs in conjunction with the Local G6’s.

The contractor shall provide support personnel to serve as the LRA staff assigned under this subtask area.

a. Provide LRA support to ensure the PKI Server Certificates are requested, approved, and installed in accordance with PKI Policy.

b. Execute PKI certificate registration, management and revocation requests to ensure all requested activities are properly documented within the ticket management system

c. Maintain and perform CAC PIN Reset operations for end-user needs in area of responsibility.

d. Archive PKI data as directed and in compliance with the CPS/Registration Practice Statement.

e. Plan, coordinate, and implement, at the local level with the local G6, evolving PKI initiatives as directed by the USMC RA.

f. Develop, update, and submit Monthly status reports providing token issuance numbers, trouble calls processed and any current issues to the USMC RA.

Local Registration Authorities shall be located at:

a. I MEF – Camp Pendleton, CA

b. II MEF – Camp Lejeune, NC

c. III MEF – Camp Foster Okinawa, Japan

d. HQMC – Pentagon, Arlington, VA

4.4 PKI Network Operations

PKI Network Operations provides technical expertise related to the support of concept exploration, functional and technical requirements generation, development, implementation, and enhancement of DoD PKI for the USMC. This technical support includes the development of a technically resilient certificate issuance and revocation status checking infrastructure for all MCEN networks, as well as meeting the requirements of HSPD-12. It ensures that USMC PKI implementation requirements are identified and made part of the development, implementation, and support of future DoD PKI architecture. MCCOG PKI provides support for assessments of USMC impacts from actions associated with DoD PKI PMO development and implementation activities, to include use of DoD PKI with mobile devices and DoD provided non-person entity issuance capabilities. MCCOG PKI provides support to address issues related to certificates, tokens, token issuance, and infrastructure services. This task provides technical requirement support to directory service providers and recommendations for USMC action to change DoD implementation and software releases. USMC PKI recommendations shall also include the impact of planned changes to registration software and hardware upon USMC users.

The contractor shall assign a PKI Network Operations Network single point of contact who will provide technical supervision and guidance specific to the PKI Network Operations contract support staff and will be the Government’s touch point for all PKI Network Operations system management tasks.

4.4.1 Certificate Authority (CA) Support

The contractor shall provide technical support for Microsoft Active Directory, DoD PKI, Unix and Windows software, Microsoft Active Directory Certificate Services (ADCS), Keyfactor EJBCA, Information Services Corporation (ISC) CertAgent, Red Hat CA software certificate services, and other Certificate Authority Services Technologies that may arise due to new technologies developed which the government may choose to implement in future years

a. Develop, deploy and configure new CA Infrastructure in accordance DoD security standards and best practices.

b. Conduct infrastructure checks twice daily and create status report using SharePoint List for Government leadership.

c. Maintain the overall health of technologies associated with the CA infrastructure.

d. Monitor the health of CA infrastructure with MCCOG provided event management tools. Report any discrepancies to Government leadership and record using incident ticketing system.

e. Publish and issue Certificate Revocation Lists on a weekly basis from Root and Sub CAs.

f. Provide Tier III troubleshooting and support for incidents related to CAs and document resolution using incident ticketing system.

g. Implement and monitor CA thresholds and conduct proactive event remediation per Government guidance.

h. Develop, plan, deploy, and configure new versions of CA Infrastructure as needed or when directed by

Government leadership.

i. Develop, test, and maintain CA Infrastructure disaster recovery plans using SharePoint Document

Library.

j. Develop, test, and maintain CA Infrastructure COOP plans using SharePoint Document Library.

k. Escalate issues to third party product vendors as required and track the progress of vendor support.

4.4.2 Certificate Validation Infrastructure (CVI) Support

The contractor shall provide CVI support for PKI, Windows Software, Axway Validation Authority Suite software to include but not limited to Online Certificate Status Protocol (OCSP), Desktop Validator, Enterprise Validation Authority, and Compact CRLs, and Keyfactor EJBCA Validation Authority

Tasks include:

a. Configure and deploy new Certificate Validation (Responder/Repeater) software as needed or directed by Government leadership.

b. Develop, deploy and maintain desktop validator configurations for use by all systems and applications residing on all USMC networks.

c. Conduct infrastructure checks twice daily and create status report using SharePoint List for Government leadership.

d. Maintain the overall health of technologies associated with the CVI.

e. Monitor the health of CVI with MCCOG provided event management tools. Report any discrepancies to Government leadership and record using incident ticketing system.

f. Ensure validation information, downloaded from DISA, is current and accessible by CVI servers.

g. Provide Tier III troubleshooting and support for incidents related to CVI and document resolution using incident ticketing system.

h. Configure and deploy new versions of CVI software as needed or when directed by Government leadership.

i. Develop, test, and maintain CVI disaster recovery plans using SharePoint Document Library.

j. Develop, test, and maintain CVI COOP plans using SharePoint Document Library.

k. Escalate issues to third party product vendors as required and track the progress of vendor support.

4.4.3 Hardware Security Module (HSM) Support

The contractor shall provide HSM support for SafeNet/Thales and nCipher hardware PKI key management.

a. Configure and deploy new HSMs as required or directed.

b. Maintain the overall health of the HSMs. Provide Tier III troubleshooting and support for incidents related to HSMs and document resolution using incident ticketing system.

c. Develop, test, and maintain HSM disaster recovery plans using SharePoint Document Library.

d. Escalate issues to third party product vendors as required and track the progress of vendor support.

4.4.4 Public Key Enabling Support

The contractor shall provide Public Key Enabling support to Marine organizations requiring Marine Corps Enterprise PKI support/services.

Tasks include:

a. Research and understand new technologies that require PK Enablement.

b. Coordinate PKI technical support, when required.

c. Create courses of action and document recommendations for PK Enabling noncompliant systems. Note:

POR/Application owners are responsible for Cryptographic Enablement.

4.4.5 Tier III PKI Advanced Support

The contractor shall provide Tier III advanced troubleshooting support in accordance with the Information Technology Infrastructure Library (ITIL).

Tasks include:

a. Perform PKI Tier III troubleshooting on MCEN systems relating to PKI specific incidents to include but not limited to cryptographic logon, certificate validation, and domain controller certificates.

b. Participate and provide PKI subject matter expertise in resolving issues within all USMC Networks in collaboration with other MCEN service providers.

4.4.6 Configuration Management Support

The contractor shall provide Configuration Management of all PKI related middleware and applications supporting smartcard authentication and certificate validation.

Tasks include:

a. Maintain and deploy Desktop Validator and Middleware Configurations supporting the MCEN using SharePoint Document Library.

b. Maintain and deploy Server Validator Configurations supporting the MCEN using SharePoint Document Library.

c. Maintain baseline configurations for all PKI software and enterprise hardware using SharePoint Document Library.

d. Plan, develop, and test, new configurations for PKI software and hardware. Provide after action reports of test results and recommendations for site/region/enterprise implementation.

4.4.7 PKI System Infrastructure Support.

The Contractor shall provide hardware and software technical support to operate, troubleshoot, and scale three separate forests with separate infrastructure and services. Each environment requires isolated access, patching, and security postures. The uptime of all PKI enterprise services is 99.97%, not including system maintenance as measured using Marine Corps Enterprise Monitoring Tools provided by MCCOG C2 Sytems and Marine Corps Enterprise Information Technology Services Management (E-ITSM/Remedy). Metrics shall be reported via the PRS.

All patching and Information Assurance Vulnerability Alert compliancy shall be accomplished, with or without a patching solution, on all PKI Enterprise services in accordance with the Marine Corps Vulnerability Management Policies and MCCOG VMT provided Assured Compliance Assessment System (ACAS). All security vulnerabilities shall be remediated and completed within the assigned deadline from subtask

(Vulnerability Management) in accordance with Marine Corps E-ITSM change management policies. For vulnerabilities that are technically unable to be remediated, PKI System Infrastructure Tech will assist subtask

4.2.23.3 change to match the one in Cyber (Vulnerability Management) in creating POA&M.

4.4.8 Virtual Infrastructure (VI) Support

The contractor shall configure all aspects of the VI in support of the PKI Enterprise Services on USMC operated networks. The contractor shall use VMware to deploy and maintain complex VMware environments to provide Virtual Machine and Virtual Desktop services.

Tasks include:

a. Maintain the overall health of technologies associated with the VI to include both Virtual Servers and Virtual Desktop Environments

b. Implement monitoring tool thresholds and conduct proactive event remediation as directed by Government leadership.

c. Monitor the health of VI with MCCOG provided event management tools. Report any discrepancies to Government leadership and record using incident ticketing system.

d. Provide Tier III troubleshooting and support for incidents related to VI and document resolution using incident ticketing system.

e. Configure and deploy new versions of VI as needed or when directed by Government leadership.

f. Develop, test, and maintain VI disaster recovery plans using SharePoint Document Library.

g. Escalate issues to third party product vendors as required and track the progress of vendor support.

h. Leverage emerging VI technologies to support additional PKI implementation and support items.

4.4.9 Storage Area Network (SAN) Support

The contractor shall configure all aspects of the SAN hardware and software supporting PKI Enterprise Services.

The contractor shall use NetApp Storage devices to include snapshots, storage provisioning, management software, recovery procedures, hardware installation and security of Logical Unit Numbers (LUNS), and access to each to provide PKI SAN support.

Tasks include:

a. Maintain the overall health of technologies associated with the SAN.

b. Implement monitoring tool thresholds and conduct proactive event remediation as directed by

Government leadership.

c. Monitor the health of SAN with MCCOG provided event management tools. Report any discrepancies to

Government leadership and record using incident ticketing system.

d. Provide Tier III troubleshooting and support for incidents related to SAN and document resolution using incident ticketing system.

e. Configure and deploy new versions of SAN as needed or when directed by Government leadership.

f. Develop, test, and maintain SAN disaster recovery plans using SharePoint Document Library.

g. Escalate issues to third party product vendors as required and track the progress of vendor support.

4.4.10 Server Management Support

a. Maintain the overall health of technologies associated with the Server Management

b. Implement monitoring tool thresholds and conduct proactive event remediation as directed by

Government leadership.

c. Monitor the health of Server Management with MCCOG provided event management tools. Report any discrepancies to Government leadership and record using incident ticketing system.

d. Provide Tier III Server support and troubleshooting for incidents related to Server Management and document resolution using incident ticketing system.

e. Configure and deploy new versions of Server Management as needed or when directed by Government leadership.

f. Develop, test, and maintain Server Management disaster recovery plans using SharePoint Document

Library.

g. Escalate issues to third party product vendors as required and track the progress of vendor support.

4.4.11 Event Management Support

a. Resolve all PKI related Event Management tickets and provide an Event Management Status Report on weekly basis for all Event Management incidents.

b. Submit and execute Event Management related Request for Change (RFC) tasks, when required, with approval of Government leadership.

c. Maintain the overall health of technologies associated with Event Management tools installed within PKI Enterprise servers.

d. Coordinate and collaborate with other MCCOG sections on Event Management issues

e. Participate in and brief PKI Change Request tasks, related to event management, to the Change Review

Board.Implement monitoring tool thresholds, analyze, and conduct proactive event remediation as needed.

4.4.12 PKI Application/Software Support

USMC PKI utilizes multiple customized tools, programs, and scripts that provide streamlined business processes and technical monitoring for USMC PKI Enterprise services. Requests for new tools and scripts, which support the USMC PKI overall service to the user community, occur frequently. The contractor shall provide support via automation of manual processes through a variety of scripts.

4.4.12 Script Development

The contractor shall create and maintain scripts to enhance and streamline PKI processes and services. The contractor shall at a minimum, use the following to support USMC PKI Operations: DoD PKI and VBScript, PowerShell, Batch, Java Script, and Perl scripting languages and others subject to relevant technology changes and updates.

Tasks include:

a. Develop, test, and implement new script capabilities as directed.

b. Maintain, validate, and ensure compatibility of existing custom scripts.

4.5 Implementation and Planning

The contractor shall provide implementation and planning support in the development and writing of project plans and implementation documentation as required in support of USMC PKI initiatives. This also includes updating existing specific PKI plans and procedures to comply with changing DoD PKI initiatives. The development of plans for the employment and support of PKI tools in all network environments, including tactical ones, which provide PKI procedures for concept of operations (CONOPS) and plan of actions and milestones (POA&M) to ensure successful execution is required.

4.5.1 Knowledge Management

The contractor shall provide Knowledge Management support using expertise in SharePoint Administration, Application Development, and Management in accordance with DoD PKI initiatives.

USMC PKI manages and maintains an internal and external SharePoint site which provides internal collaboration and external customer support services. Internal support services include, but are not limited to, document libraries, task tracking, calendar, database, and list services. External customer support services include, but are not limited to, PK Enabling documentation, Service Support/Informational Dashboard Software configurations, and downloads.

a. Create, maintain, and sustain document libraries and lists

b. Create, maintain, and sustain views for libraries and lists

c. Create, maintain, and sustain WebParts and other SharePoint services as necessary

d. Create, maintain, and sustain templates for assisting PKI personnel with individual document libraries

e. Create, maintain, and manage both internal and external facing SharePoint services

f. Create and maintain Microsoft SharePoint List and Database in support of RA Operation requirements in tracking token and certificate lifecycle.

g. Create and manage of all RA SharePoint lists and databases in support of disaster recovery efforts.

h. Develop new enhancements to current SharePoint list database capabilities.

4.5.2 Program of Record (POR) PKE Waiver Review

The contractor shall provide implementation and planning support for reviewing USMC POR Application waiver forms for compliance/noncompliance with existing DoD PKI directives. Due to technical limitations, some systems are unable to implement PKI and therefore require a waiver form to justify non- compliance with PKI directives.

Tasks include:

a. Review and submit waiver forms with recommendation for approval/disapproval to the USMC Designated Accrediting Authority /Authorizing Official (AO)

b. Create, submit, and track Remedy trouble ticket for waiver requests

c. Track all waiver forms using SharePoint and notify the POR requestor of waiver status

d. Coordinate directly with the USMC PKI Network Operations for technical guidance to verify requested waiver system is capable or incapable of PK enablement

e. Develop, maintain, and provide briefings to Government leadership depicting current status of waived systems/PORs

4.5.3 Purebred/Government Furnished Commercial Mobile Device (CMD) Support

The contractor shall provide Implementation and Planning support for updating and configuration of Purebred for Government Furnished Commercial Mobile Devices (CMD) utilizing DoD derived credential solution which delivers credentials to the CMD for use with secure email and access to network resources requiring a DoD PKI credential.

The contractor shall provide the following PKI implementation planning support:

a. Enroll and Manage USMC Purebred Limited Registration Agents within the DISA Purebred Web Application

b. Coordinate with other MCCOG sections for proper configuration of CMD Purebred Client Applications.

c. Provide Tier-3 Purebred troubleshooting of signing and encrypting emails.

d. Provide Purebred desktop manager support.

e. Establish and execute SOPs and training guides to ensure version control and adherence to sound configuration management practices for all documentation.

f. Submit/update/close trouble tickets.

4.5.4 Concept of Operations/Operational Directives/Advisories (OPDIR/OPAD) Development, Tracking, and Reporting

The contractor shall:

a. Perform technical writing, analysis, and editing of all PKI CONOPS with Government guidance.

b. Develop, review, and release OPDIR/OPAD in accordance with Government guidance for release of operational requirements and advisories. Provide reporting guidance and/or templates as required.

4.5.5 USMC and DoD PKI Document/Meeting Review

The contractor shall support the following meetings as needed:

a. DoD PKI Program Management Office (DoD PKI PMO) Program Information Exchange (PIE)/Program Status Review (PSR) meeting

b. DoD PKI Summits

c. Identity Protection and Management Senior Coordinating Group (IPMSCG) meeting and meetings of

IPMSCG sub-groups

d. Weekly Working Integrated Product Team and various conference calls

e. CAC PIN Reset Users Group (CUG) meeting

f. Remedy Queue Managers meeting

g. DoD PKI Certificate Practice Management Working Group (CPMWG) meeting

h. Developer Configuration Control Board (DCCB) meeting

i. PKI PMO Functional Managers meeting

j. DoD PKI Technical Interchange meeting

k. USMC PKI and Identity Management programs

l. Other meetings as required

Using input from these meetings, the contractor shall provide the PKI implementation planning support to:

a. Develop USMC PKI Plans and Implementation Documentation for new DoD / USMC projects, tasks, and initiatives. Review and provide comments on plans and procedures of changes to existing DoD and USMC PKI programs and update USMC-specific Plans and Procedures to comply with approved changes to DoD PKI initiatives.

b. Develop PKI Tactical Plans for the deployment and support of PKI in tactical environments which shall include CONOPS, Continuity of Operations Plans (COOP), and SOPs.

c. Develop and maintain all PKI Architecture and Migration Plans (to include, but not limited to, technical, certificate authority, certificate validation, and registration authority) for future releases of DoD PKI

d. Provide analysis, planning, implementation support to assist PKI Section with tasks and requirements levied by United States Cyber Command (USCYBERCOM), Joint Task Force – Department of Defense Information Networks (JTF-DoDIN), and Marine Corps Forces Cyberspace Command

(MARFORCYBER).

e. Review and provide recommendations for PKI policy and procedures at the DoD, DON, and USMC levels.

f. Review and recommend PKI solutions to customer problems based on an understanding of the customer environment and provide recommendations to support the customer’s mission.

4.5.6 Remedy/Task Tracking

USMC PKI Remedy/Task Tracking are responsible for coordinating activities to resolve Incidents/Service Requests and restore service with a primary focus on workforce monitoring, prioritization, incident routing, and queue management. Tasks/projects external to incident management are created and tracked using SharePoint Tasks Lists.

Tasks include:

a. Assign Incidents to and manage the Incident resolution efforts of the SMEs to ensure metric compliance in accordance with established ticketing procedures.

b. Ensure Incidents/Service Requests are accurately transferred to appropriate Queues and/or escalated to the proper functional group within prescribed standards and timelines

c. Monitor the performance and investigate/remediate Service Level breaches.

d. Ensure Incidents/Service Requests are properly documented to include priority based on impact/urgency, classification, complete and thorough updates at an appropriate level of detail on resolution.

e. Create and manage tasks using SharePoint Task lists.

f. Monitor and investigate tasks to ensure timely completion by assigned due date.

g. Analyze tasks to ensure proper updates prior to reporting to leadership.

i. Provide access to PKI information utilizing Excel Web Services

j. Create, maintain, and sustain Key Performance Indicator (KPI) web parts

k. Connect web parts

l. Create individual web pages to simulate “collaborative sites”

m. Employ web services to present information from restricted areas to the general public

n. Write basic scripts (e.g., providing Site Redirection, adding color to a list item in SharePoint, etc.)

o. Set proper security settings and permissions

p. Maintain, sustain, and update SharePoint lists for the tracking of SIPRNet Trusted Agents , NIPRNet

Trusted Agents , Alternate Tokens , SIPRNet Tokens Server Certificates and any future SharePoint lists/Databases..

q. Develop and maintain additional share point lists as required

r. Develop required reporting from SharePoint Lists using available tools

s. Develop, maintain, and sustain the external PKI SharePoint content as required by Government leadership

4.5.7 PKI Documentation

The contractor shall maintain existing documentation and create new documentation as required to support the PKI Section. The documentation shall be developed using USMC approved Office Automated software. This support shall be provided and used for drafting and updating of all documentation. All installation and configuration documentation shall be managed under strict configuration controls. The contractor shall establish and execute STIGs to ensure version control and adherence to sound configuration management practices for all documentation and solution artifacts. The below documents are examples of such documentation.

a. Instructions and Procedures for PKI Enterprise Solutions and systems to include:

1. Configuration Instructions

2. Installation Instructions

3. Maintenance Instructions

4. Transition Instructions

5. Release Instructions

6. Decommission/ Removal Instructions

7. End User Instructions

8. Engineering task, function, and process procedures

9. SOPs

b. Design Documentation for PKI Enterprise Solutions and systems to include:

1. Detailed Technical Design

2. Detailed Configuration

3. Operating Guidelines

4. Implementation Guide

5. Diagrams and technical drawings (including logical, physical, wiring, data flow, and topological)

6. RMF documentation

7. Supporting attachments to enterprise design documents

8. Technical Requirements Documentation for PKI Services designs

c. Supporting Documentation for PKI Enterprise Solutions and systems to include:

1. POA&Ms

2. Test Plans

3. A&A Documentation

4. Briefs and presentations

5. Engineering project management documentation

6. Written responses to Government tasks

7. Completed Comment Resolution Matrixes

8. Recommended policy documents supporting PKI enterprise designs and solutions

9. Document templates

10. Technical Training material and support documents

11. Transition Plans

12. Deployment Plans

13. Documentation updates and rewrites

14. Written assessments on requirements

15. Configuration Management documents

16. Lessons Learned Reports

17. After-Action Reports

18. Technology, practice, and product reviews and assessments

19. Request for Modification supporting documentation

20. RFC and incident tickets

21. Release Plans and supporting documentation

22. Implementation Plans

23. Product Review & Evaluation Reports

24. LRA Audit Reports

25. Additional supporting documents required from PKI Government Leaders

4.6 Training Support

The contractor shall assist in developing and presenting training along with participating in outreach activities in support of USMC PKI initiatives for garrison and tactical networks. Training shall be in conformance to IA policy.

Tasks include:

a. Assist in developing PKI Training Plans and tactical training materials.

b. Assist in developing and maintaining tracking and reporting mechanisms for tactical training suite and materials.

c. Assist in developing and maintaining PKI Outreach Materials to support PKI training and customer awareness as related to constant changing of PKI environment.

d. Assist in developing and providing PKI Briefs for conferences or working group meetings regarding

PKI projects, plans, and initiatives as directed.

e. Assist in developing and providing targeted computer/hands-on training specific to LRA, TA, System

Administrators, and end-users within USMC.

f. Assist in developing and providing PKI Instructor Materials such as course outlines, background material, and training aids in support of targeted training.

g. Assist in developing and providing PKI student course materials such as workbooks, handouts, completion certificates, and course critique forms for onsite hands-on training.

h. Train PKI LRAs in accordance with the USMC, DISA, and National Security Agency IA policy and procedures via formal classroom courses, and hands-on workshops as required.

i. Coordinate dates of training and classroom facilities for local (Quantico area) training requirements

j. Provide PKI end-user training on certificate utilization within the Desktop environment, at the

LRA level.

k. Develop and maintain PKI Tactical Training Plans and training materials.

l. Configure, operate, and maintain the PKI Tactical training suite leveraging most current hypervisor technology thereby allowing resetting classroom virtual environment back to baseline configuration for servers and workstations for hands on training and ease of administration.

m. Coordinate dates of training and onsite support with requesting MEFs, Marine Expeditionary Units, and Reserve Commands.

n. Provide PKI support staff to present PKI Tactical Training course to deploying Marines consisting of but not limited to:

• PKI 101

• CVI

• Cryptographic Logon

• PKI Administration and Troubleshooting

• Hands-on-lab

• Practical application and written testing

4.6.1 Training/Conference Space

The contractor shall make available to the MCCOG, as needed and within 14 calendar days of request by the MCCOG, a classroom to conduct training for approximately 10-20 students per session, for up to a week in length.

The contractor shall provide a computer for each student, audio/visual support to include an overhead projector and screen, and internet connectivity for each student workstation.

The contractor shall make available to the MCCOG, as needed and within 14 calendar days of request by the MCCOG, a conference room in a configuration to conduct physical and virtual meetings for approximately 10-20 participants. Conference rooms shall have audio/visual support to include an overhead projector and screen, and internet connectivity. Conference or meetings can be several hours or several days in length.

The training/conference space shall be located within 10 miles of the MCCOG facility in Quantico, VA.

Historically, each space is used approximately 14-16 times per year. Training/conference room shall support:

a. PKI training events hosted in the Quantico such as PKI Tactical training and other PKI training for USMC organizations external to MCCOG. Space shall support a minimum of 10 students but no more than 20

b. Periodic DoD PKI Summits and Certificate Practice Management Working Groups (at least one quarterly)

c. Off-site meeting location to discuss PKI programs, tasks and other items with stakeholder external to MCCOG

4.7 PKI Cyber Security…