COMET IDIQ PWS DRAFT.pdf

PERFORMANCE WORK STATEMENT

(PWS)

Name: Communications & Enterprise Information Technology Support

Services (COMET) IDIQ

Organization: National Air & Space Intelligence Center

Address: 4180 Watson Way, Wright-Patterson AFB, OH 45433

1 PURPOSE

The National Air and Space Intelligence Center (NASIC) is the source for air and space intelligence. NASIC produces integrated, predictive air and space intelligence to enable military operations, force modernization and national policymaking.

The Communications and Information Directorate (SC) is responsible for delivering core IT services to enable NASIC and partner missions. Services include network management and design, storage and backups, servers, operating system support, data center hosting, service/helpdesk, workstation/printer/peripheral life-cycle support, sustainment applications, accounts management, voice communication system support, software, cybersecurity, systems engineering, video conferencing, Defense Logistics Agency Disposition Services (DLADS), equipment accountability, records management, compliance support, enterprise architecture, audiovisual support, infrastructure cabling, mobile computing, telephone installation, and conference facility support.

The Geospatial and Signatures Intelligence Group (GS) conducts distributed intelligence, surveillance, and reconnaissance (ISR) operations and creates advanced capabilities to enable technical intelligence and battlespace characterization. The MASINT Analysis Squadron provides timely and relevant processing, exploitation, dissemination and integration of radar and electro-optical data to characterize weapons systems in support of US military operations, national policy making, US weapon system acquisition, and intelligence community assessments.

The Air & Cyberspace Intelligence Group (AC) is responsible for creating all-source intelligence defining the present and future air, air defense, and cyber threats to enable military operations, force modernization, and policy making. The Engineering Analysis Squadron requires contractor assistance to provide IT Support Services for the administration of networks enabling threat modeling, simulation, and analysis.

The Space, Missiles and forces Intelligence Group (SM) delivers integrated, predictive intelligence on space, ballistic missile, regional and future threat capabilities to enable U.S. decision-making advantage in the air, space and cyber domains.

DRAFT

The Global Exploitation Intelligence Group (GX) collects, exploits and analyzes air, space, and cyberspace information to create integrated intelligence for NASIC and the Nation. The Signals Analysis Squadron (GXS) utilizes engineering principles to create technical signals intelligence and digital network intelligence to determine the design characteristics and actual performance of foreign air, space and cyberspace threat systems tin order to support NASIC scientific & technical (S&TI) requirements and the intelligence community (IC).

The Security Office (SO) enforces and executes comprehensive collateral and Sensitive Compartmented Information (SCI) operations, personnel, integrated defense, industrial and physical security programs in support of the Center’s Intel production mission areas.

In regard to this effort, the execution of the Center’s physical security and integrated defense program spanning multiple security facilities is critical to obtain and maintain physical security accreditation and protect national security assets.

NASIC is located at Wright-Patterson Air Force Base (WPAFB), Fairborn, OH with an operating location at Bolling Air Force Base, Washington, DC.

2 SCOPE

Support for NASIC includes 4,500 users; 13,336 computer accounts; 37 networks; over 11,653 desktops of varying brands; over 2,111 virtual and physical servers of various operating systems and brands; 30 PB of disk storage; over 383 petabytes of tape storage;

917 distinct software titles; printers, scanners, copiers, fax machines and multi-function devices of various brands; 18 different operating systems; over 1500 miles of network fiber; seven primary VTC facilities; upwards of 70 desktop VTC devices; a facility access control system and intrusion detection system; and the largest SCIF conference center in the Intelligence Community.

All contracted support personnel shall have a Top Secret Sensitive Compartmented Information (TS SCI) security clearance with an up-to-date (having been completed within the five years immediately preceding the date of contract award) Single Source Background Investigation (SSBI). Certain contractor personnel shall also satisfy additional security requirements as detailed in section 7.

All contractor personnel shall comply with NASIC policies, processes, procedures, national and local security rules, regulations and requirements.

Primary hours of support (core work hours) for NASIC facilities at WPAFB shall be 0600 – 1800, Monday through Friday, Eastern Standard Time (EST). Other types of support may be necessary outside the core work hours in order to ensure that NASIC operations are not negatively impacted. Some areas of support shall require 24/7 staffing.

3 REQUIREMENT(S)/DESCRIPTION OF SERVICE(S)

Ordering period shall be 5 years following the contract award date. Task level performance work statements will define actual efforts and deliverables.

Communications Focal Point/Service Desk Support/Touch Maintenance/ Accounts

Management

Provide Service Desk support 24 hours a day for 365 days per year and be the single point of contact for all IT related issues for both internal and external customers.

Answer Level 1 inbound calls, web-cases, and web chats and assess customer’s technical support needs and handle/route accordingly, using documented procedures and available tools. Customer calls/web cases/web chats must be escalated and logged appropriately.

Provide technical support for PaaS, IaaS, Cloud, specialty engineering, application/database administration technical issues

Provide Level 2 remote and at-the-desk diagnosis/resolution of end-user requests/problems in a customer service oriented, team environment.

Perform duties of CFP Lead (i.e. Crew Commander) outside of core work hours including monitoring (network, system, environmental) of multiple data centers/facilities utilizing a variety of scripts, web-pages, and commercial applications, performing notification recalls to NASIC subject matter experts (SMEs), leadership and/or external agencies based on alarm/event types and coordinating response actions and documenting artifacts for after action analysis.

Monitor (network, system, environment) of multiple data centers/facilities utilizing a variety of scripts, web-pages, and commercial applications, performing notification recalls to NASIC subject matter experts (SMEs), leadership and/or external agencies based on alarm/event types and coordinating response actions and documenting artifacts for after action analysis.

Provide Service Desk support for Accounts Management to create, modify, delete, diagnose and resolve account requests/problems.

Provide Service Desk support to provision, modify, de-provision, diagnose and resolve mail requests/problems for all mail accounts across all domains.

DLADS Support

Receive, sanitize, and prepare IT equipment for pickup and preparing all disposition forms. IT equipment includes, but not limited to, desktops, laptops, mobile phones, servers, peripherals, printers, scanners, and multi-function devices

Recycle, reuse, or place back into service useable systems under warranty Perform as alternate NASIC Property Custodian (NPC) (or primary NPC) to handle the transfer of equipment if the Government NPC is not available.

Coordinate/schedule all logistics for equipment.

Factory Support (Desktop, Printers and Peripherals)

Build and maintain new IT systems and peripherals as required or repurpose IT systems and peripherals

Diagnose and resolve printer/scanner/MFD requests/problems Install/maintain/repair/remove workstations and peripherals

Maintain supply of break fix hardware for printers, workstations, and peripherals Install software on workstations and peripherals Provide computer inventory and accountability support Provide warranty support for hardware and peripherals

Software Administration/Installer/License Manager

Install, troubleshoot and uninstall software across network systems in NASIC Monitor, open, assign, update and close tickets on up to 4 separate ticketing systems Physically or remotely log into the system and execute prepackaged Microsoft

Installers (MSIs) or follow prescribed flowcharts/checklists Physically or remotely log into the system and execute prepackaged Specialized

Software Installers (SSIs) or follow prescribed flowcharts/checklists Prepare approved software for deployment through the SCCM software application center, (build software packages for deployment in a Windows environment)

Provide documentation or expand on documentation for all SW deployment packages

Update existing SW deployment packages when cybersecurity vulnerabilities are identified

Track all licensed SW and maintain the software file share Package software for the NASIC Application Catalog for SIPRNET and JWICS Work directly with customer on troubleshooting licensing, operating or troubleshooting deployed software packages

Network Services

Provide network administration for all NASIC networks including the 5 primary networks as well as all mission networks and data circuits.

Provide data center and cloud-based network administration for all NASIC data-center class networks including physical networking equipment and virtual networks to include software-defined networks.

Provide network security administration for all NASIC networks that have security appliances deployed including firewalls, VPNs, TACLANE’s, routers, ACL’s

Provide system administration and security engineering operational support, maintenance, configuration, and documentation for all NASIC cloud services including third party vendor services (ex: Amazon Web Services (Virtual Private Clouds and Elastic Compute Cloud) and Microsoft Azure)

Install and maintain network switching, routing, and network security equipment throughout the NASIC enterprise to include outlying buildings

Provide facility network cabling design Install and maintain premises network cabling throughout NASIC enterprise to include outlying buildings Install/maintain/repair/remove voice over internet protocol (VOIP) telephony systems

Sanitize and dispose of excess VoIP phones Install and maintain network switching, routing, and network security equipment throughout the NASIC enterprise to include outlying buildings

Datacenter Operations

Install/maintain/repair/remove/replace datacenter equipment to include servers, storage devices, network devices, and cabling

Perform maintenance for non-emergency and emergency requirements including servers and tape libraries

Maintain Data Center infrastructure information (location and identification of equipment, power connections, etc.) via Aperture Vista and track IT in Defense Property Accountability System (DPAS) for Automatic Data Processing Equipment (ADPE) tracking. Act as NPC/Information Technology Equipment Custodian for datacenter account

Install and remove power whips and maintain circuit breaker panel schedule Install, remove and replace data center infrastructure equipment Monitor Datacenter operations to include the environmental systems

(power/cooling/etc), civil engineering systems, and security systems Assist the data center manager with reviewing access logs and managing access to the data centers and racks

Windows System Administration

Maintain/administer/update Windows operating systems, products, applications and services

Maintain a number of automation and orchestration technologies Create and configure flexible solutions for Dev/Sec/Op, delivery, security, operations, oversight teams, ensuring system uptime, security, and performance.

Provide engineering support for complex implementations in an agile, product-centric environment Assess, deploy, and manage a number of infrastructure management tools

(SCCM, ACAS, HBSS, Satellite server) including infrastructure optimization and orchestration solutions.

Provide administrative support for agile and Dev/Sec/Ops (DevOps) environments while articulating and implementing a balanced approach to security and redundancy.

Provide production network integration between current and new services Maintain configuration management controls, to include security/update patches Develop change plans for all Windows Enterprise/Domain modifications Manage and administer Microsoft SQL database services and the SharePoint server farm Maintain Active Directory and associated custom scripting for account validation, office symbol changes and administration of Group Policy Objects (GPO) with removal/disable of no longer required GPOs

Maintain/update clustered Exchange servers for high-availability, to include daily review of system and application logs for the Exchange cluster

Provide expert-level MS-SQL Server analysis, design, configuration and management to support configuration management, operations management, application, cybersecurity, and availability requirements.

Automate all tasks using approved automation tools to include ansible/puppet/chef/etc.

Install, configure, maintain, and operate cloud-based servers (VMware, AWS, Azure, etc.)

UNIX/Linux System Administration

Maintain, administer, document, and update operating systems to include Solaris, RHEL, and CentOS, products, applications and services; build, maintain, and administer RHEL license servers; develop change plans for operating system modifications; and provide information assurance, server, virtualization and storage support

Maintain, administer, and update third party Unix and Linux applications Provide and maintain workstation, server, JumpStart workstation and JumpStart server builds Maintain and update network information system (NIS) maps, custom Samba file and print services, and programming and scripting languages and libraries Develop scripts to maintain integrity of critical network services (DNS, NIS, LDAP, VAS password synchronization) between Solaris, Linux and Windows Perform functionality testing before application installation and regression testing post-install and generating before-after reporting Develop scripts to maintain integrity of critical network services (DNS, NIS, LDAP and password synchronization) between Solaris, Linux and Windows Automate all tasks using approved automation tools to include ansible/puppet/chef/etc.

Storage and Enterprise Backup Services

Provide maintenance, administration, update, configuration, integration, and documentation of NASIC’s Enterprise backup systems, SAN-attached storage systems, tape backup systems, and Network Attached Storage (NAS) systems

Install portal devices, update portal tables, access permissions, user accounts, roles, mapping, workspace, and devices.

Provide corrective and preventative maintenance on all tape libraries and storage sub-systems

Develop scripts to monitor SAN resources and respond to adhoc user requests Configure storage allotments on Enterprise SAN storage, Network Attached

Storage and modular storage

Configure local and remote Disaster Recovery Plan (DRP) resources according to in accordance with customer guidelines, monitor daily data transfer status, insure current backup of all critical is complete, resolve hardware and network problems that would clause connectivity issues

Automate all tasks using approved automation tools to include ansible/puppet/chef/etc.

Install, configure, maintain, and operate cloud-based storage (Dell ECS, VMware vSAN, AWS S3, Azure, etc.)

VTC Operations

Schedule Video Teleconferencing (VTC) sessions and provide support throughout Coordinate and verify site locations and availability, input data into VTC Wizard, verify call is scheduled and mitigate conflicts, verify the VTC starts on time and performs all communications checks with each participant prior to the sit down time for the VTC call

Provide training and guidance to session participants on use of VTC systems

Multimedia Hardware Technician

Provide a wide range of installation, remedial and preventative hardware and software maintenance on various electronic equipment and network systems to include Analog / Digital Video Editing Equipment, Audio Visual Technical Support (projectors, screens, TV's, interface equipment, cameras, audio systems), Audio/Video Editing Stations, Video Teleconferencing Systems and Crestron control systems

Provide multimedia support for conferences and special events hosted by NASIC Provide installation, remedial and preventative hardware and software support on the Pan/Tilt/Zoom (PTZ) Video cameras installed within the NASIC Auditorium and VTC facilities and conference rooms

Provide maintenance, troubleshooting and repair of the Crestron touch panels, Input/Output modules, control programmers and low voltage controllers

Monitor the daily event logs for hardware failure Monitor CFP requests and respond to troubleshoot and resolve issues Integrate audiovisual systems and recommend technology solutions through the

CSRD process Install and connect DVTC systems throughout the Center

Software Vulnerability Testing

Provide software installation/configuration, software scanning, vulnerability remediation and documentation for compiled software, application source code, and containerized software

Provide documentation including installation instructions, vulnerability scans (pre/post), certificate to operate (CTO) reports, CTO certificate recording/tracking

Transfer media/documentation and support CFP with software installation issues/licensing issues on an as-needed basis

Conduct research with organization to determine Reciprocity for Certificate to Operate process

Coordinate with users to obtain software and troubleshoot/resolve installation issues for vulnerability scanning

Support the NASIC DevSecOps environment Review and track POA&Ms for approved software

Systems Engineering

Participate in technical reviews, teams, and discussions to plan, support and execute all systems engineering requests.

Perform installation, configuration, troubleshooting, technical assistance and/or training in response to customer requirements for the IT environment

Analyze security and regulatory compliance and make recommendations to ensure compliance and minimize security risks and insider threats.

Draft/coordinate/update design, architecture, implementation, and security documentation and artifacts including engineering references, implementation instructions, and security compliance documentation

Design, develop and implement secure designs for new or existing systems.

Ensure that the design of hardware, operating systems, and software applications meets cybersecurity requirements for the system.

Research, evaluate and provide feedback on problematic IT architecture, operation and cybersecurity trends and patterns.

Work with system engineers and administrators to jointly solve cybersecurity problems.

Develop IT architectures and designs with capacity, performance and cybersecurity integrity and availability requirements.

Assist to develop/maintain/coordinate/update system engineering processes and procedures related to configuration management and architecture standards and changes.

Support systems integration between current and new services, operating systems, servers and applications as required.

Provide engineering technical support and documentation for upgrades, integration, installation, implementation, and deployment for current and future Microsoft products.

Provide high-level (tier-4) troubleshooting and remediation for all Microsoft products and technologies

Provide expert-level Group Policy analysis, design, configuration and management to support configuration management, cybersecurity, and availability requirements.

Support systems engineering branch for cybersecurity integration including role-based access control, DISA Security Implementation Guidance (STIG) implementation, OS deployment configuration, and preparing and presenting presentations, papers, and documentation, as required.

Integrate and support new and emerging technologies such as high-performance cluster computing, cloud integration, desired configuration management and database management.

Provide functional area reports weekly, summarizing work accomplished, work planned, and important issues occurring during the week.

Automate all tasks using approved automation tools to include ansible/puppet/chef/etc.

Install, configure, and maintain network components including switches (including Cisco, Brocade, and Force10), firewalls, load balancers, and related network components

Provide state-of-the-art techniques for designing, developing, modifying and troubleshooting highly complex networks. Subject matter expert on emerging network technologies

Serve as a senior member of the team responsible for the planning and development of a robust, scalable, and highly available network infrastructure have knowledge of network and web related protocols (e.g. TCP/IP, UDP, HTTP, HTTPS, routing protocols)

Provide expert support, analysis and research into exceptionally complex security problems and challenges

Ensure that the architecture and design of information systems are functional and secure

Provide expert support for Information Technology in areas of information systems architecture, telecommunications systems design, architecture, implementation, information systems integration, software development, security engineering, and communications and network systems management

Information Technology Service Management

Perform installation, configuration, troubleshooting, technical assistance and/or training in response to customer requirements for the IT Service Management tool (Currently SCSM with plans to move to ServiceNow)

Develop, test and troubleshoot scripts written in Microsoft Powershell.

Support performance monitoring and situational awareness ‘dash-boarding’ for IT systems and processes within the ITSM tool Draft/coordinate/update design, architecture, implementation, and security documentation and artifacts including engineering references, implementation instructions, and security compliance documentation

Assist with modifying NASIC’s self-service portal, XML management packs, and service workflows in SCSM and ServiceNow

Plan, install, configure, and troubleshoot ITSM tool and integration with other reporting/management tools:

o Operating systems for monitoring o ITSM Servers (SQL, SCCM, SCSM, ServiceNow) o Microsoft System Center Orchestrator and Integration Packs o Non-Microsoft third-party service management products (Provance)

Create, modify and troubleshoot web dashboards Microsoft Internet Information Server (IIS) using hypertext markup language (HTML), ASP.NET, C#, and Visual Studio.

Create and modify web-based reports in SQL Server Reporting Services (SSRS).

Provide high-level (tier-4) troubleshooting and remediation for all Microsoft products and technologies on an ad-hoc basis IAW established procedures and processes.

Automate all tasks using approved automation tools within the ITSM tool to include ServiceNow/ansible/puppet/chef/etc.

Enterprise Architecture Support

Install, configure, and operate automated configuration management tools.

Aggregate and document configuration item information in central repository.

Populate the Configuration Management Database (CMDB) and maintain functional, allocated configuration item baselines.

Assist the Configuration Management (CM) Program Manager with maintaining and publishing the CM Concept of Operations (CONOPS).

Assist the change management processes, procedures across 4 networks (450+ change requests/year).

Perform configuration audits and report configuration discrepancies including production of impact analysis reports, and configuration status reports.

Integrate Security best practices in Configuration and Change Management to include establishing auditing and monitoring methods, Security Impact Analyses (SIAs) and verifying that products of the configuration management program meet cyber security requirements and maintain Authorities to Operate (ATO).

Cybersecurity

Install, configure, and deploy Elastic Search across NASIC’s Cornerstone Networks, in support of the IC and AF auditing requirements

Develop and document procedures/polices in order for NASIC to be compliant with Auditing guidance such as ICS 500-27 (Collection and Sharing of Audit Data). Provide technical support for any possible investigations and inquiries which may result of any misuse of information resources

Utilize Security Information and Event Management (SIEM) software products, such as Elastic Stack, to create custom queries, searches, alerts, and dashboards.

Identify and evaluate anomalous and suspicious system and network activity, detect and assess network intrusions and malware behavior, Incorporate, monitor, and analyze event logging across numerous device types (TCP/IP, packet analysis, Windows logs, syslogs)

Utilize SIEM information with other tools such as ACAS, HBSS, SolarWinds, and Palo Alto.

Provide support tasks related to Security Technical Implementation Guide (STIG) implementation compliance

Review all applicable STIG updates and work with the Risk Management process to remediate vulnerabilities

Perform tasks as Information System Security Officer (ISSO) for NASIC systems and/or networks to include completing and coordinating packages and supporting artifacts to gain authorizations to operate (ATO) in accordance with the Risk Management Framework (RMF) and perform continuous monitoring functions to maintain ATOs

Function as or support NASIC Information System Security Managers to execute oversight over the NASIC Cybersecurity program, implement corrective actions as necessary, and ensure compliance with IC, DoD, AF, and NASIC policy.

Execute continuous monitoring oversight for NASIC systems, to include tracking and reporting status of open plans of actions and milestones (POA&Ms) and verifying requires scans, auditing, and configuration management activities are occurring

Maintain/update AF IC and local system Assessment & Authorization repositories Establish/locate and maintain NASIC common security control responses and

XACTA packages and the artifacts that support them Create and provide specialized cybersecurity training and workshops to NASIC

ISSOs, privileged users, and other targeted personnel Assess RMF security controls for NASIC systems and networks and provide detailed security assessment reports to Delegated Authorizing Officials Track and monitor NASIC exceptions to and waivers from security policy Develop and maintain enterprise Cyber Health Dashboard to include the establishment and collection of key metrics as needed Host Based Security System (HBSS) support including endpoint security of 5 networks via administrative configurations, testing, analysis work, and auditing the HBSS suite (or comparable service) through modules such as Virus Scan Enterprise (VSE), Host Intrusion Prevention System (HIPS), Rogue System Detector (RSD), etc. Tasks will include analyzing logs to identify events, reviewing data transfers, developing processes to streamline analysis into Standard Operating Procedures (SOPs), documenting processes and requesting changes, preparing leadership level reports and reports to Tier 2, maintaining compliance with (Intelligence Community) IC and United States Cyber Command (USCYBERCOM) directives, and tasks as needed for HBSS events.

Infrastructure as a Services (IaaS) Operations

Manage the VMWare environment to provide virtual resources to all NASIC missions as approved by the NASIC governance process

Provide maintenance, administration, update, configuration, integration, and documentation of the IaaS

Maintain the self-service portal to provide virtual resources to approved missions (VRAutomation)

Maintain VM blueprints (configuration, STIG, patching) for deployment on the IaaS

Monitor operations of the environment (VROperations)

Platform as a Services (PaaS) Operations Manage the Pivotal Cloud Foundry Environment to provide automated container operations for NASIC’s micro-service architecture Provide maintenance, administration, update, configuration, integration, and documentation of the PaaS Maintain the CI/CD pipeline allowing approved code to move from the unclassified development environment to be run on the classified PaaS Maintain configuration, STIG, patching for the PaaS

Physical Access Control System & Intrusion Detection System Support

Coordinate between NASIC Security Office and NASIC Facility Engineers for system modification and enhancements.

Document system installation, configuration changes, network layout, and alarm views.

Add/delete users, modifying permissions, and attributes.

Complete ad hoc queries and reports as requested by Government personnel.

Sustainment services support for a variety of security controls and equipment.

Perform fault diagnosis, repair, overhaul, refurbishment, scheduled preventative maintenance services include installation as well as calibration and alignment.

Maintenance support includes electronics and mechanical support such as turnstiles and electronic control unit (ECU) repair.

Provide a 24x7 technical support for physical security to include access control system (ACS), intrusion detection system (IDS) and Closed Circuit Television (CCTV) support.

Provide a 24x7 monitoring of physical security components to include access control system (ACS), intrusion detection system (IDS) and Closed Circuit Television (CCTV).

Build, maintain, manage, and monitor the security and network infrastructure to include security door hardware, network components.

Monitor Closed Circuit Television(s) (CCTV) for Immediate Visual Assessment (IVA) and alerts Security Forces to suspicious activity.

Assist response force personnel to determine security system alarm status

Data Management

Maintain and utilize relational database systems (example Oracle, PostgreSQL, SQL, etc.) and No-SQL databases systems (such as MongoDB, Neo4J, Cassandra, Couch DB, etc.).

Participate in short-term and long-term planning about database projects and to decide how to efficiently store and analyze various types of data.

Evaluate database software against customer requirements and provide documented evaluation results with options and recommendations.

Ensure compliance with database vendor license agreement, including number of installations, and taking care of licensing renewals.

Install and upgrade the database server and/or application tools on Solaris servers.

Plan for and allocate the database system’s physical requirements, such as memory, disk space, network requirements, etc.

Collect, refine and implement communicate customer requirements and implement those requirements with the necessary database structure and other database object changes via manual processes (i.e. scripting DDL, PL/SQL, SQL, etc. and executing from command line) or Integrated Development Tools (example SQL_Developer or Toad).

Create users profiles, and ensure system security by careful allocation of user permissions.

Create a backup and recovery strategy for the database, and regularly test the backups to ensure usability.

Provide technical support for both database systems and related applications.

Create or modify existing reports by querying from database. These reports can be in the form of pre-formatted reports using the application frontend, or custom-made ad hoc reports by the database administrator.

Monitor and optimize the database’s performance using either manual or automated tools.

Migrate database instances to new hardware and new versions of software from on premise to cloud based databases and vice versa.

Implement and manage security controls, monitoring and reporting results per DISA STIG and information assurance policies, standards, and regulations as they pertain to specific database.

Turn data capture requirements into relational tables in a dataset.

Move data from one location to data models as required.

Ensure all data stored meets customer business rules.

Assist customers with troubleshooting performance and errors in the database (i.e.

ability to evaluate/write/rewrite queries) Evaluate impact of changes in the environment, communicate with customers and coordinate efforts to ensure least impact.

Produce/update documentation as required (i.e. continuity guides, standard operating procedures, test plans, security documents, slides etc.)

Application Server Management Monitor the Oracle WebLogic, Oracle HTTP Server and Apache software application, document and analyze problems, and publish maintenance schedule in a Solaris x86 environment.

Establish and maintain administrator and service accounts Management of SSL Certificate generation Maintains system documentation Program in an administrative language (i.e. PERL, C-SHELL, etc.)

Provides training to end-users and addresses questions with regard to implementation, application software functionality and user application deployment.

Maintain system availability rate of 99% Troubleshoot and resolve any reported problems Provide application performance tuning Review the governing regulations to ensure proper program support Monitor, update, and maintain existing legacy environment software systems interfaces to ensure that the interfaces exchange data properly and to support the current legacy environment

Implement and manage security controls, monitoring and reporting results per DISA STIG and information assurance policies, standards, and regulations as they pertain to specific database.

Maintain SLA, System Availability, Capacity management, and Performance Collaborate with hardware, OS, DBA technical teams to ensure proper integration of the environment Work closely with application development teams and vendors to tune and troubleshoot applications Plan and coordinate testing changes, upgrades, and new services, ensuring systems will operate correctly in current and future environments Provides second level of technical support for all corporate systems and software components Provide Level 3 support for the application. Must be able to support 24 x 7. Also enable production support team to tackle Level 2 support and issues Leads and participates in efforts to develop and implement processes for application and system monitoring Leads and participates in efforts to implement application updates to include upgrades, patches, and new releases Tests, debugs, implements, and documents programs. Assists in the modification of company products and/or customer/internal systems to meet the needs of the client and/or end-user

Develops test plans to verify logic of new or modified programs Develop and maintain the reporting and dashboard infrastructure for the organization Develop work plans and track/report status of assigned projects/tasks Liaise with vendor support on all issues Fully responsible for problem management activities such as issue resolution and root cause analysis

4 Cybersecurity The contractor shall ensure that all system or application deliverables meet the requirements of DoD and AF Cybersecurity policy. Furthermore, the contractor shall ensure personnel performing cybersecurity activities obtain, and remain current with, required technical and/or management certifications.

4.1 System Cybersecurity

For those solutions that will not inherit existing network security controls, and thus integrate an entirely new application system consisting of a combination of hardware, firmware and software, system security assurance is required at all layers of the TCP/IP DoD Model. The contractor shall ensure that all system deliverables comply with DoD and AF cybersecurity policy, specifically Department of Defense Instruction (DoDI) 8500.2, Cybersecurity, and Air Force Instruction (AFI) 33-200, Cybersecurity Program Management. To ensure that cybersecurity policy is implemented correctly on systems, contractors shall ensure compliance with DoD and AF Certification & Accreditation policy, specifically DoDI 8510.01, DoD Information Assurance Certification and Accreditation Process and AFI 17-101, Air Force Certification and Accreditation Program (AFCAP). The contractor shall also support activities and meet the requirements of DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, in order to achieve standardized, PKI-supported capabilities for biometrics, digital signatures, encryption, identification and authentication.

4.1.1 Application Cybersecurity

For those solutions that will be deployed to Infrastructure as a Service (IaaS), Platform as a Service (PaaS) or similar environments, and thus inherit existing network security controls, application security assurance is required at the Application layer of the Transmission Control Protocol and Internet Protocol (TCP/IP) DoD Model. The contractor shall ensure that all application deliverables adhere to Public Law 111-383, which states the general need for software assurance. Specifically, the contractor shall ensure that all application deliverables comply with the Defense Information Systems Agency (DISA) Application Security & Development Security Technical Implementation Guide (STIG), which includes the need for source code scanning, the DISA Database STIG, and a Web Penetration Test to mitigate vulnerabilities associated with Structure Query Language (SQL) injections, cross-site scripting, and buffer overflows. The contractor shall also support activities and meet the requirements of DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, in order to achieve standardized, PKI-supported capabilities for biometrics, digital signatures, encryption, identification and authentication.

4.1.2 Personnel Cybersecurity

Personnel performing cybersecurity activities are required to obtain, and remain current with, technical and/or management certifications to ensure compliance with DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19 December 2005 (with all current changes).

5 CONTRACTUAL REQUIREMENTS

5.1 Place of Performance

All work shall be performed at WPAFB, Fairborn, OH and Bolling AFB, Washington, DC. The majority of provided support shall occur at NASIC’s primary facility at WPAFB comprised of contiguous buildings 10859, 10856, 10858, 10822, 10828 and 10829, and 280. On-site support shall also be required at other locations on WPAFB. Many of the Center’s buildings are multi-story structures.

5.2 Normal Hours of Operation

Work will be performed 40 hours per week per contractor during core Center hours (0600-1800), Monday-Friday, excluding Federal holidays.

On-Call: ___No X Yes In the event an emergency is declared for WPAFB necessitating the implementation of an alternate work schedule (other than a standard 8-hour day, Monday-Friday work week). The Contracting Officer (or the CO’s designated representative) will make notification to the Contractor point of contact. A modified work schedule will be adopted for the duration of the declared emergency, and the Contractor shall comply with the provisions of that alternate work schedule.

5.3 Government Furnished Property

GFP Provided? _X__ No ___ Yes

The Government will only provide the following non-GFP items for Contractor use:

Office environment including desks, chairs, computers (Windows desktops or Unix workstations) as necessary to perform work function, access to non-secure phone system, access to secure phone system, badges for accessing the Base and building access badges. Some contractor personnel (primarily those involved in equipment installation and maintenance) shall share desks, computers and phones. The Government shall also provide secure locations for storage of tools and personal items such as coats, work shoes, etc.

5.4 Billable Hours

There may be occasions when support contractors are invited to participate in morale and recreational activities (i.e., holiday parties, golf outings, sports days and other various social events). Contractor employees shall not be directed to attend such events by the Government.

Since a contract employee is not a Government employee, the contract employee cannot be granted the same duty time activities as Government employees. Participation in such events is not billable to this Task Order (TO) and contractor employee participation should be in accordance with the employee’s company’s policies and compensation system.

5.5 Non-Personal Services

The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor feels that any actions constitute, or are perceived to constitute personal services, it shall be the contractor’s responsibility to notify the CO and COR immediately. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental functions. All decisions relative to programs supported by the contractor shall be the sole responsibility of the Government.

5.6 Contractor Identification

All contractor/subcontractor personnel shall be required to wear AF-approved or provided picture identification badges so as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone or via electronic mail, contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, contractor/subcontractors occupying collocated space with their Government program customer should identify their work space area with their name and company affiliation.

5.7 Combating Trafficking in Persons (CTIP)

Trafficking in Persons (TIP) is a worldwide problem posing a transnational threat involving violations of basic human rights. The DoD has a zero tolerance policy for TIP. As part of the 2013 National Defense Authorization Act, the Pentagon is required to take action against any contractor engaging in any activities related to labor trafficking, sex trafficking and child soldiering. The contractor should familiarize its employees with TIP by going to the DoD CTIP site at: http://ctip.defense.gov/Home.aspx. The contractor should immediately report all suspicious activity of its employees to the COR or CO.

5.8 Documentation and Data Management

The contractor shall establish, maintain, and administer an integrated data management system for collection, control, publishing, and delivery of all program documents. The data management system shall include but not be limited to the following types of documents: CDRLs, White Papers, Status Reports, Audit Reports, Agendas, Presentation Materials, Minutes, Contract Letters, and TO Proposals. The contractor shall provide the Government with electronic access to this data, including access to printable reports.

5.9 Records, Files, and Documents

All physical records, files, documents, and work papers, provided and/or generated by the Government and/or generated for the Government in performance of this PWS, maintained by the contractor which are to be transferred or released to the Government or successor contractor, shall become and remain Government property and shall be maintained and disposed of in accordance with Air Force Manual (AFMAN) 33-363, Management of Records; AFI 33-364, Records Disposition – Procedures and Responsibilities; the FAR, and/or the Defense Federal Acquisition Regulation Supplement (DFARS), as applicable. Nothing in this section alters the rights of the Government or the contractor with respect to patents, data rights, copyrights, or any other intellectual property or proprietary information as set forth in any other part of this PWS or the Application Services contract of which this PWS is a part (including all clauses that are or shall be included or incorporated by reference into that contract).

5.10 Personnel Security

Individuals performing work under this contract shall comply with applicable program security requirements as stated in the contract. This contract requires personnel have a TS SCI clearance.

The Contract Security Classification Specification (DD Form 254) will be at the IDIQ contract level and will encompass all security requirements. All contractors located on military installations shall also comply with Operations Security (OPSEC) requirements as set forth in DoD Directive 5205.02, Operations Security Program and AFI 10-701, Operations Security. All contractors shall also follow COMSEC and Telecommunications Electronics Material Protected from Emanating Spurious Transmissions (TEMPEST) regulations. In accordance with DoD 5200.2-R, Personnel Security Program (Jan 87), DoD military, civilian, consultants, and contractor personnel using unclassified automated information systems, including e-mail, shall have, at a minimum, a completed favorable National Agency Check plus Written Inquiries

(NACI).

5.11 Transmission of Classified Material

The contractor shall transmit and deliver classified material/reports in accordance with the National Industrial Security Program Operating Manual (DoD 5220.22-M). These requirements shall be accomplished as specified in this TO. In accordance with AFI 16-1404, AF Information Security Program.

5.12 Protection of System Data

Unless otherwise stated in the TO, the contractor shall protect system design-related documents and operational data whether in written form or in electronic form via a network in accordance with all applicable policies and procedures for such data, including DoD Regulation 5400.7-R and DoD Manual 5200.01(v1-v4) to include latest changes, and applicable service/agency/ combatant command policies and procedures. The contractor shall protect system design related documents and operational data at least to the level provided by Secure Sockets Layer (SSL)/Transport Security Layer (TSL)-protected web site connections with certificate and or user ID/password-based access controls. In either case, the certificates used by the Contractor for these protections shall be DoD or IC approved PKI certificates issued by a DoD or IC approved External Certification Authority (ECA) and shall make use of at least 128-bit encryption.

5.13 System and Network Authorization Access Requests

For contractor personnel who require access to DoD, DISA, or AF computing equipment or networks, the contractor shall have the employee, prime or subcontracted, sign and submit a System Authorization Access Report (SAAR), DD Form 2875.

5.14 Training

Contractor personnel are required to possess the skills necessary to support their company’s minimum requirements of the labor category under which they are performing. The contractor shall provide an effective and holistic operations and maintenance training plan that is pertinent for all personnel.

5.14.1 Other Government-Provided Training

The contractor’s employees may participate in other Government provided training under the following circumstances:

The contractor employees’ participation is on a space-available basis, The contractor employees’ participation does not negatively impact performance of this contract, The Government incurs no additional cost in providing the training due to the contractor employees’ participation, and Man-hours spent due to the contractor employees’ participation in such training are not invoiced to the task order

5.15 Voluntary Protection Program (VPP):

5.15.1 Applicability: This section of the PWS applies to “Applicable Contractors” as defined below.

5.15.2 Definitions:

Applicable Contractor

A contractor whose employees worked at least 1,000 hours at the site in any calendar quarter within the last 12 months and is NOT directly supervised by the applicant (installation)

Days Away, Restricted, and or Transfer Case Incident Rate (DART).

The number of recordable injuries and illness cases per 100 full-time employees resulting in days away from work, restricted work activity, and/or job transfer that a site has experienced in a given time frame

Total Case Incidence Rate (TCIR)

Total number of recordable injuries and illness cases per 100 full-time employees that a site has experienced in a given time frame

Voluntary Protection Programs

The VPP promotes effective worksite-based safety and health. In the VPP, management, labor, and Occupational Safety and Health Administration (OSHA) establish cooperative relationships at workplaces that have implemented a comprehensive safety and health management system. Approval into VPP is OSHA’s official recognition of the outstanding efforts of employers and employees who have achieved exemplary occupational safety and health

5.15.3 Requirements

WPAFB is in the process of pursuing VPP recognition or has already been recognized under the OSHA VPP. VPP impacts all “applicable contractors” operating on AF Installations. The contractor shall be responsible for ensuring their employees and managers have a comprehensive understanding of VPP as well as full compliance with OSHA requirements. The contractor shall follow the safety and health rules of the installation or VPP site. Detailed information on VPP is available on the OSHA website at http://www/osha.gov/dcsp/vpp/index.html.

The contractor shall submit a Safety and Health Plan and corresponding site safety checklist to the Government CO not later than 10 calendar days…