D1. RFP M0026425R0013.pdf

SEE ADDENDUM

(No Collect Calls)

M0026425R0013 27-Aug-2025

b. TELEPHONE NUMBER

(703) 432-1084

8. OFFER DUE DATE/LOCAL TIME

10:00 AM 30 Sep 2025

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA X ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

M002649. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

CYNTHIA A. GUTHRIDGE

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESSX

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

MCINCR - RCO

2010 HENDERSON RD

CYNTHIA GUTHRIDGE

QUANTICO VA 22134

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE M00089 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

M00089

BLDG 27410 HOT PATCH ROAD

QUANTICO VA 22134-5046

MARIEL NOGUEZ

TEL: 703-432-6908 FAX:

(703) 784-3592FAX:

TEL: (703) 432-1084

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$34,000,000

NAICS:

541519

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF87

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

M0026425R0013

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES MAX

QUANTITY

UNIT UNIT PRICE MAX AMOUNT

0001 UNDEFINED Each PKI Support Operations

FFP

PKI Support Operations in accordance with PWS Task: 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, and 5.0. NOTE: Due to system limitations, "each" means "Dollars." The individual services are identified as their own separate price. Task orders will be priced out so that each service is FFP. Each Task Order will provide a qty for which services will be provided at the unit prices proposed and unit measure of months or each identified in the Price Matrix in RFP Attachment 4.

FOB: Destination

PSC CD: DG01

MAX

NET AMT

UNIT UNIT PRICE MAX AMOUNT

0002 UNDEFINED

Travel

COST

Travel and other travel related expenses in accordance with PWS 10.0.

MAX COST

UNIT UNIT PRICE MAX AMOUNT

0002AA UNDEFINED Each Travel

COST

Travel in accordance with PWS 10.0. Travel cost shall be in accordance with

FAR 31.205-46. Contractor shall provide a breakout of the travel expenses in accordance with FAR 31.205-46. The established travel handling rate proposed at solicitation and incorporated at award shall be used. The handling rate encompasses handling and indirect expenses the contractor may account for when processing travel cost. No additional indirect rates are applicable since there is a negotiated fixed price handling rate in the contract. Fee is strictly prohibited on travel costs. NOTE: Due to system limitations, "each" means

"dollars."

UNIT UNIT PRICE MAX AMOUNT

0002AB UNDEFINED Each Other Travel Related Expenses

COST

Other travel related expenses in accordance with PWS 10.0. Travel cost shall be in accordance with FAR 31. Contractor shall provide a breakout of the travel expenses in accordance with FAR 31. The established travel handling rate proposed at solicitation and incorporated at award shall be used. The handling rate encompasses handling and indirect expenses the contractor may account for when processing travel cost. No additional indirect rates are applicable since there is a negotiated fixed price handling rate in the contract. Fee is strictly prohibited on travel costs. NOTE: Due to system limitations, "each" means

"dollars."

Use of this line item is specific to only those expenses as a result of OCONUS performance (HOLA/COLA/DoDDS).

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT

Marine Corps Public Key Infrastructure (PKI) Support Services

United States Marine Corps

1. SCOPE

This Performance Work Statement (PWS) describes the technical support services required of the Marine Corps

Public Key Infrastructure and provides descriptions of Public Key Infrastructure (PKI) technical requirements definition, operations, and sustainment support for authorized systems and personnel located at United States Marine

Corps (USMC) installations worldwide.

Required support includes sustainment of the USMC portion of the established Department of Defense (DoD)

Information Network (DoDIN): Non-classified Internet Protocol Router Network (NIPRNET) Public Key

Infrastructure (PKI), National Security Systems (NSS) Secret Internet Protocol Router Network (SIPRNET) PKI, and Defense Information Systems Agency (DISA) Gray PKI.

2. BACKGROUND

The mission of the Marine Corps PKI Program is to provide the resources, manpower, and equipment (hardware and software) dedicated to the management (i.e.: generation, production, distribution, control, accounting, and destruction) of keys and certificates used by public key-based security services to include Non-classified Internet

Protocol Router Network (NIPRNet) and SIPRNet both garrison and deployed. The PKI program operates the

USMC Certificate Validation Infrastructure (CVI) and USMC organizational Certificate Authorities (CA) necessary to ensure that only authorized users and server-based applications can operate on the Marine Corps Enterprise

Network (MCEN). These services are required for user access to all information system components on the MCEN including network accounts, applications, and web sites. PKI must be operable in garrison and tactical/deployed environments. Marine Corps PKI is operationally attached to the Marine Corps Cyber Operations Group (MCCOG) aboard Marine Corps Base Quantico, Virginia and sponsored by Headquarters Marine Corps Deputy Commandant, Information (HQMC DC I) as a USMC Representative to DoD PKI.

3. GENERAL INFORMATION

Marine Corps PKI requires support for operations, management, and sustainment of the Marine Corps Component to

DoD and NSS PKI, USMC Only-Locally-Trusted PKI, and related programs. Extensive knowledge of DoD/NSS

PKI is required (see PWS Section 19: DoDI 8520.02; DoD PKI Registration Authority/Local Registration

Authority Certificate Practice Statement; and, NSS PKI DoD Registration Authority Practice Statement). Contractor support shall include PKI registration support for authorized systems and personnel located at USMC installations worldwide. The contractor shall sustain the USMC portion of the established DoD PKI to include USMC Only-

Locally-Trusted (OLT) PKI and USMC internal Certificate Validation Infrastructure.

3.1 Objective

The objective of this PWS is to achieve effective, reliable, and secure PKI capability across the Marine Corps

Information Environment (MCIE).

Achieving the objective requires the following:

• Staff augmentation is maintained with the required qualifications, skill sets, and certifications such that services are effectively delivered.

• Contractor personnel must have expert knowledge in both the technical aspects of PKI and how PKI is employed within the Department of Defense and National Security System Networks.

• All contractor personnel are fully compliant with DoD Cyber Security Work Force certification standards.

Personnel shall continuously maintain annual DoD training requirements.

• Projects and tasks are delivered on time and within cost controls.

3.2 Synopsis of general Marine Corps PKI Program Operational Support:

• Post-deployment applications software PKI support

• Certificate generation and issuance in support of Zero Trust

• Operate and maintain Marine Corps Only Locally Trusted (OLT) PKIs on the Marine Corps portion of the

DoDIN

• Operate and maintain Marine Corps Commercial Solutions for Classified PKIs

• DoD/NSS/Gray Certificate Validation support

• DISA DoD/NSS/Gray Registration Authority operations

• Integration Support for fielded systems

• Field technical support

3.3 Place of Performance

The contractor shall provide support for the Marine Corps PKI Program at the following locations:

• MCB Quantico, Virginia – Primary Site (All tasks except LRA)

• Camp Foster, Okinawa, Japan – Local Registration Authority (LRA) task only

• Camp Pendleton, California – Secondary site (for network operations redundancy purposes), LRA task only

• Camp Lejeune, North Carolina - LRA task only

• Commandant of the Marine Corps, HQ USMC, Washington, DC - LRA task only

Contractor situational telework may be authorized when in the best interest of, and approved by, the Government in advance. Only tasks that do not require SIPRnet Access or use of Registration Authority Workstations will be considered.

3.4 Hours of Operation

The Government’s normal workday is Monday – Friday 0600 – 1800 local time. These hours denote when the designated Government facility is normally open for business and does not specify a required contractor work schedule. Contractor personnel may be required to work on weekends, may be required to work a 10 -12-hour work day, and may be recalled (at hours other than a normal work day) for high critical incidents. Although the frequency of these types of work hours is minimal, the contractor shall coordinate and maintain an adequate work force for the uninterrupted performance of all tasks defined within this PWS. Adjustments to contractor work schedules shall not constitute overtime.

3.5 Personnel Qualifications

All contractor personnel working this effort must meet the minimum qualifications listed at PWS Section 18 upon contract award. Personnel who do not meet or maintain the minimum qualifications throughout the duration of the contract are considered unqualified and will not have access to facilities and systems.

3.6 Available Workstation Space

Government on-site workspaces are limited by location and task as follows:

Location PWS Task Available On-Site

Workspaces

MCCOG – Quantico, VA

Program Management (4.1) 1

Registration Authority Operations (4.2) 6 (includes 1 Lead)

PKI Network Operations (4.4) 8 (includes 1 Lead)

Implementation and Planning (4.5) 3

PKI Cyber Security (4.6) 1 Lead

Knowledge Management (0) 1

I MEF – Camp Pendleton, CA Local Registration Authority (4.3) 1

II MEF – Camp Lejeune, NC Local Registration Authority (4.3) 1

III MEF – Camp Foster

Okinawa, Japan Local Registration Authority (4.3)

HQMC – Pentagon, Arlington, VA

Local Registration Authority (4.3)

3.7 Compliance with Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7001

The contractor shall ensure that personnel accessing information systems have the proper and current IA certification to perform IA functions in accordance with DFARS 252.239-7001. All personnel performing tasks under this contract shall be United States citizens. No foreign nationals shall be provided access to any Items any way associated with the effort under this contract regardless of the security classification of such Items.

4. PKI TASK REQUIREMENTS

The tasks identified below, when integrated and supported with the contractor’s direct DoD/NSS PKI experience shall achieve the PWS objective. These tasks enable the Marine Corps PKI to fulfill its role within the DoD’s operational hierarchy, quickly adapting to near-term changes and continuously evolving to meet long-range technology trends.

The Contactor shall provide PKI support services under the following major tasks and its subtasks.

4.1 Program Management

The contractor shall identify a Program Manager (PM) who shall provide management, technical oversight, direction and guidance, administration, quality assurance, and leadership for all contractor personnel effort in the execution of this contract. The PM shall schedule meetings and provide deliverables. The PM shall serve as the

Government’s primary point-of-contact, maintaining regular communication with Marine Corps PKI and keeping

Marine Corps PKI apprised of all contract issues and status.

The contractor shall apply and maintain proven and successful program management practices throughout the life of this contract.

4.1.1 Kick-off Meeting

The contractor shall attend a Kick-off Meeting at a location determined by the Government no later than five (5) business days after contract award. The meeting will provide an introduction between key contractor personnel and relevant Government personnel who will be involved with the effort. The purpose of the Kick-off Meeting is to achieve a clear and mutual understanding of all contract requirements and identify and resolve potential problems.

During the Kick-off Meeting, the contractor shall be prepared to discuss its management approach, staffing, and any plans submitted in response to the solicitation that will be implemented under this contract. Other topics of discussion may include contract deliverables, sub-contracting plan compliance (as applicable), government furnished equipment, travel procedures, and other topics as warranted. The contractor shall deliver Meeting Minutes in accordance with PWS Section 0.

4.1.2 In-Progress Review (IPR)

The contractor shall host, by the 15th of each month, a monthly IPR with the Government’s Technical Point of

Contact (TPOC), COR, contracting officer, and other vital Government stakeholders. The purpose of this meeting is to ensure all stakeholders are informed of the previous month’s activity, provide opportunities to identify other activities and establish priorities, and coordinate resolution of identified problems or opportunities. The contractor shall provide an agenda no later than one day prior to the meeting and written minutes of the meeting, including attendance, issues discussed, decisions made, and action items assigned within three business days after the meeting in accordance with PWS Section 0. (The first IPR will be jointly determined by the Government and the contractor.)

Minimum IPR content shall include the following:

a. Activities during reporting period, i.e. previous month, by task (include on-going activities, new activities, activities completed; progress to date on all above-mentioned activities). Start each section with a brief description of the task.

b. Problems and corrective actions taken. Also include issues or concerns and proposed resolutions to address them.

c. Contract status, which will include task leads information and staffing update/changes (vacant, transition in/out, gains, losses).

d. Security clearance status or issues.

e. Government actions required.

f. Financial Status of non-firm fixed price line items up to the previous month and projected cost for the current month.

g. Any recommendation or issues regarding the contract.

4.1.3 Project Management Plan (PMP)

The contractor shall document all support requirements in a PMP. The PMP provides the Government insight into the contractor’s process and methods of ensuring PWS objectives are satisfactorily achieved throughout the life of the contract. The PMP is subject to changes pending Government comments and recommendations. (See PWS

Section 0)

The PMP is an evolutionary document that shall be updated as required. The contractor shall work from the latest

Government-reviewed version of the PMP.

Minimum PMP content shall include:

a. Proposed management approach to ensure successful execution of all tasks, to include its staffing matrix.

b. SOPs for all tasks.

c. Milestones, tasks, and subtasks.

d. Provide for an overall Work Breakdown Structure (WBS) and associated responsibilities and partnerships between or among Government organizations.

4.1.4 Transition-Out Plan

The transition-out period, if required, shall commence 60 days prior to the end of the contract. The Transition-Out

Plan is due 90 days before the end of the contract to allow for the exchange of Government comments and questions and contractor revisions as necessary prior to submission of the final plan. The final plan is due 60 days before the end of the contract. The contractor shall maintain full personnel staffing up to the contract end date. The Plan shall facilitate a seamless transition from the current contractor to the incoming contractor and identify how it will transfer the following:

a. Project management processes

b. Points of contact

c. Location of technical and project management documentation

d. Status of ongoing technical initiatives

e. Transition of Key Personnel, if applicable

f. Schedules and milestones

g. Actions required of the Government

h. Submit a “turnover binder” for each functional area which shall include, but is not limited to, passwords, permissions, SOPs, documentation, etc.

The current contractor shall establish and maintain effective communication with the incoming contractor and

Government personnel for the period of the transition via weekly status meetings.

The contractor shall also complete or perform transfer of all tangible and intangible (intellectual) property and licenses prior to the end of the contract.

4.1.5 Quarterly Meeting

The contractor shall plan and conduct a quarterly contract status meeting. The primary purpose of these meetings is to review contract performance status and address contract-related issues. These meetings are expected to last no longer than one (1) hour. At a minimum, the meeting will include appropriate contractor representative(s), the contracting officer, the COR, and Government technical personnel, as appropriate; however, the contracting officer may choose to include other Government attendees. The meeting will be held virtually, via a phone conference call, or at a location determined by the contracting officer.

Each meeting will cover the following topics, as appropriate:

a. Contract Performance Status (interim draft CPARS rating)

b. Status of contract deliverables/tasks (updates since last meeting)

c. Performance issues encountered or expected (e.g., potential delays)

d. Required Government actions (e.g., delivery of Government Furnished Information and/or Property)

e. Compliance with staffing (See Sections 11 and 12)

f. Discussion on contractor performance against QASP metrics

g. CLIN-related issues.

h. Address new or in process modifications, requests for out-of-scope work, requests for equitable adjustment, claims, or disputes

i. Clause compliance (e.g., FAR 52.245-1, Government Furnished Property; FAR 52.219-9, Small

Business Subcontracting Plan)

j. Invoice submission and payment status

k. Continuous improvement ideas for current contract and/or future contract

4.2 Registration Authority (RA) Operations

The contractor shall provide PKI RA support for the implementation, maintenance and upkeep of the

DoD/NSS/Marine Corps PKI to include, as an example the below broad elements. The contractor shall assign a RA

Operations single point of contact who will provide technical oversight and guidance specific to the PKI RA

Operations contractor support staff and will be the Government’s touch point for all PKI RA Operations management tasks.

• Creation and removal of Local Registration Authorities (LRAs)

• Issuance and revocation of Role Based, Code Signing, End user, administrator and server certificates

Alternate token issuance

• NIPR/SIPR key recovery

• SIPRNet Token and Common Access Card (CAC) PIN resets

• Manage the production and issuance of USMC Alternate Tokens using the NIPRNet Enterprise

Alternate Token System (NEATs)

• Manage the production and issuance of the DoD/NSS SIPRNet tokens using the Token Management

System (TMS)

• Will provide USMC LRA audit support as required. A valid passport is required.

4.2.1 PKI RA Ops Enterprise Help Desk

The PKI RA section is a fast-paced work environment and serves as the only PKI Enterprise help desk in the USMC providing professional and courteous support to customers located throughout the world to include tactical environments. Help Desk support provides Level I support and will route complex support requirements to Network

Ops (PWS 4.4.6) as necessary. The contractor shall use DoD/NSS PKI RA skills to enhance the network security through the utilization of PKI while working with internal MCCOG divisions, external USMC organizations, various other DoD organizations, and a myriad of Government and civilian organizations.

Tasks include:

4.2.1.1 Certificate Issuance/Revocation

4.2.1.2 PKI Help Desk Support Level 1 (required incident handling matrix at Attachment 1)

4.2.1.3 PIN Reset Support

4.2.1.4 Purebred/Mobile Device PKI certificate support

4.2.1.5 PKI Key Recovery

4.2.1.6 New/Emerging technologies testing support

4.2.1.7 Serve as RAs and Key Recovery Agents

4.2.1.8 Maintain support for creation and removal of LRAs.

4.2.1.9 Issue end user certificates.

4.2.1.10 Coordinate installation of DoD certificates on to Mobile devices.

4.2.1.11 Execute certificate revocation within 12 hours of notification.

4.2.1.12 Download, format, and install PKI certificates.

4.2.1.13 Resolve customer issues related to PKI certificate use and system configuration.

4.2.1.14 Serve as the Liaison between the MCCOG and the field LRA staff for the resolution of issues elevated to the MCCOG call center.

4.2.1.15 Submit and update Remedy tickets in accordance with established metrics. (Attachment 1)

4.2.1.16 Execute certificate disposition for USMC casualties.

4.2.1.17 Assist in the execution of LRA, Trusted Agent and end user PKI training.

4.2.1.18 Manage the production and issuance of DoD SIPR Tokens using a TMS and peripherals provided by the

Government.

4.2.1.19 Manage the production and issuance of USMC Alternate PKI Tokens using NEATs.

4.2.1.20 Maintain and sustain the central repository of PKI records specified by the Government, to include records required to establish the validity of a signature and the proper operation of the PKI as specified in the DoD

PKI Certificate Policy.

4.2.1.21 Perform ah-hoc metric collection and reporting (deliverable 0009) on selected activities directed by the

Government. Shall maintain a daily log of user assistance calls, SIPR token and Alternate token certificate issuance, revocations, and server certificate issuance on Government-provided SharePoint site.

4.2.1.22 Shall maintain a daily physical logbook consisting of all RA certificate activities as specified in the DoD

RA LRA Certificate Practice Statements (CPS)/NSS RPS.

4.2.1.23 Maintain and update required PKI certificate issuance, revocation, and key recovery actions in appropriate existing or future SharePoint lists/Databases.

4.2.1.24 Provide data as required by the Government for future SharePoint lists/databases for issuance activities from new DoD capabilities.

4.2.1.25 Direct calls from customers of the DoD and Marine Corps PKI to appropriate MCCOG sections.

4.2.1.26 Provide both internal and external Marine Corps PKI customers with knowledgeable, problem-solving resolutions, in the shortest time possible to minimize any customer downtime or work stoppage.

4.2.1.27 Assist Program of Record (POR) application owners with integration of current Marine Corps PKI enabling technologies.

4.2.1.28 Provide general administrative support tasks to the execution of PKI logistics activities such as controlled distribution of SIPR Tokens, ALT Tokens, and PKI peripherals.

4.2.1.29 Provide input for operational metrics and analysis to improve the enterprise PKI related customer experience and reduce Help Desk calls.

4.2.1.30 Provide desktop and network support.

4.2.1.31 Perform operational testing of beta tokens, new certificate types and Token Management Testing along with operational capability testing of all new versions of PKI certificate and systems.

4.2.2 PKI RA Training and Outreach

Contractor personnel expertise under the RA task will be utilized from time to time to assist in developing and presenting PKI training along with participating in outreach activities in support of Marine Corps PKI initiatives for garrison and tactical networks. Training shall be in conformance to IA policy.

4.2.2.1 Assist in developing PKI Training Plans.

4.2.2.2 Assist in developing and maintaining PKI Outreach Materials to support PKI training and customer awareness as related to constant changing of PKI environment.

4.2.2.3 Assist in developing and providing PKI Briefs for conferences or working group meetings regarding PKI projects, plans, and initiatives as directed.

4.2.2.4 Assist in developing and providing targeted computer/hands-on training specific to LRA, TA, System

Administrators, and end-users within USMC.

4.2.2.5 Assist in developing and providing PKI Instructor Materials such as course outlines, background material, and training aids in support of targeted training.

4.2.2.6 Assist in developing and providing PKI student course materials such as workbooks, handouts, completion certificates, and course critique forms for onsite hands-on training.

4.2.2.7 Train PKI LRAs in accordance with the USMC, DISA, and National Security Agency IA policy and procedures via formal classroom courses, and hands-on workshops as required.

4.2.2.8 Coordinate dates of training and classroom facilities for local (Quantico area) training requirements

4.2.2.9 Provide PKI end-user training on certificate utilization within the Desktop environment, at the LRA level.

4.2.3 Local Registration Authority (LRA) Audit

The contractor shall provide LRA Audit support as directed by the Government for the development, updating and execution of comprehensive audit procedures and reports for all LRA field operations.

4.2.3.1 Develop, modify, and execute comprehensive audit procedures for all LRA field operations

4.2.3.2 Conduct and ensure performance of field LRA operations audits are in accordance with the most current

DoD RA/LRA CPS, NSS RPS, CNSS Certificate Policy (CP) the USMC Training User’s Guide, and USMC

RA guidance

4.2.3.3 Maintain all procedures, reports, and Automated Message Handling System (AMHS) messages to ensure the USMC RA maintains a prepared state for the successful completion of the LRA audits directed by the

DoD CPS and NSS RPS

4.2.3.4 Draft and submit LRA Audit reports within 10 business days of audit completion for signature and delivery to audited Command (deliverable 0006)

4.2.3.5 Recommend improvements to procedures and processes related to the audits to PKI Leadership (deliverable

0006)

Existing Registration Authority personnel performing under the RA Operations task shall conduct the audits. Audits typically take one week to complete and occur a minimum of once every two years, although out-of-cycle audits may be directed by the Government as necessary. Audits are required at the following locations:

• Camp Lejeune, NC

• Camp Pendleton, CA

• Okinawa, Japan

• HQMC, Arlington, VA

4.3 Local Registration Authorities

The contractor shall provide LRA support at each Marine Expeditionary Force (MEF) location listed below and

HQMC to assist in Communications General Staff (G6) PKI missions. The contractor LRA shall assist in all PKI implementations, server builds and installs in conjunction with the Local G6’s.

• Provide LRA support to ensure the PKI Server Certificates are requested, approved, and installed in accordance with PKI Policy.

• Execute PKI certificate registration, management and revocation requests to ensure all requested activities are properly documented within the ticket management system

• Maintain and perform CAC PIN Reset operations for end-user needs in area of responsibility.

• Archive PKI data as directed and in compliance with the CPS/Registration Practice Statement.

• Plan, coordinate, and implement, at the local level with the local G6, evolving PKI initiatives as directed by the USMC RA.

• Develop, update, and submit monthly status report results in the IPR providing token issuance numbers, trouble calls processed and any current issues to the USMC RA.

Local Registration Authorities shall be located at:

• I MEF – Camp Pendleton, CA

• II MEF – Camp Lejeune, NC

• III MEF – Camp Foster Okinawa, Japan

• HQMC – Pentagon, Arlington, VA

4.4 PKI Network Operations

PKI Network Operations provides technical expertise related to the support of concept exploration, functional and technical requirements generation, development, implementation, and enhancement of DoD PKI for the USMC.

This technical support includes the maintenance and sustainment of a technically resilient certificate issuance and revocation status checking infrastructure for all MCEN networks, as well as meeting the requirements of HSPD-12.

It ensures that Marine Corps PKI implementation requirements are identified and made part of the development, implementation, and support of future DoD PKI architecture. Marine Corps PKI provides support for assessments of

USMC impacts from actions associated with DoD PKI PMO development and implementation activities, to include use of DoD PKI with mobile devices and DoD provided non-person entity issuance capabilities. Marine Corps PKI provides support to address issues related to certificates, tokens, token issuance, and infrastructure services. This task provides technical requirement support to directory service providers and recommendations for USMC action to change DoD implementation and software releases. Marine Corps PKI recommendations shall also include the impact of planned changes to registration software and hardware upon USMC users.

The contractor shall assign a PKI Network Operations Network single point of contact who will provide technical oversight and guidance specific to the PKI Network Operations contractor support staff and will be the

Government’s touch point for all PKI Network Operations system management tasks.

Performance under this major task may include PKI Network Operations equipment maintenance and tactical support; see PWS Section 9.

4.4.1 Network Ops Training and Outreach

Contractor personnel expertise under the Network Operations task will be utilized from time to time to assist in developing and presenting training along with participating in outreach activities in support of Marine Corps PKI initiatives for garrison and tactical networks. Training shall be in conformance to IA policy.

• Assist in developing and maintaining PKI Tactical Training Plans and training materials.

• Assist in configuring, operating, and maintaining the PKI Tactical training suite leveraging most current hypervisor technology thereby allowing resetting classroom virtual environment back to baseline configuration for servers and workstations for hands on training and ease of administration.

• Coordinate dates of training and onsite support with requesting MEFs, Marine Expeditionary Units, and Reserve Commands.

• Assist in presentation of PKI Tactical Training course to deploying Marines consisting of but not limited to:

- PKI 101

- CVI

- Cryptographic Logon

- PKI Administration and Troubleshooting

- Hands-on-lab

- Practical application and written testing

4.4.2 Certificate Authority (CA) Support

The contractor shall provide technical support for Microsoft Active Directory, DoD PKI, Unix and Windows software, Microsoft Active Directory Certificate Services (ADCS), Keyfactor EJBCA, Information Services

Corporation (ISC) CertAgent, Red Hat CA software certificate services, and other Certificate Authority Services

Technologies that may arise due to new technologies developed which the government may choose to implement in future years

4.4.2.1 Develop, plan, deploy, and configure new Certificate Authorities as directed by the Government in accordance DoD security standards and best practices, to include new versions and technology refresh.

4.4.2.2 Conduct infrastructure checks twice daily and create status report using SharePoint List for Government leadership.

4.4.2.3 Maintain the overall health of technologies associated with the CA infrastructure.

4.4.2.4 Monitor the health of CA infrastructure with MCCOG provided event management tools. Report any discrepancies to Government leadership and record using incident ticketing system.

4.4.2.5 Publish and issue Certificate Revocation Lists on a weekly basis from Root and Sub CAs.

4.4.2.6 Provide Tier III troubleshooting and support for incidents related to CAs and document resolution using incident ticketing system.

4.4.2.7 Implement and monitor CA thresholds and conduct proactive event remediation per Government guidance.

4.4.2.8 Develop (based on technology changes), test, and maintain CA Infrastructure disaster recovery plans using

SharePoint Document Library.

4.4.2.9 Develop (based on technology changes), test, and maintain CA Infrastructure COOP plans using SharePoint

Document Library.

4.4.2.10 Escalate issues to third party product vendors as required and track the progress of vendor support.

4.4.3 Certificate Validation Infrastructure (CVI) Support

The contractor shall provide CVI support for PKI, Windows Software, Axway Validation Authority Suite software to include but not limited to Online Certificate Status Protocol (OCSP), Desktop Validator, Enterprise Validation

Authority, and Compact CRLs, and Keyfactor EJBCA Validation Authority.

4.4.3.1 Configure and deploy new Certificate Validation (Responder/Repeater) software as needed or directed by

Government leadership.

4.4.3.2 Develop, deploy and maintain desktop validator configurations for use by all systems and applications residing on all USMC networks.

4.4.3.3 Conduct infrastructure checks twice daily and create status report using SharePoint List for Government leadership.

4.4.3.4 Maintain the overall health of technologies associated with the CVI.

4.4.3.5 Monitor the health of CVI with MCCOG provided event management tools. Report any discrepancies to

Government leadership and record using incident ticketing system.

4.4.3.6 Ensure validation information, downloaded from DISA, is current and accessible by CVI servers.

4.4.3.7 Provide complex troubleshooting and support elevated by the PKI Help Desk and MCEN Help Desk for incidents related to CVI and document resolution using incident ticketing system.

4.4.3.8 Configure and deploy new versions of CVI software as needed or when directed by Government leadership.

4.4.3.9 Develop (as required), test, and maintain CVI disaster recovery plans using SharePoint Document Library.

4.4.3.10 Develop (as required), test, and maintain CVI COOP plans using SharePoint Document Library.

4.4.3.11 Escalate issues to third party product vendors as required and track the progress of vendor support.

4.4.4 Hardware Security Module (HSM) Support

The contractor shall provide HSM support for SafeNet/Thales and nCipher hardware PKI key management.

4.4.4.1 Configure and deploy new HSMs as required or directed.

4.4.4.2 Maintain the overall health of the HSMs. Provide Tier III troubleshooting and support for incidents related to HSMs and document resolution using incident ticketing system.

4.4.4.3 Develop, test, and maintain HSM disaster recovery plans using SharePoint Document Library.

4.4.4.4 Escalate issues to third party product vendors as required and track the progress of vendor support.

4.4.5 Public Key Enabling Support

The contractor shall provide Public Key Enabling support to Marine organizations requiring Marine Corps

Enterprise PKI support/services.

4.4.5.1 Research and understand new technologies that require PK Enablement.

4.4.5.2 Coordinate PKI technical support, when required.

4.4.5.3 Recommend courses of action and document such recommendations for PK Enabling noncompliant systems. Note: POR/Application owners are responsible for Cryptographic Enablement.

4.4.6 Complex PKI Advanced Support

The contractor shall provide complex advanced troubleshooting support in accordance with the Information

Technology Infrastructure Library (ITIL).

4.4.6.1 Perform PKI Tier III troubleshooting on MCEN systems relating to PKI specific incidents to include but not limited to cryptographic logon, certificate validation, and domain controller certificates.

4.4.6.2 Participate and provide PKI subject matter expertise in resolving issues within all USMC Networks in collaboration with other MCEN service providers.

4.4.7 Configuration Management Support

The contractor shall provide Configuration Management of all PKI related middleware and applications supporting smartcard authentication and certificate validation.

4.4.7.1 Maintain and deploy Desktop Validator and Middleware Configurations supporting the MCEN using

SharePoint Document Library.

4.4.7.2 Maintain and deploy Server Validator Configurations supporting the MCEN using SharePoint Document

Library.

4.4.7.3 Maintain baseline configurations for all PKI software and enterprise hardware using SharePoint Document

Library.

4.4.7.4 Plan, develop, and test, new configurations for PKI software and hardware. Provide after action reports of test results and recommendations for site/region/enterprise implementation.

4.4.8 PKI System Infrastructure Support

The Contractor shall provide hardware and software technical support to operate, troubleshoot, and scale three separate forests with separate infrastructure and services. Each environment requires isolated access, patching, and security postures. The uptime of all PKI enterprise services is 99.97%, not including system maintenance as measured using Marine Corps Enterprise Monitoring Tools provided by MCCOG C2 Systems and Marine Corps

Enterprise Information Technology Services Management (E-ITSM/Remedy).

All patching and Information Assurance Vulnerability Alert compliancy shall be accomplished, with or without a patching solution, on all PKI Enterprise services in accordance with the Marine Corps Vulnerability Management

Policies and MCCOG VMT provided Assured Compliance Assessment System (ACAS). All security vulnerabilities shall be remediated and completed within the assigned deadline from subtask

The contractor shall perform Vulnerability Management in accordance with Marine Corps E-ITSM change management policies. For vulnerabilities that are technically unable to be remediated, PKI System Infrastructure

Tech will assist subtask 4.6.3 (Vulnerability Management) in creating a POA&M.

4.4.9 Virtual Infrastructure (VI) Support

The contractor shall configure all aspects of the VI in support of the PKI Enterprise Services on USMC operated networks. The contractor shall use VMware to deploy and maintain complex VMware environments to provide

Virtual Machine and Virtual Desktop services.

4.4.9.1 Maintain the overall health of technologies associated with the VI to include both Virtual Servers and Virtual

Desktop Environments

4.4.9.2 Implement monitoring tool thresholds and conduct proactive event remediation as directed by Government leadership.

4.4.9.3 Monitor the health of VI with MCCOG provided event management tools. Report any discrepancies to

Government leadership and record using incident ticketing system.

4.4.9.4 Provide complex troubleshooting and support for incidents related to VI and document resolution using incident ticketing system.

4.4.9.5 Configure and deploy new versions of VI as needed or when directed by Government leadership.

4.4.9.6 Develop (as required), test, and maintain VI disaster recovery plans using SharePoint Document Library.

4.4.9.7 Escalate issues to third party product vendors as required and track the progress of vendor support.

4.4.9.8 Leverage emerging VI technologies to support additional PKI implementation and support items.

4.4.10 Storage Area Network (SAN) Support

The contractor shall configure all aspects of the SAN hardware and software supporting PKI Enterprise Services.

The contractor shall use NetApp Storage devices to include snapshots, storage provisioning, management software, recovery procedures, hardware installation and security of Logical Unit Numbers (LUNS), and access to each to provide PKI SAN support.

4.4.10.1 Maintain the overall health of technologies associated with the SAN.

4.4.10.2 Implement monitoring tool thresholds and conduct proactive event remediation as directed by Government leadership.

4.4.10.3 Monitor the health of SAN with MCCOG provided event management tools. Report any discrepancies to

Government leadership and record using incident ticketing system.

4.4.10.4 Provide complex troubleshooting and support for incidents related to SAN and document resolution using incident ticketing system.

4.4.10.5 Configure and deploy new versions of SAN as needed under Government direction.

4.4.10.6 Develop (as required), test, and maintain SAN disaster recovery plans using SharePoint Document Library.

4.4.10.7 Escalate issues to third party product vendors as required and track the progress of vendor support.

4.4.11 Server Management Support

4.4.11.1 Maintain the overall health of technologies associated with the Server Management

4.4.11.2 Implement monitoring tool thresholds and conduct proactive event remediation as directed by Government leadership.

4.4.11.3 Monitor the health of Server Management with MCCOG provided event management tools. Report any discrepancies to Government leadership and record using incident ticketing system.

4.4.11.4 Provide complex support and troubleshooting for incidents related to Server Management and document resolution using incident ticketing system.

4.4.11.5 Configure and deploy new versions of Server Management as needed or when directed by Government leadership.

4.4.11.6 Develop (as required), test, and maintain Server Management disaster recovery plans using SharePoint

Document Library.

4.4.11.7 Escalate issues to third party product vendors as required and track the progress of vendor support.

4.4.12 Event Management Support

4.4.12.1 Resolve all PKI related Event Management tickets and provide an Event Management Status Report on weekly basis for all Event Management incidents (Attachment 1).

4.4.12.2 Submit and execute Event Management related Request for Change (RFC) tasks, when required, with approval of Government leadership.

4.4.12.3 Maintain the overall health of technologies associated with Event Management tools installed within PKI

Enterprise servers.

4.4.12.4 Coordinate and collaborate with other MCCOG sections on Event Management issues

4.4.12.5 Participate in and brief PKI Change Request tasks, related to event management, to the Change Review

Board.

4.4.12.6 Implement monitoring tool thresholds, analyze, and conduct proactive event remediation as needed.

4.4.13 PKI Application/Software Support

Marine Corps PKI utilizes multiple customized tools and scripts that provide streamlined business processes and technical monitoring for Marine Corps PKI Enterprise services. Requests for new tools and scripts, which support the Marine Corps PKI overall service to the user community, occur frequently. The contractor shall provide support via automation of manual processes through PowerShell or other scripting languages the contractor staff may be proficient.

4.4.13.1 Develop, test, and implement new script capabilities as directed.

4.4.13.2 Maintain, validate, and ensure compatibility of existing custom scripts.

4.5 Implementation and Planning

The contractor shall provide implementation and planning support in the development and writing of project plans and implementation documentation as required in support of Marine Corps PKI initiatives. This also includes updating existing specific PKI plans and procedures to comply with changing DoD PKI initiatives. The contractor shall assist in the development of plans for the employment and support of PKI tools in all Marine Corps network environments (including tactical ones) which provide PKI procedures for concept of operations (CONOPS) and plan of actions and milestones (POA&M) to ensure successful execution.

Existing Implementation and Planning personnel performing under this task will participate in the LRA audits (see

PWS 4.2.1).

4.5.1 Knowledge Management

The contractor shall provide Knowledge Management support using expertise in SharePoint Administration, Application Development, and Management in accordance with DoD PKI initiatives.

Marine Corps PKI manages and maintains an internal and external SharePoint site which provides internal collaboration and external customer support services. Internal support services include, but are not limited to, document libraries, task tracking, calendar, database, and list services. External customer support services include, but are not limited to, PKI Enabling documentation, Service Support/Informational Dashboard Software configurations, and downloads.

4.5.1.1 Create, maintain, and sustain document libraries and lists.

4.5.1.2 Create, maintain, and sustain views for libraries and lists.

4.5.1.3 Create, maintain, and sustain WebParts and other SharePoint services as necessary.

4.5.1.4 Create, maintain, and sustain templates for assisting PKI personnel with individual document libraries.

4.5.1.5 Create, maintain, and manage both internal and external facing SharePoint services.

4.5.1.6 Create and maintain Microsoft SharePoint List and Database in support of RA Operation requirements in tracking token and certificate lifecycle.

4.5.1.7 Create and manage of all RA SharePoint lists and databases in support of disaster recovery efforts.

4.5.1.8 Develop new enhancements to current SharePoint list database capabilities.

4.5.2 Program of Record (POR) PKE Waiver Review

The contractor shall provide implementation and planning support for reviewing USMC POR Application waiver forms for compliance/noncompliance with existing DoD PKI directives. Due to technical limitations, some systems are unable to implement PKI and therefore require a waiver form to justify non- compliance with PKI directives.

4.5.2.1 Review and submit waiver forms with recommendation for approval/disapproval to the USMC Designated

Accrediting Authority /Authorizing Official (AO)

4.5.2.2 Create, submit, and track Remedy trouble ticket for waiver requests

4.5.2.3 Track all waiver forms using SharePoint and notify the POR requestor of waiver status

4.5.2.4 Coordinate directly with the Marine Corps PKI Network Operations for technical guidance to verify requested waiver system is capable or incapable of PK enablement

4.5.2.5 Develop, maintain, and provide briefings to Government leadership depicting current status of waived systems/PORs

4.5.3 Purebred/Government Furnished Commercial Mobile Device (CMD) Support

The contractor shall provide Implementation and Planning support for updating and configuration of Purebred for

Government Furnished Commercial Mobile Devices (CMD) utilizing DoD derived credential solution which delivers credentials to the CMD for use with secure email and access to network resources requiring a DoD PKI credential.

The contractor shall provide the following PKI implementation planning support:

4.5.3.1 Enroll and Manage USMC Purebred Limited Registration Agents within the DISA Purebred Web

Application

4.5.3.2 Coordinate with other MCCOG sections for proper configuration of CMD Purebred Client Applications.

4.5.3.3 Provide complex Purebred troubleshooting of signing and encrypting emails.

4.5.3.4 Provide Purebred desktop manager support.

4.5.3.5 Establish and execute SOPs and training guides to ensure version control and adherence to sound configuration management practices for all documentation.

4.5.3.6 Submit/update/close all trouble tickets/incident tickets, and work orders.

4.5.4 Concept of Operations/Operational Directives/Advisories (OPDIR/OPAD) Development, Tracking, and

Reporting

The contractor shall:

4.5.4.1 Perform technical writing, analysis, and editing of all PKI CONOPS as required with Government guidance.

4.5.4.2 Develop, review, and release OPDIR/OPAD in accordance with Government guidance for release of operational requirements and advisories. Provide reporting guidance and/or templates as required.

4.5.5 USMC and DoD PKI Document/Meeting Review

The contractor shall support the following meetings as needed:

• DoD PKI Program Management Office (DoD PKI PMO) Program Information Exchange

(PIE)/Program Status Review (PSR) meeting

• DoD PKI Summits

• Identity Protection and Management Senior Coordinating Group (IPMSCG) meeting and meetings of

IPMSCG sub-groups

• Weekly Working Integrated Product Team and various conference calls

• CAC PIN Reset Users Group (CUG) meeting

• Remedy Queue Managers meeting

• DoD…