Draft--SOW.doc

Statement of Work

1.1 BACKGROUND

1.1.1 Current DEA Operating Environment

The mission of the Drug Enforcement Administration (DEA) is to enforce the controlled substances laws and regulations and to bring to the criminal and civil justice systems those organizations involved in the growing, manufacture, or distribution of controlled substances appearing in or destined for illicit traffic in the United States. In order to meet this mission, the use of Federal Information Processing (FIP) resources is critical. The Information Technology (IT) services provided by the Office of Special Intelligence (NS) include planning, designing, developing, documenting, and maintaining DEA’s mission critical and business applications and their supporting infrastructure.

The DEA has several agency-wide Local Area Network (LAN) and Wide Area Network (WAN) environments for classified and unclassified information. Firebird, the core LAN/WAN, provides a desktop environment from which users access network resources. It is a wholly contained network environment, with no interfaces or connections to non-DEA resources (i.e. the Internet, or other agency LAN/WANs).

1.1.2 Future DEA Operating Environment

The future Classified Network LAN infrastructure includes plans to restructure the IP architecture and replace existing narrow band COMSEC equipment with state of the art Type I encryption devices. The classified network infrastructure will also be upgraded to support the ever growing bandwidth needs of the systems that utilize it. These systems may require Voice over IP (VoIP), video conferencing and other multimedia data.

1.2 Software Development Tools

The Classified Network requires minimal software development. The Operational Support and Systems Administration duties are supported by Visual Basic Scripting and Perl Scripting. Certain customized tools for management of the systems may require Visual Basic for Applications to customize Microsoft Office Applications. The majority of the tasks can be completed with the vendor supplied tools for management and monitoring.

1.3 Classified Network Project Background

The Drug Enforcement Administration (DEA) operates a classified network that provides the approved and accredited infrastructure for worldwide secure internetworking and office automation support to the entire DEA. Mission critical systems which utilize this infrastructure include the DEA classified intelligence network and application system, called Merlin; the internal organizational messaging system, called M2K; and the automated messaging handling system, called CAPS. These systems operate at classification levels up to SECRET. The systems and data are protected with the tightest security and all operations are conducted in a secure environment.

The classified network makes use of commercial off the shelf (COTS) hardware and software, and utilizes industry standards for internetworking. Whenever possible, the classified network utilizes the same hardware and software as the much larger, DEA Sensitive but Unclassified (SBU) network, called Firebird. All classified data transmissions are encrypted by a National Security Agency (NSA) Type 1 encryption device before tunneling over the same lines and circuitry provided by the Firebird network.

The operational support and systems administration functions of the classified network are handled by the Classified Network Support Team, whose duties are outlined in this Statement of Work (SOW). Additionally, the Team supports the Office of Security Programs (ISI) in the oversight and technical direction of the communications security (COMSEC) equipment used on the classified network.

Classified network hardware is installed at DEA Headquarters (HQ), Division Offices, field offices, large Foreign Offices (F.O.’s) and the Alternate Network Control Center (ANCC) in Rockville, Maryland. At HQ, classified workstations are located in secured office areas and connect to the Ethernet Local Area Network (LAN) via network switches in the HQ classified communications closets. Outside HQ, classified workstations are located in a secure Crypto Room with the classified server and communications equipment.

The Classified Network Wide Area Network (WAN) encompasses over 180 geographically separate DEA or Law Enforcement sites. One third of these sites are located in Foreign Offices that require occasional after hours support. The Support Team must provide operational support and systems administration of the networking gear at all these locations. Additionally, the Team must provide operational support and systems administration to the Merlin system at these locations. Merlin is a Windows-based intelligence application and collaboration system.

The Support Team must also provide operational support for DEA message processing. The Office of Special Intelligence (NS) Technical Support Section (NST) is responsible for receiving, transmitting, and archiving classified and unclassified organizational messages. This secure messaging process includes the support for Defense Messaging Systems (DMS), AUTODIN, GESCAN Automated Message Handling Systems (AMHS), and several proprietary internal messaging routing systems. Additionally, the Team must provide some operational support to the M2K system, which is a Microsoft Windows and Exchange system.

The hardware, software and protocols used on the classified network are listed below.

Hardware

· Cisco routers and switches

· Category 5E LAN cables

· Fiber optic cabling with ST, SC and LC type connectors

· Taclane Type 1 175A, B and D; KIV-19 and KG-84/194 encryption devices (C2, NSA certified)

· Media converters and transceivers

· Server hardware Software

· Windows 2000/XP

· Exchange 2000/2003

· Microsoft Office

· Cisco IOS

· Peregrine Service Center

· General Encryption Manager

· Perl

· VBScript

· Network monitoring software (e.g.: Snort)

Protocols

· TCP/IP

· Ethernet

· UDP

· SDD

· ESP

· SMTP

· SNMP

The Classified Network Support Team must work closely with other entities responsible for the management of systems that use the network. The day-today operational support and systems administration of the Merlin, M2K and AMHS systems are supported by other contracts and contractors. Additionally, the Firebird network, which provides the backbone Frame Relay network, is also supported by another contract. It is essential that the Support Team work well with all parties.

1.4 Project Tasks

Support hours are between 7:00 a.m. and 7:00 P.m. Emergency support after these hours may be required.

The Contractor shall perform the tasks described in the following subparagraphs. A table summarizing the tasks is provided in Table 2-1.

Table 0‑1

Project Management Plan (PMP) And Work Breakdown Structure And Schedules (WBS&S)

· Follow DEA guidelines for PMP, WBS and Schedules

· Systems Administration

· Switch and Router Management

· Management of Network Security Environment

· Engineering Systems Analysis

· Support of New Installations

· Alternate Site Support

· Basic problem diagnosis

· Tracking of problems and resolution including escalation

· COMSEC Facilities Site Survey

· COMSEC Engineering and Analysis

The Contractor agrees to provide access to all pertinent records and data requested by DEA Contracting Officer’s Technical Representative (COTR).

1.4.1 Network Systems Administration

1.4.1.1 Encryption device management

The management of encryption devices consists generally of the following duties:

· Perform weekly backups of the Taclane Network Encryption System

· Verify operational status of all Taclane remote sites on a daily basis

· Verify operational status (ping) of all Merlin remote servers on a daily basis except those whose encryptor (Taclane) is down or have circuit outages

· Troubleshoot down sites and document fixes and site history in email or Service Center Database. Provide the following services as necessary to return sites to operation:

· Transmit new and up-to-date configuration files to all sites when a significant number of new sites are activated or on a monthly basis

· Instruct site point of contact (POC) when rebooting encryptor is required

· Removal and storage of all encryption devices audit events files

· Instruct users and provide guidance to replace expired electronic key

· Provide daily status of each remote site’s encryptor condition to COTR and staff in a weekly report

· Provide Reason For Outage (RFO) for sites that are reported back in operation

· Provide written steps and procedures to users to locally troubleshoot encryptor problems via Firebird email and ad hoc support over the phone

· Document trouble shooting steps taken and need for encryptor shipment to replace a malfunctioning encryptor in the field via Firebird email to the COTR.

· Provide technical support for installation and configuration of new encryptor

· Ensure that down time for crypto gear supporting certain mission critical sites is less than four hours

1.4.1.2 Systems Administration

Network systems administration duties generally consist of the following:

· Proactive network monitoring on an hourly basis with timely reporting of outages

· Provide IP addresses to DEA Classified Network users as required via secure means

· Windows 2003/XP Systems Domain Administration of multi-domain environment including the following:

· User account and password management

· Event log monitoring

· Replication management

· Network performance monitoring

1.4.1.3 Router and Switch Management

Management of routers and switches will generally consist of the following duties:

· Physically observing or telnet via the Classified Network to view each LAN switch to insure normal operations

· Coordinating with network switch vendors to ensure that the most current operating system software/firmware is loaded on a semi-annual basis and report in monthly Classified Network Status report

· Create a Network Improvement Recommendations document at the beginning of each fiscal year. This document will include information gathered in the sub-tasks below:

· Document and recommend upgrades to the network to improve efficiency and customer satisfaction as required when performance indicators demonstrate

· Recommend training to improve network administration or use

· Conduct market research of enhancements or replacements, including costs

· Provide technical support on conversion from the AUTODIN mail traffic to the Multifunction Secure Gateway (MSG) service system.

· Provide technical support and advice for expanding network or for crisis/critical operations

· Daily security monitoring of all switches and routers

· Provide technical support to the AMHS/DEA-CAPS message handling systems

· Coordination with other systems (e.g.: Merlin, M2K)Administrators

· Maintenance and planning of HQ Classified infrastructure cabling

· Installation and configuration of new routing and switching gear

· Ensure downtime for certain critical equipment is no longer than 4 hours

1.4.1.4 Management of Network Security Environment

Management of the network security environment will generally consist of the following duties:

· Security incident response and reporting according to established DEA policies

· Security Assessment, Certification and Accreditation (C&A) - based on NSA and the National Information Assurance Certification and Accreditation Process (NIACAP) criteria. DEA will provide these criteria upon request. In support of this, the contractor shall:

· Use DEA Office of Information Security (IS) testing software, if available

· Create a Security Testing and Recommendations document each fiscal year to include the follow sub-tasks:

· Document test results and vulnerabilities and recommend improvements

· Conduct and document testing to ensure the desired improvements were achieved

· Update network documentation to reflect changes and maintain all C&A documentation

· Be responsible for advising DEA on the actions required for ensuring that the Classified Network passes the IS C&A testing of Merlin, M2K, and of the Classified Network itself

· Advise DEA of resources required to meet certification requirements. C&A’s are performed at least once every three years and follow the NIACAP guidelines

· Documentation of the above deliverables to be made available to the COTR and Information Systems Security (ISI) representative

1.4.1.5 Engineering Analysis

The contractor shall conduct and document an engineering analysis of the Classified Network topology. Based on the assessment the contractor shall:

· Recommend hardware, software, telecommunication or process changes to improve the efficiency and effectiveness of the network

· Implement DEA- approved recommendations

1.4.1.6 Support of New Installations

Support of new installations will generally consist of the following duties:

· Request and assignment of network addresses

· Set up of Taclane products configurations and network connectivity

· Providing configuration files and documentation to installation personnel

· Working with installation teams to ensure site is operational

1.4.1.7 Future Alternate Site Support

Support of an alternate site will consist of the following duties:

· Maintenance of switching and routing equipment

· Ensuring network link availability

· Performance of regular fail-over testing

· Maintenance of the Continuity of Operations Plan (COOP). This task consists of the following:

· The contractor shall advise DEA on the actions required for ensuring continuity of Classified Network operations. This includes:

· Backing up encryption devices, files, and system software both locally and to the Alternate Site

· Ensuring the constant and uninterrupted flow of Message traffic

· The Classified Network Continuity of Operations (COOP) documents the current processes. The contractor shall visit the alternate site four (4) times per year to ensure the facilities are compliant with the COOP. The contractor shall assist the Government in scheduling and conducting testing that shall include shifting the Communication guard from the Headquarters to the ANCC. The contractor shall document this procedure as follows:

· Testing and then providing lessons learned within 30 days of the test completion

· The contractor shall update the COOP to reflect changes implemented under this SOW

· Coordinate with network project teams (i.e., Merlin and M2K) to insure individual COOP plans are compatible

1.4.2 Problem Management and End-User Support

1.4.2.1 Merlin Tier II Support

The contractor shall provide Merlin Tier II support. The DEA Help Desk provides Tier I support, while the Merlin team provides Tier III services. In support of this task, the contractor shall perform the following duties:

· Work closely with the DEA Help Desk and the Merlin Project team to provide Level II support for Merlin user trouble calls

· Resolve issues or refer the trouble ticket to the appropriate responsible authority (i.e., Merlin Tier III and Information Security)

· The DEA Trouble Ticket System (Peregrine Service Center) will be used to update, close, or transfer a ticket so as to maintain appropriate tracking and coordination of all trouble calls. The majority of the calls received are for connectivity issues and locked passwords

1.4.2.2 Basic Problem Diagnosis

The contractor shall be responsible for basic network problem diagnosis. These duties consist of the following:

· Quickly identifying problem areas on the network and notifying affected parties

· Resolving issues and providing DEA with reason for outage (RFO)

· Escalating problems as necessary to responsible parties

1.4.2.3 Problem Management

The contractor shall be responsible for Problem Management. These duties consist of the following:

· Hourly monitoring of the Service Center application

· Proper documentation and annotation of problem tickets

· Proper escalation and re-assignment of problems

· Reporting of problem ticket data as part of regular status reporting

· Handle between 100-150 problem tickets per month

1.4.3 Security Programs Support

1.4.3.1 Support COMSEC Inventory and Accountability

The contractor may be required to assist in the management of the COMSEC Accounts. These duties consist of the following:

· Performing information security or physical security compliance inspections.

· Tracking, monitoring, and delivery of data for technical COMSEC information ranging from type and amount of COMSEC accountable material received, prepared, and shipped

· Track shipped hardware

· Providing technical advice and assistance to the DEA end users of secure voice and data devices

· Assistance in the installation, maintenance; shipping, relocation and troubleshooting of COMSEC secure voice and data equipment

· Audit briefing

· Ensuring all advice and assistance is in compliance with the NSA, Department of Justice (DOJ) and the DEA guidelines and directives

1.4.3.2 COMSEC Facilities Site Survey

The contractor may be required to assist in COMSEC facilities site surveys. These duties consist of the following:

· Performing DEA site surveys to ensure suitability of proposed sites/offices that will house a cryptographic facility in accordance with (IAW) the National Security Agency Manual (NSAM) 90-2 and other applicable documents

· Providing a written report in the approved DEA format, within 5 working days, from the completion of the survey

· Providing any facility improvement recommendations in this report and upon approval, they shall assist in the implementation of any adopted changes

1.4.3.3 COMSEC Engineering and Analysis

The contractor shall be required to assist in COMSEC Engineering and Analysis. These duties consist of the following. The contractor shall create a COMSEC Technology Recommendation Report. This report will contain data collected from the following tasks:

· Providing technical support for data encryption equipment, such as Taclane product KIV-7/19 and KG-84.

· Maintaining a close liaison with security personnel in government and industry to maintain cognizance of state-of-the art COMSEC technology

· As requested by the COTR, the contractor may attend security briefings and seminars that are directly related to this task or the development of future supporting tasks

· Assisting in the training of COMSEC custodians and Alternate COMSEC custodians in all aspects of their functions

· This also would require providing assistance to DEA users of COMSEC equipment and systems utilizing logical troubleshooting methods in restoring user equipment to proper operation

· Performs security audit database maintenance and specialized user account management functions

1.4.4 Provide Activity/Progress Status Reports

The Contractor shall submit Activity Reports weekly and Progress Status Reports monthly to the COTR. These reports must be technically and grammatically correct. Activity and progress reports shall reflect:

· Personnel

· Hours worked and actual start/finish dates

· Description of tasks and/or work efforts

· Labor rates and total dollars expended

· Work performed in the reporting period

· Problems encountered (if applicable)

· Milestones achieved or deliverables submitted

· Work scheduled for the next reporting period

· Test results (where applicable)

· Comments

· Funding status

· Monthly progress status reports shall be accompanied by an updated project work schedule The Monthly Activity Report shall also reflect the results of regular product reviews and formal product inspections as well as summaries of alternating weekly status review meetings.

The Contractor’s monthly status report shall incorporate metrics sufficient in scope to permit an objective assessment of Contractor performance relative to work accomplished, and schedules.

SECTION 2 operator personnel 2.1 Background

The Office of Special Intelligence (NS) operates the Drug Enforcement Administration (DEA) Headquarters (HQS) Communications Center (Comm. Center) in DEA HQS, located at 600 Army Navy Drive in Arlington, Virginia. The Comm. Center is currently staffed 16/5 and DEA is seeking contractual support for this staffing. The Comm. Center operates Monday to Friday 6 a.m. to 10 p.m. and closed on weekends and holidays.

2.2 Objectives

The objective is to staff the Comm. Center with two shifts and a total of three contractors as Comm. Center Operators, 16/5, to supplement the Federal Telecommunications Operations Staff. The three contractors shall work an 8.5 hour shift, Monday – Friday between the hours of 6 a.m. to 10 p.m.

The Comm. Center Operators are responsible for administering the receipt and transmission, passing and readdresses of all DEA message traffic. The Operators are responsible for troubleshooting system or technical problems and correcting or coordinating the correction of the problems. The Operators must respond to service requests, to include classified or unclassified message processing, sending and receiving secure and non-secure facsimiles, and customer service issues received via phone or directly from HQS customers.

2.3 Technical Scope

The Comm. Center supports classified message transmission, profiling and archiving within DEA and between DEA and external entities for approximately 800 plus users. DEA-CAPS provide these users with access to DEA organizational messages via standard queries or profiles from a Merlin workstation located in their offices.

The volume of messages is approximately 160,000 per year. Classified and unclassified messages are also received at DEA HQS from a hardcopy and a softcopy on floppy disks that are distributed to specific addressees.

DEA-CAPS provide authorized DEA personnel real-time access to DEA organizational and other agencies messages. DEA-CAPS stores all messages exchanged between the Pentagon, Department of State, Open Source Center (OSC), DEA Mercury (M2K) classified emails and the DEA Communication Center up to the SECRET level. The Operators must become proficient utilizing DEA-CAPS, the Multi-functional Secure Gateway (MSG), the Firebird Message Center (MCenter), and the upcoming MCenter replacement system. The Comm. Center Operators are responsible for the transmission of messages from DEA-CAPS via the MSG in additional to resolving anomalies. The MSG is connected to the DEA-CAPS System via network share. This connection is for the purpose of sending and receiving both incoming and outgoing messages from overseas and other government entities via the Autodin network. The Comm. Center Operators are also responsible for the transmission of messages from the Firebird Message Center.

2.4 Duties and Responsibilities

The definitions of the duties and responsibilities of Comm. Center personnel in relation to the operation and maintenance of the Comm. Center listed in this section. It is not an all-inclusive list of responsibilities. Sound judgment and professionalism must also serve as guidelines for all assigned personnel. Personnel should be flexible and assume additional responsibilities as the need arises.

1. Advises the Shift Supervisor or Task Monitor of any information that requires attention. This includes but is not limited to systems not functioning properly, printers not working, fax machines not working, accounts not working, passwords not working.

2. Serves as the primary liaison/contact point for DEA officials, DEA users and other government agencies.

3. Adheres to security policies issued by the National Security Agency and appropriate DEA authorities.

4. Establishes and maintains detailed documentation on all significant problems that have affected or may affect the successful receipt or transmission of message traffic.

5. Ensures that a proper shift change is conducted, including informing the oncoming Shift Supervisor/Operator of the current operational status of the Comm. Center. Maintains the Shift Supervisor’s daily report of circuit outages and back logs.

6. Assumes the duties of the Shift Supervisor when the Shift Supervisor is absent.

7. Perform System Administrator and Database Administration duties as required to resolve problems. Administers the receipt, re-addresses, retransmissions and transmission of all DEA message traffic through the Comm. Center. Monitors incoming and outgoing message operations.

8. Insures messages are properly classified as per requestor prior to message transmission.

9. Fax messages as required.

10. Shall provide operations, maintenance and user support to all DEA offices via the core systems, KG equipment, DEA-CAPS, Mercury 2000 (M2K), Firebird Message Center (MCenter), the Multi-Functional Secure Gateway (MSG’s) and related circuits by monitoring and troubleshooting problems to ensure they are operational.

11. Must correct switching problems between various interface systems.

12. Must identify and fix Plain Language Address problems on the MSG or contact the System Administrator to resolve the problems.

13. Shall provide the Task Monitor with statistics on work load, messages transmitted/received, processed, or statistics on overall duties when requested.

14. Advises users in domestic and foreign offices of corrective measures to be taken to resolve message traffic deficiencies. Provide advice and instruction to Headquarters, Foreign offices, Domestic Offices and Resident offices pertaining to the composition, transmission, receipt and delivery of messages.

15. Determines the system or technical problems and corrects or coordinates the correction of the problems with the DEA-CAPS staff, Task monitor or Shift Supervisor.

16. Resolves hardware and software problems and then provides detailed analyses and recommended solutions for weaknesses or problems in the system.

17. Shall write procedures for all undocumented tasks. Maintain the Standard Operating Procedures (SOP) by keeping it updated with corrections and new procedures. Shall submit to the Task monitor all changes and new documents prior to implementation.

18. Ensures that an adequate stock of supplies is maintained in the Comm. Center.

19. Employees may be expected to stay beyond their scheduled working hours if the oncoming shift is late, calls in sick or has not been relieved. The employee shall not leave until he/she is properly relieved.

20. Employees shall lock up all classified materials (documents, disks, cd’s) prior to closing the Comm. Center.

21. Alerts the Shift Supervisor or Task Monitor immediately of any unavoidable scheduling problems.

22. Employees shall to arrive for their shift on time.

23. Employees shall follow the Comm. Center policy and not bring cell phones, laptops and recording devices into the Comm. Center.

24. Employees shall clean his/her work area prior to the end of the shift.

25. Employees shall coordinate with the Shift Supervisor or Task monitor when leaving the Comm. Center.

26. Employees shall coordinate breaks and lunch with the Shift Supervisor or Task monitor. If two Operators are working during lunch hours, both shall not leave at the same time without approval from the Task Monitor.

27. The Comm. Center hours of operation are Monday – Friday, 10:00 p.m. to 6:00 a.m., and closed all day on weekends and holidays. The staff will be required to open/close the Comm. Center properly (i.e., securing classified data, turning on/off specific equipment, disabling/enabling printers), completing the open/close checklists opening or securing the room. The staff will receive ADT alarm and Security training by a DEA Security employee.

2.5

DUTY LOCATION

1. The primary duty location for the support engineer assigned to this task is the Washington DC National Capitol Region (NCR). The National Capital Region is defined to include the DEA headquarters (HQ) and the Sterling, Virginia office. This position may be permanently moved to Sterling Virginia in 2008 or later. There may be occasions when the duty location is temporarily altered to support exercise, contingency, or maintenance requirements at other DEA locations.

2. Travel associated with this contract will be addressed at a later date or in a separate contract vehicle. This proposal does not include travel.

3. Services will be provided 16/5, 8.5 hours per shift, 3 shifts per day Monday – Friday 6:00 a.m. to 10:00 p.m. and closing weekends and on holidays. The shifts assignments will be defined by the DEA as required for coverage.

4. The Government shall provide a work area, access to a telephone, access to a computer, and network access, suitable for the tasks to be accomplished, for the contractor.

5. The contractor will undergo security screening, must be granted a DEA security clearance and DEA access as a condition of employment.

6. If the government determines that the performance of the contracted Operator assigned is unsatisfactory or in need of improvement, the contractor will take immediate action to correct the problem.

7. The contractor will be required to work within the Communication Center or DEA facility without Government supervision.

2.6 Deliverables

The following deliverables must be delivered.

1. Provide Monthly Status Report and budgetary standing last Wednesday of each month.

2. Provide the timesheets with the monthly invoicing.

3. There will be occasions when the operators are required to provide the task monitor with statistics on work load, messages transmitted/received, processed, or statistics on overall duties.

Classified Network Statement of Work DEA Sensitive Date: 1/20/2004

2-6