Draft Final -Performance Work Statement (PWS) - FY27.docx

PERFORMANCE WORK STATEMENT (PWS)

1 BACKGROUND

The Naval Criminal Investigative Service (NCIS) is an organization of approximately 2,500 personnel of which 700 serve at HQ and the remaining staff serve at offices worldwide. NCIS is the Department of the Navy (DoN) component with primary responsibility for criminal investigation, law enforcement (LE), counter-terrorism (CT), counter-intelligence (CI), and cyber matters. NCIS not only has primary responsibility for all criminal investigative, CI, CT, and cyber matters within the DoN, but it also has exclusive investigative jurisdiction in non-combat matters involving actual, potential, or suspected criminal, terrorism, sabotage, espionage, and subversive activities. NCIS provides the DoN with threat status and warnings associated with terrorist, criminal, cyber, and counter-intelligence activity throughout the world. NCIS is the only DoN organization that has the information and responsibility to fuse and analyze the national intelligence and law enforcement information necessary to provide these warnings. Due to worldwide changes and increased threats to the DoN, NCIS must increase its overall capability to provide DoN Commanders with a timely and accurate common operational picture (COP) of security threats and vulnerabilities in and around existing naval facilities.

The NCIS Cyber Directorate supports and advances the agency’s mission of investigating and defeating criminal, terrorist, and foreign intelligence threats to the DoN – in the maritime domain, ashore, and in cyberspace. The Cyber Directorate within NCIS provides an agile, enterprise capability that supports the law enforcement/counter-intelligence mission and drives innovation in collaboration with mission partners, industry, and academia to out-maneuver and defeat threats to the Department of the Navy (DoN) in cyberspace. The strategic goals of the Cyber Directorate are threefold: (1) Operate a unified cyber capability across the DoN network enterprise in support of law enforcement and counter-intelligence activities and protect DoN personnel, assets and infrastructure from foreign intelligence, criminal and terrorist threats; (2) Conduct operations and investigations in the cyber domain and provide digital information and analysis of counter-intelligence or evidentiary value; and (3) Enhance shared cyber situational awareness and implement operational, intelligence, and information-sharing relationships with key cyber counterparts to enable active network defense.

2 SCOPE

This Performance Work Statement (PWS) for the Cyber Directorate describes the support services required by the Naval Criminal Investigative Service (NCIS) to meet their strategic goals noted above. This PWS identifies the tasking requirements of the Government and allows for flexibility in the development and evolution of the Cyber Directorate’s initiatives. The PWS is not written to tell the Contractor how to provide support. In this way, the Contractor is given maximum opportunity to provide support as it sees fit, but in accordance with stated Department of Defense (DoD) and Department of Navy (DoN) mandates and/or other requirements to which the Contractor must adhere. NCIS desires that the Contractor bring a mission focus that continuously identifies new performance methods, processes, and procedures for applying information technology to improve NCIS’ mission performance, as well as recommendations and ideas for executing its mission in a more cost-effective, efficient, but service-oriented fashion. The Contractor’s approach to the work should be innovative, comprehensive, and executed as an integrated team with the Government.

3 CYBER DIRECTORATE CORE FUNCTIONAL AREA REQUIREMENTS AND OUTCOMES

The tasking efforts identified in this PWS provide the range of technical and operational capabilities that are required to support the NCIS Cyber Directorate’s (NCIS Cyber) ability to use digital information to identify and counter threats to DoN critical assets, personnel, operations, computer networks, and information. The Contractor shall maintain and develop new capabilities for NCIS Cyber's data aggregation and analysis system. In addition, the Contractor will identify and assess new capabilities for collecting, analyzing, and exploiting digital data. The system shall be improved to incorporate additional data types and the user interface shall be continuously improved to automatically correlate data from new sources. High priority information shall be identified and highlighted to users. The system shall make use of artificial intelligence/machine learning (AI/ML) capabilities to automatically identify events of interest, reduce the learning curve for new users and reduce the mental strain on all users through data summarization and natural language capabilities.

The system shall also serve as the backbone for NCIS Cyber's data centralization project. The system shall enable NCIS and community analysts and agents to leverage NCIS Cyber's digital information to enhance their investigative and operational capabilities. In executing this PWS, the Contractor shall adhere to the following global set of requirements that apply to each functional areas identified in this PWS. The Contractor shall:

1. Provide personnel that are trained for their roles, flexible, willing to learn, able to adapt to changing stakeholder needs, and follow NCIS Cyber established standards and operating procedures.

2. Execute cross-division collaboration such that best practices and standards are performed as needed and as required.

3. Maintain patch/update cycle, centrally manage operating system (OS) builds, and follow configuration management (CM) guidelines as provided by the Government throughout development, testing, deployment, and production. NCIS follows industry standards for Capability Maturity Model Integration [CMMI] with specific Standard Operating Procedures (SOPs) for NCIS implementation.

4. Follow NCIS Cyber organizational policies and procedures (e.g., Software Development Life Cycle [SDLC], CMMI) and participate in configuration and change management control initiatives.

5. Document artifacts and deliverables according to standardized formats and approved templates created through collaboration with NCIS Cyber Program Management Division and Cyber Capabilities & Integration Division (Code 20A and Code 20C).

6. Provide recommendations for process and programmatic improvement areas to reduce cost and enhance IT services.

7. Provide support for custom classified system, which is based on a proprietary configuration, to include development and implementation of custom features such as AI/ML capabilities, to meet customer requirements, management of core features (i.e., data post-processing, version control, and data ingest), integrate new datasets with existing data collection feeds, manage the processing of daily data loads, maintain backend database and supporting middleware, manage storage and respond to system faults, maintain persistent virtual machines (VMs) and VM pool.

3.1 CYBER DIRECTORATE CONTRACTOR PROGRAM AND TASK MANAGEMENT

The technical and management efforts in this contract shall be conducted under the direction and coordination of a Program Manager (PM). The PM shall meet the requirements for this labor category as stated in Appendix D – Position Descriptions and Personnel Qualifications. While the primary focus for the Contractor will be daily operations and maintenance activities, the Contractor will be expected to improve the data aggregation and analysis system as noted earlier. Consequently, a key requirement for the PM is to maintain a staffing plan that provides adequate depth of primary and secondary resources such that continuity can be ensured in the event of turnover.

3.1.1 Cyber Directorate Contractor Program and Task Management Requirements

Requirements for the Contractor Program and Task Management function include:

1. Provide overall, on-site, day-to-day management of the program and its inherent tasks; costs; personnel; planning; and quality control necessary to ensure effective contract performance.

1. Ensure Contractor personnel accessing information systems meet the applicable training and certification requirements.

1. Manage and execute the tasks for the Government as appropriate and as required.

1. Follow policies and processes established in conjunction with NCIS Cyber.

1. Routinely conduct in-depth reviews to identify progress, risks, and other issues that impact the success of contract performance.

1. Provide status reports and other deliverables as described in Appendix B, Schedule of Deliverables.

1. Develop, coordinate, and brief program goals and other program aspects, as determined by the Government, in Monthly Interim Progress Reviews (IPRs)(CDRL A002).

1. Brief project plans to senior NCIS leaders, as required.

1. Ensure Contractor’s services and products adhere to standards of quality prescribed by NCIS and Cyber Directorate.

1. Routinely identify and execute, where approved by the Government, recommendations that are innovative ideas for process efficiencies that facilitate better service delivery.

1. Provide input to the Government for any disaster recovery/incident after action report, as required.

1. Provide monthly status report on past month’s accomplishments (CDRL A001).

3.1.2 Cyber Directorate Contractor Program and Task Management Outcomes

Outcomes for the Contractor Program and Task Management function include:

1. Staffing levels are maintained with appropriate skill sets such that services are effectively delivered.

2. Production and on-time delivery of all required deliverables identified herein are achieved.

3. Costs are monitored and controlled ensuring that the Government is receiving best value for services rendered.

4. All tasks are completed on time and within budget, and will have had appropriate and significant participation from the Contractor.

5. All tasks are executed in compliance with the Cyber Directorate Portfolio Management/Project Management processes.

6. Risks are identified and mitigated; negative impacts from realized risks and other issues are minimized.

7. Strengths and weaknesses in the Program and Task Management functional area are identified and addressed, as appropriate.

8. Underlying gaps in performance drivers will have been diagnosed.

9. Performance improvements will have been prescribed.

3.2 CYBER DIRECTORATE APPLICATIONS AND SOFTWARE: ENGINEERING, DATA AGGREGATION AND ANALYSIS, DEVELOPMENT, INTEGRATION, AND MAINTENANCE SUPPORT

To provide best value to the Government, software efforts must be done in such a way that they ensure NCIS is meeting mission needs while reducing maintenance requirements. NCIS Cyber requires that software efforts be based on sound engineering principles and practices such that they improve run-time production and support to NCIS Cyber’s user base; however, in engineering the way forward, the vendor must take into account aspects of the infrastructure that are mandated by the DoN and/or the DoD.

The Contractor shall be responsible for performing development activities that meet customer requirements by including stakeholders through joint application development efforts such as user acceptance testing or requirements elicitation meetings. By performing in this way, NCIS Cyber can be assured that requirements and use cases are gathered and can be traced throughout the Software Development Life Cycle (SDLC). The listing of the NCIS Cyber Directorate’s current software applications and technologies can be found in Appendix C, Cyber Directorate Applications and Technologies.

This functional area provides much needed capabilities in support of NCIS’ and NCIS Cyber’s missions. Analytic resources are often used to liaise with end users and engineers to create documents. The Contractor will be accountable for proper descriptive documentation submitted through NCIS Cyber’s Configuration Management (CM) process. These documents include, but are not necessarily limited to the following categories:

· Requirements documentation

· Test plans, procedures, associated test data, and results

· Operations and support manuals

· Maintenance and diagnostic manuals with illustrated parts breakdowns

· Programmer’s manuals.

Software and application monitoring and maintenance are required to ensure that NCIS mission support is available as needed. The Contractor will measure and audit application performance using a variety of existing and potentially new capabilities to ensure the identification of relevant system utilization and data accuracy metrics. These metrics should be used to improve Contractor performance.

3.2.1 Cyber Directorate Applications and Software: Engineering, Data Aggregation and Analysis, Development, Integration, and Maintenance Support Requirements

Requirements for the Applications and Software: Analysis, Engineering, Data Aggregation and Analysis, Development, Integration, and Maintenance Support functions include:

1. Ensure key software components are developed and delivered in support of the SDLC, and that critical Quality Assurance (QA) measures are adopted and implemented.

2. Recommend, implement and leverage processes, policies, and procedures in support of SDLC practices across the NCIS Cyber Divisions.

3. Meet mission requirements while reducing maintenance complexities based on sound engineering principles and practices.

4. Develop a technical architecture that is fully integrated with the developing NCIS Cyber systems architecture and is compliant with Department of Defense Architecture Framework (DODAF) and DoN EAs.

5. Develop technical roadmaps and architectures that incorporate NCIS Cyber strategic direction and ensure compliance with DoD, DoN, and NCIS Cyber.

6. Build-in metrics and metadata to capture system statistics that ensure quality application performance (e.g., user loads, usage, outages, data processed) and move to consolidate application system resources whenever possible.

7. Ensure that cross-division collaboration is executed in a way that best practices and standards are honored.

8. Perform reviews of existing systems and make recommendations for application systems and components that can be modernized, combined, and retired.

9. Align all software development with the NCIS and NCIS Cyber missions, and produce traceability between functionality and business requirements. Liaise with stakeholders and deliver mission-specific functionality for acceptance by the user community.

10. Establish formal peer reviews, design, and code reviews such that standards are met and software and hardware systems operate more efficiently.

11. Adheres to the standards defined by the Government.

12. Develop and update training material, user guides, and Frequently Asked Questions (FAQs)(CDRL A006).

13. Use automated and manual testing tools and techniques (e.g., regression, load, end-to-end, etc.) to ensure software quality.

14. Produce Test Plans, Test Cases, Test Reports, and Requirements Traceability Matrices (CDRL A004).

15. Ensure roles and responsibilities are delineated for development, testing, and production efforts.

16. Document artifacts and deliverables according to standardized formats and templates created through collaboration with NCIS Cyber Divisions and its CM processes.

17. Follow formal methodologies and best practices from industry, other government agencies (OGAs) and the military for integration and deployment of software.

18. Develop assessments of existing technologies and their usage and usability.

19. Analyze community technologies and their applicability to NCIS mission requirements.

20. Investigate and make recommendations for changes that enhance, consolidate, or eliminate applications.

21. Follow CM processes and ensure CM version control is implemented and consistently maintained in accordance with NCIS Cyber’s policies and procedures.

22. Resolve infrastructure-related issues when deploying new technologies.

23. Proactively monitor applications and establish automated processes for notifications and restarts.

24. Troubleshoot and correct bugs in a timely fashion, using an engineering review process.

25. Routinely utilize metrics to develop appropriate solutions to root causes of problems encountered.

26. Perform application Security Technical Implementation Guidelines (STIGs), patches, and updates, as needed and as required.

27. Ensure that hardware and software inventory and assets are properly documented.

28. Formally document technical roadmaps and architectures (CDRL A003).

29. Modernize, migrate to alternative capabilities, or retire existing application systems and/or components.

30. Establish roadmaps for future architectures that comply with DoN and DoD architectures.

31. Update the architecture to accommodate new end-user needs whenever required to meet changing mission requirements.

32. Identify and manage risks proactively.

33. Deliver applications with usability in mind; with manuals and guides; and in such a way that the need for formalized training activities for developers and end users are minimized (CDRL A005).

34. Develop, maintain, and monitor the necessary artifacts for C&A package submission to receive Authority to Test (ATT), Interim Authority to Operate (IATO), and ATO certifications (CDRL A008).

35. Evaluate computer systems and architectures, to map and assess the effectiveness of access control methodologies, data stores, file systems, log management, operating systems, and security features.

36. Monitor, maintain, and update hardware and software. Install hardware and software solutions to better support Cyber operations and investigations.

3.2.2 Cyber Directorate Applications and Software: Engineering, Data Aggregation and Analysis, Development, Integration, and Maintenance Support Outcomes

Outcomes for the Applications and Software: Engineering, Data Aggregation and Analysis, Development, Integration, and Maintenance Support functions include:

1. Software maintenance efforts and costs are reduced while NCIS and NCIS Cyber mission requirements are achieved.

2. Applications and software components are as bug-free and defect-free as possible; this is evidenced by improved availability, quality, and usability as reported by users.

3. Requirements and use cases are traceable throughout the SDLC—design, develop, stage, and test.

4. Performance with respect to response times is base-lined, measured, and monitored to achieve documented performance improvements.

5. STIGs are followed, and patches and updates are applied routinely with minimal user downtime.

6. Documentation is maintained according to standards as improvements or upgrades occur.

7. Resolutions to defects and enhancements to improve overall capabilities of applications have been designed, developed and implemented.

8. Strengths and weaknesses in system architecture are identified and addressed, as appropriate.

9. Risks are proactively identified and managed.

10. Underlying gaps in performance drivers will have been diagnosed.

11. Performance improvements will have been prescribed.

3.3 CYBER DIRECTORATE DATA MANAGEMENT

As NCIS structured and unstructured data continues to grow, management of this “big data” becomes paramount. NCIS databases and specific geospatial data, including standard and authoritative data repositories, should be managed in such a way that users and user administrators are provided consistent access to all of these repositories. The goal would be to enable access to accurate and relevant data in a timely fashion.

3.3.1 Cyber Directorate Data Management Requirements

Requirements for the Data Management function include:

1. Ensure NCIS Cyber leverages authoritative data sources and consolidate repositories using Government-approved metadata.

2. Ensure compliance with DoD, DoN, Personally Identifiable Information (PII), System of Record Notices (SORNs), and Freedom of Information Act (FOIA) mandates.

3. Manage and document data and/or metadata and provenance and/or pedigree to improve accuracy, integrity and non-repudiation to accomplish mission goals while meeting standards.

4. Establish data inventories using diagrams (e.g., data relationship models), schemas, and data dictionaries.

5. Ensure data warehousing, where appropriate, and proper use of authoritative data for reporting statistical, operational, and analytic information.

6. Improve the security of Data at Rest in all structured and unstructured data repositories.

7. Develop standard practices for Extract, Transform and Load (ETL) processes.

8. Utilize tools and capabilities to document traceability and non-repudiation of all data sources.

9. Document, standardize, manage, and utilize publications of diagrams (e.g., data flow, entity relationship (ER), and database), process models, schemas, and data dictionaries (CDRL A007).

10. Manage data such that “big data” analytic capabilities are provided to users, as well as specific and accurate query and reporting capabilities.

11. Adopt and adhere to data standards based on DoD, Department of Justice (DOJ), Intelligence Community (IC) and other relevant federal polices throughout engineering and integration processes.

12. Document in manuals and routinely use scripts, DDL, Entity Relationship (ER) and other diagrams, Extensible Markup Language (XML) schemas, and procedures associated with same (CDRL A007).

3.3.2 Cyber Directorate Data Management Outcomes

Outcomes for the Data Management function include:

1. Data accuracy and integrity are improved and non-repudiation of data is realized.

2. Encryption of Data at Rest is implemented using DoD standard security requirements.

3. Metadata and metrics reporting to identify data flow issues are utilized, data growth and capacity planning requirements are executed, and information-sharing components are implemented.

4. Data and metadata provenance and pedigree to improve accuracy, integrity and non-repudiation to accomplish mission goals and to meet standards are managed and documented.

5. Security of Data at Rest in all structured and unstructured data repositories is improved.

6. Strengths and weaknesses in Data Management functional area are identified and addressed as appropriate.

7. Underlying drivers of performance gaps will have been diagnosed.

8. Prescribed actions to improve performance will have utilized lessons learned.

4 SECURITY REQUIREMENTS/CERTIFICATIONS

The Contractor shall be a United States Contractor, licensed, chartered, or incorporated in the United States. The Contractor shall perform this contract in accordance with the DoD Industrial Security Manual (DoD 5220.22M) and shall ensure that classified material is handled in accordance with the latest appropriate security classification specification. See DD Form 254 provided as Attachment I.

The Contractor shall propose and deliver qualified personnel with relevant, recent and suitable experience as well as appropriate education levels, training credentials, and backgrounds as applicable and as indicated in Appendix D, Position Descriptions and Personnel Qualifications. All personnel must be eligible AND adjudicated to the Top Secret (TS)/Sensitive Compartmented Information (SCI) level at contract start. The Contractor shall submit adequate clearance packages within 10 calendar days of identification of increased security requirements.

Contractor employees performing work under this PWS shall comply with the requirements mandated by SECNAV M-5239.2 “Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual”. Any costs for the Contractor employees to maintain their commercial certifications shall be borne by the Contractor (or their employee(s)) and shall not be a chargeable cost of the contract. Any new staff members who require certification shall be 5239.2 compliant from the date of hire. Six-month waivers may be approved by the COR on a case-by-case basis. See the clause in entitled “Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information” for further information.

Contractor is authorized to attend relevant, government-provided training with COR approval. For the following positions, contractor shall provide, at contractor expense, at least 40 hours of training per year on a technology directly related to the contractor’s work responsibilities:

· Application Administration

· Linux Systems Administration

· Network Administration

· DevOps

· Cyber Threat Hunting

· Machine Learning/Artificial Intelligence

· ArcGIS

· Network Accreditation.

5 PLACE OF PERFORMANCE/HOURS OF OPERATION

The primary places of performance for this effort shall be:

NCIS Headquarters Russell Knox Building 27130 Telegraph Road Quantico, VA 22134

The Contractor’s Program Manager shall be based in the Washington, DC metro area with their primary place of performance being at NCIS Headquarters in Quantico, VA.

Contractor personnel shall adhere to Government work hours and workdays. Normal hours of operation are 8:00 AM to 5:00 PM (local time), Monday through Friday, exclusive of Federal Holidays. The following federal holidays are observed:

New Years’ Day Martin Luther King, Jr. Day Inauguration Day Washington’s Birthday Memorial Day Juneteenth National Independence Day Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

There may be occasions when Contractor personnel will be required to work other than normal business hours, including holidays, to full contract requirements. Overtime is not authorized.

6 TRAVEL AND OTHER DIRECT COSTS (ODCS)

The Contractor may be required to perform local and temporary duty (TDY) non-local travel (both CONUS and OCONUS) in the performance of this contract. All travel will be provided in accordance with DoD Joint Travel Regulations. The Contractor shall submit all travel requests in writing to the Contracting Officer’s Representative (COR) for approval at least one week prior to the date that the required travel is scheduled to begin. With the approval of the COR, contractors are authorized to use government vehicles to support contract requirements in accordance with 41 CFR 101-38.301-1. Emergency (last minute) travel requirements shall also be coordinated as indicated above by telephone or email as necessary.

The Contractor shall provide limited procurement of commercial off-the-shelf (COTS) hardware and software items in support of ongoing tasks within the scope of this Performance Work Statement (PWS). The Contractor shall bill purchases back to the Government as Other Direct Costs (ODCs) in a fully itemized fashion and provide original copies of all documentation.

All incidental hardware and software purchased by the Contractor in support of this contract shall be purchased only upon written approval of the COR prior to procurement and be considered the sole property of the Government.

Federal contracting laws and regulations apply to all Contractor open market purchases of hardware and software under this contract. Prices must be determined fair and reasonable from three competitive sources and are subject to Government audit. The Contractor shall maintain records documenting competitive sourcing, in strict compliance with the competition requirements set forth in the Federal Acquisition Regulation (FAR), for all material and ODC purchases. The Contractor shall provide such documentation upon request from the Government to verify that the Contractor complied with the competition requirements set forth in the FAR.

Section 508 of the Rehabilitation Act requires Federal agencies to make their electronic and information technology accessible to people with disabilities. This applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology. All electronic and information technology (EIT) procured through this contract must meet the applicable accessibility standards specified in 36CFR1194.2, unless an agency exception to this requirement exists.

7 DELIVERABLES

All deliverables developed under this contract shall be delivered as indicated in Appendix B, Schedule of Deliverables.

The Contractor shall obtain, store, maintain and/or reproduce the required technical data and applicable documents, plans, regulations, specifications, and other pertinent data as appropriate for fulfilling the tasks described in this PWS. When appropriate procedures exist – which may be in the majority of instances – the Contractor shall acquire the above information directly; however, in instances where the data and/or procedures are to be created, the Contractor is expected to follow procedures once they are approved by the Government and made available. The Contractor shall obtain the data from both Government and non-Government sources.

The Contractor may build unique software, such as COTS custom interfaces, information bridges, integration software, scripts, etc. Any Contractor-developed software or data created under this contract becomes Government-owned and may not be reused without the explicit permission of NCIS.

The Contractor shall provide the Government or other agencies, as approved by the COR, access to any and all program information and data prepared or obtained as part of this contract or in support of any tasking of this PWS.

All information, records, data, files, documents, and work papers obtained or created in support of this PWS shall become and remain the property of the Government and shall be returned or disposed of in accordance with the COR’s instructions at the conclusion of this contract.

8 GOVERNMENT FURNISHED RESOURCES

When Contractor staff are working in a Government facility, the Government shall supply workspace, desktop computers dedicated to unclassified and classified processing, one or more desktop computers with access to the NCIS local LAN and applicable shared drives or directories; NCIS email accounts; telephones with voice mail; and official use only access to the NIPRNET, SIPRNET, and JWICS (if required). Any other requirements identified by the Contractor shall be requested in writing from the COR.

9 CONTRACTOR FURNISHED RESOURCES

The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform the technical and operational support defined in this Performance Work Statement except for those items specified as government furnished resources.

APPENDIX A QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

Critical to the performance of the support services detailed in the PWS is the timely, accurate and thorough completion of all contract requirements. To ensure that the Government has an effective and systematic method of surveillance for the services listed in the PWS, the following QASP will be used as a tool to verify that the contractor is performing all services required by the PWS in a timely, accurate and complete fashion.

Performance Standards

a. Schedule - The due dates for deliverables and the actual accomplishment of the schedule will be assessed against original due dates and milestones established for the contract.

b. Deliverables – The deliverables required to be submitted will be assessed against the specifications for the deliverables detailed in the contract for the required content, quality, timeliness, and accuracy.

c. Cost - The COR will review monthly cost vouchers to monitor the contractor’s expenditures throughout the contract performance period(s). Also, the COR will analyze the impact on cost of any inaccurate management assertions, acceleration of the due dates for the financial reports, or the lack of personnel.

d. Past Performance - In addition to any schedule, deliverables, and cost aspects of performance discussed above, pursuant to FAR 42.15, the Government will assess the contractor’s record of conforming to contract requirements and to standards of good workmanship, the contractor’s record of forecasting and controlling costs, the contractor’s adherence to contract schedules including the administrative aspects of performance, the contractor’s history of reasonable and cooperative behavior and commitment to customer satisfaction, and the contractor’s business-like concern for the interest of the customer.

Surveillance methods: The primary methods of surveillance used to monitor performance of this contract will include, but not be limited to, random or planned sampling, periodic or inspection, and validated customer complaints.

Performance Measurement: Performance will be measured in accordance with the following table:

If performance is within acceptable levels, it will be considered to be satisfactory. If not, overall performance may be considered unsatisfactory.

Incentives/Disincentives:

The COR makes an annual report on Contractor Performance (CPARS or other annual report). The contractor’s failure to achieve satisfactory performance under the contract, reflected in the COR’s annual report, may result in termination of the contract and may also result in the loss of future Government contracts. The contractor’s failure to achieve satisfactory performance under the contract may result in the non-exercise of available options.

For each item that does not meet acceptable levels, the Government may issue a Contract Discrepancy Report (CDR). CDRs will be forwarded to the Contracting Officer with a copy sent to the contractor. The contractor must reply in writing within 5 days of receipt identifying how future occurrences of the problem will be prevented. Based upon the contractor’s past performance and plan to solve the problem, the Contracting Officer will determine if any further action will be taken.

In accordance with inspection of services provisions of the contract, the contractor will be incentivized to provide quality products in a timely manner since the Government can require the Contractor, at no additional fee, to replace or correct work that fails to meet contract requirements. To maximize the profit earned on costs incurred, the contractor is incentivized to ensure that quality products are provided in a timely manner.

APPENDIX B—SCHEDULE OF DELIVERABLES

APPENDIX C—CYBER DIRECTORATE APPLICATIONS AND TECHNOLOGIES

The Government is required to maintain versions of these applications and technologies to within two releases of the most current version at all times.

APPENDIX D—POSITION DESCRIPTIONS AND PERSONNEL QUALIFICATIONS

1. Program Manager:

Description: Overall manager for the contractor effort who will serve as the Contractor's authorized point of contact with the Contracting Officer Representative, and is responsible for managing scope, budget, schedule and performance. Provides direction, prioritization, coordination, and conflict resolution. Senior-level program manager with a demonstrated ability to lead and manage a multi-disciplinary team of technical and technical support staff for Government customers in the information technology domain. Provides support for engagement coordination duties such as maintaining time reports; generating and reconciling invoices; preparing burn reports, cost estimates, contract modifications, project schedules, and other deliverables as needed and as required. Serves as a member of various task management teams and applies a comprehensive and in-depth working knowledge of financial/business concepts and contract management practices. In addition to managing the contract, provides direct technical and/or cyber analytical support to the customer.

Qualifications: Master’s degree in any technology related field. Minimum of five (5) years of intensive and progressive experience working in IT or engineering industries. Demonstrated ability managing at least ten (10) or more IT professionals in diverse locations and with duties commensurate to those defined in this PWS. Greater than one year managing complex organizations of which he/she had total responsibility for the financial success of the organizational unit. Demonstrated project and risk management skills including ability to manage multiple priorities, resources, customers, and managers with a focus on consistency and accuracy. PM must have working knowledge of Federal acquisition laws, regulations, policies and procedures. Demonstrated ability to oversee programmer development of new capabilities and oversee maintenance of existing capabilities. Excellent written and spoken communication skills are required, as well as the ability to work with all levels of management. Proficient in the use of MS Office tools (i.e., Word, Excel, Project, PowerPoint, Visio). Position requires Certified Information Systems Security Professional (CISSP) certification. This position requires the person(s) to be eligible and adjudicated to Top Secret (TS/SCI) clearance level at contract start.

2. Project Control Analyst (PCA):

Description: Supports the Contractor Program Manager (PM) for contract accounting and reporting, tracking and analyzing annual fiscal plans and monthly updates, maintaining staffing updates, maintenance and reporting, procurement/purchasing; initiates purchases, via generation of purchase requisitions, of equipment and supplies, tracking through procurement process and approval of vendor payments once contractual requirements are met.

Maintains contract budgets and tracks execution to available funds; responsible for 75% tracking and notification.

Provides input to the Contractor PM for monthly activity reports, prepares monthly contract billing and provides all required backup information, provides cost and pricing estimates on existing efforts, for labor, materials, equipment, production costs and delivery schedules.

Qualifications: Bachelor's degree in accounting, business, finance, or a related discipline and five (5) to seven (7) years of related project support or management experience. Experience using Microsoft Office and one (1) or more accounting systems. This position does not require a clearance.

3. Software Developer:

Description: This position will be responsible for developing and analyzing software in support of NCIS Cyber Directorate data collection and processing requirements. This position will work as part of a team to deliver fully functional tools to NCIS agents and analysts and train those customers on the use and maintenance of the technical solution. This position will also be responsible for reviewing, analyzing and modifying program code (to include malicious software) and other technical work. Responsibilities include program design, modeling, simulation, coding, testing, debugging, documentation, and close collaboration with system administrators. Formulates and defines specifications for new applications and maintains existing applications by incorporating new feature requests and keeping dependencies up to date. Responsibilities may include applications dealing with the operating system, such as sophisticated file maintenance routines and advanced mathematical/scientific software packages. In addition, the position may require conducting complex and high-profile, non-destructive evaluations of target computer systems in support of cyber operations, and may be called upon to provide briefings and expert advice on solutions and findings. This position is expected to apply industry best practices to all development efforts and make recommendations for improvements. Some AI related Software Developer positions will support the development and deployment of artificial intelligence/machine learning (AI/ML) capabilities. Some AI related Software Development positions will also be responsible for evaluating commercial and government software applications to support NCIS mission requirements.

Required Qualifications:

Preferred Qualifications:

4. Linux Systems Administrator:

Description: Monitors and controls one or more mid-range application Linux servers. Maintain, update, and secure existing Linux systems and build new systems to government-provided specifications in support of Cyber investigations and operations. The systems administrator will also be responsible for ensuring that networked Linux systems perform optimally with minimal downtime to effectively support the mission. They may also be asked for creative contributions to improve existing processes in support of various initiatives in areas related to their area of expertise. Monitors systems operations and confers with software systems engineering or applications programming personnel to develop appropriate solutions, and to implement them. Ensures that configurations/builds are compliant with applicable Security Technical Implementation Guides (STIGs), patching, updating, and log monitoring. Supports and/or develops Risk Management Framework (RMF) artifacts and documentation to support RMF accreditation. May perform key RMF submission and approval roles.

Qualifications: Minimum of five (5) years of increasingly complex and progressive experience in operating and supporting computer systems in a Red Hat Enterprise Linux environment (Red Hat Enterprise Linux 6.X, 7.X or 8.X) with a strong command-line interface (CLI) skillset. Experience securing Linux systems, including conducting regular patches and updates and configuring iptables. Experience remotely administering Linux systems both in the datacenter and in forward-deployed locations. Experience troubleshooting Linux systems in a networked environment. Familiarity with at least one common scripting language such as Python, Perl, bash, etc. Experience in maintaining build process for deployable systems. Experience in conducting routine security processes such as ensuring that configurations/builds are compliant with applicable Security Technical Implementation Guides (STIGs), patching, updating, and log monitoring. Troubleshoot Linux system faults, including networking-related issues. Integrate new capabilities into existing processes. Experience with configuration management services such as Ansible and Puppet. Position requires minimum of CompTIA Linux+, Red Hat Certified Systems Administrator (RHCSA) or Linux Foundation Certified Systems Administrator (LFCS). This position requires the person(s) to be eligible and adjudicated to Top Secret (TS/SCI) clearance level at contract start.

5. DevOps Engineer/Linux Systems Administrator:

Description: Design, develop, and implement software integrations based on user feedback. Implement and design CI/CD pipelines in an on-premise GitLab environment. Develop and maintain a Kubernetes cluster for production, development and test clusters utilizing existing clusters, or designing new ones. Collaborate with team members to improve the organization's engineering tools, systems and procedures, and data security. Utilize and develop change management functions utilizing Ansible. Develop and troubleshoot code deployment functionality in coordination with software developers. Provide input and assist with the containerization of existing software solutions. Develop and maintain design and troubleshooting documentation.

Qualifications: Minimum of three (3) years of increasingly complex and progressive experience in operating and supporting computer systems in a Red Hat Enterprise Linux environment (Red Hat Enterprise Linux 6.X, 7.X, or 8.X) with a strong command-line interface (CLI) skillset. Experience utilizing Git as a source control system. Experience securing Linux systems, including conducting regular patches and updates and configuring iptables. Experience remotely administering Linux systems both in the datacenter and in forward-deployed locations. Experience troubleshooting Linux systems in a networked environment. Experience developing and maintaining Kubernetes clusters. Familiarity with at least one common scripting language such as Python, Perl, bash, etc. Experience in maintaining build process for deployable systems. Experience in conducting routine security processes such as ensuring that configurations/builds are compliant with applicable Security Technical Implementation Guides (STIGs), patching, updating, and log monitoring. Troubleshoot Linux system faults, including networking-related issues.Integrate new capabilities into existing processes. Experience with configuration management services such as Ansible and Puppet. This position requires the person(s) to be eligible and adjudicated to Top Secret (TS/SCI) clearance level at contract start.

6. Cyber Intel Analyst:

Description: The Cyber Intel Analyst will perform intelligence analysis and production tasks using intelligence reporting, open source data, and information derived from a custom, classified system which is based on a proprietary configuration to support of investigations, operations, and intelligence production. Responsible for collecting, reviewing, interpreting, evaluating, and integrating information from multiple sources to assess the relevance and significance of developments in assigned area(s) and preparing complex intelligence products including briefings, summaries, reports, studies, assessments, and estimates.

Qualifications: The person(s) must be eligible and adjudicated to Top Secret (TS/SCI) at contract start.