DRAFT - Performance Work Statement - Digital Forensics Services - FY27.docx

PERFORMANCE WORK STATEMENT (PWS)

1 BACKGROUND

The Naval Criminal Investigative Service (NCIS) is an organization of approximately 2,500 personnel of which 700 serve at HQ and the remaining staff serve at offices worldwide. NCIS is the Department of the Navy (DoN) component with primary responsibility for criminal investigation, law enforcement (LE), counter-terrorism (CT), counter-intelligence (CI), and cyber matters. NCIS not only has primary responsibility for all criminal investigative, CI, CT, and cyber matters within the DoN, but it also has exclusive investigative jurisdiction in non-combat matters involving actual, potential, or suspected criminal, terrorism, sabotage, espionage, and subversive activities. NCIS provides the DoN with threat status and warnings associated with terrorist, criminal, cyber, and counter-intelligence activity throughout the world. NCIS is the only DoN organization that has the information and responsibility to fuse and analyze the national intelligence and law enforcement information necessary to provide these warnings. Due toworldwide changes and increased threats to the DoN, NCIS must increase its overall capability to provide DoN Commanders with a timely and accurate common operational picture (COP) of security threats and vulnerabilities in and around existing naval facilities.

The NCIS Operational Technology & Cyber Innovation (OTCI) Directorate, hereafter referred to as the Cyber Directorate, supports and advances the agency’s mission of investigating and defeating criminal, terrorist, and foreign intelligence threats to the DoN – in the maritime domain, ashore, and in cyberspace. The Cyber Directorate within NCIS provides an agile, enterprise capability that supports the law enforcement/counter- intelligence mission and drives innovation in collaboration with mission partners, industry, and academia to out- maneuver and defeat threats to the Department of the Navy (DoN) in cyberspace. The strategic goals of the Cyber Directorate are threefold: (1) Operate a unified cyber capability across the DoN network enterprise in support of law enforcement and counter-intelligence activities and protect DoN personnel, assets and infrastructure from foreign intelligence, criminal and terrorist threats: (2) Conduct operations and investigations in the cyber domain and provide digital information and analysis of counter-intelligence or evidentiary value; and (3) Enhance shared cyber situational awareness and implement operational, intelligence, and information-sharing relationships with key cyber counterparts to enable active network defense.

Contractors are encouraged to review the NCIS Charter known as Secretary of the Navy Instruction (SECNAVINST) 5430.107A as it will provide insight into NCIS roles and responsibilities. Additional information on NCIS can be found at our public website http://www.ncis.navy.mil/ including a complete listing of NCIS locations.

2 SCOPE

This Performance Work Statement (PWS) for the Cyber Directorate describes the technical and operational support services required to meet their strategic goals noted above. This PWS identifies the requirements of the Government with respect to digital forensics examinations and allows for flexibility in the development and evolution of the Cyber Directorate’s initiatives. The PWS is not written to tell the Contractor how to provide support. In this way, the Contractor is given maximum opportunity to provide support as it sees fit, but in accordance with stated Department of Defense (DoD) and Department of Navy (DoN) mandates and/or other requirements to which the Contractor must adhere. NCIS desires that the Contractor bring a mission focus that continuously identifies new performance methods, processes, and procedures for applying information technology to improve NCIS’ mission performance, as well as recommendations and ideas for executing digital forensic investigations in a more cost- effective, efficient, but service-oriented fashion. The Contractor’s approach to the work should be innovative, comprehensive, and executed as an integrated team with the Government.

3 CYBER DIRECTORATE - DIGITAL FORENSICS INVESTIGATION SUPPORT TASKING

The Contractor shall designate a Program Manager. As the Program Manager, this individual will serve as the primary point of contact (POC) for the COR who will be responsible for ensuring timely execution of all task efforts; timely receipt of all contract deliverables by the Government; approval of Contractor travel; and resolution of any issues related to Contractor performance. Such resolution, as necessary, will be done in coordination with the Contracting Office.

The tasking identified below provides the range of technical and operational capabilities needed to support NCIS investigations and operations involving digital evidence. The current listing of NCIS Cyber Directorate’s applications and technologies can be found in Appendix C. In support of the NCIS Cyber Directorate and its mission, the Contractor shall:

1. Provide personnel who are fully trained and certified for their roles, flexible, willing to learn, able to adapt to changing stakeholder needs, and who follow NCIS Cyber established standards and operating procedures. See Appendix E, Personnel Qualifications.

2.

2. Provide monthly status report on past month’s accomplishments (CDRL A001).

3. Conduct complex and high-profile evaluations of target computer systems to determine operating and file systems, stored information, user and program logs, ownership and access methodology, as well as security features and usage (CDRL A002).

4. Provide detailed forensic examinations for NCIS cases when computers, mobile devices or other digital media are instruments of a crime, DoN computer networks are victims, or when computers or other digital media is used to store data of evidentiary or intelligence value (CDRL A003).

5. Document artifacts and deliverables according to standardized formats and approved templates created through collaboration with NCIS Cyber Divisions (CDRL A004).

6. Provide for support under this PWS in accordance with the Government’s Quality Assurance Surveillance Plan (QASP) – See Appendix A.

7. Execute cross-division collaboration such that best practices and standards are performed as needed and as required.

8. Follow NCIS Cyber organizational policies and procedures.

9. Document all support activity per NCIS policy.

10. Work collaboratively in a team environment to identify opportunities to provide forensic support via active engagement with NCIS customers, including case agents, investigators, and traial counsels.

11. Fully coordinate appropriate investigative/operational activity as delineated in NCIS policy.

12. When appropriate and/or directed, timely share relevant and actionable information with customer and partner LE/CI organizations in accordance with NCIS, DoN, and DoD guidelines, polices, and regulations.

13. When appropriate and/or directed, participate and maintain meaningful working relationships with DoN/DoD commands, NCISHQs, geographical field offices, and other Federal and local law enforcement organizations to further operational and investigative goals.

14. Provide recommendations for process and programmatic improvement areas to reduce cost and enhance digital forensics and network intrusion support services.

15. Liaison with NCIS agents and analysts in the field and at NCISHQ.

16. Handle and preserve all digital evidence in accordance with NCIS, DoN, and DOD guidelines, policies, and regulations.

17. Perform log analysis in support of NCIS investigations.

18. Conduct digital forensic examinations of data and electronic evidence from seized digital media.

19. Analyze computer network security settings, server, system, router, firewall, intrusion detection system (IDS) and intrusion prevention system (IPS) logs and packet capture data.

20.

21. Assist the NCIS Special Agent as a technical consultant, ensuring that the data is seized in compliance with digital forensic standards and in compliance with chain of custody guidelines.

22. As required, serve as a subject matter expert (SME) and testify in court proceedings regarding forensic procedures utilized to acquire evidence and the description of any evidence obtained.

23. Assist with the digital forensic caseload and keep current with emerging technologies, software, and, legal and policy changes related to digital evidence.

24. Test and assess new commercial and government-developed network-based investigative tools for reviewing and improving NCIS' current collection platforms.

25. Evaluate and implement new technologies to support the improvement and modernization of the NCIS criminal and intelligence capabilities with regard to the gathering digital evidence.

26. Provide digital forensic response surge support when required.

27. When tasked or requested by management, provide informal on-the-job training and guidance to new or less experienced cyber personnel during the execution of forensic examinations, and ensure sound investigative practices are utilized in accordance with NCIS guidelines, policies, and regulations.

28. Provide informal on-the-job local area training/familiarization of cyber forensic support to counterpart Geographic Field Offices.

29. Configure, install, and maintain Network Forensic Analysis Tools on locally configured networks.

30. Should be able to carry at least 50lbs of equipment/evidence to various locations, including up and down stairs and through tight spaces.

4 SECURITY /CERTIFICATION REQUIREMENTS

The Contractor shall be a United States Contractor, licensed, chartered, or incorporated in the United States. The Contractor shall perform this contract in accordance with the DoD Industrial Security Manual (DoD 5220.22M) and shall ensure that classified material is handled in accordance with the latest appropriate security classification specification. See DD Form 254 provided as Attachment IV.

The Contractor shall propose and deliver qualified personnel with relevant, recent and suitable experience as well as appropriate education levels, training credentials, and backgrounds as applicable and as indicated in Appendix E, Personnel Qualifications. The contractor may request a twelve month waiver for candidates to obtain the required qualifications. Contractor is authorized to attend government-provided forensics training with COR approval. Contractor shall provide, at contractor expense, each contract employee at least 40 hours of training per year on any of the applications listed in Appendix C.

All personnel must be eligible AND adjudicated to the Top Secret (TS)/Sensitive Compartmented Information (SCI) level at contract start. The Contractor shall submit adequate clearance packages within 10 calendar days of identification of increased security requirements.

Contractor employees performing work under this PWS shall comply with the requirements mandated by SECNAV M-5239.2 “Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual”. Any costs for the Contractor employees to maintain their commercial certifications shall be borne by the Contractor (or their employee(s)) and shall not be a chargeable cost of the contract. Any new staff members who require certification shall be 5239.2 compliant from the date of hire. Six month waivers may be approved by the COR on a case-by-case basis. See below the clause entitled “Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information” for further information.

5 PLACE OF PERFORMANCE/HOURS OF OPERATION

The primary place(s) of performance for this effort shall be at the following locations:

MARINE CORPS WEST FIELD OFFICE (2 individuals) 120101 De Luz Road Camp Pendleton, CA 92055

CAROLINAS FIELD OFFICE (1 individual) 1250-G Birch Street Camp Lejeune, NC 28547-1603

Camp Lejeune, NC 28547-1603 SOUTHEAST FIELD OFFICE (1 individual) PO Box 280076 Naval Station Mayport, FL 32228

NCISRA MIRAMAR (1 individual) 7208 Gonsalves Ave.

MCAS Miramar, CA 92145

While an on-site presence may not be required at all locations listed in Appendix D, Contractor personnel will be expected to travel to any of the locations listed to support NCIS Cyber investigations and operations as determined necessary by the COR.

Contractor personnel shall adhere to Government work hours and workdays. Normal hours of operation are 8:00 AM to 5:00 PM (local time), Monday through Friday, exclusive of Federal Holidays. The following federal holidays are observed:

New Years’ Day Martin Luther King, Jr. Day Presidents’ Day Memorial Day Juneteenth Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

There may be occasions when Contractor personnel will be required to work other than normal business hours, including holidays, to fulfill contract requirements. Overtime is not authorized.

6 TRAVEL

The Contractor may be required to perform temporary duty (TDY) non-local travel (both CONUS and OCONUS) in the performance of this contract. All travel will be provided in accordance with DoD Joint Travel Regulations. The Contractor shall submit all travel requests in writing to the Contracting Officer’s Representative (COR) for approval at least one week prior to the date that the required travel is scheduled to begin. Emergency (last minute) travel requirements shall also be coordinated as indicated above by telephone, email or fax, as necessary.

7 DELIVERABLES

All deliverables developed under this contract shall be delivered as indicated in Appendix B, Schedule of Deliverables.

The Contractor shall obtain, store, maintain and/or reproduce the required technical data and applicable documents, plans, regulations, specifications, and other pertinent data as appropriate for fulfilling the tasks described in this PWS. When appropriate procedures exist – which may be in the majority of instances – the Contractor shall acquire the above information directly; however, in instances where the data and/or procedures are to be created, the Contractor is expected to follow procedures once they are approved by the Government and made available. The Contractor shall obtain this data from both Government and non-Government sources.

The Contractor shall provide the Government or other agencies, as approved by the COR, access to any and all program information and data prepared or obtained as part of this contract or in support of any tasking of this PWS.

All information, records, data, files, documents, and work papers obtained or created in support of this PWS shall become and remain the property of the Government and shall be returned or disposed of in accordance with the COR’s instructions at the conclusion of this contract.

Section 508 of the Rehabilitation Act requires Federal agencies to make their electronic and information technology (EIT) accessible to people with disabilities. This applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology. All existing EIT and all EIT procured by NCIS during the term of this contract shall meet applicable accessibility standards specified in 36 CFR1194.2 unless an agency exception to the requirement exists.

8 GOVERNMENT FURNISHED RESOURCES

While Contractor employees are working in a Government facility, the Government shall supply workspace, desktop computers dedicated to unclassified and classified processing, one or more desktop computers with access to the NCIS local LAN and applicable shared drives or directories; NCIS email accounts; telephones with voice mail; and official use only access to the NIPRNET, SIPRNET, and JWICS networks if necessary. Any other requirements identified by the Contractor shall be requested in writing from the COR.

Contractor employees may require the intermittent use of government vehicles in support of NCIS Cyber Department Investigations and Operations. The use of government vehicles will only be authorized if:

1. Contractor personnel are tasked by the appropriate NCIS supervisor.

2. The use of a government vehicle is required for the transportation of seized forensic evidence.

3. The use of a government vehicle is required for the maintenance of the chain of custody for seized forensic evidence.

4.

Contractor employees must have a valid state driver’s license and passport and be authorized by the Contracting Officer’s Representative (COR) to use Government Services Administration (GSA) vehicles to accomplish the requirements of this contract as directed. No cost shall be incurred by Contractor personnel on this contract for the use of Government-furnished vehicles. The Contractor shall maintain automobile liability insurance written on the comprehensive form of the policy. The policy shall provide for bodily injury and property damage liability covering the operation of all automobiles used in connection with performing the contract including Government provided vehicles. Policies covering automobiles operated in the United States shall provide coverage of at least $200,000 per person and $500,000 per occurrence for bodily injury and $20,000 per occurrence for property damage.

9.0 CONTRACTOR FURNISHED RESOURCES

The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform the technical and operational support defined in this Performance Work Statement except for those items specified as government furnished resources. Specifically, the contractor will provide each digital forensic examiner with a mobile phone and cellular service that can be used in furtherance of the duties specified in the contract.

10 DEPARTMENT of DEFENSE HEALTH PROTECTION CONDITION (HPCON) GUIDANCE

Contractor personnel will adhere to the Department of Defense Health Protection Condition (HPCON) guidance as implemented by the NCIS office being supported.

APPENDIX A QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

Critical to the performance of the digital forensics investigation support services is the timely, accurate and thorough completion of all contract requirements. To ensure that the Government has an effective and systematic method of surveillance for the services listed in the PWS, the following QASP will be used as a tool to verify that the contractor is performing all services required by the PWS in a timely, accurate and complete fashion.

Performance Standards:

a. Schedule - The due dates for deliverables and the actual accomplishment of the schedule will be assessed against original due dates and milestones established for the contract.

b. Deliverables – The deliverables required to be submitted will be assessed against the specifications for the deliverables detailed in the contract for the required content, quality, timeliness, and accuracy.

c. Past Performance - In addition to any schedule and deliverable aspects of performance discussed above, pursuant to FAR 42.15, the Government will assess the contractor’s record of conforming to contract requirements and to standards of good workmanship, the contractor’s adherence to contract schedules including the administrative aspects of performance, the contractor’s history of reasonable and cooperative behavior and commitment to customer satisfaction, and the contractor’s business-like concern for the interest of the customer.

Surveillance methods: The primary methods of surveillance used to monitor performance of this contract will include, but not be limited to, random or planned sampling, periodic inspection, and validated customer complaints.

Performance Measurement: Performance will be measured in accordance with the following table:

Performance Element

Performance Requirement

Surveillance Method

Frequency

Acceptable Quality Level

rating in the COR’s annual report on Contractor Performance

If performance is within acceptable levels, it will be considered to be satisfactory. If not, overall performance may be considered unsatisfactory.

Incentives/Disincentives:

The COR makes an annual report on Contractor Performance (CPARS or other annual report). The contractor’s failure to achieve satisfactory performance under the contract, reflected in the COR’s annual report, may result in termination of the contract and may also result in the loss of future Government contracts. The contractor’s failure to achieve satisfactory performance under the contract may result in the non-exercise of available options.

For each item that does not meet acceptable levels, the Government may issue a Contract Discrepancy Report (CDR). CDRs will be forwarded to the Contracting Officer with a copy sent to the contractor. The contractor must reply in writing within 5 days of receipt identifying how future occurrences of the problem will be prevented. Based upon the contractor’s past performance and plan to solve the problem, the Contracting Officer will determine if any further action will be taken.

In accordance with the inspection of services provisions of the contract, the contractor will be incentivized to provide quality products in a timely manner since the Government can require the Contractor, at no additional cost, to replace or correct work that fails to meet contract requirements.

APPENDIX B—SCHEDULE OF DELIVERABLES

Government and Contractor Close of Business 10th calendar day of each month for the preceding month COR; AD, DADs

Functional Area

established processes ASACs, SSAs, SA, SDFE, Forensics Division Chief

Functional Area

established processes ASACs, SSAs, SA, SDFE, Forensics Division Chief

Functional Area

established processes ASACs, SSAs, SA, SDFE, Forensics Division Chief

APPENDIX C—CYBER DIRECTORATE APPLICATIONS AND TECHNOLOGIES

The Government will maintain versions of these applications and technologies to within two releases of the most current version at all times. Not all tools will be individually assigned to each contractor. Some applications are shared among several forensic examiners.

APPENDIX D—NCIS FIELD OFFICES

NCIS Headquarters Russell Knox Building 27130 Telegraph Road Quantico, VA 22134

MIDDLE EAST FIELD OFFICE

Manama, BAHRAIN PSC 451, Box 32

FPO, AE 09834

CAROLINAS FIELD OFFICE

H-32 Julian C. Smith Blvd. Camp Lejeune, NC 28542

NORFOLK FIELD OFFICE

1329 Bellinger Blvd.

Norfolk, VA 23511

CENTRAL FIELD OFFICE

305 Bronson Avenue Bldg 2B Suite 100 Great Lakes, IL 60088

NORTHEAST FIELD OFFICE

344 Meyerkord Avenue Naval Education and Training Center Newport, RI 02841

EUROPE FIELD OFFICE

Naples, ITALY PSC 817, Box 36

FPO, AE 09622

NORTHWEST FIELD OFFICE

Land Title Professional Bldg. Suite L-20 9657 Levin Road, NW Silverdale, WA 98383

FAR EAST FIELD OFFICE

Yokosuka, JAPAN PSC 473, Box 76

FPO, AE 96349

SOUTHWEST FIELD OFFICE Box 368130 3405 Welles Street, Suite 1 San Diego, CA 92136

HAWAII FIELD OFFICE

449 South Avenue Pearl Harbor, HI 96860 SOUTHEAST FIELD OFFICE PO Box 280076 Naval Station Mayport, FL 32228

MARINE CORPS WEST FIELD OFFICE Bldg. 1224, Box 555238 Camp Pendleton, CA 92055

SINGAPORE FIELD OFFICE

PSA Sembawang Wharves Deptford Road Building 7-4 Singapore 759657

WASHINGTON FIELD OFFICE

Building 168 Joint Base Anacostia-Bolling Anacostia Annex, DC 20373

APPENDIX E PERSONNEL QUALIFICATIONS

QUALIFICATIONS

Computer Specialist – Digital forensics Examiner

· Minimum of a bachelor's degree in a computer science-related field or five year of equivalent work experience.

· Minimum of five years digital forensics experience using Cellebrite UFED4PC/Physical Analyzer. Proficiency with Cellebrite, Axiom, Graykey and/or OS Forensics.

· Expertise with various computer operating systems to include Windows, Linux/Unix, and Macintosh OS.

· Expertise with a variety of computer hardware to include servers, workstations, desktops, laptops, networking equipment, tablets and cellphones.

· Full understanding of proper forensic data collection procedures, chain of custody, and documentation procedures in a law enforcement environment.

· Required certifications:

· DCITA DoD Digital Forensic Examiner or FBI Computer Analysis Response Team (CART) certification

· SANS FOR 500 and SANS FOR 585

· Cellebrite CCO and CCPA

· Strong documentation skills.

· Ability to testify as an expert witness in judicial proceedings.

· Proficient in information security, information assurance, information technology, and cyber defense best practices and principles

This position requires the person(s) to be eligible AND adjudicated to clearance level at contract start.