Draft PKI Support Services PWS.pdf

PERFORMANCE WORK STATEMENT

Public Key Infrastructure (PKI) Support Services

Marine Corps Cyberspace Operations Group 2025-2030

Version: 20241024_Draft

Table of Contents

1. SCOPE

APPLICABLE DOCUMENTS

GENERAL REQUIREMENTS

TASKS/SPECIFIC REQUIREMENTS

5. KEY PERSONNEL

6. SECURITY CONSIDERATIONS

7. CYBER SECURITY

8. OTHER DIRECT COSTS (ODC) (TRAINING/ TRAVEL/ MATERIALS/ HOLA/ COLA)

9. GOVERNMENT‐FURNISHED PROPERTY, FACILITIES, EQUIPMENT, INFORMATION (GFP, GFF, GFE, GFI)

10. PERFORMANCE REQUIREMENTS SUMMARY (PRS)

APPENDIX A…

1. SCOPE

This Performance Work Statement (PWS) describes the technical support services required of the Marine Corps Cyberspace Operations Group (MCCOG) and provides descriptions of Public Key Infrastructure (PKI) technical requirements definition, operations, and sustainment support for authorized systems and personnel located at United States Marine Corps (USMC) installations worldwide.

Required support includes sustainment of the USMC portion of the established Department of Defense (DoD) Information Network (DoDIN): Non-classified Internet Protocol Router Network (NIPRNET) Public Key Infrastructure (PKI), National Security Systems (NSS) Secret Internet Protocol Router Network (SIPRNET) PKI, and Defense Information Systems Agency (DISA) Gray PKI.

1.1 Background.

The mission of the USMC PKI Program is to provide the resources, manpower, and equipment (hardware and software) dedicated to the management (i.e.: generation, production, distribution, control, accounting, and destruction) of keys and certificates used by public key-based security services to include Non-classified Internet Protocol Router Network (NIPRNet) and SIPRNet both garrison and deployed. The PKI program operates the USMC Certificate Validation Infrastructure (CVI) and USMC organizational Certificate Authorities (CA) necessary to ensure that only authorized users and server-based applications can operate on the MCEN. These services are required for user access to all information system components on the MCEN including network accounts, applications, and web sites. PKI must be operable in garrison and tactical/deployed environments.

USMC PKI is operationally attached to the MCCOG aboard Marine Corps Base Quantico, VA and sponsored by Headquarters Marine Corps Deputy Commandant, Information (HQMC DC I) as a USMC Representative to DoD

PKI.

APPLICABLE DOCUMENTS

Unless otherwise supplemented or superseded, Directives applicable to the performance of the subject work shall be as follows:

a. Information Technology Infrastructure Library (ITIL) version 4 framework established guidelines for the Information Technology Service Management discipline for managing IT systems

b. DoD Instruction 8520.02, PKI and Public Key Enabling, 18 May 2023

c. DoD Instruction 8520.03, Identity Authentication for Information Systems, 19 May 2023

d. DoD PKI Registration Authority/Local Registration Authority Certificate Practice Statement, 13

Jul 2022

e. NSS PKI DoD Registration Authority Practice Statement, Update 08 May 2024

f. Department of Defense Directive 8570-1 (DoDD 8570-1) - Information Assurance. Training, Certification, and Workforce Management. 12-2005 with Incorporated change of 4-20-2010

g. MARINE CORPS ORDER (MCO) 5510.18B, 30 Jan 2017 - United States Marine Corps

Information and Personnel Security Program Manual

h. Secretary of the Navy-SECNAVINST 5510.30B - Department of the Navy (DON) Personnel

Security Program (PSP) Instruction

i. Secretary of the Navy (SECNAV M-5510.30) - DON PSP

j. SECNAVINST 5510.36A - DON Information Security Program (ISP) Instruction

k. Secretary of Navy (SECNAV) M-5510.36 - DON ISP Manual, 1 Jul 06

l. Marine Corps Base Order (MCBO) 5510.1C - Information and Personnel Security Program (IPSP)

m. Marine Administrative Message (MARADMINS) and USMC Operational Directives as tasked

n. MCCOG policies, procedures and Standard Operating Procedures (SOP)

o. Additional Regulatory Guidance: The Contractor shall apply, as appropriate, Marine Corps, Department of the Navy and the Department of Defense Information Assurance policies, procedures, and technical communication requirements, which can be found through the Defense Information Systems Agency (DISA) portal at cybercom.mil, and United States Cyber Command, https://www.cybercom.mil, under the orders and Directives tab.

p. Commercial Solutions for Classified (CSfC) Enterprise Gray Implementation Requirements Annex v1.1 19 May 2022

q. Commercial Solutions for Classified (CSfC) Key Management Requirements Annex V2.1 19 May 2022

r. United States Department of Defense X.509 Certificate Policy, Version 10.76, 3 June

s. United States Department of Defense S-Interoperability Domain X.509 Certificate Policy, 30 Nov 2018

t. Committee National Security System (CNSS) Instruction No. 1300 (Instruction for National Security Systems PKI X.509 CP Under CNSS Policy No. 25), 6 Jan 2021

u. MARINE CORPS ORDER 3070.2A, THE MARINE CORPS OPERATIONS

SECURITY PROGRAM

GENERAL REQUIREMENTS

The MCCOG requires support for operations, management, and sustainment of PKI and related programs.

Contractor support shall include PKI registration support for authorized systems and personnel located at USMC installations worldwide. The contractor shall sustain the USMC portion of the established DoD PKI to include USMC Only-Locally-Trusted (OLT) PKI .

3.1 Objectives.

Requirements for the Contractor Program, Project and Task Management function include:

a. Provide staff augmentation supporting overall, on-site, day-to-day operations of Marine Corps PKI and its inherent operations, projects; costs; personnel; planning; and quality control necessary to ensure effective contract performance within Marine Corp PKI

b. Provide PKI Subject Matter Experts (SMEs) to support NSS, DoD, and Marine Corps PKI initiatives to include DoD PKI and DoD CIO working groups both scheduled and ad-hoc;

provide documentation review and recommendations to the Government Program Managers

c. Ensure Contractor personnel accessing information systems meet the applicable training, certification, and security clearance requirements

d. Manage and execute the projects and tasks for the Government Program Managers and Technical Leads as appropriate and as required

e. Routinely conduct in-depth reviews to identify progress, risks, and other issues that impact the success of operations and projects

The objective of this PWS is to describe the required contractor efforts needed for operational support to USMC PKI programs. The Contractor shall provide following support listed below:

f. Post-deployment applications software PKI support

g. Certificate generation and issuance in support of Zero Trust

h. Operate and maintain Marine Corps Only Locally Trusted (OLT) PKIs on the Marine Corps portion of the DoDIN

i. Operate and maintain Marine Corps Commercial Solutions for Classified PKIs

j. DoD/NSS/Gray Certificate Validation support

k. DISA DoD/NSS/Gray Registration Authority operations

l. Integration Support for fielded systems

m. Field technical support

3.2 Locations.

The Contractor shall provide support for the MCCOG PKI section at the following locations:

- MCB Quantico, Virginia – Primary Site

- Okinawa, Japan – Local Registration Authority (LRA)

- Camp Pendleton, California – Secondary site, Local Registration Authority (LRA)

- Camp Lejeune, North Carolina - Local Registration Authority (LRA)

- Commandant of the Marine Corps, HQ USMC, Washington, DC - Local Registration Authority (LRA)

TASKS/SPECIFIC REQUIREMENTS

The tasks identified below, when integrated, shall provide the USMC with an effective, reliable, and secure PKI capability across the Marine Corps Information Environment (MCIE). These tasks enable the Marine Corps PKI to fulfill its role within the DoD’s operational hierarchy, quickly adapting to near-term changes and continuously evolving to meet long-range technology trends.

NOTE: The tasks identified in this PWS are non-personal in nature; therefore, the Contractor’s employees are not subject to the supervision and control of the Federal Government employees. All tasks listed below shall be completed in accordance with the PWS and the identified SOP’s and managed by the Contractor with surveillance by the Government. The Contractor shall perform all tasks requiring development in coordination with the MCCOG. The Government will monitor the Contractor’s performance to ensure compliance with the PWS and other terms and conditions in accordance with the Government’s Performance Requirements

Summary (PRS).

4.1 Program Management.

The Contractor shall provide program management support. The Contractor shall identify a Program Manager (PM), by name, who shall provide management, direction, administration, quality assurance, and leadership of the execution of this Contract. The Contractor shall schedule meetings and provide deliverables. The PM shall serve as the Government’s primary point-of-contact and provide technical supervision and guidance for all Contractor personnel assigned to support the MCCOG under this contract.

The PM shall possess the qualifications as stated in the “Task 1 - Qualification Table” in Appendix A of this PWS.

The Contractor shall apply and maintain their proven and successful program management practices throughout the life of this contract.. The Contractor shall plan and monitor the execution of all tasks and shall maintain regular communications to keep the Government apprised of all contract issues and status.

The Contractor shall deliver a Monthly Status Report (MSR) to the Government in accordance with

CDRL A001.

CDRL A001 Monthly Status Report (MSR)

4.1.1 Kick-off Meeting

The Contractor shall attend a Kick-off Meeting at a location determined by the Government no later than 5 business days after contract award. The meeting will provide an introduction between key contractor personnel and relevant Government personnel who will be involved with the effort. The purpose of the Kick-off Meeting is to achieve a clear and mutual understanding of all contract requirements and identify and resolve potential problems.

As part of the Kick-off Meeting, the Contractor shall present program implementation processes to be utilized under this contract. Other topics of discussion include contract deliverables, sub-contracting plan compliance (as applicable), government furnished equipment, clause and flow-down clause compliance (as applicable), and plans submitted in response to the solicitation and incorporated into the contract. The contractor shall provide and be prepared to discuss its draft Transition-In Plan. The Contractor shall deliver Meeting Minutes, Meeting Agenda, and Briefing Materials in accordance with CDRLs A002.

CDRL A002 Meeting Minutes

CDRL A001 MSR

4.1.2 In-Progress Review (IPR)

The Contractor shall host a monthly Contract Activity and Status Meeting with the Technical Point of Contact (TPOC), COR, Procuring Contracting Officer and other vital Government stakeholders. The purpose of this meeting is to ensure all stakeholders are informed of the monthly activity and MSR, provide opportunities to identify other activities and establish priorities, and coordinate resolution of identified problems or opportunities. The Contractor shall provide an agenda, written minutes of these meetings, including attendance, issues discussed, decisions made, and action items assigned, to the COR. Any non-concurrence of the meeting notes content by the COR will be provided to the Contractor for revision. The Contractor shall make the necessary changes and provide them to the Government.

The Contractor shall develop and deliver an In-Progress Report. The In-Progress Report shall include the following:

a. Activities during reporting period, i.e. previous month, by task (include on-going activities, new activities, activities completed; progress to date on all above-mentioned activities). Start each section with a brief description of the task.

b. Problems and corrective actions taken. Also include issues or concerns and proposed resolutions to address them.

c. Contract Status which will include contract number information, task leads information and staffing update/changes (vacant, transition in/out billets).

d. Personnel gains, losses, and status (security clearance, etc.).

e. Government actions required.

f. Financial Status of the current contract including Accumulated Invoice Cost for each Contract Line-Item Number (CLIN) up to the previous month and projected cost for each CLIN for the current month.

g. Any recommendation or issues regarding the contract.

CDRL A003 In-Progress Report CDRL A012 Agenda

4.1.3 Project Management Plan (PMP)

The Contractor shall document all support requirements in a PMP. The Contractor shall provide the draft PMP to the Government included with the Proposal. The draft PMP is subject to changes pending Government comments and recommendations after the Post Award Conference.

The PMP is an evolutionary document that shall be updated annually, or as determined by the COR.

The Contractor shall work from the latest Government-approved version of the PMP.

The PMP shall:

a. Describe the proposed management approach.

b. Contain detailed SOPs for all tasks.

c. Include milestones, tasks, and subtasks required in this Contract.

d. Provide for an overall Work Breakdown Structure (WBS) and associated responsibilities and partnerships between or among Government organizations.

e. Include the Contractor’s Quality Management Plan (QMP).

CDRL A004 PMP

4.1.4 Quality Management Plan

The Contractor shall document and deliver a QMP at the time of Proposal.

The QMP shall address the Contractor’s plan to meet quality and performance standards outlined in the PRS and shall include, at a minimum, the following components:

a. Quality objectives

b. Key project deliverables and processes to be reviewed for satisfactory quality level

c. Quality standards

d. Quality control and assurance activities

e. Quality roles and responsibilities

f. Quality tools

g. Plan for reporting quality control and assurance problems

CDRL A005 QMP

4.1.5 Transition Plan

The Contractor shall deliver a Transition-In plan with the Proposal. The Contractor shall ensure that there will be minimum service disruption to vital Government business and no service degradation during and after transition into this contract. Upon contract award, the Contractor, in coordination with the Government and the incumbent contractor, shall provide phase-in support days beginning at the start of contract performance for sixty60) days thereafter. All transition activities shall be completed with full performance no later than 60 calendar days after the start date of the contract.

Transition-In Plan- The Contractor shall, at minimum, address the below phase-in activities. The plan shall also include a transition program for on-boarding contractor personnel and a date for accepting responsibilities for each division of work. Additionally, proposed staff levels with a WBS during and after the transition in period shall be included within the Transition-In Plan.

The phase-in activities shall include such functions as:

a. Implement the staffing plan to ensure full performance at end of transition-in period.

b. Receive knowledge, experience, and lessons learned from incumbent contractor and Government personnel

c. Ensure no service disruption to the Marine Corps

d. Receive appropriate property, documentation, or personnel, as agreed to between the parties

(including but not limited to, devices, equipment, databases and systems related to this PWS)

e. Attend program reviews and participate in working groups, briefings

Transition-Out Plan - The Contractor shall facilitate the accomplishment of a seamless transition from this Contractor to any subsequent incoming contractor and Government personnel at the expiration of this Contract. The Contractor shall provide a Transition-Out Plan in accordance with CDRL A010.

The Contractor shall identify how it will coordinate with any subsequent incoming contractor and/or Government personnel to transfer knowledge regarding the following:

a. Project management processes

b. Points of contact

c. Location of technical and project management documentation

d. Status of ongoing technical initiatives

e. Appropriate contractor–to-contractor coordination to ensure a seamless transition.

f. Transition of Key Personnel

g. Schedules and milestones

h. Actions required of the Government

i. Submit a “turnover binder” for each functional area which shall include, but is not limited to, passwords, permissions, SOPs, documentation, etc.

The Contractor shall also establish and maintain effective communication with the incoming contractor/Government personnel for the period of the transition via weekly status meetings.

The contractor shall also complete or perform transfer of all tangible and intangible (intellectual) property and licenses.

Upon Government direction, the Contractor shall implement its Transition-Out Plan no later than 75 calendar days prior to expiration of the contract.

CDRL A010 Transition Plan

4.1.6 Post Award Conference (PAC)

The Contractor shall schedule and coordinate a PAC to occur within 30 calendar days after Contract award at the Government’s primary site at Quantico MCB. The meeting will provide an introduction between the Contractor personnel and Government personnel who will be involved with this Contract.

The meeting will provide the opportunity to discuss technical, management, and security issues, and travel authorization and reporting procedures. At a minimum, the attendees shall include vital Contractor personnel, representatives from the directorates, the KO, other relevant Government personnel, and the COR. The Contractor shall provide the following at the PAC:

a. Draft Transition-In Plan

CDRL A004 PMP

CDRL A005 QMP

CDRL A010 Transition Plan CDRL A012 Agenda

4.1.7 Training/Conference Space

The Contractor shall make available to the MCCOG, as needed and within 14 calendar days of request by the MCCOG, a space in a classroom or conference room configuration to conduct training for approximately 10-20 students per session. The Contractor shall provide a computer for each student, audio/visual support to include an overhead projector and screen, and internet connectivity which allows vendors to reach back to their network servers or sites as required to provide the course. The physical training/conference space shall be located within 10 miles of the MCCOG facility in Quantico, VA. Training/conference room shall support:

a. PKI training events hosted in the Quantico such as PKI Tactical training and other PKI training for USMC organizations external to MCCOG. Space shall support a minimum of 10 students but no more than 20

b. Periodic DoD PKI Summits and Certificate Practice Management Working Groups (at least one quarterly)

c. Off-site meeting location to discuss PKI programs, tasks, and other items with stakeholders external to MCCOG

4.1.8 Quarterly Meeting

The contractor shall plan and conduct a quarterly contract status meeting. The primary purpose of these meetings is to review contract performance status and address contract-related issues. These meetings are expected to last no longer than one (1) hour. At a minimum, the meeting will include appropriate contractor representative(s), the contracting officer, the COR, and Government technical personnel, as appropriate; however, the contracting officer may choose to include other Government attendees. The meeting will be held virtually, via a phone conference call, or at a location determined by the contracting officer.

Each meeting will cover the following topics, as appropriate:

• Contract Performance Status (interim draft CPARS rating)

• Status of contract deliverables/tasks (updates since last meeting)

• Performance issues encountered or expected (e.g., potential delays)

• Required Government actions (e.g., delivery of Government Furnished Information and/or Property)

• Compliance with staffing (See Sections 11 and 12)

• Discussion on contractor performance against QASP metrics

Other Items:

• CLIN-related issues.

• Address new or in process modifications, requests for out-of-scope work, requests for equitable adjustment, claims, or disputes

• Clause compliance (e.g., FAR 52.245-1, Government Furnished Property; FAR 52.219-9, Small Business Subcontracting Plan)

• Invoice submission and payment status

• Contractor Performance Assessment Report System (CPARS) status (FAR 42.15)

• Continuous improvement ideas for current contract and/or future contract

The contractor will provide meeting minutes within five business days after the meeting. Contractor format is acceptable with a copy emailed to the contracting officer and the COR.

4.2 Public Key Infrastructure Support (USMC PKI)

The Contractor shall possess the qualifications identified in the Task 2 – Qualification Table of Appendix A. The Contactor shall assist in providing PKI support services under the following subtasks.

4.2.1 Registration Authority (RA) Operations

The Contractor shall provide PKI RA support for the implementation, maintenance and upkeep of the DoD/NSS/USMC PKI by the creation and removal of Local Registration Authority (LRAs); the issuance and revocation of Role Based, Code Signing, End user, administrator and server certificates; Alternate token issuance; key recovery; SIPRNet Token and Common Access Card (CAC) PIN resets. The Contractor shall manage the production and issuance of USMC Alternate Tokens using the NIPRNet Enterprise Alternate Token System (NEATs) and production and issuance of the DoD/NSS SIPRNet tokens using the Token Management System (TMS). The PKI RA section is a fast-paced work environment and serves as the only PKI Enterprise help desk in the USMC providing professional and courteous support to customers located throughout the world to include tactical environments. The Contractor shall use PKI RA skills to enhance the network security by the use of PKI while working with internal MCCOG divisions, external USMC organizations, various other DoD organizations, and a myriad of Government and civilian organizations. The Contractor shall provide personnel to support the Marine Corps RA assigned under this subtask area. Personnel shall possess a DoD/NSS PKI Registration Authority, Local Registration Authority, and Key Recovery Agent training certificates and must be a U.S. Citizen. The Contractor shall provide the following RA operations support using its direct DoD/NSS PKI experience:

a. Certificate Issuance/Revocation

b. Help Desk Support

c. CAC PIN Reset Support

d. Purebred/Mobile Device PKI certificate support

e. PKI Key Recovery

f. New/Emerging technologies testing support

g. Serve as RAs and Key Recovery Agents

h. Maintain support for creation and removal of LRAs.

i. Issue end user certificates.

j. Coordinate installation of DoD certificates on to Mobile devices.

k. Execute certificate revocation within 12 hours of notification.

l. Download, format, and install PKI certificates.

m. CAC PIN Reset and Key recovery.

n. SIPR Token PIN Reset and Key recovery.

o. Resolve customer issues related to PKI certificate use and system configuration.

p. Serve as the Liaison between the MCCOG and the field LRA staff for the resolution of issues elevated to the MCCOG call center.

q. Submit and update Remedy tickets in accordance with established metrics.

r. Execute certificate disposition for USMC casualties.

s. Assist in the execution of LRA, Trusted Agent and end user PKI training.

t. Manage the production and issuance of DoD SIPR Tokens using a TMS and peripherals provided by the

Government at the MCCOG.

u. Manage the production and issuance of USMC Alternate PKI Tokens using NEATs.

v. Maintain and sustain the central repository of PKI records specified by the Government, to include records required to establish the validity of a signature and the proper operation of the PKI as specified in the DoD PKI Certificate Policy.

w. Perform metric collection and reporting on selected activities directed by the Government. Shall maintain a daily log of user assistance calls, SIPR token and Alternate token certificate issuance, revocations, and server certificate issuance to be incorporated into a monthly status report.

x. Shall maintain a daily physical logbook consisting of all RA certificate activities as specified in the DoD RA LRA Certificate Practice Statements (CPS)/NSS RPS.

y. Maintain and update required PKI certificate issuance, revocation, and key recovery actions in appropriate existing or future SharePoint lists/Databases.

z. Provide data requirements for future SharePoint lists/databases for issuance activities from new DoD capabilities.

aa. Direct calls from customers of the DoD and USMC PKI to appropriate MCCOG sections.

bb. Provide both internal and external USMC PKI customers with knowledgeable, problem-solving resolutions, in the shortest time possible to minimize any customer downtime or work stoppage.

cc. Assist Program of Record (POR) application owners with integration of current USMC PKI enabling technologies.

dd. Provide general administrative support tasks to the execution of PKI logistics activities such as controlled distribution of SIPR Tokens, ALT Tokens, and PKI peripherals.

ee. Provide input for operational metrics and analysis to improve the enterprise PKI related customer experience and reduce Help Desk calls.

ff. Provide desktop and network support.

gg. Perform operational testing of beta tokens, new certificate types and Token Management Testing along with operational capability testing of all new versions of PKI certificate and systems.

4.2.2 Implementation and Planning

The Contractor shall provide implementation and planning support in the development and writing of project plans and implementation documentation as required in support of USMC PKI initiatives. This also includes updating existing specific PKI plans and procedures to comply with changing DoD PKI initiatives. The development of plans for the employment and support of PKI tools in all network environments, including tactical ones, which provide PKI procedures for concept of operations (CONOPS) and plan of actions and milestones (POA&M) to ensure successful execution is required.

The Contractor shall provide support to the Implementation and Planning staff.

4.2.3 Knowledge Management

The Contractor shall provide Knowledge Management support using expertise in SharePoint Administration, Application Development, and Management in accordance with DoD PKI initiatives.

USMC PKI manages and maintains an internal and external SharePoint site which provides internal collaboration and external customer support services. Internal support services include, but are not limited to, document libraries, task tracking, calendar, database, and list services. External customer support services include, but are not limited to, PK Enabling documentation, Service Support/Informational Dashboard Software configurations, and downloads.

The Contractor shall:

a. Create, maintain, and sustain document libraries and lists

b. Create, maintain, and sustain views for libraries and lists

c. Create, maintain, and sustain WebParts and other SharePoint services as necessary

d. Create, maintain, and sustain templates for assisting PKI personnel with individual document libraries

e. Create, maintain, and manage both internal and external facing SharePoint services

f. Provide access to PKI information utilizing Excel Web Services

g. Create, maintain, and sustain Key Performance Indicator (KPI) web parts

h. Connect web parts

i. Create individual web pages to simulate “collaborative sites”

j. Employ web services to present information from restricted areas to the general public

k. Write basic scripts (e.g., providing Site Redirection, adding color to a list item in SharePoint, etc.)

l. Set proper security settings and permissions

m. Maintain, sustain, and update SharePoint lists for the tracking of SIPRNet Trusted Agents , NIPRNet Trusted Agents , Alternate Tokens , SIPRNet Tokens Server Certificates and any future SharePoint lists/Databases..

n. Develop and maintain additional share point lists as required

o. Develop required reporting from SharePoint Lists using available tools

p. Develop, maintain, and sustain the external PKI SharePoint content as required by

Government leadership

4.2.4 Local Registration Authority (LRA) Auditor

The Contractor shall provide LRA Audit support for the development, updating and execution of comprehensive audit procedures and reports for all LRA field operations.

The Contractor shall:

a. Develop, modify, and execute comprehensive audit procedures for all LRA field operations

b. Conduct and ensure performance of field LRA operations audits are in accordance with the most current DoD RA/LRA CPS, NSS RPS , CNSS Certificate Policy (CP) the USMC Training User’s Guide, and USMC RA guidance

c. Maintain all procedures, reports, and Automated Message Handling System (AMHS) messages to ensure the USMC RA maintains a prepared state for the successful completion of the LRA audits directed by the DoD CPS and NSS RPS

d. Draft and submit LRA Audit reports within 30 days of audit completion for signature and delivery to audited Command

e. Recommend improvements to procedures and processes related to the audits to PKI Leadership

The Contractor shall provide two personnel for each audit, one Registration Authority and one RA Workstation System administrator taking place over one week at each of the following locations:

a. Camp Lejeune, NC

b. Camp Pendleton, CA

c. Okinawa, Japan

d. HQMC, Arlington, VA

Audit periodicity is a minimum of once every three-years. Out-of-cycle audits may be directed by the Government

CDRL A006 After Action Report CDRL A007 Audit Reports

4.2.5 Program of Record (POR) PKE Waiver Review

The Contractor shall provide implementation and planning support for reviewing USMC POR Application waiver forms for compliance/noncompliance with existing DoD PKI directives. Due to technical limitations, some systems are unable to implement PKI and therefore require a waiver form to justify non- compliance with PKI directives.

The contractor shall:

a. Review and submit waiver forms with recommendation for approval/disapproval to the USMC Designated Accrediting Authority /Authorizing Official (AO)

b. Create, submit, and track Remedy trouble ticket for waiver requests

c. Track all waiver forms using SharePoint and notify the POR requestor of waiver status

d. Coordinate directly with the USMC PKI Network Operations for technical guidance to verify requested waiver system is capable or incapable of PK enablement

e. Develop, maintain, and provide briefings to Government leadership depicting current status of waived systems/PORs

4.2.6 Purebred/Government Furnished anCommercial Mobile Device (CMD) Support

The Contractor shall provide Implementation and Planning support for updating and configuration of Purebred for Government Furnished Commercial Mobile Devices (CMD) utilizing DoD derived credential solution which delivers credentials to the CMD for use with secure email and access to network resources requiring a DoD PKI credential.

The Contractor shall provide PKI implementation planning support for the following:

a. Enroll and Manage USMC Purebred Limited Registration Agents within the DISA Purebred Web Application

b. Coordinate with other MCCOG sections for proper configuration of CMD Purebred Client Applications.

c. Provide Tier-3 Purebred troubleshooting of signing and encrypting emails.

d. Provide Purebred desktop manager support.

e. Establish and execute SOPs and training guides to ensure version control and adherence to sound configuration management practices for all documentation.

f. Submit/update/close trouble tickets.

4.2.7 Concept of Operations/Operational Directives/Advisories(OPDIR/OPAD) Development, Tracking, and Reporting

The Contractor shall:

a. Perform technical writing, analysis, and editing of all PKI CONOPS with technical Subject Matter Expert (SME) assistance.

b. Develop, review, and release OPDIR/OPAD in accordance with Government leadership guidance for release of operational requirements and advisories. Provide reporting guidance and/or templates as required.

c. Track and report OPDIR compliancy from reporting commands and create reports for briefings to leadership, when required.

d. Contact non-compliant commands and report to Government leadership with the status when required.

4.2.8 USMC and DoD PKI Document/Meeting Review

The Contractor shall provide Subject Matter Expertise in supporting the following meetings as needed:

a. DoD PKI Program Management Office (DoD PKI PMO) Program Information Exchange (PIE)/Program Status Review (PSR) meeting

b. DoD PKI Summits

c. Identity Protection and Management Senior Coordinating Group (IPMSCG) meeting and meetings of IPMSCG sub-groups

d. Weekly Working Integrated Product Team and various conference calls

e. CAC PIN Reset Users Group (CUG) meeting

f. Remedy Queue Managers meeting

g. DoD PKI Certificate Practice Management Working Group (CPMWG) meeting

h. Developer Configuration Control Board (DCCB) meeting

i. PKI PMO Functional Managers meeting

j. DoD PKI Technical Interchange meeting

k. USMC PKI and Identity Management programs

l. Other meetings as required

Using input from these meetings, the Contractor shall provide the PKI implementation planning support to:

a. Develop USMC PKI Plans and Implementation Documentation for new DoD / USMC projects, tasks, and initiatives. Review and provide comments on plans and procedures of changes to existing DoD and USMC PKI programs and update USMC-specific Plans and Procedures to comply with approved changes to DoD PKI initiatives.

b. Develop PKI Tactical Plans for the deployment and support of PKI in tactical environments which shall include CONOPS, Continuity of Operations Plans (COOP), and SOPs.

c. Develop and maintain all PKI Architecture and Migration Plans (to include, but not limited to, technical, certificate authority, certificate validation, and registration authority) for future releases of DoD PKI

d. Provide analysis, planning, implementation support to assist PKI Section with tasks and requirements levied by United States Cyber Command (USCYBERCOM), Joint Task Force – Department of Defense Information Networks (JTF-DoDIN), and Marine Corps Forces Cyberspace Command (MARFORCYBER).

e. Review and provide recommendations for PKI policy and procedures at the DoD, DON, and USMC levels.

f. Review and recommend PKI solutions to customer problems based on an understanding of the customer environment and provide recommendations to support the customer’s mission.

4.2.9 Remedy/Task Tracking

USMC PKI Remedy/Task Tracking are responsible for coordinating activities to resolve Incidents/Service Requests and restore service with a primary focus on workforce monitoring, prioritization, incident routing, and queue management. Tasks/projects external to incident management are created and tracked using SharePoint Tasks Lists.

The Contractor shall:

a. Assign Incidents to and manage the Incident resolution efforts of the SMEs to ensure metric compliance in accordance with established ticketing procedures.

b. Ensure Incidents/Service Requests are accurately transferred to appropriate Queues and/or escalated to the proper functional group within prescribed standards and timelines

c. Monitor the performance and investigate/remediate Service Level breaches.

d. Ensure Incidents/Service Requests are properly documented to include priority based on impact/urgency, classification, complete and thorough updates at an appropriate level of detail on resolution.

e. Create and manage tasks using SharePoint Task lists.

f. Monitor and investigate tasks to ensure timely completion by assigned due date.

g. Analyze tasks to ensure proper updates prior to reporting to leadership.

4.2.10 Training Documentation Support

The Contractor shall assist in training and outreach activities in support of USMC PKI initiatives for garrison and tactical networks. This includes training plans, activities, developing and maintaining training material, tracking and reporting training activities, supporting PKI computer-based training for target audiences as requested, developing and maintaining outreach activities to support PKI, and related implementation changes from Joint/USMC programs. The Contractor shall develop, prepare, and train PKI RA, LRA, Trusted Agent (TA) and others as directed via formal classroom courses, workshops and seminars. Training shall be in conformance to IA policy.

The Contractor shall:

a. Assist in developing PKI Training Plans and tactical training materials.

b. Assist in developing and maintaining tracking and reporting mechanisms for tactical training suite and materials.

c. Assist in developing and maintaining PKI Outreach Materials to support PKI training and customer awareness as related to constant changing of PKI environment.

d. Assist in developing and providing PKI Briefs for conferences or working group meetings regarding PKI projects, plans, and initiatives as directed.

e. Assist in developing and providing targeted computer/hands-on training specific to LRA, TA, System Administrators, and end-users within USMC.

f. Assist in developing and providing PKI Instructor Materials such as course outlines, background material, and training aids in support of targeted training.

g. Assist in developing and providing PKI student course materials such as workbooks, handouts, completion certificates, and course critique forms for onsite hands-on training.

h. Train PKI LRAs in accordance with the USMC, DISA, and National Security Agency IA policy and procedures via formal classroom courses, and hands-on workshops as required.

CDRL A003 IPR

4.2.11 Local Registration Authorities

The Contractor shall provide LRA support at each MEF location and HQMC to assist in Communications General Staff (G6) PKI mission. The Contractor LRA shall assist in all PKI implementations, server builds and installs in conjunction with the Local G6’s.

The Contractor shall provide support personnel to serve as the LRA staff assigned under this subtask area. These personnel shall possess a DoD/NSS PKI certification as a DoD/NSS LRA and must be a U.S.

Citizen.

a. Provide LRA support to ensure the PKI Server Certificates are requested, approved, and installed in accordance with PKI Policy. Provide PKI end-user training on certificate utilization within the Desktop environment.

b. Execute PKI certificate registration, management and revocation requests to ensure all requested activities are properly documented within the ticket management system

c. Maintain and perform CAC PIN Reset operations for end-user needs in area of responsibility.

d. Archive PKI data as directed and in compliance with the CPS/Registration Practice Statement.

e. Plan, coordinate, and implement, at the local level with the local G6, evolving PKI initiatives as directed by the USMC RA.

f. The Contractor LRA located at Camp Pendleton shall be fully trained and qualified as a Registraion Authority and complete required DoD/NSS RA training conducted at a designated DISA location.

g. Develop, update, and submit Monthly status reports providing token issuance numbers, trouble calls processed and any current issues to the USMC RA.

4.2.12 PKI Network Operations

PKI Network Operations provides technical expertise related to the support of concept exploration, functional and technical requirements generation, development, implementation, and enhancement of DoD PKI for the USMC. This technical support includes the development of a technically resilient certificate issuance and revocation status checking infrastructure for all MCEN networks, as well as meeting the requirements of HSPD-12. It ensures that USMC PKI implementation requirements are identified and made part of the development, implementation, and support of future DoD PKI architecture. MCCOG PKI provides support for assessments of USMC impacts from actions associated with DoD PKI PMO development and implementation activities, to include use of DoD PKI with mobile devices and DoD provided non-person entity issuance capabilities. MCCOG PKI provides support to address issues related to certificates, tokens, token issuance, and infrastructure services. This task provides technical requirement support to directory service providers and recommendations for USMC action to change DoD implementation and software releases. USMC PKI recommendations shall also include the impact of planned changes to registration software and hardware upon USMC users.

The Contractor shall provide support personnel to serve as the PKI Network Operations staff as described in Sections 4.2.12 through 4.2.20.

The Contractor shall provide support personnel to serve as the PKI Network Operations Network Lead which provides technical supervision and guidance to the PKI Network Operations contract support staff for all PKI Network Operations system management tasks supporting the MCCOG.

4.2.13 Certificate Authority (CA) Support

The Contractor shall provide technical support for Microsoft Active Directory, DoD PKI, Unix and Windows software, Microsoft Active Directory Certificate Services (ADCS), Keyfactor EJBCA, Information Services Corporation (ISC) CertAgent, Red Hat CA software certificate services, and other Certificate Authority Services Technologies that may be deployed in future years

The Contractor shall:

a. Develop, deploy and configure new CA Infrastructure in accordance DoD security standards.

b. Conduct infrastructure checks twice daily and create status report using SharePoint List for Government leadership.

c. Maintain the overall health of technologies associated with the CA infrastructure.

d. Monitor the health of CA infrastructure with MCCOG provided event management tools.

Report any discrepancies to Government leadership and record using incident ticketing system.

e. Publish and issue Certificate Revocation Lists on a weekly basis from Root and Sub CAs.

f. Provide Tier III troubleshooting and support for incidents related to CAs and document resolution using incident ticketing system.

g. Implement and monitor CA thresholds and conduct proactive event remediation per

Government guidance.

h. Develop, plan, deploy, and configure new versions of CA Infrastructure as needed or when directed by Government leadership.

i. Develop, test, and maintain CA Infrastructure disaster recovery plans using SharePoint

Document Library.

j. Develop, test, and maintain CA Infrastructure COOP plans using SharePoint Document

Library.

k. Escalate issues to third party product vendors as required and track the progress of vendor support.

4.2.14 Certificate Validation Infrastructure (CVI) Support

The Contractor shall provide CVI support for PKI, Windows Software, Axway Validation Authority Suite software to include but not limited to Online Certificate Status Protocol (OCSP), Desktop Validator, Enterprise Validation Authority, and Compact CRLs, and Keyfactor EJBCA Validation Authority

The Contractor shall:

a. Configure and deploy new Certificate Validation (Responder/Repeater) software as needed or directed by Government leadership.

b. Develop, deploy and maintain desktop validator configurations for use by all systems and applications residing on all USMC networks.

c. Conduct infrastructure checks twice daily and create status report using SharePoint List for Government leadership.

d. Maintain the overall health of technologies associated with the CVI.

e. Monitor the health of CVI with MCCOG provided event management tools. Report any discrepancies to Government leadership and record using incident ticketing system.

f. Ensure validation information, downloaded from DISA, is current and accessible by CVI servers.

g. Provide Tier III troubleshooting and support for incidents related to CVI and document resolution using incident ticketing system.

h. Configure and deploy new versions of CVI software as needed or when directed by

Government leadership.

i. Develop, test, and maintain CVI disaster recovery plans using SharePoint Document Library.

j. Develop, test, and maintain CVI COOP plans using SharePoint Document Library.

k. Escalate issues to third party product vendors as required and track the progress of vendor

4.2.15 Hardware Security Module (HSM) Support

The Contractor shall provide HSM support for SafeNet/Thales and nCipher hardware PKI key management.

a. Configure and deploy new HSMs as required or directed.

b. Maintain the overall health of the HSMs. Provide Tier III troubleshooting and support for incidents related to HSMs and document resolution using incident ticketing system.

c. Develop, test, and maintain HSM disaster recovery plans using SharePoint Document Library.

d. Escalate issues to third party product vendors as required and track the progress of vendor

4.2.16 Public Key Enabling Support

The Contractor shall provide Public Key Enabling support.

The Contractor shall:

a. Research and understand new technologies that require PK Enablement.

b. Provide PKI technical support, when required, to subtask 4.2.2 --

Receive and review PKI noncompliance waiver requests and recommend approval/disapproval

c. Create courses of action and document recommendations for PK Enabling noncompliant systems. POR/Application owners are responsible for Cryptographic Enablement.

4.2.17 Tier III Advanced Support

The Contractor shall provide Tier III advanced troubleshooting support. The Contractor shall:

a. Perform PKI Tier III troubleshooting on MCEN systems relating to PKI specific incidents to include but not limited to cryptographic logon, certificate validation, and domain controller certificates.

b. Participate and provide PKI subject matter expertise in resolving issues within all USMC Networks in collaboration with other MCEN service providers.

4.2.18 Configuration Management Support

The Contractor shall provide Configuration Management support.

a. Maintain and deploy Desktop Validator and Middleware Configurations supporting the MCEN using SharePoint Document Library.

b. Maintain and deploy Server Validator Configurations supporting the MCEN using SharePoint Document Library.

c. Maintain baseline configurations for all PKI software and enterprise hardware using SharePoint Document Library.

d. Plan, develop, and test, new configurations for PKI software and hardware. Provide after action reports of test results and recommendations for site/region/enterprise implementation.

4.2.19 PKI System Infrastructure Support.

The Contractor shall provide hardware and software technical support to operate, troubleshoot, and scale three separate forests with separate infrastructure and services. Each environment requires isolated access, patching, and security postures. The uptime of all PKI enterprise services is 99.97%, not including system maintenance.

The Contractor shall provide support personnel to serve as the PKI System Infrastructure Support staff assigned under this subtask area.

All patching and Information Assurance Vulnerability Alert compliancy shall be accomplished, with or without a patching solution, on all PKI Enterprise services in accordance with the MCCOG change policy. All security vulnerabilities shall be remediated and completed within the assigned deadline from subtask

4.2.21.3 (Vulnerability Management). For vulnerabilities that are technically unable to be remediated, PKI System Infrastructure Tech will assist subtask 4.2.21.3 (Vulnerability Management) in creating

POA&M.

CDRL A009 Cybersecurity Management Report

4.2.19.1 Virtual Infrastructure (VI) Support

The Contractor shall configure all aspects of the VI in support of the PKI Enterprise Services on USMC operated networks. The Contractor shall use VMware to deploy and maintain complex VMware environments to provide Virtual Machine and Virtual Desktop services.

The Contractor shall:

a. Maintain the overall health of technologies associated with the VI to include both Virtual Servers and Virtual Desktop Environments

b. Implement monitoring tool thresholds and conduct proactive event remediation as directed by Government leadership.

c. Monitor the health of VI with MCCOG provided event management tools. Report any discrepancies to Government leadership and record using incident ticketing system.

d. Provide Tier III troubleshooting and support for incidents related to VI and document resolution using incident ticketing system.

e. Configure and deploy new versions of VI as needed or when directed by Government leadership.

f. Develop, test, and maintain VI disaster recovery plans using SharePoint Document Library.

g. Escalate issues to third party product vendors as required and track the progress of vendor support.

h. Leverage emerging VI technologies to support additional PKI implementation and support items.

4.2.19.2 Storage Area Network (SAN) Support

The Contractor shall configure all aspects of the SAN hardware and software supporting PKI Enterprise Services. The Contractor shall use NetApp Storage devices to include snapshots, storage provisioning, management software, recovery procedures, hardware installation and security of Logical Unit Numbers (LUNS), and access to each to provide PKI SAN support.

a. Maintain the overall health of technologies associated with the SAN.

b. Implement monitoring tool thresholds and conduct proactive event remediation as directed by Government leadership.

c. Monitor the health of SAN with MCCOG provided event management tools. Report any discrepancies to Government leadership and record using incident ticketing system.

d. Provide Tier III troubleshooting and support for incidents related to SAN and document resolution using incident ticketing system.

e. Configure and deploy new versions of SAN as needed or when directed by Government leadership.

f. Develop, test, and maintain SAN disaster recovery plans using SharePoint Document

Library.

g. Escalate issues to third party product vendors as required and track the progress of vendor

4.2.19.3 Server Management Support

The Contractor shall provide Server Management support.

The Contractor shall:

a. Maintain the overall health of technologies associated with the Server Management

b. Implement monitoring tool thresholds and conduct proactive event remediation as directed by…