DRAFT PWS.pdf

1 | 14

PERFORMANCE WORK STATEMENT

NAVAL SEA SYSTEMS COMMAND HEADQUARTERS ELECTRONIC SECURITY

SYSTEM TECHNICAL AND NETWORK ENGINEERING SUPPORT

1.0 INTRODUCTION

This contract provides the Security Operations Division (SEA 00P1) of the Naval Sea Systems Command (NAVSEA) Office of Security Programs (SEA 00P) with Technical and Network Engineering (Information Technology (IT)) support for Electronic Security Systems (ESS) at the NAVSEA Headquarters (HQ) at the Washington Navy Yard, DC.

2.0 BACKGROUND

Johnson Controls Building Automation Systems (JCBAS) is under contract to replace the existing, integrated Intrusion Detection System (IDS), Automated Entry Control System (AECS), Closed Circuit Video (CCV), and Video Management System (VMS) at NAVSEA HQ.

The current legacy system was leased from JCBAS through 3 Jan 2022, but under direction of NAVSEA leadership, all system components were purchased by the Government as part of the modernization contract.

Under the JCBAS lease contract, all maintenance and technical services were provided as part of the overhead costs associated with the contract. With the decision to own the systems, the Government is now responsible for providing all necessary Risk Management Framework (RMF), system programming, engineering, administration, and maintenance support for the ESS.

Currently, the maintenance services for the ESS are provided by a six-month contract to JCBAS, through 3 July 2022, pending the solicitation and award of a replacement service contract by Naval Information Warfare Center Atlantic (NIWC-A). It is highly possible that the incumbent will not receive this contract and NAVSEA must ensure there is a clean transition with the sustainment of the legacy system, the installation of the new system components to replace the legacy system, and the Authority to Test (ATT) and Authority to Operate (ATO) for the incoming integrated system of systems.

Due to its age and original installation in 1999, the legacy ESS did not have a requirement for an ATO, or the ability to valid ATO in Enterprise Mission Assurance Support Service (eMASS).

The legacy system now requires the completion of an ATO package, and have its hardware and software profiles registered in the Department of the Navy (DON) Application and Database Management System (DADMS) or Department of Defense (DoD) Information Technology Portfolio Repository – Department of the Navy (DITPR-DON).

Prior to installing and operating the new ESS, while simultaneously operating the legacy system, all hardware and software must be entered into the various management systems, and the RMF process initiated. System configuration, patching, updating, testing, and administration are requirements of the process to attain and maintain the ATT and/or ATO for all electronic

2 | 14 systems. System network engineering, design, documentation, and management is also an integral part of the RMF process that requires specialized support.

3.0 SCOPE

This Performance Work Statement (PWS) covers ESS Technical and Network Engineering (IT) support to NAVSEA HQ. Support includes the design, development, configuration, testing, integration, and subsequent administration, management, and operation of the integrated ESS within multiple NAVSEA buildings at the Washington Navy Yard, DC. Support includes the development, submission, and sustainment of a RMF authorization and accreditation package for any legacy and new system ATT and ATO.

4.0 APPLICABLE DOCUMENTS

Document Type

No./ Version

Title Date

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT) https://www.esd.whs.mil/Directives/issuances/dodm/

12 Mar

DoD 8570.01-M Information Assurance Workforce Improvement Program https://www.esd.whs.mil/Directives/issuances/dodm/

10 Nov

ICD 705 Secure Compartmented Information Facilities https://www.dni.gov/index.php/what-we-do/ic-related-menus/ic-related-links/intelligence-community-directives

26 May

OPNAVINST 5530.14E

CH3

Department of the Navy Physical Security Program, http://www.secnav.navy.mil/doni/Directives/Forms/AllItems.aspx

28 Jan

SECNAVINST 5510.36B Department of the Navy Information Security Program http://www.secnav.navy.mil/doni/Directives/Forms/AllItems.aspx

12 Jul

DoDM 5200.48 Controlled Unclassified Information https://www.esd.whs.mil/Directives/issuances/dodm/

6 Mar

5.0 PLACE(S) OF PERFORMANCE

The site requirements below identify contractor employee office location(s) and the location of Government provided facilities, if applicable. Travel locations (i.e., temporary duty sites) are not specified in this section.

a. Contractor facility

b. NAVSEA HQ, Washington Navy Yard, DC

5.1 GOVERNMENT FACILITIES

The primary duty location for the Technical Engineer (IT) is at NAVSEA HQ, Washington Navy Yard, DC, but work from the contractor facility is authorized. Network engineering support will be performed at either the contractor facility or NAVSEA HQ, as required.

Government facilities (i.e., office space or lab space) are provided to those contractor personnel at the Government site. Labor categories with supplied Government facilities shall be located at

3 | 14

NAVSEA HQ, Washington Navy Yard, DC. Contractor personnel assigned space within Government facilities shall provide support in accordance with the following requirements.

5.1.1 Access to Government Facilities

NAVSEA HQ and other Government installations have restricted access. Contractors supporting this PWS will generally have unrestricted access to their Government workspace. If access to the assigned Government facility is restricted due to safety/security exercise, an Executive Order, or an administrative leave determination applying to the local activity (e.g., inclement weather), the contractor, in agreement with the Technical Point of Contact (TPOC), shall make alternative work arrangements. The contractor shall adjust work schedule or work at an alternate location.

If alternate work arrangements cannot be accommodated, the contractor shall notify the TPOC of the inability to access the assigned facility prior to charging their time to the contract as direct cost provided such charges are consistent with the contractor’s accounting practices. The ability to work at an alternate location that is not a Government or contractor facility site is dependent on the contractor having an alternative work site agreement with the employee. The ability to work at an alternate location may not be an option for certain support services.

5.1.2 Parking

Parking at the Washington Navy Yard is limited to military, Government civilians, and emergency service contractors. On base parking will not be provided to employees of this contract.

The Contractor will provide any transit or parking benefits to its employees in accordance with D.C. Law 20-142 Sustainable DC Omnibus Amendment Act of 2014, D.C. Act 23-305 Amendment to the Sustainable DC Omnibus Amendment Act of 2014, and D.C. Law 32–152 Transportation Benefit Program of 2016, as applicable.

5.1.3 Training Requirements and Exercise Support

Contractor personnel working full-time at a Government facility shall complete all applicable training requirements as specified under Mandatory Training of this PWS (see Paragraph 11.0).

Contractor personnel may also be required to participate in local orientation training as well as safety, security (e.g., Anti-Terrorism Force Protection (AT/FP)), and operational training exercises (possibly two per year). Applicable contractor personnel shall support and participate in the training exercise which may include role-playing and reacting to exercise injects based on the situation or exercise objectives.

5.1.4 Alternate Work Locations from Government Facilities

As applicable to perform advance programming, testing, configuration, or other tasks supporting this PWS, the contractor personnel are authorized to work at the primary contractor facility to perform any task required by this contract.

4 | 14

5.1.5 Emergency Management at Government Installations

During emergency situations including health (e.g., COVID-19 pandemic) or weather related circumstances, contractor personnel with scheduled access to a Government installation shall coordinate with the TPOC prior to reporting to their Government worksite. Access will be in accordance with the latest Government installation requirements and restrictions.

The Government shall determine whether certain contractor personnel are designated mission essential and determine the work expectations during the emergency period of performance.

Depending on the type of support, working from an alternative worksite may or may not be allowed. To the extent possible, contractor personnel shall follow the same requirements and restrictions as Government civilian personnel at the same facility/installation in order to continue work or return to the Government workplace; requirements include, but not limited to, quarantining, completing/submitting questionnaire, and medical screening/testing prior to entering a Government facilities.

6.0 REQUIREMENTS

6.1 RELEVANT EXPERIENCE

This PWS section is intended to inform the contractor of, and require experience with, typical systems, vendors, and related certifications necessary to perform work under this contract. This is not an all-inclusive list and does not limit the scope of this contract with regards to ESS and IT systems.

6.1.1 ESS Equipment

The contractor shall provide trained and certified integrator, partner, Value Added Reseller (VAR) or similar services for the following Commercial Off-The-Shelf (COTS) Original Equipment Manufacturer (OEM) security solutions:

a. Dynamic Monitoring Product (DMP) IDS Solutions

b. Lenel IDS, AECS, and VMS Solutions

c. Bosch CCV Cameras, Encoders/Decoders, Controllers, Recorders, VMS, and IDS Solutions

d. Picture Perfect AECS Solutions

e. Software House IDS, AECS, and VMS

f. Milestone XProtect CCV Cameras, Controllers, Recorders, and VMS.

g. AIPHONE Intercom System

h. Endura Badge Printers

6.1.2 IT Equipment

5 | 14

The contractor shall provide technical capability, knowledge, industry partnerships, experience, and expertise/proficiency required to design, procure, establish, integrate, install, test, maintain and support enterprise systems solutions comprised of the following types of IT equipment and software:

a. Servers and Hosting (Windows, Linux)

b. Database (Oracle, SQL, MySQL)

c. Workstations and Thin client Workstations (Windows, Linux)

d. Domain Name Servers

e. Active Directory Servers

f. Data Storage (NAS, SAN, iSCSI, Tape)

g. Networking and Data Transport

h. Wireless

i. Local Area Networks (LAN)/Wide Area Networks (WAN)

j. Telephony

k. Secure and Non-Secure Internet Protocol.

6.2 ESS ENGINEERING AND ADMINISTRATION SUPPORT

The Contractor shall perform the following tasks in support of THE NAVSEA HQ ESS development, test, implementation, management, and operations effort.

6.2.1 Technical Reporting

All system upgrades, updates, patches, control changes, or additions require a plan detailing what change will be introduced and how the subsequent testing in the development / testing environment will be performed. These plans and procedures will be submitted per CDRL A003 before performing any changes or conducting the testing.

Following testing, all identified, uncorrected system vulnerabilities will be reported per CDRL A004 to demonstrate potential risk factors associated with the potential changes.

Monthly status reports (CDRL A002) will annotate any attempted changes made to the systems, successful application of changes made, changes that failed implementation, and any residual vulnerabilities or compliance short-falls due to failed change management.

6 | 14

6.2.2 ESS Design, Development, Integration, and Testing

Possess a comprehensive understanding of the principles, concepts, theories, and practices of physical security and supporting systems; i.e., access control, intrusion detection and response, video surveillance, detection, and response.

Provide subject matter expert (SME) support for the design, implementation, and integration of an ESS to support the NAVSEA HQ facilities.

Develop network plans/routing tables for all IP-based system components.

Develop test plans and conduct operational verification and integration testing.

Implement and test security controls in accordance with Security Technical Implementation Guides (STIGs).

Configure and manage the ACS/IDS/CCV/VMS firmware and software applications.

6.2.3 ESS Accreditation and Maintenance Support

Prepare Plans of Actions and Milestones (POAMs) and other documents in support of the RMF effort.

Maintain current hardware and software lists, physical and logical network diagrams, and ports and protocols information.

Implement and monitor security measures for access controls, video cameras, and alarm sensors, and all patches, panels, and supporting system devices.

Validate, in a test environment, system operation following software/hardware patches and updates prior to implementing in the operational environment.

Adhere to established security standards and Governmental requirements for security on these systems.

Maintain configuration control over the ESS in accordance with NAVSEA HQ configuration management policies.

6.2.4 ESS Access and Management

Design, install, and configure servers, storage systems/networks workstations, and other IT systems hardware.

Install and configure system/network software to include operating systems, database applications, storage management, and network monitoring and reporting applications.

Install system security application such as Host-Based Security System (HBSS) and data-at-rest encryption applications.

7 | 14

Install compliance monitoring software; e.g., Assured Compliance Assessment Solution

(ACAS).

Create/Establish role-based accounts for all systems and applications for administrators and users.

Implement security controls in accordance with DoD STIGs.

Develop policies, standard operating procedures, and other security artifacts as directed by the RMF manager.

Perform network compliance and vulnerability scans; identify and correct discrepancies. Provide scan results to the RMF manager.

6.2.5 ESS Operations and Sustainment

Install/Implement software patches and updates; determine impacts on system prior to use in an operational environment.

Perform periodic ACAS scans, monitor results and provide to the RMF manager.

Monitor HBSS and system logs.

Update system documentation.

Perform system backups in accordance with local policies; manage backup libraries.

Perform system restorals from backup as directed.

Provide guidance/recommendations to the Government or any hardware/software updates or additions.

Monitor software licenses and notify the Government of pending expirations.

Create and run system scripts and queries and provide access, video, and alarm reports as required.

Train new and refresher personnel on system access and use.

7.0 INFORMATION TECHNOLOGY (IT) SERVICES REQUIREMENTS

The contractor shall provide Information Technology support in accordance with the basic contract requirements.

7.1 ACQUISITION OF COMMERCIAL SOFTWARE PRODUCTS AND HARDWARE

Contractors shall not purchase commercial software products, hardware, and related services on this contract.

7.2 CYBERSECURITY SUPPORT

8 | 14

The contractor shall provide Cybersecurity support in accordance with the basic contract requirements.

7.2.1 Cybersecurity Workforce (CSWF) Designation

CSWF contractor personnel shall perform cybersecurity functions. In accordance with DoD 8570.01-M, Information Assurance (IA) Workforce Improvement Program Manual, the CSWF is comprised of the following categories: IA Technical (IAT) and IA Management (IAM)); and specialties: Computer Network Defense Service Providers (CND-SPs) and IA System Architects and Engineers (IASAEs).

Based on the IA function provided by the individual, an IA designator is assigned that references an IA category or specialty. The Contractor shall provide a report, in accordance with CDRL A001. The following Labor Categories shall meet the IA Designator, IA Level/Position, and have the estimated Primary/Additional/Embedded hours performing IA duties:

Labor Category Quantity Personnel

(FTE)

IA

Designator

(Note1)

IA

Level/Position

(Note2)

IA Duty Hours

Primary (≥25 hrs)

Additional (15-24 hrs)

Embedded (1-14 hrs)

Technical Engineer (1.0) IAT Level 1 X Network Engineer (0.25) IAT Level 2 X

8.0 CONTRACT ADMINISTRATION

Administration of the work being performed is required; it provides the Government a means for contract management and monitoring. Regardless of the level of support, the ultimate objective of the contractor is ensuring the Government’s requirements are met and delivered on schedule.

8.1 CONTRACT MONITORING, MAINTENANCE, AND MANAGEMENT

In accordance with the basic contract PWS requirements applicable to this Purchase Order, the contractor shall develop and submit documentation in accordance with CDRL A002 and CDRL A005 (see PWS, Paragraph 9.0) for contract administration and closeout.

9.0 DELIVERABLES

The following list identifies only the data item deliverables required under this contract. Unless otherwise specified, days are calendar days; one week equals 7 calendar days; 1 day equals 24 hours; and a 24-hour time period is consecutive hours that is exclusive of non-workweek days.

CDRL Name PWS A001 Cybersecurity Workforce (CSWF) Report Paragraph 7.2.1 A002 Contract Status Report Paragraph 6.2.1, 8.1 A003 Test Plans/Test Procedures Paragraph 6.2.1 A004 Cybersecurity Vulnerability Report – System Vulnerability Report Paragraph 6.2.1 A005 Status Report – Contract Closeout Report Paragraph 8.1

9 | 14

10.0 SECURITY

10.1 ORGANIZATION

10.1.1 Security Classification

As specified in the DoD Contract Security Classification Specification, DD Form 254, the contractor shall perform work requiring personnel to be cleared under this contract. At time of contract award, the contractor shall have a TOP SECRET facility clearance level (FCL).

U.S. Government security clearance eligibility is required to access and handle classified and certain controlled unclassified information (CUI), attend program meetings, and work within restricted areas unescorted.

10.1.2 Security Officer

The contractor shall appoint a Facility Security Officer (FSO) to support those contractor personnel requiring clearance and/or access to Government facility/installation and/or access to information technology systems under this contract. The FSO is typically a key management person who is the contractor’s main point of contact for security issues.

The FSO shall have a U.S. Government security clearance equal to or higher than the FCL required on this contract. The FSO shall be responsible for tracking the security requirements for all personnel (subcontractors included) utilized on contract. Responsibilities include tracking all personnel assigned Government CAC (issuance and expiration dates) and submitting visitor access requests (VAR) to NAVSEA HQ in the Defense Information Security System (DISS).

10.2 PERSONNEL

Prior to the start date of the contract, the contractor shall ensure all personnel working on the contract have obtained and can maintain favorable background investigations at the appropriate access level required by this contract, and are certified/ credentialed for the CSWF.

Investigations are not necessarily required for personnel performing unclassified work who do not require access to Government installations/facilities and/or Government IT systems/IT resources.

All personnel providing direct support to the Government shall possess a TOP SECRET personnel clearance (PCL).

11.0 MANDATORY TRAINING

All contractor working full-time at the government facility are required to be enrolled by the supported Government representative in the Total Workforce Management Services (TWMS) system. Full-time contractors must attend and complete a one-week onboarding training for new personnel. Unless otherwise noted, the contractor shall complete mandatory training annually between 1 October and 30 September utilizing TWMS, Waypoints, or Navy eLearning systems.

10 | 14

The following table is a sample of contractor mandatory training that is subject to change in accordance with Secretary of the Navy (SECNAV), Office of the Chief of Naval Operations (OPNAV), or NAVSEA instructions. Mandatory training will be listed in the TWMS or Waypoint account pages for all applicable personnel:

# Training Course Name Contractor Personnel Applicability 1 NAVSEA Newcomer’s Orientation All fulltime, onsite contractors 2 Active Shooter, Level 1 All fulltime, onsite contractors 3 Operations Security (OPSEC) All fulltime, onsite contractors 4 Antiterrorism Training, Level 1 All fulltime, onsite contractors 5 NAVSEA Annual Security Refresher All fulltime, onsite contractors 6 Records Management All contractors NMCI account holders 7 DoD Cyber Awareness Challenge All contractors NMCI account holders

Privacy and Personally Identifiable Information (PII) Awareness Training

All contractors with access to PII

12.0 GOVERNMENT FURNISHED INFORMATION (GFI)

For the purposes of this contract, Government Furnished Information (GFI) includes manuals, technical specifications, software, software licenses, maps, building designs, schedules, drawings, test data, etc. provided to contractors for performance on this contract. Depending on information contained in a document, the contractor shall comply with additional controls (e.g., completion of a Non-Disclosure Agreements, etc.) for access and distribution. The Government will mark any CUI which includes unclassified covered defense information and unclassified controlled technical information provided to the contractor. For any missing markings, contractor shall request appropriate marking from the Government.

GFI is utilized on this contract. Any applicable document covered in Paragraph 4.0 will be provided by the Government if not available online. The contractor shall inventory all GFI by tracking distribution and location and provide a GFI inventory to the Government. The contractor shall use the GFI provided to support this contract only – use of GFI document(s) to support other projects beyond this contract is not allowed.

The contractor shall return all GFI to the Government at completion of the contract. If a contractor requires additional GFI other than what is listed, the contractor shall submit a request to the TPOC within 30 days after contract award.

13.0 GOVERNMENT PROPERTY

As defined in FAR Part 45, Government property is property owned or leased by the Government which includes Government-furnished (GFP) and Contractor-acquired property (CAP). Government property is material, equipment, special tooling, special test equipment, and real property.

13.1 GOVERNMENT-FURNISHED PROPERTY (GFP)

As defined in FAR Part 45, GFP is property in the possession of, or directly acquired by, the Government and subsequently furnished to the contractor for performance of a contract. GFP

11 | 14 includes spares and property furnished for repair, maintenance, overhaul, or modification. GFP includes Government-furnished equipment (GFE), Government-furnished material (GFM), Special Tooling (ST) and Special Test Equipment (STE).

Any GFP required to perform will not be provided on this contract.

NOTE: Although NMCI assets are not tracked as GFP, a NMCI computers will be assigned to each full-time contractor. Prior to a NMCI computer being removed from a Government facility, the contractor employee shall possess at all times a Property Pass (OF-7) with each NMCI asset that will be authorized and signed by the TPOC or other authorized Government personnel.

13.2 CONTRACTOR-ACQUIRED PROPERTY (CAP)

As defined in FAR Part 45, CAP is property acquired, fabricated, or otherwise provided by the contractor for performing a contract and to which the Government has title but has not yet performed receipt and acceptance. CAP consists of Contractor-acquired equipment (CAE), Contractor-acquired material (CAM), ST, and STE.

CAP is not anticipated on this contract.

14.0 TRAVEL

No travel requirements are anticipated on this contract.

15.0 WORKWEEK

All or most of the effort under this contract will be performed on a Government installation. The contractor shall provide support services corresponding to Government workweek and core hours.

Normal workweek is Monday through Friday Normal business hours occur 0730-1600 local standard time (LST) based on location of work.

16.0 ACRONYM LIST

ACRONYM DENOTATION

ACAS Assured Compliance Assessment Solution AECS Automated Entry Control System AT/FP Anti-Terrorism / Force Protection ATO Authority to Operate ATT Authority to Test CAC Common Access Card CAE Contractor Acquired Equipment CAM Contractor Acquired Material CAP Contractor Acquired Property CCV Closed Circuit Video

CDRL Contract Data Requirements List

12 | 14

CND-SP Computer Network Defense Service Provider COTS Commercial Off-The-Shelf CUI Controlled Unclassified Information

CSWF Cybersecurity Workforce DADMS DON Application and Database Management System

DISS Defense Information Security System DITPR-DON DoD Information Technology Portfolio Repository – DON

DoD Department of Defense DoDI Department of Defense Instruction

DoDM Department of Defense Manual DON Department of the Navy EA Executive Agent eMASS Enterprise Mission Assurance Support Service ESS Electronic Security Systems FCL Facility Clearance Level FSO Facility Security Officer GFE Government Furnished Equipment GFI Government Furnished Information GFP Government Furnished Property

HBSS Host-Based Security System HQ Headquarters ICD Intelligence Community Directive IDS Intrusion Detection System iSCSI Internet Small Computer Systems Interface IA Information Assurance

IAM IA Management IAT IA Technical

IASAE IA System Architects and Engineers IT Information Technology

JCBAS Johnson Controls Building Automation Systems LAN Local Area Network LST Local Standard Time NAS Network Attached Storage

NATO North Atlantic Treaty Organization NAVSEA Naval Sea Systems Command NIWC-A Naval Information Warfare Center Atlantic

NMCI Navy and Marine Corps Internet ODC Other Direct Cost OEM Original Equipment Manufacturer OF Optional Form

OPNAV Office of the Chief of Naval Operations PII Personally Identifiable Information

POAM Plan of Actions and Milestones PWS Performance Work Statement RMF Risk Management Framework

13 | 14

SAN Storage Area Network SAP Special Access Program

SAPCO Special Access Program Central Office SCI Secure Compartmented Information

SEA 00P Office of Security Programs SEA 00P1 Security Operations Division

SEA 08 Navy Nuclear Propulsion SECNAV Secretary of the Navy

SME Subject Matter Expert SQL Structured Query Language SSO Special Security Officer ST Special Tooling

STE Special Test Equipment STIG Security Technical Implementation Guide

TWMS Total Workforce Management Services USC United States Code VAR Value Added Reseller VAR Visitor Access Request VMS Video Management System WAN Wide Area Network

14 | 14

THIS PAGE CONTAINS NECESSARY INFORMATION FOR THE PROCUREMENT

ACTION THAT IS PLACED IN OTHER SECTIONS OF THE CONTRACT

A. PERIOD OF PERFORMANCE

TBD

B. PLACE OF PERFORMANCE

C. SHIPPING ADDRESS

D. INSPECTION AND ACCEPTANCE

E. TECHNICAL POINT OF CONTACT