DRAFT PWS_Enterprise Cloud Services.pdf

Performance Work Statement (PWS)

Enterprise Cloud and Network Operations, and Management Services

19 February 2026

Table of Contents

1.0 Introduction

1.1 Background:

1.2 Purpose

1.3 Objective:

1.3 Scope

2.0 References

3.0 Period of Performance:

4.0 Place of Performance:

5.0 Performance Requirements:

5.1 Cloud and Tenant Operations

5.2 Network and SD-WAN Management

5.3 Cloud Tenant and Microsoft 365 Management

5.4 Endpoint Management

5.5 IT Service and Cloud Service Management

5.6 Records Management, eDiscovery, and Compliance

5.7 Program, Security, Financial, Technical, and Documentation Management

6.0 Security Requirements:

6.1 Security

6.2 Privacy Act Compliance:

6.3 Government Furnished Equipment (GFE):

7.0 DOD 8140 CYBER SECURITY WORKFORCE (CSWF) REQUIREMENTS:

8.0 GENERAL/ADMINISTRATIVE MATTERS:

8.1 Staffing:

8.2 Data Rights:

8.3 Contractor Quality Assurance:

8.4 Government Quality Assurance Surveillance:

8.5 Complaints Lodged Against Contractor Personnel:

8.6 Office Space:

8.7 Statement of Non-Personal Service:

8.8 Mandatory Training:

10.0 SUPPORT SERVICES/QUALIFICATIONS/DUTIES:

Position 1. Project Manager II (PM II):

Position 2. Technical Writer (SME III):

Position 3. Conditional Access Policy Administrator:

Position 4. Azure Virtual Desktop System Administrator

Position 5. Cloud Service Support Administrator/Analyst:

Position 6. Cloud Service Support Engineer (SME II):

Position 7. Cloud Application Administrator (SME II):

Position 8. Configuration Manager:

Position 9. E-Discovery Administrator (Security/FOIA/CAPSTONE):

Position 10. Identity and Entitlement Administrator:

Position 11

Position 12 Financial Specialist

Position 13 Information Assurance Analyst

Position 14 Network Specialist

Position 15 Network Analyst

Position 16 Network Engineer

11.0 QUALIFICATION REQUIREMENTS:

12.0 TRAVEL REQUIREMENTS

12.1 Reimbursement of Travel Cost (Sep 2015)

13.0 TRANSITION PLAN

13.1 Phase-In / Mobilization Phase

13.2 Phase-In / Mobilization Phase

14.0 MISSION ESSENTIAL:

15.0 DELIVERABLES

15.1 Contractor Quality Assurance Plan (QASP)

15.2 Monthly Status Report

15.3 Contract Kick-Off Meeting

15.4 Program Management Plan (PMP)

15.5 Trip Reports

15.6 Specific Work Products

15.7 Monthly Financial Report

16.0 TRAINING REQUIREMENTS AND OPPORTUNITY:

17.0 SERVICE CONTRACT REPORTING (SCR) (NMCARS 5237.102-90):

1.0 Introduction

1.1 Background:

The Navy has transitioned from an on-premise IL5 architecture to a cloud centric, zero trust architecture. Contractor support will include the operations and management, sustainment, and support for Cloud Environments and Services, including the current Azure Impact Level (IL) 4/5 security environment and Intune Management of Nautilus Endpoints.

Simerly, the Navy is transitioning the current on-premise classified architecture to a cloud centric, zero trust, IL6 architecture that enables secure access to Navy Cloud Services and its open and flexible cloud computing platform. The initiatives are aimed at bolstering Cloud

Computing productivity services and network services while improving resiliency in the unclassified (IL5) and classified (IL6) environments across the Continental United States

(CONUS) and outside CONUS (OCONUS). IL6 is reserved for storing and processing information classified up to the SECRET level, which pertains to classified information that, if compromised, could pose serious damage to national security interests. Efforts will include maximizing security and availability, while leveraging cloud efficiencies that include Artificial

Intelligence and Machine Learning (AI/ML). Contractor support will augment the government workforce, in some cases on a 24x7 basis, while standing up a classified IL6 cloud environment, implementing and executing IT service management (ITSM) processes, maximizing efficiencies across both tenants, and delivering weekly status reports depicting network health and user impact. Contractor support will include sustaining the cloud security environment, and augmenting the management, sustainment, and establish cloud support model for the enterprise cloud architectures and future cloud services. The enterprise architectures are designed to support robust authentication, device hardening, and the reduction of the overall attack surface;

improvements shall enhance capabilities to detect and quickly respond to adversarial activities.

The implementation of IL5 and IL6 cloud services are instrumental in elevating the Navy's cybersecurity posture and advancing all concepts demanded in a Zero trust model. Furthermore, Microsoft Azure expertise is sought-after, with cloud experience desired with commercial cloud service providers (CSPs) such as but not limited to Amazon Web Services (AWS) and Google

Cloud Platform (GCP), to facilitate expanding the existing Flank Speed (FS) infrastructure, including integrating with enterprise identity services, such as Naval Identity Services (NIS), the execution of design refinements, the deployment of additional advanced security features through automation, and the incorporation of new collaboration functionalities. These capabilities are essential to enhancing zero trust principles while further improving capabilities that include Hyper Converged (HCI) stacks that deliver enhanced computing power and more adaptable access to data and services hosted at the edge.

This PWS specifically covers Enterprise Cloud Services, Operations and Maintenance (O&M) for IL5 and IL6. While the primary operating platform will be hosted on Microsoft’s Azure, contractor support is expected to extend across other cloud services such as AWS, Google, and

Oracle.

1.2 Purpose

The purpose of this PWS is to define requirements for the operations, sustainment, management, and defense of the Government’s enterprise cloud and network ecosystem, with primary emphasis on 24x7 service operations. This PWS provides performance-based requirements to ensure confidentiality, availability, performance, compliance, and security for Microsoft Azure, Microsoft 365, Intune-managed endpoints, SD-WAN, and other CSP environments, while remaining cloud-agnostic to support multi-cloud operations.

1.3 Objective:

The objective is to procure a non-personal services contract to aid the government in various efforts, including Service Strategy, Service Design, Service Operations, Service Transition, and

Continual Service Improvements across the cloud tenant. Contractor support must include, but not limited to architectural design, process development, network and service monitoring, sustainment, implementation, incident resolution, operations and maintenance of advanced security automation and collaboration features. These capabilities are essential to facilitate maximum access to Microsoft Azure Cloud services in a rapidly evolving operational networking environment, which will also extend to support AWS and Google services and Naval

Exchange Point (NXP) Integration. Enterprise services and network access to the maximum extent feasible is crucial for users operating from any site utilizing Department of Defense (DoD) networks and shall align with the guidance as outlined in USCYBERCOM PLANORD 20-

0042. Additionally, contractor services are required to deliver ongoing support for enterprise account management (i.e., e-Discovery, Records Management, Litigation Hold, CAPSTONE, etc.), and the migration of NXP network components, along with all associated support activities.

This framework, founded on Azure identity and security services, will enable maximum access and secure convergence of both IL5 and IL6 environments that span across NMCI, ONE-Net, IT-

21/CANES, and the Excepted networks. The totality of all efforts are crucial to broadening cloud capabilities, maximizing resiliency, and implementing state-of-the art technical advances using AI/ML; all work is intended to fully support future application integration as part of the broader Navy cloud migration strategy.

1.3 Scope

The scope of work encompasses the management of operational data, systems, and applications spanning several Impact Levels (IL) of information management, including IL 4, 5, 6, network transport, and Hyper-converged infrastructure (HCI) Stacks while addressing all use cases involving Controlled Unclassified Information (CUI), Classified Information, and Navy Nuclear

Propulsion Information (NNPI). For direct contractor support within the IL6 environment, access to classified information at government facilities is required for all support staff. The ongoing implementation of an architecture that supports cloud services and the maturation of zero trust principles represent a significant transformation for both the Navy and the broader DoD. This transformation will demand substantial efforts, including the development or update of security policies, the re-engineering of systems, and the retraining of personnel to effectively operate, maintain, and secure the IL5/IL6 Azure Cloud environments. Furthermore, the Navy will continue to maximize the utilization of new collaboration and productivity features that require meticulous planning, engineering, configuration, and change management. The Navy's strategy also includes migrating additional excepted networks and new applications into the IL5/IL6

Cloud architecture, to include Multi-Tenant Organizations (MTO). Architecture improvements include implementing enterprise cloud solutions that include installing Azure HCI Stacks that will effectively bring cloud services closer to end-users. This shift aligns with network resiliency and the Navy's objectives to enable an enhanced teleworking environment while concurrently reducing data center footprints and embracing modern cybersecurity principles, such as zero trust.

The ongoing development of the enterprise Azure cloud framework is crucial as it will facilitate centralized management and monitoring, improve network flexibility, and expedite the expansion of increased compute capacity and mission workloads where required. Additionally, this contract will support implementing a Records Management capability within the IL5/IL6 cloud tenant to meet Department of the Navy (DON) data retention, legal Litigation Hold, CAPSTONE requirements and e-Discovery search requests. The contractor shall provide enterprise IT support services, including but not limited to help desk, network operations, and cybersecurity.

The Contractor shall provide continuous operational, sustainment, management, and defense services for enterprise cloud and network systems. Services include administration of Microsoft ecosystem environments, endpoint management, SD-WAN operations, cybersecurity defense, ITSM functions, performance monitoring, reporting, incident resolution, and continual service improvement. The Contractor shall also support service design and strategy activities to ensure operational feasibility, maintainability, and alignment with evolving Government priorities.

2.0 References

a) DoD Directive 8140.01 CYBERSPACE WORKFORCE MANAGEMENT

b) SECNAV M-5239.2 Department of the Navy CYBERSPACE INFORMATION

TECHNOLOGY AND CYBERSECURITY WORKFORCE MANAGEMENT AND

QUALIFICATION MANUAL

c) FAR 52.217-8 Option to Extend Services

d) Memorandum for Distribution: Subj: IT LEVEL DESIGNATION ON DD FORM 2875

SYSTEM AUTHORIZATION ACCESS REQUEST

3.0 Period of Performance:

The resultant Indefinite Delivery, Indefinite Quantity (IDIQ) contract will consist of the following five-year base ordering period and will contain FAR 52.217-8 – Option to Extend

Services to allow for a six-month extension of the ordering period if circumstances necessitate the exercise of this option. The ordering periods are as follows:

Period of Performance

One 5-Year Base Period 25 February 2027 – 24 February 2032

FAR 52.217-8 25 February 2032 – 25 February 2033

4.0 Place of Performance:

Work in accordance with this PWS shall be performed at:

(1) Primary Location: Naval Network Warfare Command, 112 Lake View Parkway, Suffolk, Virginia 23435.

(2) Secondary Locations at designated government facility (i.e., W-143 Norfolk, Virgina;

Chesapeake Facility).

(3) Local Telework via authorized VPN standards as directed by Government Contracting

Officer Representative (COR) and periodic alternate work location to support command teambuilding activities.

The contractor will not perform regular day-to-day work at any other location unless that work has been authorized by the Contracting Officer's Representative (COR).

5.0 Performance Requirements:

The Contractor Support (CS) shall provide comprehensive operations, incident resolution, sustainment, management, and defense services in accordance with DoD, DISA, and NIST guidance, while adhering to ITIL-based service operations best practices. CS is required to assist the Navy with worldwide acceleration and migration to Flank Speed, Nautilus and cloud service monitoring, network services and availability, and to sustain the continually evolving security and productivity features using zero trust secure technologies.

5.1 Cloud and Tenant Operations

The Contractor shall:

5.1.1 Operate, maintain, and secure Department cloud tenants within Microsoft Azure or equivalent CSP environments accredited for IL5 and IL6 workloads, ensuring compliance with

DoD cybersecurity, Security Technical Implementation Guides (STIGs), and Risk Management

Framework (RMF) requirements.

5.1.2 Engineer and implement solutions enabling key service dependencies, including identity management, authentication, routing, and hybrid integrations across on-premise, cloud environments and HCI stack resources.

5.1.3 Identify, document, and recommend decoupling strategies for hybrid dependencies, including DNS, load balancing, proxy services, and directory synchronization.

5.1.4 Perform capacity planning and lifecycle management of cloud subscriptions, resource groups, and workloads to ensure optimal performance, scalability, and cost efficiency.

5.1.5 Implement monitoring and alerting using native tools (e.g. Azure Monitor, Log Analytics, Purview, Sentinel) or equivalent CSP monitoring platforms for proactive incident detection and remediation.

5.1.6 Develop and maintain Continuity of Operations (COOP) and Disaster Recovery (DR) plans for cloud tenant services updating as needed, reviewing annually; testing failover and recovery plans and procedures annually at a minimum.

5.1.7 Manage Role-Based Access Control (RBAC), Privileged Identity Management (PIM), and audit administrative access logs for compliance and least-privilege enforcement.

5.1.8 Implement and manage governance controls such as Azure Policy, Blueprints, and tagging or equivalent CSP policy enforcement to standardize configuration and compliance.

5.1.9 Maintain cost management dashboards, resource tagging, and utilization reports to support

Government oversight and financial transparency.

5.1.10 Support cloud architecture development and configuration design aligned with Zero Trust principles and DODIN connectivity requirements.

5.1.11 Coordinate with Government and vendor stakeholders to ensure configurations comply with DoD Cloud SRG and FedRAMP security baselines.

5.1.12 Operate and maintain edge or hybrid HCI stacks (e.g. Azure Stack or equivalent CSP hybrid platform) at Government and/or Commercial data centers to optimize performance and ensure operational continuity.

5.2 Network and SD-WAN Management

5.2.1 Operate, monitor, and maintain network infrastructure supporting cloud and Microsoft 365 connectivity including routers, firewalls, SD-WAN appliances (i.e. NXP), and encryption devices.

5.2.2 Perform end-to-end SD-WAN management across CONUS and OCONUS locations, AFLOAT, maintaining configuration synchronization and connectivity compliance.

5.2.3 Manage firmware updates, configuration backups, and rollback plans for SD-WAN devices and controllers.

5.2.4 Monitor network performance metrics including latency, jitter, and throughput, maintaining service levels in accordance with approved thresholds.

5.2.5 Manage routing policies, quality of service (QoS) parameters, and segmentation rules consistent with DoD transport security requirements.

5.2.6 Perform proactive diagnostics, analyze transport anomalies, and coordinate with DoD or vendor entities for resolution.

5.2.7 Comply with Network Configuration Management Plans and sustain a Configuration

Management Database (CMDB) tracking all SD-WAN and network assets and configuration items.

5.2.8 Ensure all network configurations comply with encryption and cybersecurity standards defined by DISA and DoD CIO.

5.2.9 Manage network baselines, align with change control actions, and incident resolution activities within the approved ITSM system.

5.3 Cloud Tenant and Microsoft 365 Management

5.3.1 Administer M365 and equivalent SaaS platforms to include but not limited to Exchange

Online, SharePoint, OneDrive, Teams, Intune, and Virtual Desktop infrastructure.

5.3.2 Manage identity and access cloud directory services (i.e. Microsoft Azure Entra ID or equivalent Active Directory), ensuring synchronization with DoD Global Directory and DISA

(i.e. Defense Enterprise Provisioning Online (DEPO), etc.) identity and entitlement provisioning processes.

5.3.3 Administer user and administrative accounts, roles, and access privileges according to least-privilege principles.

5.3.4 Monitor and remediate synchronization, licensing, and access issues within the tenant environment.

5.3.5 Manage Conditional Access, Defender for Cloud Apps, and equivalent security policies, ensuring compliance documentation and testing validation are maintained.

5.3.6 Manage licensing allocation, reclamation, and forecasting for all Microsoft 365 or equivalent services.

5.3.7 Coordinate and validate feature rollouts, updates, and service changes; conduct impact assessments, and communicate release schedules to stakeholders.

5.3.8 Perform tenant-level health assessments, readiness checks, and service optimization to sustain operational reliability.

5.3.9 Ensure data retention, backup, and recovery processes meet DoD and NARA requirements for mission-critical workloads.

5.3.10 Manage hybrid integrations (Exchange Hybrid, AAD Connect, or equivalent) ensuring secure coexistence and continuity between on-premise and cloud environments.

5.3.11 Maintain governance over collaboration platforms, including SharePoint and Teams, ensuring appropriate permissions, structure, and lifecycle management.

5.3.12 Produce operational dashboards and reports on tenant availability, license utilization, and

SLA performance.

5.4 Endpoint Management

5.4.1 Operate and maintain endpoint management solutions (Microsoft Intune or equivalent) to enforce configuration baselines, compliance policies, and patch management.

5.4.2 Manage endpoint enrollment, provisioning, and retirement for all devices (Windows, iOS, Android, and other supported platforms).

5.4.3 Enforce device compliance policies for encryption, antivirus, OS version, and security posture.

5.4.4 Maintain endpoint groups, configuration profiles, and conditional access policies integrated with Azure AD or equivalent identity platform.

5.4.5 Integrate endpoint protection with Defender for Endpoint or equivalent, ensuring Zero

Trust enforcement and continuous monitoring.

5.4.6 Monitor and respond to endpoint security alerts, remediating compliance drift within defined SLAs.

5.4.7 Maintain standard operating system images, application deployment packages, and automation scripts for consistent endpoint configuration.

5.4.8 Provide monthly reports detailing device compliance rates, patch status, and endpoint health metrics.

5.5 IT Service and Cloud Service Management

5.5.1 Perform IT Service Management (ITSM) in accordance with DoDI 8440.01, ITIL, and the

DESMF framework, including:

• Incident Management

• Problem Management

• Change Management

• Configuration Management

• Event Management

• Identity and Access Management

• Service Request Management

• Information Security Management

• Security Compliance

5.5.2 Integrate ITSM tools with CSP-native monitoring systems to support automated alerting, event correlation, and incident escalation.

5.5.3 Maintain ITSM artifacts including CMDB updates, change requests, problem records, and incident reports.

5.5.4 Develop and report SLAs, KPIs, and performance metrics for cloud and network operations.

5.5.5 Provide dashboards and analytics reflecting service health, availability, cost, and compliance posture.

5.5.6 Develop and maintain knowledge articles, standard operating procedures, work instructions, and other plans, procedures and lessons learned within a central knowledge repository.

5.5.7 Support RMF accreditation, compliance assessments, and cybersecurity audits for all operational environments.

5.6 Records Management, eDiscovery, and Compliance

5.6.1 Execute Records Management processes to support search, retrieval, litigation hold, eDiscovery requests, and Capstone compliance in accordance with DoD policy.

5.6.2 Generate and distribute audit logs and compliance reports from Microsoft Purview or equivalent CSP compliance tools.

5.6.3 Create and manage eDiscovery cases, content searches, and disposition workflows.

5.6.4 Perform data disposition, destruction, or archival transfer to NARA per applicable policies.

5.6.5 Support electronic spillage response and execute containment, remediation, and reporting procedures.

5.7 Program, Security, Financial, Technical, and Documentation Management

5.7.1 Provide program and project management for all deliverables and maintain alignment with

Government objectives and mission outcomes.

5.7.2 Develop and submit monthly progress, risk, and financial reports in Government-approved formats.

5.7.3 Maintain TTPs, SOPs, and process documentation across all service areas, updating them as environments or policies evolve.

5.7.4 Develop and maintain COOP documentation, system design packages, and operational diagrams for cloud and network environments.

5.7.5 Provide technical briefings, reports, and executive updates summarizing current performance, issues, and improvement initiatives.

5.7.6 Maintain authoritative documentation repositories accessible to Government-designated personnel.

5.7.7 Provide financial analysis and budget reporting support

5.7.8

6.0 Security Requirements:

6.1 Security: The contractor shall be responsible for adhering to all Department of Defense

(DOD), Department of the Navy (DON) and Command instructions, guidance, orders, directives, and supplements relative to performing tasks set forth in this PWS. The contractor and its contract service providers shall not disclose and must safeguard procurement sensitive information, operationally sensitive data, computer systems and data, Privacy Act data, law enforcement data, litigation related data, and Government personnel work products that are obtained or generated in the performance of this contract. This includes dissemination of protocols and papers not generally available through public literature. Neither the contractor nor any of its contract service providers shall disclose or cause to disseminate any information concerning operations of military activities. Such action(s) could result in breach of the contract and possible legal actions.

Access will be granted to Government facilities as required in support of the tasking. Contractor personnel performing work under this contract must meet all requirements for gaining access to

US Government installations. The contractor shall conform to all DoD, DON, and local

(base/installation) security instructions; refer to Contractor Unclassified and Classified Access to

Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or

Protected Health Information.

The scope of work requires all contractor personnel to hold a security clearance. For general administrative work, personnel must hold a Secret clearance, which requires a Tier 3

(T3) investigation. For personnel with domain/root level administrator accounts, a Top

Secret clearance, which requires a Tier 5 (T5) investigation (or equivalent), is mandatory.

Contractor personnel must possess the appropriate final or interim clearance by the first day of the period of performance. Where annotated, certain positions may require a Secret clearance that is supported by a Single Scope Background Investigation (SSBI)/Tier 5 investigation.

An Interim Top Secret clearance, granted upon the initiation of an SSBI, is acceptable pending final adjudication.

All work is to be performed in accordance with DOD and Navy Operations Security (OPSEC) requirements and in accordance with the DD Form 254 and all attachments.

The contractor shall comply with all applicable federal, state, and local laws and ensure performance is secure while protecting material, equipment, and supplies from damage and loss.

Government security personnel shall have the express right to inspect for security violations at any time during the term of the contract.

The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment and materials shall be secured.

The Common Access Card (CAC) card serves as the primary method of identification for the contractor employees, as well as providing the basis of Public Key Infrastructure (PKI) access to the Navy/Marine Corps Intranet (NMCI), the NCDOC Excepted network, and numerous Navy web sites, which may also require PKI access. The COR shall assist in providing the contractor the appropriate documentation for obtaining CACs. The contractor shall be responsible for obtaining any Government issued identification cards from former employees or employees whose access has been terminated and to turn those items over to the COR upon termination of employment or access.

Contract personnel shall wear a badge that clearly identifies them as a contractor employee. The badge will be issued by the COR, via the Special Security Office (SSO), and will contain a personal picture, name of employee, and contractor's name. Badges shall be worn on the outer garment, above the waist, in full view at all times, attached to the outer shirt or jacket pocket by a button or clip or worn around the neck secured by an appropriate identification card lanyard.

6.2 Privacy Act Compliance: The contractors may be in contact with data and information subject to the Privacy Act of 1974 (Title 5 of the U.S. Code Section 552a). The contractors shall ensure that its employees assigned to this effort understand and adhere to the requirements of the

Privacy Act and to Department of Defense and Department of the Navy regulations that implement the Privacy Act. Department of Navy policy and procedures implementing the

Privacy Act are detailed in SECNAVINST 5211.5E (Department of the Navy (DON) Privacy

Act (PA) Program). The contractors shall identify and safeguard data, information and reports accordingly. In addition, the contractor shall ensure that contractor employees assigned to the contract are trained on properly identifying and handling data and information subject to the

Privacy Act prior to commencing work.

6.3 Government Furnished Equipment (GFE): GFE will be provided to contractor employees as needed to complete the tasks set forth in this performance work statement. Access to classified information must be granted in accordance with the terms and conditions contained in DOD

Manual 5220.22-M and DD Form 254 (Contract Security Classification Specification). The contractor shall comply with all current information assurance awareness, information security policies, procedures, and statutes applicable to DOD information technology; including DOD

Instruction 8500.01 on Cyber Security.

7.0 DOD 8140 CYBER SECURITY WORKFORCE (CSWF)

REQUIREMENTS:

The contractor shall ensure employees have all required certifications/licenses (current and valid) for each applicable occupation category before commencement of work. Contractor must meet this qualification upon first day of employment.

Procedures surrounding the qualification of the DON Cyberspace IT/Cybersecurity Workforce must be in accordance with DoD Directive 8140.01. The SECNAV M-5239.2 establishes mandatory procedures for the uniform identification, management, and qualification of the

Cyberspace IT/Cybersecurity Workforce (Cyber IT/CSWF). The contractor must demonstrate upon request by the COR that all Cyber IT/CSWF personnel have met and maintains the minimum qualification standards of their assigned Specialty Area and proficiency level throughout the duration of this contract. DON has identified appropriate training, education, and industry certification requirements along with proficiency demonstration in the lab or on the job.

All contractor personnel are required to carry an approved certification for their particular job classification.

Any full or part-time contractor personnel, with privileged access to a DoD information system, performing Cyber Security (information assurance) functions, regardless of job or occupational series, must meet the requirements associated with the CSWF specialty area outlined in the position description to maintain employment as part of this contracting effort. Additionally, all contractors must participate in a continuous learning program as described in SECNAVINST

1543.2. A minimum of 20 hours of Cyber IT/CSWF related continuous learning must be annually documented and available to NNWC’s CSWF Program Manager and/or COR.

Additionally, all contractor personnel must provide proof that required annual maintenance fees are paid within seven (7) days of the due date.

All reporting contractor personnel must meet the requirement for their position immediately upon arrival.

8.0 GENERAL/ADMINISTRATIVE MATTERS:

The contractor shall only conduct business with designated government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the contractor by the government COR, in writing, and updated as necessary throughout the contract period.

All inquiries, comments or complaints arising from any matter observed, experienced, or learned of as a result of or in connection with the performance of this contract, the resolution of which may require the dissemination of official information, shall be directed to the COR. The COR will forward inquiries, comments or complaints to the Contracting Officer (KO).

8.1 Staffing: The contractor shall provide a fully qualified workforce on the first day of contract performance.

All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Additionally, they must clearly indicate on email title blocks their company name and that they are contractor personnel.

All positions are defined to fulfill tasking based on working hours. For the purpose of this PWS, Full-Time Employee (FTE) is defined as 1920 billable work hours per calendar year.

8.2 Data Rights: It is the Government’s intent to retain unlimited rights to all software, documentation, and data first produced in performance of the task.

U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports are maintained by the contractor, but remain the property of the U.S. Government. These files/results must be surrendered to the COR immediately upon demand.

8.3 Contractor Quality Assurance: The contractor shall develop and maintain a Quality

Assurance Plan (QA Plan) in order to ensure only qualified personnel, as defined in the position descriptions, are assigned to fulfill the requirements stated in this PWS. The contractor shall detail in its quality assurance plan how it intends to maintain personnel qualifications and ensure contract employees have up-to-date training and knowledge in their respective areas of endeavor.

This QA Plan shall detail the methodology to be used by the contractor to monitor and grade the performance of its personnel as they carry out the requirements of this PWS. The QA Plan shall address the contractor’s courses of action to address under-performing employees.

8.4 Government Quality Assurance Surveillance: The Government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance

Surveillance Plan (QASP). This plan is primarily focused on what the Government must do in order to ensure that the contractor is performing in accordance with the performance standards.

It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

8.5 Complaints Lodged Against Contractor Personnel: In the event that a complaint is made regarding the conduct or ability of contractor personnel, the individual receiving the complaint will contact the COR. The COR will notify the contractor. The Contract Overarching Project

Manager and COR will cooperate in investigating complaints made against contractor employees. If the results of the investigation prove the complaint(s) to be valid, the contractor shall have a maximum of three (3) working days to propose a corrective plan for resolving the matter and preventing future similar occurrences. This plan shall be submitted in writing to the

Contracting Officer and COR. In the event that the Government deems the corrective plan insufficient for resolution of the problem, a written response to the contractor shall be provided within three (3) working days.

8.6 Office Space: Government will provide office space, desk, chair, and common office supplies. In addition to office space, each contract employees shall be provided with access to

Government computers and telephones, but not cellular phones, for official use only. Under no circumstances will contractor-provided personal computers, electronic devices, or cellular phones be connected to the Navy/Marine Corps Intranet (NMCI). Contractor personnel shall comply with all DOD and Navy internet usage and cybersecurity policies.

8.7 Statement of Non-Personal Service: Contractor employees performing services under this contract will be controlled, directed, and supervised at all times by management personnel of the contractor. Contractor management shall ensure that employees properly comply with the performance work standards outlined in the PWS. Contractor employees shall perform their duties independently, under the supervision of, an appointed Government official. The tasks, duties, and responsibilities set forth in this contract shall not be interpreted or implemented in any manner that results in contractor employees creating or modifying Federal policy, obligating the appropriated funds of the United States Government, overseeing the work of Federal employees, providing direct personal services to Federal employees, or otherwise violating the prohibitions set forth in

Parts 7.5 and 37.1 of the Federal Acquisition Regulation (FAR) https://www.acquisition.gov/browse/index/far The Government shall control access to the facilities and shall perform the inspection and acceptance of completed work.

8.8 Mandatory Training: Government has annual training requirements for the safety and security of personnel and data that will be required to be completed by all assigned contractors.

This training will be provided by Government personnel, either in person or via computer, for completion during normal working hours. The COR will provide the annual required training list to the Company Program Manager on an annual basis, and completion will be tracked by the

COR.

10.0 SUPPORT SERVICES/QUALIFICATIONS/DUTIES:

Historically, the Scope of Work above is provided via fulfillment of the following positions:

Position

Number

Labor Category Clearance Level of

Effort Per

Labor

Category

Quantity of

FTE

Position 1 Project Manager II Secret 1920 hours 1

Position 2 Technical Writer III Secret 1920 hours 1

Position 3 Conditional Access Policy

Admin

Top Secret 3840 hours 2

Position 4 Azure Virtual Desktop Sys

Admin

Top Secret 23040 hours

Position 5 Cloud Service Support

Admin/Analyst

Top Secret 40320 hours

Position 6 Cloud Service Support

Engineer

Top Secret 34560 hours 18

Position 7 Cloud Application Admin Top Secret 9600 hours 5

Position 8 Configuration Manager Top Secret 11520 hours 6

Position 9 E-Discovery Administrator

(Security/FOIA/CAPSTONE)

Top Secret 40320 hours 24

Position 10 Identity and Entitlement

Admin

Top Secret 5760 hours 3

Position 11 IT Infrastructure Security

Specialist

Top Secret 1920 hours 1

Position 12 Financial Specialist Secret 1920 hours 1

Position 13 Information Assurance

Analyst

Top Secret 5760 hours 10

Position 14 Network Specialist Top Secret 95000 hours 50

Position 15 Network Analyst Top Secret 19200 hours 10

Position 16 Network Engineer Top Secret 19200 hours 10

Position 1. Project Manager II (PM II):

DESCRIPTION:

These positions have been designated as a Cyber IT/Cybersecurity Workforce position in

Specialty Area 802, and as a condition of employment incumbents of the position is required to comply with the DON Cyber IT/CSWF Program requirements of SECNAV M-5239.2. Manages strategy, personnel, infrastructure, policy enforcement, emergency planning, security awareness, and/or other resources. Coordinate the efforts of subordinate SMEs including approval of and compliance with Tactics, Techniques and Procedures (TTPs) and Standard Operating Procedures

(SOPs); coordinate with Naval Network Warfare Command (NNWC) teams to maximize effect of analysis of Flank Speed-generated data; and provide day to day leadership and guidance to all members of the Operation Flank Speed Effort. The contractor shall facilitate delivery of OFS

Program Management tracking / artifacts / documentation to the COR or his / her designated representative.

QUALIFICATIONS REQUIRED:

• Clearance requirement is SECRET

• Experience managing 30+ people

• 12 years IT experience with MS365 Software as a Service offerings, cloud applications, and network management

• Extensive understanding of operating systems and networking

• Organizational skills

• Capable of managing multiple projects

• Great communication skills (oral and written)

• Azure Fundamentals Certification

• Microsoft 365 Fundamentals Certification

• Comprehensive understanding of cloud computing and networking

• Azure Firewall Knowledge

• Experience with Microsoft Office suite and PowerShell

• Experienced in the administration of Microsoft SharePoint

CONTRACTOR SHALL:

Provide administrative support for centralized preparation of all contract related deliverables, and ensure contractor deliverables are aligned with critical agency priorities.

Provide financial management support for centralized tracking, analysis and reporting all contract related funding, costs, and expenditures required the execution of this contract.

• Prepare monthly status/progress report for contract tasks

• Prepare monthly contract financial reports

• Prepare technical reports as required by specific projects

• Provide contract tracking deliverables to the COR monthly

• Liaison between contractor workforce and NNWC leadership for administrative purposes

• Ensure all contractor tasks are accomplished in a timely manner and that the proper support is being delivered

• Ensure product delivery is in alignment with intended government outcomes

• Deliver and maintain all TTPs/SOPs and exceptions assigned by government lead

• Coordinate and deliver additional tasking as assigned by OFS government leads; ensuring product delivery is in alignment with intended outcomes

Have knowledge to effectively oversee contractor workforce AND augment contractor workloads while performing the following functions:

• Managing Azure identities and governance

• Implementing and managing storage

• Monitoring and conducting back-up to Azure resources

• Configuring and managing virtual networking

• Be familiar with the hierarchal structure utilized in SharePoint sites hosted in Flank

Speed

• Provide support for Teams Live Events as requested

• Monitor Microsoft 365 Admin Center for service-related incidents, outages, and feature releases

• Monitor Azure Information Protection data labels and controls

• Participate in various ITSM roles and activities (as required) including but not limited to change management, incident management and problem management

• Monitor, analyze and respond to alerts from M365 SaaS cloud operational and security tools and services

• Analyze SaaS cloud operational performance and trends, and support applications and systems on premise, in cloud, inclusive of network, server, and endpoints

• Deploy and manage virtual machines in Azure to support a large user base

• Provide technical support to the Enterprise Flank Speed Tier 2 service desk for troubleshooting issues as required

• Review and provide recommendations regarding group policy and end user software

• Provide recommendations regarding hierarchal management of SharePoint sites hosted in

OFS

Position 2. Technical Writer (SME III):

The contractor shall perform quality reviews, rewrites, and editing of a wide-range of documentation throughout the command. Works with technical experts to develop, design, edit, all forms of documentation to include Standard Operating Procedures (SOPs), Process Guides, Instructions, Notices, Memorandums, Concept of Operations (CONOPS), and other written deliverables as requested.

• Clearance requirement is SECRET

• 3+ years IT experience

• Fluent spoken and expert written English language skills

• Experience in authoring executive level documentation written requirements, drafting

Operating Procedures, delivering/documenting test results, etc.

• Expert level experience in Microsoft Word, and PowerPoint to include creating/applying styles, headers, footers, etc.

• Familiar with tracking changes and version control

• Experience with a Configuration Management tool (SharePoint) is preferred

• Robust attention to detail

• Strong organizational skills, with the ability to work on multiple projects with multiple deadlines

• Proven ability to collaborate and negotiate with multiple stakeholders to steer and document projects through the requirements phase, establish a consensus, and complete within established timeframe

• Be able to write for multiple audiences: project managers, subject matter experts, developers, system administrators, QA testers, technical support, end users, and executive decision makers.

• Be able to write multiple documentation types, technical and non-technical: design specifications, technical requirements, installation procedures, system administration/management, test plans

• Working knowledge of the Information Technology Infrastructure Library (ITIL)

Framework

• Working knowledge of government CIVPERs classification processes, as required to write evaluation statements for positions that will transition to CES

• Develop detailed technical and non-technical briefings, providing informational updates to chain of command in current and future development and implementation of measurements and data strategies

• Combine disparate materials into documents that flow logically and speak with one voice.

• Translate complex concepts and solutions into multiple types of documents

(requirements, compliance, SOPS, test results, etc.)

• Draft documentation, user guides for all user levels, technical support and FAQs, as well as executive summaries

• Develop Standard Operating Procedures (SOPs), checklists, workflow process charts, forms, Points of Contact (POC) lists, and other documentation needed to support processes and related IA functions

• Create and maintain existing and potential data sources for local consumption;

collaborate with data architect to ensure data sources availability

• Develop MS Power Point slides, MS Excel workbooks, and executive level word documents for review and forwarding to leadership

• Create and maintain existing and potential data sources for local consumption;

collaborate with data architect to ensure data sources availability

Position 3. Conditional Access Policy Administrator:

Specialty Area 461 and as a condition of employment incumbents of the position is required to comply with the DON Cyber IT/CSWF Program requirements of SECNAV M-5239.2. The contractor shall perform tasks associated with the development, testing, deployment, and documentation of Microsoft Azure Conditional Access and Microsoft Defender for Cloud

Application policies.

• Clearance requirement is TOP SECRET

• 5+ years IT experience with significant experience with Microsoft Azure

• Azure Fundamentals Certification

• Azure Administrator Certification

• Understanding of cloud computing and networking

• Superior organizational skills

• Capable of managing multiple projects

• Great communication skills (oral and written)

• Familiar with tracking Access Requests and account provisioning

• Experience with Account and Access Management capabilities/tools

• Familiar with M365 SaaS Personas, and license types

• Strong attention to detail

• Working knowledge of the Information Technology Infrastructure Library (ITIL)

Framework

• Maintain detailed documentation of conditional access policy, including archiving relevant configuration files to a centralized data repository

• Develop, document, test, and deploy Microsoft Azure conditional access policies.

• Develop, document, test, and deploy Microsoft Defender for Cloud Applications policies.

• Perform verification and validation that approved changes are made properly

• Perform account access provisioning and de-provisioning based on approved processes

• Evaluate policies to ensure compliance with DoD Tenant Configuration Guides

• Where development outpaces existing guidance, support development of DoD Tenant

Configuration Guides with mission partners and DISA.

• Monitor Message Center for feature releases that have the potential to impact existing configuration, access roles and personas

Position 4. Azure Virtual Desktop System Administrator

This position has been designated as a Cyber IT/Cybersecurity Workforce position in Specialty

Area 461 and as a condition of employment incumbents of the position is required to comply with the DON Cyber IT/CSWF Program requirements of SECNAV M-5239.2. Administers

Navy Flank Speed Azure desktop environment server-based systems, security devices, distributed applications, network storage, and performs systems monitoring. Consults on network, application, and customer service issues to support computer systems’ security and availability.

• Comptia Sec +

• 5+ years IT experience with significant experience with Microsoft Azure

• Relevant experience as a Windows system administrator

• Understanding of cloud computing and networking

• Experience with PowerShell

• Knowledge of Microsoft Cloud Security and Data Governance Tools

• Superior organizational skills

• Capable of managing multiple projects

• Great communication skills (oral and written)

• Strong attention to detail

• Deploy and manage virtual machines in Azure to support a large user base

• Closely monitor session statistics to develop and refine usage metrics to inform provisioning additional resources or shutting down unused resources; assist in development of service optimization models

• Provide technical support to the Enterprise Flank Speed Tier 2 service desk for troubleshooting issues as required

• Manage Windows image to include group policy and end user software

Position 5. Cloud Service Support Administrator/Analyst:

comply with the DON Cyber IT/CSWF Program requirements of SECNAV M-5239.2. The contractor shall perform tasks associated with the administration of Microsoft 365 Software as a

Service (SaaS) offerings, to include AZURE Virtual Desktop, Intune, Exchange Online, OneDrive, Teams, and SharePoint. Additionally, the contractor will perform administrative functions associated with Azure Information Protection/data labeling and control.

• 3+ years IT experience Azure Cloud Administrator in an enterprise level cloud computing environment

• Azure Fundamentals Certification

• Microsoft 365 Fundamentals Certification

• Comprehensive understanding of cloud computing and networking

• Azure Firewall Knowledge

• Experience with Microsoft Office suite and PowerShell

• Experienced in the administration of Microsoft SharePoint

• Knowledge of Purview

• Basic experience with Power Platform

• Experience with Microsoft Cloud Security and Data Governance Tools

• Superior organizational skills

• Capable of managing multiple projects

• Great communication skills (oral and written)

• Strong attention to detail

• Perform administrative tasks associated with the management of Microsoft 365 SaaS offerings

• Manage Azure identities and governance

• Implement and manage storage

• Deploy and manage Azure compute resources

• Configure and manage virtual networking

• Monitor and back up Azure resources

• Configure and manage virtual networking

• Oversee the hierarchal management of SharePoint sites hosted in Flank Speed

• Manage tenant-wide configuration settings for Microsoft SaaS offerings

• Provide support for Teams Live Events as requested (e.g., conferencing/telephony support)

• Monitor Microsoft 365 Admin Center for service-related incidents, outages, and feature releases

• Manage Azure Information Protection data labels and controls

• Participate in various ITSM roles and activities (as required) including but not limited to;

change management, incident management and problem management

• Monitor, analyze and respond to alerts from M365 SaaS cloud operational and security tools and services

• Perform M365 SaaS cloud service operations, analyze operational performance and trends, and support applications and systems on premise, and in cloud, inclusive of network, server, and endpoints

• Deploy and manage virtual machines in Azure to support a large user base

• Provide technical support to the Enterprise Flank Speed Tier 2…