DRAFT PWS NW-WV4100-23-00060.pdf

DR

AF

TNational Oceanic and Atmospheric Administration

National Weather Service

Performance Work Statement for

Information System Security Officer (ISSO) Services

Information System Security Officer (ISSO) PWS Page 1

T

1.0 General

1.1 Background

The National Oceanic and Atmospheric Administration (NOAA), which plays several distinct roles within the Department of Commerce (DOC), is focused on the condition of the oceans and the atmosphere.

NOAA is comprised of various Line, Staff, and Program Offices that serve as vital contributors to NOAA’s mission.

NOAA’s Information Technology organizations oversees activities in IT security, information systems operations, and information systems development and modernization. Specialized technical expertise to support these activities is required in security certification and accreditation and continuous monitoring of national critical information systems, earned value and portfolio analysis of complex programs, and engineering support for data networks and telecommunications that span across the enterprise.

The National Weather Service (NWS) Alaska and Pacific Regions are focused on providing customers with quality, timely and cost-efficient maintenance, modernization, technical, and logistics support.

Staff in the Systems Operations Division (SOD) serve as the focal point in coordinating the technical activities involved with other OCIO organizations including the Chief Information Officer and Deputies, Investment Management, Enterprise Architecture (EA), Policy and e-Gov, IT Operations, and IT Security offices.

The Government proactively maintains an IT architecture that supports users on a real time basis to include access to needed corporate information from workstations for Government owned workstations.

1.2 Scope

The scope of this effort includes FISMA and ISSO services to the Tsunami System in the Alaska and Pacific Regions.

Scope of services is to provide general assistance, advice, and support to NOAA, NWS, ACIO, IT Security Officers (ITSOs) and the system owner with technical support services. The technical support services may include, but are not limited to:

● Establishing and maintaining IT security policies and procedures,

● Evaluating compliance and quality of system security plans and related documentation,

● Developing and providing role-appropriate IT security training to personnel,

● Annually reviewing of IT security controls documented by the NWS systems,

● Maintaining a mechanism to manage and track corrective action plans of actions and milestones, and

● General Project Management and Coordination.

1.3 Objective

The primary goal of this PWS is to assist the Tsunami Centers and system owner with FISMA compliance and improve program efficiency and effectiveness by providing prompt, reliable and high-quality information security support to NOAA and NWS.

T

Accomplishment of these objectives directly impacts long-term programmatic success.

The contractor shall provide all personnel, supervision and other items necessary to perform the FISMA and ISSO Services as defined in this PWS.

1.4 Applicable Documents

1.4.1 Compliance Documents: The following documents provide specifications, standards, or guidelines that must be complied with in order to meet the performance requirements.

Publication Version Page(s) Mandatory/ Advisory

NIST SP 800-53, Rev. 4/5 Most current All Mandatory

NIST SP 800-37, Rev. 2 Most current All Mandatory NIST SP 800-30, Rev. 1 Most current All Mandatory

National Oceanic And Atmospheric Administration-IT Security Manual 212-1301

Most current All Mandatory

National Weather Service NWS Instruction 60-702 Most current All Mandatory

Department of Commerce Information Technology Security Baseline Policy, (DOC ITSBP), Version 1.0 Most current All Mandatory

1.5 Performance Requirements Summary

This Performance Work Statement (PWS) includes a Performance Requirements Summary (PRS) see section 10.0. The PRS plays an integral role in the administration of the requirements.

In addition to any applicable inspection clauses or other related terms and conditions contained in the PWS, the PRS shall serve as a primary tool for inspection and acceptance of services as facilitated by the Task Manager (TM). Evaluation of the Contractor’s overall performance shall be in accordance with the performance standards set forth in the PRS, and will be conducted by the TM. The PRS constitutes a material aspect of the requirements and will not be changed or otherwise modified without prior written approval of the Contracting Officer.

2.0 Specific Requirements/Tasks

T

The Contractor shall provide skilled, experienced technical support staff and manage and support them as needed to remain highly effective and productive members of the Alaska Region Systems Operations Division. In addition, the contractor shall develop and maintain detailed project schedules and milestones for performing tasks in a collaborative environment. The contractor shall communicate task status, milestones and schedule changes promptly and produce monthly status reports highlighting task completion schedules, milestones, work schedule variations (if any), and work product deliveries.

2.1 TASK ONE. IT Security Policies and Procedures

2.1.1 The Contractor shall draft and propose to the system owner sound IT security policies, procedures, templates, and checklists.

2.1.2 The Contractor shall draft and maintain necessary compliance team policies, procedures and other documents.

2.1.3 The contractor shall provide technical support, aptitude and knowledge in technical tasks involved in IT security and procedures including but not limited to; answering questions about security compliance, discussing technical solutions and issues, providing advice on security implementation, providing assistance on the implementation of new tools, products, etc. The support shall use various methods such as phone calls, email, video conferencing, in-person meetings and/or other similar technologies as approved by NOAA and NWS for official business communications.

2.2 TASK TWO. Compliance and Quality of System Security Plans and other Related Documentation

2.2.1 The contractor shall perform the system security authorization process activities (which may include developing high quality security authorization package documentation, performing compliance reviews of system owner-developed documentation, based on system classification or category, and monitoring Plans of Action and Milestone progress and completion for the NWS FISMA systems);

2.2.2 The contractor shall perform compliance reviews of system security plans, including security control implementation descriptions and provide feedback for improvement;

2.2.3 The contractor shall perform compliance review of contingency plans, business impact analysis, backup and recovery plans, contingency plan test plans, and contingency plan test reports, and provide feedback for improvement;

2.2.4 The contractor shall perform Plans of Action and Milestones (for adequacy of closure evidence, completeness of content);

2.2.5 The contractor shall perform quality and completeness checks of security authorization packages;

T

2.2.6 The contractor shall ensure that all documentation is uploaded into Cyber Security Assessment and Management (CSAM).

2.3 TASK THREE. IT Security Training

2.3.1 The contractor shall provide support to administer IT security training. Training may take place in the form of PowerPoint presentations, webinars or video conferencing sessions, or instructor led content documents for key security roles.

Training Topics may include, but are not limited to:

● Areas of interest specified by NOAA

● Discussions based upon new mandates

● FISMA compliance

● Policy Changes

● Best Practices

2.4 TASK FOUR. IT Security Controls Documented by the NWS systems

2.4.1 The contractor shall provide assistance to the ACIO assessment teams in accordance with DOC, NOAA, and NWS policies and procedures for implementation of the Risk Management Framework.

2.5 TASK FIVE. Maintaining a mechanism to manage and track vulnerability related Plans of Action and Milestones (POA&Ms)

2.5.1 The contractor shall develop and document a repeatable method for managing, tracking and effectively reporting out on POA&Ms resulting from security assessments.

2.6 TASK SIX. General Project Management and Coordination

2.6.1 The contractor shall assist with assembling responses to the office of the inspector general (OIG), DOC, and NOAA inquiries and data calls, as directed by Federal ITSSB staff.

2.6.2 The contractor shall provide advice on IT security requirement solution options, developing solution migration/implementation plans, and assisting with risk measurement/determination.

2.6.3 The contractor shall provide general project oversight, coordination and management for each work task.

2.6.4 The contractor shall track and report all metric data (e.g. monthly, quarterly, and annual) as requested/required by the system owner.

T

3.0 Contractor Personnel

3.1 Qualified Personnel

The Contractor shall provide qualified personnel to perform all requirements specified in this PWS. The contractor is expected to provide a fully trained workforce to the government;

therefore, personal development training costs and hours are not billable to the government.

All contractor personnel must possess the following general skills:

● Proficiency in verbal and written communications

● Proficiency in interpersonal skills

● Proficiency in handling multiple tasks concurrently

● Proficiency in project and time management

● Ability to efficiently adjust to changing priorities

All contractor personnel shall possess the following technical skills:

● Knowledge of US Federal (e g. DOC, NOAA, NWS, etc.) IT security policies and implementation standards, and comprehensive understanding of NIST guidance to include, but not limited to, NIST Special Publications and Federal Information Processing Standards

● Knowledge of NWS IT systems or comparable systems

● Proficiency in applying IT security concepts, methodologies, principles, procedures and using industry-standard IT security tools

● Proficiency with enterprise architecture and IT security methodologies, concepts, procedures, principles, and tools

● Proficiency in contingency planning and backup and recovery best practices and application of NIST guidance in this area

● Technical proficiency with IT security concepts, tools, applications and the implementation of all aforementioned terms

● At a minimum one (1) certification listed below or proof that an applicable employee(s) is significantly along (at a minimum of one (1)-year) in the process of attaining at least one of the following professional certifications required by DOC Information Technology Security Baseline Policy (DOC ITSBP) Version 1.0, Annex C-1: Information System Security Training for Significant Roles for an Information System Security Officer:

○ CompTIA A +

○ CompTIA Network +

○ CompTIA Security +

○ GIAC Certified Incident Handler (GCIH)

○ GIAC Security Expert (GSE)

○ GIAC Information Security Professional (GISP)

○ GIAC Security Leadership Certification (GSLC)

○ ISC2 Certified Authorization Professional (CAP)

T

○ ISC2 System Security Certified Practitioner (SSCP)

○ ISC2 Certified Information System Security Professional (CISSP)

○ Certified Information Systems Auditor (CISA)

○ ISACA Certified in Risk and Information System Control (CRISC)

○ Security Certified Program Security Certified Network Professional (SCNP)

○ Security Certified Program Security Certified Network Architect (SCNA)

○ Security Certified Network Professional (SCNP)

○ Security Certified Network Architect (SCNA)

The minimum qualifications for the IT Security Specialist III are as follows: Must have at least six (6) years of experience in the IT security field. Must have at least six (6) years or experience on projects (of progressive experience) - some of which must include Federal Government projects/contracts that covered the following:

● Advising on IT security requirement solution options inclusive of developing documentation and/or white papers

● Leading the development of the solution migration and implementation plans on IT security requirement solutions

● Creating IT security policies and procedures

3.2 Continuity of Support

The Contractor shall ensure that the contractually required level of support for this requirement is maintained. The Contractor shall ensure that support personnel are present for all hours of the workday. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., the Contractor shall provide e-mail notification to the Task Manager (TM) prior to employee absence.

3.3 Project Manager - Point of Contact

The Contractor shall provide a single Point of Contact (POC) who shall be responsible for all Contractor work performed under this PWS. The POC shall be a single point of contact for the Contracting Officer and the TM. The name of the POC, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Point of Contact, shall be provided to the Government as part of the Contractor's quote. During any absence of the POC, only one (1) alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract. The POC and all designated alternates shall be able to read, write, speak and understand English. Additionally, the Contractor shall not replace the POC without prior notification to the TM.

3.4 Key Personnel

Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise approved by the Contracting Officer. The Contractor shall not replace Key Contractor personnel without approval from the

T

Contracting Officer. The following Contractor personnel: The IT Security Specialist is designated as Key for this requirement.

3.4.1. IT Security Specialist III

3.5 Processing and Identification of Contractor Employees

Prior to commencing work under this contract, the contractor shall submit or have their employee submit the required security forms and number of copies as informed by the Task Manager. The contractor, when notified that the Government rejected the suitability assessment forms shall either have the rejected forms made compliant and resubmitted or withdraw the employee from consideration from working under this contract.

All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contractor personnel will be required to obtain and wear badges in the performance of this task while on-site at a NOAA facility.

3.6 Employee Conduct

Contractor's employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, "off limits” areas, etc.) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or NOAA. The Contractor shall ensure Contractor employees understand and abide by NOAA's established rules, regulations and policies concerning safety and security.

3.7 Removing Employees for Conduct or Security Reasons

The Government may, at its sole discretion (in coordination with the Contracting Officer where practical), direct the Contractor to remove any Contractor employee from NOAA facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

4.0 Other Applicable Conditions

4.1 Security

All contractor personnel working on-site must be capable of passing a background investigation as required by Homeland Security Presidential Directive 12.

T

Procedures necessary to obtain a NOAA badge involve the completion of a Security Cover sheet/Request for Investigation Worksheet. Request for Security Services (NOAA Form 65-8), Applicant Finger Chart (Electronic Form FD-258), Declaration of Federal Employment (Form OF-306), Department of Commerce Personal Identity Verification Request (Form CD-591), Request for Contractor Background Investigation Form, Fair Credit Reporting Act of 1970 Form, Certificate of Completion of Personal Identification Verification Applicant Training Module, Certificate of Completion of Introduction to Security Awareness Briefing, and certification by an authorizing NOAA official.

Procedures necessary to obtain a NOAA Common Access Card involve the completion of an Application for Department of Defense Common Access Card DEERS Enrollment (Electronic Form DD1172-2) and certification by an authorizing NOAA official (i.e. Trusted Agent).

The systems supported under this task are High impact. The suitability/risk level for this work has been determined to be High. As such, the contractor shall pre-screen their employees to eliminate anyone who is NOT a U.S. Citizen. This contract will only permit U.S. Citizens.

48 CFR 1352.237-70 - Security Processing Requirements—High or Moderate Risk Contracts (APR 2010)

(a) Investigative Requirements for High and Moderate Risk Contracts. All contractor (and subcontractor) personnel proposed to be employed under a High or Moderate Risk contract shall undergo security processing by the Department's Office of Security before being eligible to work on the premises of any Department of Commerce owned, leased, or controlled facility in the United States or overseas, or to obtain access to a Department of Commerce IT system. All Department of Commerce security processing pertinent to this contract will be conducted at no cost to the contractor. The level of contract risk will determine the type and scope of such processing, as noted below.

(1) Investigative requirements for Non-IT Service Contracts are:

(i) High Risk—Background Investigation (BI).

(ii) Moderate Risk—Moderate Background Investigation (MBI).

(2) Investigative requirements for IT Service Contracts are:

(i) High Risk IT—Background Investigation (BI).

(ii) Moderate Risk IT—Background Investigation (BI).

(b) In addition to the investigations noted above, non-U.S. citizens must have a pre-appointment check that includes an Immigration and Customs Enforcement agency check.

(c) Additional Requirements for Foreign Nationals (Non-U.S. Citizens). To be employed under this contract within the United States, non-U.S. citizens must have:

(1) Official legal status in the United States;

T

(2) Continuously resided in the United States for the last two years; and

(3) Obtained advance approval from the servicing Security Officer of the contracting operating unit in consultation with the DOC Office of Security (OSY) headquarters. (OSY routinely consults with appropriate agencies regarding the use of non-U.S. citizens on contracts and can provide up-to-date information concerning this matter.)

(d) Security Processing Requirement. Processing requirements for High and Moderate Risk Contracts are as follows:

(1) The contractor must complete and submit the following forms to the Contracting Officer's Representative (COR):

(i) Standard Form 85P (SF-85P), Questionnaire for Public Trust Positions;

(ii) FD-258, Fingerprint Chart with OPM's designation in the ORI Block; and

(iii) Credit Release Authorization.

(2) The Sponsor will ensure that these forms have been properly completed, initiate the CD-254, Contract Security Classification Specification, and forward the documents to the cognizant Security Officer.

(3) Upon completion of security processing, the Office of Security, through the servicing Security Officer and the Sponsor, will notify the contractor in writing of an individual's eligibility to be provided access to a Department of Commerce facility or Department of Commerce IT system.

(4) Security processing shall consist of limited personal background inquiries pertaining to verification of name, physical description, marital status, present and former residences, education, employment history, criminal record, personal references, medical fitness, fingerprint classification, and other pertinent information. For non-U.S. citizens, the Sponsor must request an Immigration and Customs Enforcement agency check. It is the option of the Office of Security to repeat the security processing on any contract employee at its discretion.

(e) Notification of Disqualifying Information. If the Office of Security receives disqualifying information on a contract employee, the COR will be notified. The Sponsor, in coordination with the Contracting Officer, will immediately remove the contract employee from duties requiring access to Departmental facilities or IT systems. Contract employees may be barred from working on the premises of a facility for any of the following:

(1) Conviction of a felony crime of violence or of a misdemeanor involving moral turpitude;

(2) Falsification of information entered on security screening forms or on other documents submitted to the Department;

(3) Improper conduct once performing on the contract, including criminal, infamous, dishonest, immoral, or notoriously disgraceful conduct or other conduct prejudicial to the Government, regardless of whether the conduct was directly related to the contract;

(4) Any behavior judged to pose a potential threat to Departmental information systems, personnel, property, or other assets.

T

(f) Failure to comply with security processing requirements may result in termination of the contract or removal of contract employees from Department of Commerce facilities or denial of access to IT systems.

(g) Access to National Security Information. Compliance with these requirements shall not be construed as providing a contract employee clearance to have access to national security information.

(h) The contractor shall include the substance of this clause, including this paragraph, in all subcontracts.

4.2 PLACE OF PERFORMANCE

The primary place of performance will be at the Government's Facility located at:

National Oceanic and Atmospheric Administration National Weather Service Alaska Region HQ 222 W. 7th Ave Anchorage, AK 99513

Some activities within this PWS may be performed at other locations rather than the primary place of performance. The contractor shall seek TM approval for any location not designated as the primary place of performance. Telework is authorized on an ad-hoc basis and is monitored by the TM. All telework must comply with the Department of Commerce Information Technology Requirement (CITR) 0008: Remote Access.

4.3 Hours of Operation

Contractor employees shall generally perform all work between the hours of 8:00 AM and 4:30 PM Alaska Time, Monday through Friday (except Federal holidays). The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the below reasons.

Occasional emergency workload peaks, or changing government priorities, may necessitate that the Contractor discuss workload priorities with the TM and request the approval of a variance in regularly scheduled hours. If the TM cannot rank the jobs in order to meet critical deadlines without affecting predetermined shift composition, the TM may approve a shift variance if requested. This does not constitute an approval for extended compensation. Rather, the contractor shall realign the scheduling of personnel to preclude the necessity for extended compensation.

When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential. Flexible work schedules are permitted. However, contractor personnel must be present during core business hours (9:00 AM to 3:30 PM).

4.4 Travel

Contractor travel may be required to support this requirement. Travel expenses incurred by the contractor will be reimbursed against the applicable not-to-exceed travel CLIN. Travel expenses

T may include transportation and per diem (I.e., lodging and meals & incidental expenses (M&IE)) and will be reimbursed to the Contractor in accordance with the Federal Acquisition Regulation (FAR) 31.205-46 (Travel Costs), without adding any markups, fees/costs, General and Administrative (G&A) costs, overhead, or profit.

Pre-Travel Authorization:

The Contractor shall be responsible for obtaining TM approval (electronic mail is acceptable) for all reimbursable travel in advance of each travel event. All contractor travel requests must be submitted in writing and approved by the TM prior to the travel. Travel requests should be submitted as early as possible, but no less than two (2) weeks prior to the travel.

4.5 Post Award Conference

The Contractor shall attend a Post Award Conference with the Contracting Officer and TM no later than 10 business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this requirement and review the Contractor's draft project plan. The Post Award Conference will be held via teleconference.

4.6 Project Plan

The Contractor shall provide a draft Project Plan which should include but not limited to milestones, schedule, risks and issues, and roles and responsibilities at the Post Award Conference for Government review and comment. The Contractor shall provide a final Project Plan to the TM no later than 10 business days after the Post Award Conference.

4.7 Progress Meetings

The Project Management Point of Contact shall be available to meet with the TM upon request to present deliverables, discuss progress, exchange information and resolve emergent technical problems and issues. These meetings shall take place via teleconference.

4.8 General Report Requirements

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with NOAA workstations (e.g., Windows Operating System and Microsoft Office Applications).

4.9 Intellectual Property

Intellectual property is not anticipated to be provided.

4.10 Protection of Information

Contractor access to information protected under the Privacy Act is required under this PWS.

Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and Government policy and regulation.

4.11 Transition Planning

T

A transition plan will be required that demonstrates the ability to transition work from the incumbent at the initial award of the contract or a transfer to a new contract after expiration. The government anticipates the transition plan will address, at a minimum, the following:

● 2-week minimum overlap for knowledge walkthroughs and documentation transfer;

● Availability of key personnel during transition;

● Participation in knowledge transfer meetings;

● Timely submission of all final and updated documentation for systems or processes;

● Transfer for all in-progress work;

● Maintain the ability to answer task related questions from the new contractor through the

TM; and,

● All resources participating should have the skills and knowledge to actually perform the work being transitioned.

5.0 GOVERNMENT TERMS & DEFINITIONS

ACIO Assistant Chief Information Officer CISA Certified Information Systems Auditor CISO Chief Information Security Officer CO Contracting Officer COR Contracting Officer's Representative CSAM Cyber Security Assessment and Management FISMA The Federal Information Security Modernization Act ISSEP Information Systems Security Engineering Professional ISSO Information System Security Officer IT Information Technology ITSO Information Technology Security Officer ITSSB IT Security Services Branch NIST National Institute of Standards and Technology NOAA National Oceanic and Atmospheric Administration NWS National Weather Service OCIO Office of the Chief Information Officer PWS Performance work statement TM Task Manager

6.0 Government Furnished Resources

T

The Contractor shall use Government furnished facilities, property, equipment and supplies only for the performance of work in support of this requirement, and shall be responsible for returning all Government furnished Common Access Cards, facilities, property, and equipment in good working condition, subject to normal wear and tear.

The Contractor shall use Government furnished information, data and documents only for the performance of work under this contract, and shall be responsible for returning all Government furnished information, data and documents to the Government at the end of the performance period. The Contractor shall not release Government furnished information, data and documents to outside parties without the prior and explicit consent of the Contracting Officer.

7.0 Government Furnished Resources

The Contractor shall furnish all facilities, materials, equipment and services necessary to fulfill the requirements, except for the Government Furnished Resources specified in PWS 6.0.

8.0 Government Acceptance Period

The TM will review deliverables prior to acceptance and provide the contractor with an e-mail that provides documented reasons for non-acceptance. If the deliverable is acceptable, the TM will send an email to the Contractor notifying it that the deliverable has been accepted.

8.1 The TM will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the contract. In the event of a rejected deliverable, the Contractor will be notified in writing by the TM of the specific reasons for rejection. The Contractor may have an opportunity to correct the rejected deliverable and return it per delivery instructions.

8.2 All review times and schedules for deliverables (specifically item 6 below) shall be agreed upon by the parties based on the assigned individual work tasks/requests. The Contractor shall be responsible for timely delivery to Government personnel in the agreed upon review chain, at each stage of the review. The Contractor shall work with personnel reviewing the deliverables to assure that the established schedule is maintained.

9.0 Deliverables

The Contractor shall provide all deliverables in accordance with NAM Clause 1330.52.215-70- Schedule of Deliverables.

ITEM PWS

REFERENC

E

DELIVERABLE/EVENT DUE BY DISTRIBUTION

1 2.0 End product or service (the requirements will be specified

To be determined by the NWS ITSO, CISO, or TM and

NWS ITSO and TM - this will be stipulated in the

T in the individual work tasks/requests) NOTE: The deliverables may be comprised of various documents, reports, forms, charts, diagrams, and other products as requested.

contractor at the time of assignment individual work task/request

2 4.5 Post Award Conference Within 10 days of contract award

N/A

3 4.6 Draft Contractor Project Plan Post Award Conference

TM, Contracting Officer

4 4.6 Final Contractor Project Plan Within 10 days of post award conference

TM, Contracting Officer

5 4.7 Business Continuity Plan Within 10 days of post award conference

TM, Contracting Officer

6 4.9 Monthly Program Reports and Spend Plans

By the 15th of the following month (of the reporting period)

TM

7 4.12 Transition Plan 4 weeks prior to the end of the contract

TM

10.0 Performance Requirements Summary (PRS)

The PRS establishes key elements of Contractor performance that represent "mission essential" service requirements, which are identified in the table below in the "Service Output" column.

The "Performance Objective" column represents the standard against which Contractor performance will be measured in relation to accomplishment of the corresponding service output.

The performance objective or "standard" describes the minimum acceptable level of service by the Contractor for satisfactory performance. The "Acceptable Quality Level (AQL)" column displays the maximum allowable deviation from the performance objective, wl1lch, if exceeded, evokes the negative incentive specified in the table below.

PWS

REF

Performance Objective Acceptable Quality Level

(AQL)

Method of Surveillance

T

2.1 Provide analysis and recommendations

for IT security protection measures for current and new IT projects.

95% 100% Inspection

2.2 Provide support to ITSOs, ISSOs, and

System Owners to ensure IT security documentation is complete, accurate and compliant with national policy and loaded into CSAM.

95% 100% Inspection

2.2 Ensure all IT Security documentation in

CSAM is accurate, complete and timely.

95% 100% Inspection

2.5 Ensure Systems Owners and ISSOs are

notified, racking, and completing their POA&Ms in a timely manner.

95% 100% Inspection

2.6 Ensure monthly, quarterly, and annual

metrics data are collected and reported to the ITSOs as required.

95% 100% Inspection