DRAFT SOW CEEOSS.pdf

ATTACHMENT 1

DEPARTMENT OF HOMELAND SECURITY (DHS)

CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)

Statement of Work (SOW) for CISA Enterprise Engineering and Operations Support Services (CEEOSS)

1.0 GENERAL

1.1 BACKGROUND

CISA’s mission is to lead the national effort to protect and enhance the resilience of the nation’s physical and cyber infrastructure. CISA includes the CISA Mission Enabling Offices (MEOs) and six Divisions: the Cybersecurity Division (CSD), the Emergency Communications Division (ECD), the Integrated Operations Division (IOD), Infrastructure Security Division (ISD), the Stakeholder Engagement Division (SED), as well as, the National Risk Management Center (NRMC), which are headquartered within the National Capital Region (NCR).

CISA’s information technology (IT) landscape has historically produced networks and systems individually managed and maintained within each of its Divisions as well as its MEOs. This task order is to provide Enterprise Engineering and Operations Support Services (EEOSS) to CISA/OCIO to establish enterprise IT capabilities. These enterprise IT capabilities will support CISA’s ability to continue establishing a modern IT infrastructure; engaging in various initiatives to evaluate and implement emerging technologies; migrating to the cloud; supporting mobility and collaboration platforms; and continually improving the performance, security, and availability of enterprise IT services.

1.2 SCOPE

The contractor will perform the services listed below for the functional areas and will ensure the services are integrated, well defined, and documented, standardized, repeatable, accurate and timely. All the associated processes in all functional areas will produce secure, high quality and cost-effective services, work products and IT solutions, and will be properly documented using the ITIL v3 framework. The contractor will perform these services in a manner that will drive efficiencies through continual maintenance and improvement of documented processes.

This SOW details CISA’s requirement for the following services:

• Technology Evaluation and Integration

• Enterprise Technology Services and Solutions Strategy and Architecture

• Technical Solutions Engineering and Implementation

• Operations and Maintenance Support

• Program / Project Management

1.3 OBJECTIVE

CISA’s objective is to obtain expertise to support the:

• Engineering subdivision in architecting, designing, and engineering CISA enterprise IT capabilities and services to include but not limited to network, identity and access management, mobility, asset management, imaging, application and systems development, collaboration capabilities, cloud hosting, and communication services.

• Management of system operations, configurations, and support; overseeing infrastructure asset management; advanced network/infrastructure/application support. The Engineering Subdivision partners work closely with the IT Operations and Service Management subdivision on enhancements and the transition of those enhancements into the production environments for operations and support.

1.4 APPLICABLE DOCUMENTS

1.4.1 Compliance Documents

The following documents provide specifications, standards, or guidelines that must be complied with in order to meet the requirements of this task order:

1. Federal Information Security Modernization Act of 2014 https://www.govinfo.gov/content/pkg/PLAW-113publ283/pdf/PLAW-113publ283.pdf

2. Section 508 of the Rehabilitation Act of 1973 (amended) https://www.govinfo.gov/content/pkg/USCODE-2011-title29/pdf/USCODE-2011-title29-chap16-subchapV-sec794.pdf

3. Federal Travel Regulations, Code of Federal Regulations https://www.ecfr.gov/current/title-41/subtitle-F

4. Government Performance Results Modernization Act of 1993 https://www.congress.gov/103/statute/STATUTE-107/STATUTE-107-Pg285.pdf

5. FIPS-140-2 Security Requirements for Cryptographic Modules.

6. FIPS-199 Standards for Security Categorization of Federal Information and Information systems.

7. NIST SP800-53 rev 5 Security and Privacy Controls for Federal Information Systems and Organizations.

8. DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified

Information

9. DHS Management Directive 4300A Policy Directive (Version 13.3, February 13, 2023).

10. DHS Management Directive 142-02-001 Information Technology Integration

& Management

11. DHS Instructions 102-01-103 System Engineering Life Cycle (SELC)

12. DHS Management Directive 140-01 Information Technology Security Program

Revision 2

13. DHS Section 508 Compliance Test Process for Applications https://www.dhs.gov/publication/dhs-section-508-compliance-test-processes

14. DHS Management Directive 11056.1, Sensitive Security Information (SSI)

15. DHS Privacy Incident Handling Guidance, Version 5.0, December 4, 2017

16. DHS Instruction 047-01-001 Privacy Policy and Compliance

17. DHS Privacy Policy Guidance Memorandum 2011-02 Roles and Responsibilities for

Shared IT Services https://www.govinfo.gov/content/pkg/PLAW-113publ283/pdf/PLAW-113publ283.pdf https://www.gsa.gov/policy-regulations/regulations/federal-travel-regulation#:%7E:text=The%20Federal%20Travel%20Regulation%20summarizes%20the%20travel%20and,conducted%20in%20a%20responsible%20and%20cost%20effective%20manner.

https://www.ecfr.gov/current/title-41/subtitle-F http://www.dhs.gov/publication/dhs-section-508-compliance-test-processes http://www.dhs.gov/publication/dhs-section-508-compliance-test-processes http://www.dhs.gov/publication/dhs-section-508-compliance-test-processes

18. DHS Instruction Guide 047-01-008, Handbook for Safeguarding Sensitive Personally Identifiable Information, December 4, 2017

19. DHS Instruction 047-01-001 Privacy Policy and Compliance

20. DHS 4300A Policy Directive, Version 13.3, February 13, 2023)

21. DHS Instructions Guide 026-06-001 Test and Evaluation Master Plan (TEMP)

22. DHS Procedures for Operational Test and Evaluation of Cybersecurity

23. DHS Management Directive (MD) 4010.2: Section 508 Program Management Office

Electronic and Information Technology Accessibility.

24. Homeland Security Enterprise Architecture (HLS EA), current version.

25. Office of Management and Budget M-07-16, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information,” May 22, 2007

1.4.2 Reference Documents

The following documents may be helpful to the contractor in performing the work described in this document:

• Federal Information Technology Acquisition Reform Act (FITARA), 2015:

Provides the statutory basis for Federal-wide IT reform

• Federal Information Technology Shared Services Strategy, May 2, 2012:

Provides organizations in the Executive Branch of the United States Federal Government (Federal Agencies) with policy guidance on the full range and lifecycle of intra- and inter-agency IT shared services that enable mission, administrative, and infrastructure-related IT functions.

• Federal CIO 25 Point Implementation Plan to Reform Federal Information Technology Management, Dec 9, 2010:

Specifies that “Agencies must focus on consolidating existing data centers, reducing the need for infrastructure growth by implementing a Cloud First policy for services, and increasing the use of available cloud and shared services”.

• Federal Risk and Authorization Management Program (FedRAMP):

Provides joint "provisional" authorizations and continuous security monitoring services applicable to “Executive departments and agencies procuring commercial and non-commercial cloud services that are provided by information systems that support the operations and assets of the departments and agencies, including systems provided or managed by other departments or agencies, contractors, or other sources”.

• Federal Cloud Computing Strategy, Feb 8, 2011:

Intends to articulate the benefits, considerations, and trade-offs of cloud computing by providing a decision framework and case examples to support agencies in migrating towards cloud computing; highlighting cloud computing implementation resources; and identifying Federal Government activities and roles and responsibilities for catalyzing cloud adoption.

2.0 SPECIFIC REQUIREMENTS/TASKS

2.1 TASK ONE. Technology Evaluation and Integration

Contractor access to classified information will be required under this Task. The maximum level of classification for this Task is Top Secret/SCI (TS/SCI). Details will be specified in a DD Form 254.

This task deals with identifying, evaluating, and recommending emerging technologies and/or services that can be implemented to establish and improve CISA enterprise network, identity and access management, mobility, asset management, imaging, application and systems development, collaboration capabilities, cloud hosting, and communication services to meet CISA mission requirements.

2.1.1 Market Research

The contractor will track industry trends, engage with vendors and service providers to identify emerging technologies and solutions, and conduct market research to identify viable options for technologies and solutions that will meet CISA mission requirements and establish and improve technology performance, availability, and reliability.

2.1.2 Trade Studies and Evaluations

The contractor will conduct trade studies to evaluate and identify the most acceptable technology or solution to satisfy a specified set of requirements or criteria. The contractor will test related solutions / technologies and document findings and recommendations to assist the Government in making decisions regarding solutions and/or services to procure and/or implement. The contractor will conduct Proof of Concepts (PoCs)/Proof of Values (PoVs) to demonstrate new or improved services/capabilities as directed by the Government.

2.1.3 Technology Refresh Recommendations

The contractor will test, evaluate, and make recommendations on new technologies or solutions to replace aging related technologies.

2.2 TASK TWO. Enterprise Technology Services and Solutions Strategy and

Architecture

Contractor access to classified information will be required under this Task. The maximum level of classification for this Task is Top Secret/SCI (TS/SCI). Details will be specified in a DD Form 254.

This task encompasses the identification of functional requirements; developing the business case for implementation of new CISA enterprise network, identity and access management, mobility, asset management, imaging, application and systems development, collaboration capabilities, cloud hosting, and communication services; developing and maintaining an

Enterprise Technology Strategy and Target Architecture, establishing architecture standards, and developing the conceptual and logical designs for DHS CISA/OCIO related systems.

When architecting and designing solutions, strategies, and/or services, the contractor will design in accordance with DHS and CISA security requirements to achieve the architecture and engineering objectives of ensuring a secure scalable, interoperable and flexible system.

2.2.1 Requirements Analysis

The contractor will collaborate with the appropriate stakeholders to identify functional and technical requirements for new or enhanced capabilities and/or services to support the CISA mission.

2.2.2 Business Cases

The contractor will conduct Return on Investment (ROI) analyses and develop business cases for the procurement and/or implementation of new related technologies and/or services.

2.2.3 Enterprise Technology Strategy and Target Architecture

The contractor will create and maintain an Enterprise Network Taxonomy document, document the target technology architecture or framework, and develop an Enterprise Technology Strategy to achieve the target architecture.

2.2.4 Technology Architecture Standards and Design

The contractor will establish and maintain architecture standards and develop and maintain System Design Documents (SDDs) with the conceptual and logical designs for new and existing related systems. The contractor will develop technology architecture and designs to fulfill functional and business requirements. The contractor will install, configure, and manage software defined network, identity and access management, mobility, asset management, imaging, application and systems development, collaboration capabilities, cloud hosting, and communication services and solutions.

2.3 TASK THREE. Technical Solutions Engineering and Implementation

Contractor access to classified information will be required under this Task. The maximum level of classification for this Task is Top Secret/SCI (TS/SCI). Details will be specified in a DD Form 254.

This task encompasses, but is not limited to, the identification of technical requirements and also includes engineering and implementing network, identity and access management, mobility, asset management, imaging, application and systems development, collaboration capabilities, cloud hosting, communication services, and solutions connectivity to cloud services to facilitate migration to the cloud; engineering and implementing solutions and capabilities in data centers, CISA facilities, and/or cloud environments; providing Tier 3 escalation support to troubleshoot and/or resolve related issues in a timely manner; and transitioning management of solutions to operations and support team for continued operations and maintenance.

When engineering and implementing solutions and/or services, the contractor will design, implement, and test security controls to meet DHS and CISA security requirements and achieve the architecture and engineering objectives of ensuring a scalable, interoperable and flexible system.

2.3.1 Technology Design

The contractor will engineer and design secure technologies supporting CISA locations and remote work that meets CISA standards and other functional and business requirements to support CISA end-users’ requirements based on site type, applications, location, and processing needs. The contractor will develop a comprehensive Detail Design Document (DDD) based on the System Design Document (SDD) for CISA sites. The contractor will review and update the DDDs on a periodic basis to reflect a new design(s) and/or technologies.

2.3.2 Enterprise Technology Infrastructure

The contractor will engineer, design, test, and implement an enterprise network infrastructure and technologies at CISA. These services will include but not limited to:

• Identity and access management (IAM)

• Mobility,

• Asset management,

• Imaging,

• Application and systems development,

• Collaboration capabilities,

• Cloud hosting and services

• Network communication solutions

The contractor will leverage latest technologies, trends, and best practices to provide a secure, robust, high performance, and reliable network that supports all existing and future CISA applications. In addition, these services will improve CISA’s business agility and resilience, lower total cost of ownership (TCO), and increases operational efficiency. The contractor will develop a comprehensive Technical Requirements Document (TRD) and Detailed Design Document (DDD) for each system, capability, or service, consistent with FRD and SDD and/or comparative Agile Methodology documentation as applicable for the associated system or solution, before transitioning to Information Technology (IT) Operations subdivision. The contractor will update the DDD when there is a change in the design and/or technologies. The contractor will develop a standard Test Plan Template that will be used to test all systems to verify that it meets requirements and will work as designed prior to implementing in the production environment. The contractor will collaborate with all stakeholders and submit a test report along with the Implementation plan for each change that contractor will perform on the production network. Manage system hardware and software releases, changes, moves and installation to minimize disruption.

2.3.3 Cloud Network Environment

The contractor will engineer, design, test, and implement secure and reliable network connectivity to cloud services (e.g., commercial cloud services providers (CSPs), private cloud, and hybrid cloud). The contractor will develop a comprehensive Technical Requirement Document (TRD), and a Detailed Design Document (DDD) associated FRD and DDD and/or comparative Agile Methodology documentation as applicable, before transitioning to Operations.

The contractor will update the DDD when there is change in the cloud design and/or technologies. The contractor will collaborate with all stakeholders to test all cloud related systems and application migration process to verify that the systems meet requirements and are able to host applications with no degradation to performance or security. The contractor will submit a test report along with the Implementation Plan for each change the contractor performs on the cloud network environment.

2.3.4 Configuration/Change Management Support

The contractor will prepare Change Requests (CRs) with supporting documentation (e.g., DDDs, Implementation Plans, Test Plans, and As-Is Diagrams), enter the CR into the configuration management tool, present the CR at various review gates, coordinate with all stakeholders(s) for information sharing, approval, and support.

2.3.5 Hardware and Software Testing and Implementation

The contractor will conduct thorough testing of all new hardware/software and its command line recommended by the vendors to remediate software bugs and/or vulnerabilities in CISA Engineering Lab or at vendor provided lab to ensure the new hardware integrates well with the existing environment and no secondary bug and/or vulnerability that causes other issues. Once testing of new hardware and/or software is completed, the contractor will submit a comprehensive test report to the Government for review and approval. The contractor will manage system hardware and software releases, changes, moves, installation, and transition to minimize disruption.

2.3.6 Transition to Operations

The contractor will prepare necessary artifacts, diagrams, procedures, and additional information and data as required in executing transfer of capabilities and solutions to IT Operations for operations, maintenance, and management.

2.4 TASK FOUR. Operations and Maintenance Support

Contractor access to classified information is required under this Task. The maximum level of classification for this Task is Top Secret/SCI (TS/SCI). Details will be specified in a DD Form 254.

This task encompasses operations and maintenance (O&M) of capabilities and solutions transitioned to Operations for their operations, maintenance, and management. These responsibilities include, but are not limited to, system administration; network management, system hosting and access; information assurance management; certification and accreditation support; software patches and upgrades; configuration management; user management and support; backup and recovery; and network and performance monitoring.

2.4.1 Operations Support

The contractor will provide the necessary operations, maintenance, and maintenance support of capabilities and solutions delivered to support operations. Support will include but is not limited to

• Logistics

• Service desk support

• Trouble ticket incident tracking and management

• Network management and monitoring

• Systems performance monitoring and capacity planning

• System performance evaluation

• Identity and access management

• Technology integration

• System administration

• Data management

• Infrastructure support

• Asset management

• Image management

• Software patches and upgrades

• Information security vulnerability management

• Information security compliance

• Upgrades

• Fault resolution

• Patch management

• Change, configuration, and release management

• Disaster recovery

• Emerging technology assessments

• Testing processes including all tasks related to production deployment

• System artifact and process maintenance

• Technical refresh

2.5 TASK FIVE. Program / Project Management

Contractor access to classified information will be required under this Task. The maximum level of classification for this Task is Top Secret/SCI (TS/SCI). Details will be specified in a DD Form 254.

This task encompasses program management and project management support to include overall reporting to the Contracting Officer’s Representative (COR), management and reporting of progress and activities in all task areas, coordinating and reporting on contractor work on projects as directed by the Government project managers and leads, conducting the Kick-Off Meeting, and performing transition in/out activities.

2.5.1 Program Management Services

The contractor will provide program management support to include, but not necessarily limited to, overall reporting to the COR and the management and reporting of progress and activities in all task areas. The contractor will designate a Program Manager as a single point of contact (POC) capable of program management disciplines, task order administration, and effectively interfacing with subcontractors and CISA at various levels. The contractor will develop and provide recommendations to improve the support procedures and documentation.

The Program Manager and supporting staff will perform program management activities that include, but are not necessarily limited to the following:

• Performance tracking and reporting

• Quality control

• Risk management

• Invoicing

• Staffing

• Sub-contractor management

• Submitting Weekly Status Reports (WSRs), Monday NLT 2:00pm EST

2.5.2 Monthly Program Management Reviews

The contractor Program Manager and/or supporting staff will coordinate, facilitate, and attend the monthly Program Management Review (PMR) meeting to brief Government management regarding the operational performance under this task order 10 business days after the end of the month. The contractor will be responsible for all aspects of the review, including preparing meeting agendas, reports, support documentation, providing meeting minutes, and tracking and reporting action items.

2.5.3 Program Management Support

The contractor will coordinate work activities on projects as directed by the Government project manager or lead and provide a Quality Control Plan final plan due 10 business days after the kickoff meeting. The contractor will perform project management activities that include, but is not limited to:

• Developing or providing input to a project schedule as directed by the government project manager

• Tracking and reporting project progress with respect to the project plan and schedule

• Staffing projects to implement the project plan and achieve the project objectives

• Coordinating performance of project tasks

• Identifying project risks and develop a mitigation strategy

• Performing quality control for project deliverables

3.0 DELIVERABLES

The contractor will consider items in BOLD as having mandatory due dates. Items in italics are deliverables or events that must be reviewed and/or approved by the COR prior to proceeding to next deliverable or event in this SOW.

ITEM SOW

REFERENCE DELIVERABLE/EVENT DUE BY DISTRIBUTION

1 2.1.1 Market Research Report(s) As Required COR

2.1.2 Proof of Concepts (POCs)/Proof of Values (PoVs)

As Required COR

3 2.1.3 Technology Refresh Recommendations

As Required COR

4 2.2.1 Requirements Analysis As Required COR 5 2.2.2 Return on Investment (ROI)

Analyses & Develop Business Cases

As Required COR

6 2.2.3 Enterprise Technology Strategy

As Required COR

7 2.2.3 Enterprise Taxonomy Document

As Required COR

8 2.3.3 Test Report As Required COR 9 2.3.1, 2.3.3,

2.2.4 Detail Design Documents (DDD) based on the System Design Document (SDD) for each system consistent with FRD and SDD and/or comparative Agile Methodology documentation.

As Required COR

10 2.3.2 Test Plan Template As Required COR 11 2.3.2, 2.3.4, & Comprehensive Technical

Requirements Documents (TRD) & DDD for each system

As Required COR

12 2.3.4 Change Requests (CRs) As Required COR 13 2.3.6 Artifacts, Diagrams, Procedures, Additional Information and Data for executing transfer of capabilities and solutions to Operations for operations, maintenance, and management.

As Required COR

14 2.5.1 Weekly Progress Status Reports (WSRs)

Weekly Monday NLT 2:00pm EST

15 2.5.2 Monthly Program Management Review

(PMR)

Monthly 10 business days after end of month

16 2.5.3

Quality Control Plan

As Required Final due 10 business days after Kickoff Meeting

17 4.1 Staffing Plan Post Award Conference

COR

18 4.11

Progress Reports

Weekly, COB

Monday (for the previous week)

COR &

Contracting Officer

19 5.8 Attend Post Award Conference

Within 14 Business Days of Award

COR

20 5.9 Draft Contractor Project Plan

At Post Award Conference

COR &

Contracting Officer

21 5.9

Final Contractor Project Plan

NLT 14

Business Days after the Post Award Conference

COR &

Contracting Officer

22 5.10

Business Continuity Plan

Within 15 business Days of Award

COR &

Contracting Officer

23 5.10 Updated Business Continuity Plan Annually

COR &

Contracting Officer

24 5.14.2(b) (1) Security Training Certificate Annually COR 25 5.14.2(c) Privacy Training Annually COR 26 5.15.9.2 Records Management

Training Annually COR

26 5.17.3 Detail Section 508 Conformance Test Plan As Required

COR &

Contracting Officer

27 5.17.3 (4) Other Section 508 Documentation

Upon Request

COR &

Contracting Officer

28 7.2 Asset Management Report Monthly COR 29 9

Invoices Monthly COR, see section 9 for specific instructions

4.0 CONTRACTOR PERSONNEL

4.1 Qualified Personnel

The contractor will provide qualified personnel to perform all requirements specified in this SOW. The contractor will furnish a detailed Staffing Plan that clearly demonstrates how the contractor will obtain the required staff to meet the Government’s requirements as defined in this SOW. The plan will include the names and resumes of key personnel, as defined in section 4.3, and any other key positions identified in this SOW. The staffing plan is due by the post award conference.

4.2 Continuity of Support

The contractor will ensure that the contractually required level of support for this requirement is maintained at all times. The contractor will ensure that all task order support personnel are present for all hours of the workday. If for any reason the contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel will not be provided, the contractor will provide e-mail notification to the Contracting Officer’s Representative (COR) prior to employee absence. Otherwise, the contractor will provide a fully qualified replacement.

4.3 Key Personnel

Before replacing any individual designated as Key by the Government, the contractor will notify the Contracting Officer no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes will possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise approved by the Contracting Officer. The contractor will not replace Key The contractor personnel without approval from the Contracting Officer.

"Key Personnel" is defined as contractor personnel who are recognized by the Government and The contractor as essential to the successful completion and execution of this task order. The contractor will provide resumes with the proposal for Key Personnel. The contractor will identify the following positions as key personnel and provide personnel with the qualifications below:

• Program Manager - The contractor will identify a program manager to oversee the day-to-day operations of the CEEOSS Task Order and serve as the contractor’s Point of Contact (POC) for the Contracting Officer Representative (COR), and senior level Government managers. The contractor Program Manager should have the following qualifications:

o Project Management Professional (PMP) and ITIL v3 Foundation certified to ensure task order functions, program/project management services, performance tracking and reporting, and task order execution are conducted and managed according to industry best practices.

o A minimum of five (5) years of experience in IT program management.

o A bachelor’s degree in management, computer science, or information systems.

o Experience with applying the Agile and Scrum methodologies.

• In lieu of a bachelor’s degree, the Government the PM should have an additional 10 years' experience in IT program management for a total of 15 years of experience.

• Lead Enterprise Architect – The contractor will identify a Lead Enterprise Architect, as key personnel, to serve as the subject matter expert in the areas of application development, network and cloud architecture and design activities. The lead enterprise architect will lead application and network architecture and design efforts, assist the Government in developing business cases for new technologies and solutions, advise the Government on an information technology (IT) system strategy to meet business objectives and requirements, and research and evaluate new networking technologies to support the CISA mission. In addition, the lead enterprise architect will demonstrate experience in developing business cases and determining the Return on Investment (ROI); identifying and architecting solutions and technologies to meet business and functional requirements; and applying the Agile and Scrum frameworks and methodologies in support of projects. The lead enterprise architect will possess a broad knowledge of application development framework and methodology that can be leveraged to seamlessly integrate into CISA enterprise network. The Lead Enterprise Architect should have the following qualifications:

o Have a minimum of ten (10) years of experience in software development.

o Experience in network engineering and a minimum of 5 years in network architecture.

o Possess a bachelor’s degree in engineering, computer science, or information systems.

• In lieu of a bachelor’s degree, the Government the Lead Enterprise Architect should have an additional 10 years' experience in IT architecture and engineering for a total of 15 years of experience.

• Lead Network Engineer – The contractor will identify a Lead Network Engineer, as key personnel, to serve as the contractor’s subject matter expert in the areas of network engineering design, testing, and deployment. In addition, the lead network engineer will be responsible for maintaining the design and integrity of CISA Wide Area Network (WAN), Local Area Network (LAN), Enterprise Network Tools, Domain Name Servers

(DNS), Wireless, and Cloud environments. The lead network engineer will provide expert technical assistance to team members and Government with high-level system and networking requests and solution identification. The Lead Network Engineer should have the following qualifications:

o have a minimum of ten (10) years of experience in network engineering and design o possess a bachelor’s degree in engineering, computer science, or information systems.

• In lieu of a bachelor’s degree, the Government the Lead Network Engineer should have an additional 10 years' experience in IT network engineering for a total of 15 years of experience.

4.3.1 The contractor Key personnel will not be assigned by the contractor to more than one key position for this requirement.

4.4 Program Manager

The Program Manager will be responsible for all The contractor work performed under this SOW. The Program Manager will be a single point of contact for the Contracting Officer and the COR. It is anticipated that the Program Manager will be one of the senior level employees provided by the contractor for this work effort. The name of the Program Manager, and the name(s) of any alternate(s) who will act for the contractor in the absence of the Program Manager, will be provided to the Government as part of the contractor's proposal. During any absence of the Program Manager, only one alternate will have full authority to act for the contractor on all matters relating to work performed under this task order. Additionally, the contractor will not replace the Program Manager without prior approval from the Contracting Officer.

4.4.1 The Program Manager will be available to the COR via telephone between the hours of

0800 and 1600 ET, Monday through Friday, and will respond with acknowledgement to a request for discussion or resolution of technical problems within 1 hour of notification.

Discussion can be scheduled at a later date and time at the discretion of the government COR and government Program Manager.

4.5 Employee Identification

4.5.1 The contractor employees visiting Government facilities will wear an identification badge that, at a minimum, displays the contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting The contractor employees will comply with all Government escort rules and requirements. All The contractor employees will identify themselves as The contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

4.5.2 The contractor employees working on-site at Government facilities will wear a

Government issued identification badge. All The contractor employees will identify themselves as The contractors when their status is not readily apparent (in meetings, when answering Government telephones, in e-mail messages, etc.) and display the Government issued badge in plain view above the waist at all times.

4.6 Employee Conduct

The contractor’s employees will comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The contractor will ensure The contractor employees present a professional appearance at all times and that their conduct will not reflect discredit on the United States or the Department of Homeland Security. The Program Manager will ensure The contractor employees understand and abide by Department of Homeland Security and CISA established rules, regulations and policies concerning safety and security.

4.7 Removing Employees for Misconduct or Security Reasons

The Government may, at its sole discretion (via the Contracting Officer), direct the contractor to remove any contractor employee from DHS facilities for misconduct or security reasons.

Removal does not relieve the contractor of the responsibility to continue providing the services required under the task order. The Contracting Officer will provide the contractor with a written explanation to support any request to remove an employee.

5.0 OTHER APPLICABLE CONDITIONS

5.1 SECURITY

The contractor must obtain and retain an active Top-Secret facility clearance and Safeguarding Level as None granted by the Defense Counterintelligence and Security Agency (DCSA) throughout the Option Period 1 period of performance and subsequent option periods. Individual access to classified information is required under this SOW, therefore contractors are required to hold the following clearance level(s) at the time they are submitted for a DHS Fitness decision and maintain that level through to the entire task order performance period.

The contractor access to classified information is required under this SOW. The maximum level of classification is Top Secret/SCI. The details will be specified in the Department of Defense (DD)Form 254.

The maximum level of classification for this Task order is Top Secret/SCI (TS/SCI). Specific requirements will be detailed in a DD 254, which will be incorporated via a formal modification to the award.

Task 2.4 – Operations and Maintenance Support – Top Secret/SCI (TS/SCI)

Labor Category - PKI Systems Engineer/Cloud Engineer 4 - Top Secret/SCI (TS/SCI)

5. POST-AWARD INSTRUCTIONS REGARDING SECURITY REQUIREMENTS

FOR CONTRACTS/ORDERS

The procedures outlined below will be followed for the DHS Office of the Chief Security Officer (OCSO), Personnel Security Division (PSD) to process background investigations, Entry on Duty determinations, and Fitness determinations, as required, in a timely and efficient manner.

Carefully read the security clauses in the task order. Compliance with the security clauses in the task order is not optional.

The contractor employees (to include applicants, temporary employees, part-time and replacement employees) under the task order, requiring access to sensitive information, will undergo a position-sensitivity analysis based on the duties each individual will perform on the task order. The results of the position sensitivity analysis will identify the appropriate background investigation to be conducted. All background investigations will be processed through the DHS OCSO/PSD. Prospective contractor employees will submit the below completed forms to the DHS OCSO/PSD. The Standard Form (SF) 85-P must be completed electronically through the Office of Personnel Management’s e-QIP SYSTEM. The SF-85P signature pages and other completed forms must be given to the OSCO/PSD after task order award or thirty (30) days prior to the requested entry on duty date, for all contractor employees whether a replacement, addition, subcontractor employee, or vendor:

• Standard Form (SF) 85-P, ―Questionnaire for Public Trust Positions‖

• SF-85P Certification

• SF-85P Authorization for Release of Information

• FD Form 258, ―Fingerprint Card (2 copies)

• DHS Form 11000-6 ―Conditional Access To Sensitive But Unclassified

Information Non-Disclosure Agreement

• DHS Form 11000-9, ―Disclosure and Authorization Pertaining to Consumer

Reports Pursuant to the Fair Credit Reporting Act

1. Only complete packages will be accepted by the DHS OCSO/PSD. Specific instructions on submission of packages will be provided upon award of the task order.

2. The DHS OCSO/PSD may, as it deems appropriate, authorize and grant a favorable

Entry on Duty (EOD) decision based on preliminary checks. A favorable EOD decision allows a contractor employee to commence work temporarily prior to the completion of the full background investigation. The granting of a favorable EOD decision will not be considered as assurance that a favorable Fitness determination will follow. In addition, a favorable EOD or Fitness determination will in no way prevent, preclude, or bar DHS from withdrawing or terminating access to government facilities or information, at any time during the term of the task order.

No employee of the contractor will be allowed unescorted access to a Government facility without a favorable EOD or Fitness determination by the DHS OCSO/PSD.

3. Limited access to Government buildings is allowable without an EOD decision if the contractor is escorted by a Government employee and the purpose of the visit is to attend a limited number of required briefings or non-recurring meetings in order to facilitate the transition of a task order. The intent of this statement is to allow a minimum number of meetings / transition attendances to prepare for the new task order.

4. The DHS OCSO/PSD will be notified of all terminations/resignations within five (5) days of occurrence. The contractor will return to the Contracting Officer’s Representative (COR) all DHS issued identification cards and building passes that have either expired or have been collected from terminated employees. If an identification card or building pass is not available to be returned, a report will be submitted to the COR, referencing the pass or card number, name of individual to whom it was issued and the last known location and disposition of the pass or card.

5.2 Period of Performance

The period of performance for this task order is a 3-month base period, and a 3-month option period as follows:

Base Period For 12-months after contract award.

Option Period One For 12-months after the end of base period.

Option Period Two For 12-months after the end of option period one.

Option Period Three For 12-months after the end of option period two.

Option Period Four For 12-months after the end of option period three.

5.3 PLACE OF PERFORMANCE

The primary place of performance will be at Government facilities listed below, and all classified work will be at the Government facilities.

Department of Homeland Security facilities in the Washington Metro Area, to include:

o 1110 Glebe Road, Arlington VA, 22201 o 4601 N. Fairfax Drive, Arlington, VA, 22203 o 4200 Wilson Blvd, Arlington, VA, 20598 o with certain project requirements necessitating support at CISA Regional Office locations.

On-site Support: Government Facilities (throughout the NCR and Pensacola Florida)

5.4 Facility Clearance Level (FCL) (the highest level of DHS classified that will require access:

Top Secret/SCI

All classified work will be at the Government facilities up to the TS/SCI level.

• Department of Homeland Security facilities in the Washington Metro Area to include:

o 1110 Glebe Road, Arlington VA,22201 o 4601 N. Fairfax Drive, Arlington VA, 22203 o 4200 Wilson Blvd, Arlington, VA, 20598 o Corry Station – 1000 Chief Way, Corry Station Naval Base/Building 3782, Pensacola, FL,32511

5.5 Facility Clearance Level (FCL) (the highest level of DHS classified that will require access):

a. Top Secret/SCI

5.6 Is storage/safeguarding required; if so, at what level

a. No

5.7 FAR Clause 52.204-2 Security Requirements (MAR 2021)

The contractor access to CISA Sensitive Information, systems, networks and reoccurring access to CISA facilities is required under this SOW; therefore, contractor employees will require DHS Fitness Determination and Top-Secret clearance to perform work.

Sensitive Information is defined in the DHS Instruction Handbook, 121-01-007, “The Department of Homeland Security, Personnel Security, Suitability and Fitness Program” as “Any information, the loss, misuse, disclosure, unauthorized access to, or modification of, which could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria by an Executive Order or an Act of Congress to be kept secret in the interests of national defense, homeland security, or foreign policy. This definition includes one of the following categories of information:

A. Protected Critical Infrastructure Information (PCII) as described in the Critical Infrastructure Information Act of 2002, 6 U.S.C. section 21 1-224; its implementing regulations, 6 C.F.R. Part 29; or the applicable PCII Procedures Manual; or

B. Sensitive Security Information (SSI), as described in 49 C.F.R. Part 1520; or

C. Sensitive but Unclassified Information (SBU) -For Official Use Only -, which consists of any other information which:

(1) If provided by the government to the contractor, is marked in such a way to place a reasonable person on notice of its sensitive nature;

(2) Is designated "sensitive" in accordance with subsequently adopted homeland security information handling requirements.”

The contractor access to classified information is required under this SOW. The maximum level of classification is Top Secret/SCI. The details will be specified in the Department of Defense (DoD) Form 254.

5.8 CONTRACTOR TELECOMMUTING – REMOTE PERSONAL RESIDENCE

WORK LOCATIONS.

All work performed outside of the identified contractor and/or government facility(ies) will be performed at the Unclassified FOUO level. Telecommuting for federal government contractors will be considered on a situational basis to the extent practicable to meet CISA’s mission needs.

Telecommuting allows contractor personnel to perform their contractual requirements outside of CISA office locations, typically at a contractor’s personal residence or a corporate telecommuting office location. Telecommuting for contractor personnel provides the government flexibility to meet unique CISA organizational and facility needs and requirements.

The goal of telecommuting for contractor personnel is to enhance the delivery of services that support the CISA mission. Telecommuting (Telework) is permitted under this contract, with the approval of the Government Technical Lead and the COR.

All telework that requires access to DHS Government Furnished Equipment (GFE), information, or remote systems must only be conducted from within the Continental United States (CONUS) and U.S. Territories. The use of GFE Outside the Continental United States OCONUS is prohibited unless the contract requires overseas travel. Any access or use of GFE, information, or remote access system OCONUS must be requested by the Government Program Manager and approved by the COR or Contracting Officer, after all requirements are met. Any OCONUS use or access, not authorized, will result in immediate revoking of all privileges and access to systems.

Additionally, the provision to permit contractor telecommuting may be revoked at the task order level at any time if the Government makes such determination. The telecommuting provision does not change any task order requirements; all other terms and conditions of the task order remain in full force and effect.

5.9 CONTRACTOR LABOR RATES CHARGED WHILE TELECOMMUTING

The contractor will charge the same applicable fixed hourly rate as for a Government site for those contractor personnel when they telecommute at their designated telecommuting location.

5.10 HOURS OF OPERATION

The contractor employees will generally perform all work between the hours of 0800 and 1700 EST, Monday through Friday (except Federal holidays). However, there may be occasions when The contractor employees will be required to work other than normal business hours, including weekends and holidays, to fulfill requirements under this SOW.

5.11 TRAVEL

The contractor travel may be required to support this requirement. All travel required by the Government outside the local commuting area(s) will be reimbursed to the contractor in accordance with the Federal Travel Regulations. The contractor will be responsible for obtaining COR approval (electronic mail is acceptable) for all reimbursable travel in advance of each travel event.

5.12 POST AWARD CONFERENCE

The contractor will attend a Post Award Conference with the Contracting Officer and the COR no later than 14 business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this task order and review the contractor's draft project plan. The Post Award Conference will be held via teleconference.

5.13 PROJECT PLAN

The contractor will provide a draft Project Plan at the Post Award Conference for Government review and comment. The contractor will provide a final Project Plan to the COR no later than 14 business days after the Post Award Conference.

5.14 BUSINESS CONTINUITY PLAN

The contractor will prepare and submit a Business Continuity Plan (BCP) to the Government.

The BCP Plan will be due 15 business days after the date of award and will be updated on an annual basis. The BCP will document The contractor plans and procedures to maintain support during an emergency, including natural disasters and acts of terrorism. The BCP, at a minimum, will include the following:

• A description of the contractor’s emergency management procedures and policy

• A description of how the contractor will account for their employees during an emergency

• How the contractor will communicate with the Government during emergencies

• A list of primary and alternate contractors, each with primary and alternate:

• Telephone numbers

• E-mail addresses

5.10.1 Individual BCPs will be activated immediately after determining that an emergency has occurred, will be operational within 4 hours of activation or as directed by the Government, and will be sustainable until the emergency situation is resolved and normal conditions are restored or the task order is terminated, whichever comes first. In case of a life-threatening emergency, the COR will immediately contact the contractor Program Manager to ascertain the status of any contractor personnel who were located in Government controlled space affected by the emergency. When any disruption of normal, daily operations occurs, the contractor Program Manager and the COR will promptly open an effective means of communication and verify:

• Key points of contact (Government and contractor)

• Temporary work locations (alternate office spaces, telework, virtual offices, etc.)

• Means of communication available under the circumstances (e.g. email, webmail, telephone, FAX, courier, etc.)

• Essential The contractor work products expected to be continued, by priority

5.10.2 The Government and The contractor Program Manager will make use of the resources and tools available to continue contracted functions to the maximum extent possible under emergency circumstances. The contractors will obtain approval from the Contracting Officer prior to incurring costs over and above those allowed for under the terms of this task order. Regardless of task order type, and of work location, The contractors performing work in support of authorized tasks within the scope of their tasks will charge those hours accurately in accordance with the terms of this task order.

5.15 PROGRESS REPORTS

The Program Manager will provide a weekly status progress report to the Contracting Officer and COR via electronic mail by COB Monday (for the previous week). This report will include a summary of all The contractor work performed, including a breakdown of labor hours by labor category, all direct costs by line item, an assessment of technical progress, schedule status, any travel conducted and any The contractor concerns or recommendations for the previous reporting period.

5.16 PROGRESS MEETINGS

The Program Manager will be available to meet with the COR upon request to present deliverables, discuss progress, exchange information and resolve emergent technical problems and issues.