PWS_for_CES_Information_Assurance_Support_Services.pdf

PERFORMANCE WORK STATEMENT

FOR

INFORMATION ASSURANCE SUPPORT SERVICES

AT

6TH CIVIL ENGINEER SQUADRON

MACDILL AFB, FLORIDA

May 11, 2016

1.0 DESCRIPTION OF SERVICES. The CONTRACTOR shall provide all personnel, equipment, tools, supplies, materials, transportation, supervision, and any other items and/or services necessary to ensuring that systems are certified and accredited in accordance with DoD and Air Force Information Assurance (IA) directives and instructions. Systems needing Certification and Accreditation (C&A) may include Industrial Control Systems (ICS) and non-ICS systems. Coordinate all work with base ICS Functional Area Managers (FAM’s) and Higher Headquarters (HHQs) i.e. AFCEC or AMC Program Manager (PM’s) as necessary to ensure a well-managed program and successful outcomes.

1.1 Implement Access Privileges and Permissions Management of VLAN Security System Approve and manage all access privileges to ICS Virtual Local Area Network (VLAN) Security and monitoring related applications; validate all access privileges annually; and re-evaluate frequency requirements every three years or at any mission change, system change, or other significant change to operating requirements. Utilize full administrative rights to install software updates/patches.

1.2 Oversight of VLAN ICS Systems and Stand Alone ICS Systems CONTRACTOR will function as the Base ICS security program manager (PM) and shall provide the necessary security documentation to their respective Major Command (MAJCOM) or Air Force Civil Engineer Center (AFCEC) ICS security PM for each Base Civil Engineer ICS they support.

CONTRACTOR will oversee the same activities mentioned for the VLAN Security System that are conducted by the FAM for each of the 6CES ICS solutions i.e. EMCS, Electric Metering, Traffic Signal Controls, etc. Ensure appropriate access privileges are granted for all individuals based on their training, qualifications, and functional duties. Coordinate with ICS PM’s to oversee the management of CE ICS access by ensuring that accounts are deactivated or activated in a controlled manner. Ensure personnel designated to make configuration decisions and responsible for IA controls for both Platform IT (PIT) and Platform IT Interconnection (PITI) are certified IAW DoD regulations. Review, modify, and edit the Enterprise Information Technology Data Repository (EITDR) or equivalent systems entries as needed and after coordination with the Industrial Control System Functional Area Manager. Document and track system configurations for each CE-owned, operated, and maintained ICS throughout the system life cycle, including any Air Force CE ICSs operated and maintained by other contractors on other contracts.

Provide annual reports that identify compliance/non-compliance as required to HHQs. The CONTRACTOR shall follow Engineering Technical Letter (ETL) 09-11 as necessary to successfully meet the requirements of this PWS. The CONTRACTOR shall create and maintain inventory of both Industrial Control Systems (ICS) and non-ICS systems requiring Certification and Accreditation (C&A), i.e. Authority to Operate (ATO) certification. The CONTRACTOR shall work the C&A processes and associated activities for 6CES systems in the order provided by the government. Perform the functions in this PWS pertaining to current and future 6 CES mission requirements. The CONTRACTOR must perform to the standards in this contract. The CONTRACTOR shall Work with the Designated Approval Authority (DAA), to ensure all ICS and non-ICS systems are properly certified and accredited in accordance with the Risk Management Framework (RMF), formerly DoD Information Assurance Certification and Accreditation Process (DIACAP) – work with system owners on resolving any issues that may prevent receipt of ATO for that system.

2.0 SERVICES SUMMARY: The Services Summary identifies the performance objectives and performance thresholds for all critical tasks associated with providing the services outlined in this PWS.

This section contains only those items considered most important for mission accomplishment. The performance objectives are those services/tasks required in the PWS. The performance threshold briefly describes the minimum acceptable levels of service for each requirement. The thresholds are critical to mission success. The Government expects the Contractor to perform at the acceptable levels throughout the life of the contract.

Performance Objective

PWS

para

Performance Threshold Surveillance Method

Enforce password management according to ETL 09-11 for all C&A systems once a month

1.1 1.2

100% Compliance with

ETL 09-11

Review monthly

Create, upload and maintain C&A packages according to the Risk Management Framework Process

1.1 1.2

100% inspection - All packages must be edited or actively maintained monthly

Monthly review

The contractor shall conduct an initial and maintain a current full inventory of Energy Management Control Systems (EMCS)

1.2 No more than 1 inventory

discrepancy per month

Review monthly inventory results and random inventory samples.

3.0 GENERAL INFORMATION

3.1 Contractor Personnel: The CONTRACTOR shall provide a sufficient number of personnel possessing the skills, knowledge, and training to satisfactorily perform the services required by this PWS.

Contractor personnel shall meet industry minimum education or experience requirements for each specific service area and must have and maintain a current “Security + Certification”. The CONTRACTOR shall not employ persons who are identified to the CONTRACTOR by the Contracting Officer (CO) as potential threats to the health, safety, security, general wellbeing, or operational mission of the installation and its population. All CONTRACTOR personnel shall be able to fluently understand, read, write, and speak English. The CO may require the CONTRACTOR to remove employees from the workplace for reasons of misconduct or security. The CONTRACTOR shall ensure employees have current and valid certifications and licenses, as identified by the Government or Federal, State, and local requirements or laws, to accomplish the services of the PWS before starting work. The CONTRACTOR shall not employ any person who is an employee of the United States Government if employing that person would create a conflict of interest or the appearance of a conflict of interest. The CONTRACTOR is cautioned that off-duty active military personnel hired to perform work may be subject to permanent change of station, change in duty hours, or deployment. Military Reservists and National Guard members may be subject to recall to active duty. The abrupt absence of these personnel could adversely affect the CONTRACTOR’s ability to perform; however their absence at any time shall not constitute an excuse for non-performance.

3.2 Federal Holidays: The Contractor shall observe the same holidays observed by the Government, as follows:

HOLIDAY WHEN OBSERVED

New Year’s Day January 1 or the Friday preceding or Monday following

Martin Luther King’s Birthday 3rd Monday in January

President’s Day 3rd Monday in February

Memorial Day Last Monday in May

Independence Day July 4 or the Friday preceding or Monday following

Labor Day First Monday in September

Columbus Day 2nd Monday in October

Veterans Day November 11 or the Friday preceding or Monday Following

Thanksgiving Day 4th Thursday in November

Christmas Day December 25 or the Friday preceding or Monday following

3.3 Breach of Security: Neither the Contractor nor any of its personnel shall disclose nor cause to be disclosed any information concerning operations which could result in or increase the likelihood of the possibility of a breach of the activity’s security or interrupt the continuity of operations.

3.4 Quality Control Plan: The Contractor shall develop, maintain, enforce, and document a Quality Control Plan (QCP). The QCP shall ensure that the government receives the level of quality that is consistent with the requirements specified in this performance work statement. The QCP shall be made available for Government review upon request. The Contractor shall be responsible for overall responsiveness, cost control, adherence to schedules, responsible for cooperative behavior, technical quality of work, and commitment to customer satisfaction

3.5 Hours of Operation. The contractor is responsible for conducting business, between the hours of 0730 – 1630 Monday through Friday except Federal holidays or when the government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

3.6 Contractor Full-Time Equivalent Reporting: The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the USAF via a secure data collection site. The contractor is required to completely fill in all required data fields at http://www.ecmra.mil.

Reporting inputs will be for the labor executed during the period of performance for each Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October* of each calendar year. Contractors may direct questions to the CMRA help desk at: http://www.ecmra.mil/” http://www.ecmra.mil/ http://www.ecmra.mil/