N2ITSM_Mexico_PWS_DRAFT_v5_3_FEB_16.docx

NORAD and USNORTHCOM Information Technology Service Management (N2ITSM) Office of Defense Coordination (ODC), Mexico

US EMBASSY, MEXICO CITY, MEXICO

ON SITE TECHNICAL REPRESENTATIVE (OSTR)

Performance Work Statement

Current as of: 3 February 2016

DRAFT

Table of Contents

1 GENERAL

1.1 DESCRIPTION OF SERVICES

1.2 BACKGROUND INFORMATION

1.3 DEFINITIONS OF RESPONSIBILITIES

1.4 PLACE OF PERFORMANCE

1.5 HOURS OF OPERATION

2 TASKS AND SERVICES DESCRIPTIONS

2.1 TASK 1: SERVICE OPERATIONS AND STABILITY

2.2 TASK 2: SERVICE TRANSITION AND SUPPORT

3 SERVICE SUMMARY

4 FURNISHED ITEMS AND SERVICES

4.1 GOVERNMENT FURNISHED ITEMS AND RESPONSIBILITIES

4.2 CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITES

5 SPECIFICS

5.1 APPLICABLE DIRECTIVES

5.2 CHANGES

5.3 KEY PERSONNEL

5.4 SPECIAL QUALIFICATIONS

5.5 INFORMATION ASSURANCE

5.6 CERTIFICATION UPDATES

5.7 OTHER DIRECT COSTS (ODC)

5.8 INFORMATION AND DOCUMENTATION REQUESTS

5.9 CONTINGENCY AND EXERCISES

5.10 PROCESS REQUIREMENTS

5.11 SECURITY REQUIREMENTS

5.12 CONTRACTOR’S QUALITY CONTROL

5.13 QUALITY ASSURANCE

5.14 RECOGNIZED HOLIDAYS

5.15 CONTRACTING OFFICER REPRESENTATIVE

5.16 PRIMARY POINT OF CONTACT

5.17 CONTRACTOR PERSONNEL

5.18 ORGANIZATIONAL CONFLICT OF INTEREST APPROVAL

5.19 CONTRACTOR MANPOWER REPORTING

5.20 PROFESSIONAL EMPLOYEE COMPENSATION PLAN

6 DELIVERABLES

7 ATTACHMENTS/APPENDIX LISTING

1 GENERAL

A. The contractor shall perform work in accordance with (IAW) this Performance Work Statement (PWS) in support of the Office of Defense Coordination (ODC) Mexico.

B. The contractor shall perform work IAW this PWS and the basic idefinite delivery/indefinite quantity (IDIQ) PWS, as applicable.

1.1 DESCRIPTION OF SERVICES

1.1.1 The contractor shall provide non-personal services to manage, operate, sustain, and provide logistical and general support for the Information Technology (IT) Services, as identified in the ODC Mexico Service Catalog Attachment 4.

1.1.2 The contractor shall provide the on-site IT Service Management (ITSM) for IT Services provided to USNORTHCOM personnel and select personnel supporting the USNORTHCOM mission within the U.S. Embassy, Mexico City, Mexico. The IT services, as identified in the ODC Mexico Service Catalog, are an extension of the NORAD and USNORTHCOM IT Services Management Division (N-NC/J66), who is ultimately responsible for day-to-day operational effectiveness of the USNORTHCOM C4S architecture. The IT services that are in scope and responsibility of the on-site technical representative (OSTR) and contractor are identified by ‘OSTR’ in the ODC Mexico Service Catalog. On-site contractor personnel are tenants of ODC Mexico, and are sponsored by the United States ODC Chief and Commander USNORTHCOM. The contractor shall fully comply with all the rules, procedures, and practices as directed by the ODC Commander concerning the flow of information to or from the Embassy and forward locations that come within the Ambassador’s jurisdiction. The Government will include the on-site IT services in the ODC Mexico’s International Cooperative Administrative Support Services (ICASS) System Agreement #5728.0 (AF-USNORTHERN COMMAND) by USNORTHCOM for Basic Service Cost Center #6150 contractor eligible support items negotiated between the Department of Defense (DoD) and the Department of State (DoS).

1.2 BACKGROUND INFORMATION

1.2.1 N-NC conducts theater security cooperation and supports counterdrug activities in order to promote democracy and stability in the NORAD and USNORTHCOM Area of Responsibility (AOR). The Command responds unilaterally or multilaterally to crises that threaten regional stability, security, or national interests. It also continuously prepares for future hemispheric challenges. ODC Mexico is responsible for acknowledgment, response, and compliance to actions directed by NORAD and USNORTHCOM Theater Network Control Center (TNCC) and the Network Operation Security Center (NOSC) in regards to network systems configurations and vulnerability remediation.

1.3 DEFINITION OF RESPONSIBILITIES

1.3.1 IT OPERATIONS SUPPORT LEVELS

1.3.1.1 Enterprise Maintenance Levels

The contractor shall perform Tier 1 and Tier 2 maintenance levels for all systems and services provided to ODC Mexico and USNORTHCOM personnel operating in the U.S. Embassy, Mexico City.

First-Point Resolution (Tier 1): Performs first look trouble-shooting, including cables, configuration, and customer errors.

B. Second-Level Support Group (Tier 2): First point of escalation for problems beyond the scope of the Tier 1 technicians. Would typically include global server configuration settings, security policy, network infrastructure, and application configurations.

1.3.1.2 ITSM Prioritization Levels.

The contractor shall perform maintenance levels on-site as required to meet the ITSM Prioritization levels for response and restorations of users, systems, and services

A. Priority 1

(1) Chief, ODC Mexico and/or equivalent users; IAC Chief

(2) General Officer\Flag Officer (GOFO) users of NORAD and USNORTHCOM services within the Embassy

(3) Mission communications equipment or systems whose failure prevents mission accomplishment

(4) Mission Essential services as identified in the Basic IDIQ or ODC Mexico Service Catalog and User Profile

(5) Communication equipment outage that isolates an operational unit of the NORAD and USNORTHCOM enterprise on a critical service as defined by the Basic IDIQ or ODC Mexico Service Catalog

(6) Outages deemed critical by appropriate government Point of Contact (POC)

(7) Requires restoral of like service capability within 4 hours

B. Priority 2

(1) Chief, ODC Mexico Direct Support staff; Deputy ODC Chief; IAC Operations Officer

(2) Support staff for GOFO users

(3) Any request for assistance from a subordinate service provider on the ODC Mexico and /or NORAD and USNORTHCOM domain, unless the incident occurs as a product of unapproved change

(4) Mission communications equipment or systems whose failure severely impairs mission accomplishment but does not impact priority 1 users

(5) Requires restoral of like service capability within 24 hours

c. Priority 3

(1) All other users

(2) All other network/service issue(s)

(3) Any request for assistance from a subordinate service provider on the ODC Mexico and/or NORAD and USNORTHCOM network

(4) Requires restoral of like service capability in compliance with service level agreements (on average 72 hours)

1.4 PLACE OF PERFORMANCE

1.4.1 The contractor shall support the following sites outside of the Continental United States (OCONUS) and within the Continental United States (CONUS):

A. OCONUS

(1) US Embassy, Mexico City, Mexico

(2) SEMAR, Mexico City, Mexico (U.S. CENTRIXS Service Only)

(3) SEDENA, Mexico City, Mexico (U.S. CENTRIXS Service Only)

B. CONUS

(1) NORAD and USNORTHCOM Headquarters, Tiered Maintenance responsibilities per the N2ITSM PWS

1.5 HOURS OF OPERATION

The contractor’s core operating hours are 7:30 am to 4:30 pm, Monday thru Friday, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. In addition, the contractor shall provide support and response to incidences per the services priorities (paragraph 1.6.1.2) and respective response times (Incident Management and Service Request) to include:

A. Provide telephone service support 24/7/365 B. Provide 24/7/365 support for all services IAW ITSM priorities established in this PWS C. Provide 24/7 support during exercises and contingencies D. Service Desk operating hours are from 6:00 am to 6:00pm, Monday thru Friday

2. TASKS AND SERVICES DESCRIPTION

The contractor shall provide on-site IT Service Management for the specified tasks and sub-tasks. The Performance Work Statement and the Basic IDIQ contract Performance Work Statement shall be the core responsibilities for all IT Service Management support to ODC Mexico and its customers, users, systems, and services, to include specific tasks and sub-tasks identified. The contractor shall provide on-site contractor reach-back for those ITSM tasks and sub-tasks performed in this PWS All Tasks and Subtasks should be integrated as required for the Process Models IAW para 5.10.2. All Task and Subtask metrics should be reported separately for this task, but included in the overall Critical Success Factors.

2.1 TASK 1: SERVICE OPERATIONS AND STABILITY

2.1.1 SUB-TASK 1: SERVICE DESK

The Service Desk is the primary point of contact for users experiencing a service disruption or requesting a service and/or a service change. The goal of the Service Desk is to provide incident management and request fulfillment. The Service Desk resumes normal service to the user in accordance with priority level response times and documents and facilitates service requests.

2.1.1.1 REQUIREMENTS. The contractor shall:

A. Provide a Service Desk function that will support the users specified in Paragraph 1.7.1. During contingency and exercise operations, the Service Desk will be staffed 24/7 to meet the user demand.

B. Provide, integrate, and manage Service Desk functions to meet Government specified outputs, Operational Metrics (OM), Key Performance Indicators (KPI), and Critical Success Factors (CSF) identified below. The COR will review and validate reports and documents provided by the contractor and provide feedback.

C. Maintain the Service Desk as the primary point of contact for all incoming calls, walk-ins, and emails. The contractor shall provide a customer focused interface between the users to enable the efficient use of IT services, assisting in the restoral of normal services, in addition to assisting users against potential service interruptions.

D. The Contractor shall provide Common Access Card (CAC) unlock and Personal Identification Number (PIN) reset capability for NORAD and USNORTHCOM Personnel through the Service Desk and the N2C2 On-Site technical support.

E. Ensure all Service Desk requests that are identified as standard requests are immediately processed based on approved request models and nonstandard requests are logged and routed for contractor analysis.

F. Provide accurate status updates and feedback to the Contracting Officer Representative (COR) or designated Government Representative on all incidents, service and change requests submitted to the Service Desk on a weekly basis, until resolved, fulfilled, or officially declined by the Government. Develop and utilize a method to track that status updates are being delivered and provide weekly reports of notification history to the COR or designated Government Representative.

G. Utilize an incident, request, and call management system to log, categorize, and escalate incident records as well as record workarounds, maintain a known error database, and document final resolution within required timelines. Expose a customer facing view of the database to allow all N-NC customers (to include subordinates, regions, and sectors) to check on the status of requests in real-time. Maintain CAC PIN reset capability during normal service desk hours.

2.1.1.2 OUTPUTS: (Service Output Specifications, See Attachment 3) A. Monthly Service Desk Call Report

2.1.1.3 OPERATIONAL METRICS: (Monthly)

A. Total Number Of Incidents Recorded By Service Desk B. Average Call Waiting Time (Seconds) C. Number Of Calls Abandoned after 60 Seconds D. Total Number Of First Contact Resolutions (i.e. walk-ins, phone calls) Tickets, within 15 minutes E. Total Number Of Calls Received

2.1.1.4 KEY PERFORMANCE INDICATORS: (Monthly)

A. Call Abandon Rate [Metric: C/E]

(1) Superior Service Threshold: 3%

(2) Service Warning: 5% B. Call Waiting Rate [Metric: B]

(1) Superior Service Threshold: (60 seconds)

(2) Service Warning: (120 seconds) C. First Contact Resolution Rate [Metric: D/A]

(1) Superior Service Threshold: 70%

(2) Service Warning: 55%

2.1.1.5 CRITICAL SUCCESS FACTORS:

A. Maintain Quality IT Services B. Improve User Satisfaction C. Effective Communications with Users

2.1.2 SUB-TASK 2: INCIDENT MANAGEMENT:

Incident management covers every occurrence that disrupts or might disrupt a network, system, capability, or security service. This includes incidents reported by customers to the Service Desk as well as those reported by subordinate, deployed, or alternate command sites, and automated systems. The goal of Incident Management is to restore normal service operation to meet user priority levels and minimize the adverse effect on operations, thus ensuring that the best possible levels of service quality and availability are maintained.

2.1.2.1 REQUIREMENTS. The contractor shall:

A. Provide, integrate, and manage Incident Management to meet Government specified outputs, OMs, KPIs, and CSFs identified below. The COR will review and validate reports and documents provided by the contractor and provide feedback.

B. Apply the following ITSM Prioritization Levels to incident management. By exception, the IT Service Management Division Chief can elevate the priority of an operations element, staff section, and/or mission essential personnel for a temporary period of time to meet an urgent or critical command need and if there is a significant impact to meet the mission. Similarly, the Director/Deputy Director of Command and Control Systems can also determine that the incident does not impair the operational mission of the user at the priority listed and can downgrade the priority to ensure unnecessary focus is not diverting efforts from issues with more operational necessity.

(1) Priority 1A

i. Priority 1A designation is reserved for Battle Staff Center seats. The seats are associated with the elements identified in the N-NC Publication 1-01 Battle Staff Standard Operating Procedure (BSOP). The primary location for the P1A seats is the N2C2 but the priority designation applies to any location occupied by Battle Staff personnel. Deployed elements in support of for N-NC missions (e.g. Homeland Defense, Civil Support, and NSSEs.

ii. Restoral of service within two (2) hours of outage notification and respond within 30 minutes

(2) Priority 1

i. Users: GO/FO/SES/Director/Element Commander users. Service restoration shall be contingent upon a required time coordinated with the executive staff or requested by the IT Service Management Division Chief.

ii. Services: Mission communications equipment or systems whose failure prevents mission accomplishment Mission Critical and Essential services as identified in the Basic IDIQ or ODC Mexico Service Catalog. Priority 1 applies to all N-NC services extended to subordinate commands, regions, sectors, and service components which isolates and/or degrades services. Service outages deemed critical by the appropriate Government Service Owner.

iii. All require restoral of like service capability within four (4) hours.

(3) Priority 2

i. Users: Support staff for GO/FO/SES (Priority 1) users; per the N-NC Chief of Staff’s Staff Directory and All command special staff directors.

ii. All require restoral of like service capability within 12 business hours.

(4) Priority 3

i. Users: All other N-NC users using N-NC IT Services.

ii. Manage, configure, install, troubleshoot, maintain and upgrade Government-approved incident management systems. Make the incident management system available for Government access, use, and review at all times.

iii. Respond and resolve all incidents for N-NC users. Priority 3 user incidents shall be resolved within 60 business hours. To minimize the incident aging, ninety percent (90%) of Priority 3 user problems shall be resolved 60 business hours, and one-hundred percent (100%) of Priority 3 user problems shall be resolved within 80 business hours (i.e. this requires all Priority 3 tickets to be resolved in ten (10) business days). All user incidents not resolved within 80 business hours shall be reported in the Daily Service Desk Report.

iv. Contact end-user on any anticipated service level breaches based on end-user priority.

v. All open incidents, after the 60 days phase-in period, will be reported to the COR within ten (10) business days. Incident open dates will be reset to contract start date and resolved IAW the ITSM prioritization schema.

Report all major incidents defined by either a service outage or degradation affecting ten (10) or more users or a Core Service outage within 30 minutes to the Government Service Owner for Network Operations.

2.1.2.2 OUTPUTS: (See Attachment 3 Service Output Specifications) A. Monthly Incident Management Report B. Monthly Service Level Agreement (SLA)/ Operational Level Agreement (OLA) Breach Reports C. Monthly Major Incident Report D. Incident Models (Required within one (1) hour after closure of Major Incident

2.1.2.3 OPERATIONAL METRICS: (Monthly)

A. Total Number Of Incidents (All incidents resolved) B. Number Of Incidents Resolved Within Priority Levels C. Number Of Incidents Reopened Within Ten (10) Working Days D. Incidents Caused By Customer (e.g., Port Blocked Denial of Service, Password Lock Out) E. Number Of Closed Incidents without Customer/User Agreement F. Number of Priority 3 Incidents Resolved within 60 Business Hours G. Number of Priority 3 Incidents Resolved H. Average Time to Incident Resolution for Priority 1A User I. Average Time to Incident Resolution for Priority 1 User J. Average Time to Incident Resolution for Priority 2 User Average Time to Incident Resolution for Priority 3 User

2.1.2.4 KEY PERFORMANCE INDICATORS:

A. Incident Resolution Rate [Metric: (B/A)]

(1) Superior Service Threshold: 95%

(2) Service Warning: 90% B. Customer Incident Impact Rate [Metric: (D/A)]

(1) Superior Service Threshold: 4.5%

(2) Service Warning: 7.5% C. Incident Reopen Rate [Metric: (C/A)]

(1) Superior Service Threshold: 4.5%

(2) Service Warning: 7.5% D. Customer Dissatisfaction Rate [Metric: (E/A)]

(1) Superior Service Threshold: 5%

(2) Service Warning: 10% E. Incident Resolution (Avg) for Priority 1A Users [Metric: H]

(1) Superior Service Threshold: One (1) hour (Average)

(2) Service Warning: Two (2) hours (Average) F. Incident Resolution (Avg) for Priority 1 Users [Metric: I]

(1) Superior Service Threshold: Two (2) hours (Average)

(2) Service Warning: Four (4) hours (Average) G. Incident Resolution (Avg) for Priority 2 Users [Metric: J]

(1) Superior Service Threshold: Eight (8) business hours (Average)

(2) Service Warning: 12 business hours (Average) H. Incident Resolution (Avg) for Priority 3 Users [Metric: K]

(1) Superior Service Threshold: 36 business hours (Average)

(2) Service Warning: 60 business hours (Average) I. Priority 3 Incident Aging [Metric: F/A]

(1) Superior Service Threshold: 90% Service Warning: 80%

2.1.2.5 CRITICAL SUCCESS FACTORS:

A. Provide Effective and Efficient IT Service Management B. Maintain Quality IT Services C. Improve Mission/Business Productivity with IT Services D. Improve User Satisfaction

2.1.3 SUB-TASK 3: REQUEST FULFILLMENT

Request Fulfillment is the process that incorporates all aspects of fulfilling a customer’s approved IT request. IT requests can be either for hardware or software equipment, devices, application, etc. that are offered in the Basic IDIQ or ODC Mexico Service Catalog. User requests can be requests for information, advice, a standard change, or access to a service in the Basic IDIQ or ODC Mexico Service Catalog. It should include self-service for identifying available services, capture the service request, approval, tracking, provisioning, delivery and delivery confirmation. The goals of the Request Fulfillment process are:

A. To offer users a channel through which they can request and receive services; to this effect an agreed approval and qualification process must exist B. To provide users and customers with information about the availability of service and the procedures for obtaining these services C. To assist with general information, complaints, or comments

2.1.3.1 REQUIREMENTS. The contractor shall:

A. Provide, integrate, and manage Request Fulfillment to meet Government specified outputs, OMs, KPIs, and CSFs identified below. The Government will review and validate reports and documents provided by the contractor and provide feedback.

B. Apply the following ITSM Priority Levels to request fulfillment.

(1) Priority 1A requests will be fulfilled in three (3) business days

(2) Priority 1 user requests will be fulfilled within five (5) business days

(3) Priority 2 user requests will be fulfilled within ten (10) business days

(4) Priority 3 user requests will be fulfilled within 14 business days

(5) All Priority 1A, 1, and 2 service requests exceeding the specified fulfillment days will be reported daily.

C. By exception, the Director of Command and Control Systems, can elevate the priority of an operations element, staff section, and/or mission essential personnel for a temporary period of time to meet an urgent or critical command need and if there is a significant impact to meet the mission.

D. Manage, configure, install, troubleshoot, maintain and upgrade Government-approved service request management systems. Make the service request management system available for Government access, use, and review at all times.

E. Respond and resolve all service requests for N-NC users and customers. Estimated average 1,500 service requests per month, both standard and non-standard.

F. Report all open service requests within 70 calendar days after contract start date.

G. After 90 calendar days of contract start, produce quarterly standard request model according to volume, recommended changes and updates. This report shall be provided to the designated Government representative.

H. Produce a Request Model for each IT Service. A Request Model should include, at a minimum, approval authority, provisioning steps, associated costs, funding approval steps, service assets, the Core Service Package (See Basic IDIQ or ODC Mexico Service Catalog), and any associated Service Level Packages for any differentiated offerings. Each Request Model will be approved by the Change Advisory Board prior to it becoming a standard change.

2.1.3.2 OUTPUTS: (See Attachment 3 Service Output Specifications) A. Monthly and Quarterly Request Fulfillment Report B. Monthly Request Model for each IT Service

2.1.3.3 OPERATIONAL METRICS: (Monthly)

A. Average Time to Fulfill Requests for Priority 1A User B. Average Time to Fulfill Requests for Priority 1 User C. Average Time to Fulfill Requests for Priority 2 User D. Average Time to Fulfill Requests for Priority 3 User E. Number Of Request Fulfillment Complaints F. Total Number of Requests G. Number Of Requests Reopened

2.1.3.4 KEY PERFORMANCE INDICATORS:

A. Request Fulfillment Rate for Priority 1A Users [Metric: A]

(1) Superior Service Threshold: Two (2) business days (Average)

(2) Service Warning: Three (3) business days (Average) B. Request Fulfillment Rate for Priority 1 Users [Metric: B]

(1) Superior Service Threshold: Three (3) business days (Average)

(2) Service Warning: Five (5) business days (Average) C. Request Fulfillment Rate for Priority 2 Users [Metric: C]

(1) Superior Service Threshold: Seven (7) business days (Average)

(2) Service Warning: Ten (10) business days (Average) D. Request Fulfillment Rate for Priority 3 Users [Metric: D]

(1) Superior Service Threshold: Ten (10) business days (Average)

(2) Service Warning: 14 business days (Average) E. Request Fulfillment Satisfaction Rate [Metric: 1-(E/F)]

(1) Superior Service Threshold: 95%

(2) Service Warning: 90% F. Service Request Reopen Rate [Metric: G/F]

(1) Superior Service Threshold: 3.0%

(2) Service Warning: 5.0%

2.1.3.5 CRITICAL SUCCESS FACTORS:

A. Deliver Accurate and Timely IT Services B. Maintain Quality IT Service C. Improve User Satisfaction

2.1.4 SUB-TASK 4: CYBER SECURITY MANAGEMENT:

A. The N-NC Cyber Security Management (CSM) process incorporates all applicable policies and regulations and seeks to ensure that information security is effectively incorporated in all service and service management activities related to the confidentiality, integrity, availability, authentication and non-repudiation of information systems and data. This includes the security of hardware and software components, documentation and security procedures across the enterprise which includes the N-NC owned circuits, N-NC domains and N-NC Internet Protocol Address ranges. The CSM Government process develops and enforces policy, standards, and procedures to ensure the protection of the organization’s assets, data, information, and IT services. The goal of CSM is to align IT and mission security to ensure that information security is employed effectively in all N-NC IT services and service management activities in accordance with applicable legal and regulatory guidance and organizational policy.

B. The overarching governance for the CSM requirements is captured in, but is not limited to, references included in Appendix A – Publications and Attachment 3 – Output Specifications. The contractor shall maintain awareness of all applicable Government policy, standards, mandates, and regulations as they apply to IT security. The governance outlines regulatory requirements to be used by the contractor to ensure the N-NC enterprise (e.g. systems and networks) are in compliance and are inspection ready at all times.

C. The contractor shall ensure key cybersecurity personnel have the requisite education, expertise and/or experience to execute the cybersecurity tasks. Commercial certification requirements for cybersecurity, in accordance with DoD 8570.01-M have previously been referenced in this document. While certifications are mandatory, they are often insufficient and cannot be a substitute for experience and expertise managing an effective cybersecurity program. Key personnel should have a profound understanding of applicable directives and programs and be able to integrate multiple cybersecurity initiatives in the most effective and efficient manner possible.

2.1.4.1 REQUIREMENTS. The contractor shall:

A. Provide, integrate, and manage Cyber Security Management to meet Government specified outputs, OMs, KPIs, and CSFs identified below. The Government will review and validate compliancy with required security governance.

B. Install, operate, maintain, troubleshoot, and upgrade boundary protection systems to include, but not limited to: firewalls, intrusion detection/prevention systems, patch management, web proxies, and external routers. The contractor shall operate, maintain, and manage vulnerability compliance through Government-designated tools (such as, but not limited to Assured Compliance Assessment Solution (ACAS), Host Based Security System (HBSS), Continuous Monitoring and Risk Scoring (CMRS).

C. Comply with all DISA STIGS (to include, but not limited to network STIG, enclave STIG, non-traditional STIG) for all service assets in the N-NC Basic IDIQ or ODC Mexico Service Catalog.

D. Serve as Global Administrator to operate, configure, and maintain the HBSS infrastructure per DoD and USCYBERCOM guidance on the NIPRNet, SIPRNet, and NORAD Enterprise Network (or equivalent). All point products will be deployed and maintained on all systems as mandated. POA&M or waivers will be maintained and updated annually or upon expiration for all non-compliant systems. The system will be monitored 24/7 for rogue machines, policy alerts, and possible nefarious activity with identification and mitigation measures to be completed within 24 hours. Administration of this tool includes the implementation of all mandated and industry best practices, policy development and enforcement, dashboard development, tuning, waiver/policy exception requirements, and analysis of user activity. As the Global Administrator, responsible for coordination and advisement for all N-NC subordinates, regions, and sectors for the maintenance and compliancy of the HBSS infrastructure.

E. Assessment and Authorization –Provide complete assessment and authorization documentation for new systems and existing systems requiring re-accreditation per DoD regulations and the Risk Management Framework construct. Documentation for systems includes, but is not limited to servers, routers, infrastructure, DISN video services, devices/equipment for new and existing systems that include at a minimum STIG review and findings, vulnerability scans, security (Information Assurance) controls, risk assessment to include business impact, scorecard, supporting artifacts, Government approved POA&Ms, System Identification Plan, topologies, implementation plan, and other documentation as required per the Government and DoD guidance.

F. Within 90 days of contract start date, conduct an audit of all assessment and authorization documentation, and identify all incomplete documentation.

G. Provide complete assessment and authorization documentation for all new and existing enclaves and systems per DoD regulations and the Risk Management Framework. Maintain, update, and modify assessment and authorization documentation for the following and all other enclaves and systems within the Basic IDIQ or ODC Mexico Service Catalog as required by DoD guidance:

(1) N-NC SIPRNet

(2) N-NC NIPRNet

(3) NORAD Enterprise Network (NEN)

(4) NORAD Operations on SIPR (NOoS)

(5) SIPR-REL

(6) Classified VTC

(7) Unclassified VTC

(8) Stand-alone systems

(9) New projects

H. Requirements for a complete package include (but is not limited to) the System Identification Plan (or equivalent under RMF), security scorecard, validation checklist, topology, supporting artifacts for compliant controls, POA&Ms, and implementation plan and others as DoD regulations require. Completed documentation is to be provided 45 business days prior to authorization date for auditing through the Government designated system (such as, but not limited to Enterprise Mission Assurance Support Service (EMASS)).

I. Assess and document security controls within 45 business days prior to authorization date. Controls will be assessed as compliant, non-compliant, or not applicable, with supporting validation checklist answered, or written determination as to why control was assessed as non-compliant or not applicable. All controls assessed as non-compliant or not applicable will have assessment and determination comment as to how conclusion was made. This will include interviewing and gathering artifacts from resources inside and outside of the J6 and scope of the Basic IDIQ or ODC Mexico Service Catalog, such as (but not limited to) facilities personnel, J3, J7, and CMAFS. If unable to obtain necessary documentation, will notify government service owner 60 business days prior to authorization date.

J. Provide POA&Ms for items within the Basic IDIQ or ODC Mexico Service Catalog and for all non-compliant controls 45 business days prior to authorization date. Controls assessed for government action, will be identified and provided to the government 60 business days prior to authorization date.

K. Provide the following items to be used by the Government for validation and acceptance for compliance of cyber security requirements:

(1) Security Controls – Provide report bi-annually to include at a minimum compliant controls, detailed non-compliant controls, POA&Ms for mitigation of non-compliant controls.

(2) DoD Designated Vulnerability Tracking System – Manage and maintain general asset and scan entries in Government-designated system to include at a minimum, but not limited, to scans, STIGS, Government approved POA&Ms.

(3) Federal Information Security Management Act (FISMA) Reporting-Upon notice, complete documentation as required for quarterly and annual FISMA reporting requirements for all service assets in the Basic IDIQ or ODC Mexico Service Catalog.

(4) CAC unlock and PIN reset capability for NORAD and USNORTHCOM Personnel through the Service Desk and the N2C2 On-Site technical support.

(5) Vulnerability Scans –Scan for and identify vulnerabilities within the boundaries of the Basic IDIQ or ODC Mexico Service Catalog monthly. At a minimum, identify systems out of compliance and patch/reimage accordingly. All systems to include servers with more than 25 vulnerabilities will be identified monthly, and will be brought into compliance within seven (7) days form scan date or quarantined and reimaged to bring into compliance. If a network or system is provided by a third-party, the contractor shall notify the supporting organization of other network or system non-compliance and track until completion.

(6) Patch Systems – Maintain knowledge of required patches and deploy as mandated. Patches older than 21 days have a valid Government approved POA&M in place and be tracked within the Government-designated system. Zero-day vulnerabilities will be tracked and corrected as soon as the applicable patch becomes available. While awaiting corrective patch, mitigation to protect from zero-day vulnerabilities will be provided to the Government for course of action recommendation (such as, but not limited to disable application until patch approved, disable port/protocol). All servers will be rebooted minimally every 30 days. All workstations that have not rebooted within seven (7) days will be forced to reboot. Exceptions for rebooting must be identified in a government approved POA&M.

(7) Ports and Protocols – Manage and maintain ports and protocols to ensure security. Maintain information that at a minimum includes collected ports and protocols data, vulnerability assessment, assurance category, threat potential to cause damage to DoD operations and interests, a detailed description of exceptions and why necessary, description of the compensating controls in place to mitigate risk, business Impact and Risk, and Threat and Vulnerability Analysis.

(8) Ports and Protocols information will be entered, updated, and maintained in the Government designated system (such as, but not limited to DoD Ports Protocols and Service Management (PPSM) Registry). Prepare DoD mandated documentation for all systems requiring port openings when services are not listed in the PPSM registry. The contractor shall provide proof to the Government that mitigation measures are in place per the PPSM vulnerability assessment, prior to implementing the boundary modification.

(9) Command Cyber Readiness Inspection –Manage and maintain security posture and compliance in accordance with DoD inspection criteria at an acceptable or better state for all enclaves. Expect and plan for criteria changes. All vulnerability findings will be corrected or mitigated within the DoD mandated timeframes. If vulnerabilities cannot be corrected as mandated, a government approved POA&M’s must be in place prior to mandated remediation date. Provide quarterly status report that includes at minimum non-compliant items that affect the inspection ready state.

(10) Circuit Support – Comply with the DISA Connection Approval Process guidelines, instructions and DoD guidance to manage, maintain, operate, and accredit N-NC Command Communication Service Designators (CCSDs). Provide accurate and complete documentation as required for new circuit requests or renewals to include at a minimum circuit details (such as, but not limited to Internet Protocol (IP) range, Point of Presence (POP) address, topologies and SIPRNet Connection Questionnaire. Complete and provide Internet Service Provider (ISP) Waiver packages as required. Package will include at a minimum a brief for the Office of Secretary of Defense (OSD) Global Information Grid (GIG) Panel, justification explaining the requirement, technical details, and topology. Provide mitigation actions/activities as required to address findings annotated during remote vulnerability scans and remote compliance assessment scans to address at a minimum Category (CAT) 1 findings fixed/mitigated within 30 days of notification.

(11) Cross Domain Solution Support- Comply with DoD regulatory guidelines, instructions to manage, maintain, operate, and accredit Cross Domain Solutions for the N-NC Enterprise. Provide technical reports as required for new and existing Cross Domain requirements. Reports and required documentation will include at a minimum configuration details (such as, but not limited to data types, security levels, throughput, topology) and completed Cross Domain template for all four Phases of the Secret and Below Information (SABI) process. Provide report at least annually on Cross Domain configurations and associated POA&Ms for all N-NC cross domain devices. Complete and provide Joint Vulnerability Assessment Process (JVAP) annually.

(12) External Scans-- Comply with all required actions from USCYBERCOM CTO 07-09, Support Remote Vulnerability Assessment and Compliance Monitoring Scans of SIPRNet Enclaves. The Classified Connection Approval Office will conduct announced and unannounced Remote IA Compliance Assessment Scans of N-NC CCSDs. The contractor shall provide support and correct any found discrepancies such as improper firewall settings and identified CAT 1, CAT 2 and CAT 3 discrepancies. CAT 1 weaknesses will be corrected with 15 days, CAT 2 weaknesses corrected within 45 days, CAT 3 weaknesses corrected as directed by the DAA and results provided to the Command IAM. Any weakness not corrected in given timeframe will be mitigated and a Plan of Action and Milestone provided.

2.1.4.2 OUTPUTS: (See Attachment 3 Service Output Specifications) A. Monthly Information Security Management Report B. Monthly POA&M C. Monthly Certification and Accreditation Package(s) D. Monthly Circuit Request(s) E. Monthly Cross Domain Request(s) F. Monthly Technical Review Sheet(s) G. Quarterly Information Security Management Report

2.1.4.3 OPERATIONAL METRICS:

A. Number of Unique CAT 1 STIG Compliance Audit Checks Evaluated Per Service

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN B. Number of Unique CAT 2 STIG Compliance Audit Checks Evaluated Per Service

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN C. Number of Unique CAT 3 STIG Compliance Audit Checks Evaluated Per Service

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN D. Number of Unique Failed CAT 1 STIG Compliance Audit Checks Per Service Evaluated without a Government approved POA&M

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN E. Number of Unique Failed CAT 2 STIG Compliance Audit Checks Per Service Evaluated without a Government approved POA&M

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN F. Number of Unique Failed CAT 3 STIG Compliance Audit Checks Per Service Evaluated without a Government approved POA&M

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN G. Total Number of Network Assets Within Scan Range

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN H. Total Number of Network Assets Scanned per Network

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN I. Number of Open Vulnerabilities identified by Scan (Over 21 days since issue date; With No Government approved POA&Ms)

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN J. Total Number of Applicable Patches/Security Updates due for compliance in rating period

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN K. Total Number of Successful Patches/Security Updates Deployed

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN L. Number of systems with less than five (5) Vulnerabilities

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN M. Number of Assessment and Authorization documents required for delivery during rating period N. Number of Assessment and Authorization documents delivered complete O. Number of Network Assets with all HBSS point products installed in accordance with current DoD Directives.

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN P. Number of machines identified as rogue in HBSS

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN Q. Number of Rogue Machines mitigated in less than 24 hours.

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN

2.1.4.4 KEY PERFORMANCE INDICATORS:

A. STIG CAT 1 Audit Failure Ratio [Metric: D/A]

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN

i. Superior Service Threshold: <10%

ii. Service Warning: >20% B. STIG CAT 2 Audit Failure Ratio [Metric: E/B]

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN

i. Superior Service Threshold: <10%

ii. Service Warning: >20% C. STIG CAT 3 Audit Failure Ratio [Metric: F/C]

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN

i. Superior Service Threshold: <10%

ii. Service Warning: >20% D. Vulnerability Rate [Metric: I/H]

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN

i. Superior Service Threshold: <2.5

ii. Service Warning: >3.5 E. Vulnerability Scan Quality [Metric: [H/G]

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN

i. Superior Service Threshold: >95%

ii. Service Warning: <90% F. Vulnerability Assessment Metric [Metric: [H/L]

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN

i. Superior Service Threshold: >95%

ii. Service Warning: <90% G. Patch/Update Deployment rate [Metric: [J/K]

(1) Per NIPR

(2) Per SIPR/SIPR-REL

(3) Per NEN

i. Superior Service Threshold: >95%

ii. Service Warning: <90% H. HBSS Asset Coverage Rate [Metric: O/G]

(1) Per NIPR

(2) Per SIPR

(3) Per NEN

i. Superior Service Threshold: >98%

ii. Service Warning: <95% I. HBSS Rogue Coverage Rate [Metric: P/Q]

(1) Per NIPR

(2) Per SIPR

(3) Per NEN

i. Superior Service Threshold: >98%

ii. Service Warning: <95% J. Accreditation Documentation [Metric: M/N]

2.1.4.5 CRITICAL SUCCESS FACTORS:

A. Maintain IT Security Compliance B. Optimize Overall Mission Risks C. Maintain Mission Assurance with IT Services D. Protect and Defend IT Services from Threats

2.2 TASK 2: SERVICE TRANSITION AND SUPPORT

2.2.1 SUB-TASK 1: CHANGE MANAGEMENT:

Change Management is the process responsible for controlling the lifecycle of all changes. Change management ensures that standardized methods and procedures are used for efficient and prompt handling of all changes with minimal disruption to IT Services. Change Management ensures that changes are authorized, recorded, prioritized, planned, tested, implemented, assessed, documented and reviewed in a controlled manner. The goals of change management are to provide a deliberate response to RFCs in a timely manner.

2.2.1.1 REQUIREMENTS-The contractor shall:

A. Provide, integrate, and manage Change Management to meet Government specified outputs, OMs, KPIs, and CSFs identified below. The Government will review and validate reports and documents provided by the contractor and provide feedback.

B. Produce and submit all RFCs for the execution of this PWS and tasks. The contractor shall ensure that all RFCs for any Service, Network, Infrastructure, or supporting systems configuration item changes are submitted to the Government Change Advisory Board (CAB) for approval prior to implementation and/or execution. Obtain Government CAB approval to all non-emergency RFCs to a minimum of ten (10) business days prior to start of change implementation. Estimate approximately 100-150 normal and standard RFCs produced per month.

C. The contractor shall include, but not limited to, submit the following information for each RFC:

(1) Configuration Items Impacted and Risk.

(2) Release Method and Resource information.

(3) Deployment approach.

(4) Change Back-out Plan.

(5) Test Method and Results.

(6) User Validation Method and Results.

D. Perform all required activities to coordinate and obtain an Approved Service Interruption (ASI) prior to change implementation.

E. Produce standard change models for, at a minimum, O&M activities that are low impact and/or routine within 60 days of contract start. Review existing standard change models and submit to CAB within 60 days of contract start for re-approval; review annually all standard change models thereafter.

2.2.1.2 OUTPUTS: (See Attachment 3 Service Output Specifications) A. Monthly Change Management Report B. Monthly Forward Schedule Of Changes C. Monthly RFCs D. Monthly Standard Change Models

2.2.1.3 OPERATIONAL METRICS: (Monthly)

A. Total Changes In Pipeline Scheduled Per Month B. Total Changes Implemented Per Month C. Number Of Failed Changes Per Month D. Number Of Unauthorized Changes Detected Per Month E. Number Of Changes Rescheduled Per Month

2.2.1.4 KEY PERFORMANCE INDICATORS:

A. Monthly Change Efficiency Rate [Metric: B/A]

(1) Superior Service Threshold: 95%

(2) Service Warning: 90% B. Change Success Rate [Metric: 1-(C/B)]

(1) Superior Service Threshold: 98%

(2) Service Warning: 95% C. Change Reschedule Rate [Metric: E/A]

(1) Superior Service Threshold: 5%

(2) Service Warning: 10% D. Unauthorized Change Rate [Metric: D/B]

(1) Superior Service Threshold: 1%

(2) Service Warning: 2%

2.2.1.5 CRITICAL SUCCESS FACTORS:

A. Implement Quality IT Services B. Optimize Overall Mission Risks C. Deliver Accurate and Timely IT Services

2.2.2 SUB-TASK 2: SERVICE ASSET AND CONFIGURATION MANAGEMENT:

Service Asset and Configuration Management (SACM) ensures that components (Configuration Items) forming delivered services are identified, baselined, and maintained on both the operational network and in the definitive hardware store. It ensures service release into controlled environments and operational use are based on formal approval. SACM provides a logical model of the N2ITSM enterprise and maintains accurate configuration information on its historical, planned, and current state. The goal of SACM is to define and control the components of services to maintain accurate configuration information on their historical, planned, and current states.

2.2.2.1 REQUIREMENTS-The contractor shall:

A. Provide, integrate, and manage SACM to meet Government specified outputs, OMs, KPIs, and CSFs. The Government will review and validate reports and documents provided by the contractor and provide feedback.

B. Assign Equipment Control Officer (ECO) to perform duties for assigned equipment listed in the assigned Defense Reporting Activity (DRA). ECO shall perform all duties and responsibilities IAW Air Force Manual (AFMAN) 33-153 to include but not limited to Service Asset accounting, inventory, reconciliation and sanitization in addition to the training and auditing of ITEC account holders under the USNORTHCOM Defense Reporting Activity (DRA). Manage and maintain the N-NC ECO Program IAW governance listed the Technical Library to include but not limited to the receipt, transport, and retirement of Service Assets. The contractor shall maintain Service Asset records in the Asset Inventory Management (AIM) database.

C. Perform Information Technology Equipment Custodian (ITEC) duties IAW AFMAN 33-153 for the N-NC infrastructure and all other Automated Data Processing Equipment (ADPE) Service Assets used by the contractor to perform the responsibilities of this PWS.

D. Maintain warehouse and storage space IAW industry standards. Comply with all safety requirements IAW industry standards. Perform warehouse, storage, and service asset shipping/receiving functions; store, inventory, package, ship, receive and deliver classified and unclassified ADPE service assets to provision and/or retire services in the Basic IDIQ or ODC Mexico Service Catalog and those services provided to deployed and subordinate organizations. Receive assets and coordinate delivery of assets with Government personnel. Warehouse personnel shall in turn identify and report any damaged or lost items to the ECO. Coordinate Return Merchandise Authorization (RMA) requests with vendors. Complete the ADPE AFEMS-AIM accountability paperwork IAW AFMAN 33-153 and coordinate completed copies between the ITECs and ECO. Perform hardware relocation between HQ N-NC facilities.

E. Schedule and transfer equipment to Defense Reutilization Management Office (DRMO) to ensure timely and efficient turn-in of service assets that are retired or disposed. Service Assets should be scheduled for turn-in with 60 days of retirement. All hard drives will be wiped clean of all data prior to DRMO turn-in per NNC Headquarters Instruction 33-146.

F. Develop and maintain a relational Configuration Management Database (CMDB) which is the sole, trusted source of CI data for the N-NC networks.

G. Capture, maintain, and update configuration item record for each service asset. This record will contain all operating systems, required applications, optional applications, software updates, security settings, configuration settings, and/or options for the service asset sufficient in detail that allows a low-level technician to deploy a replacement service asset into the N-NC environment and be fully functional.

H. Develop and maintain service mapping for all services in the Basic IDIQ or ODC Mexico Service Catalog IAW Microsoft Operational Framework (MOF 4.0 Service Mapping)

I. Maintain definitive network and logical diagrams per service and overall in a single location and linked to the CMDB. Produce specific diagrams on demand as requested by the Government and Service Owner within request fulfillment timelines.

J. Develop a Lifecycle Technical Refresh Plan for IT Service Assets supporting Services in the Basic IDIQ or ODC Mexico Service Catalog. Support future budget analysis and recommendations on service asset upgrades and replacement. Implement Government-approved annual technology refresh decisions.

K. Provide technical support to maintain existing or new architecture products (DoD Architecture Framework (DoDAF) Standard Views for N-NC mission sets and critical processes. The contractor shall maintain detailed network topology diagrams for each service in the Basic IDIQ or ODC Mexico Service Catalog using the DoDAF Architecture Diagrams, Service Systems Matrix, Service Functionality Description, Service Measures Matrix, Service Evolution Description, and Service & Technology & Skills Forecast.

L. Develop and maintain a master spreadsheet per network which list all Hardware assets being used and which services they support.

2.2.2.2 OUTPUTS: (See Attachment 3 Service Output Specifications) A. Monthly Service Asset and Configuration Management Report B. Monthly Configuration Management Database (CMDB) Report C. Monthly Hardware And Software Asset Report D. Monthly Software License Utilization Report E. Bi-Annual Microsoft True-Up Report F. Monthly Equipment Control Officer Report G. Annual Lifecycle Technical Refresh Plan H. Approved Software Catalog

2.2.2.3 OPERATIONAL METRICS: (Monthly)

A. Total Number Of CIs In CMDB B. Number Of CI Errors (Omission Or Inaccuracies) Discovered C.