CWOC_PWS_6_MONTH_BRIDGE_9_Jan_2018_FBO_post.docx

FA2517-18-R-9014

PERFORMANCE WORK STATEMENT

FOR

NORAD and USNORTHCOM/ADVISORY & ASSISTANCE (A&AS)

Cyberspace Warning and Operations Center (CWOC)

9 JANUARY 2018

1.1. MISSION: The C4 Operations Division ensures robust, reliable, and flexible C4 and knowledge management capabilities that enable NORAD and USNORTHCOM (N&NC) and mission partners to execute the full spectrum of Homeland Defense (HD) and Defense Support of Civil Authorities (DSCA) missions in a collaborative environment; provides real-time situational awareness and analysis of cyberspace activities; anticipates, plans, and conducts C4 operations to ensure information and decision superiority; and provides expert and timely communications security, spectrum management, and deployable communications as critical enablers to mission accomplishment.

1.2. OVERVIEW OF SERVICES REQUIRED: The primary function of the N&NC Cyberspace Warning and Operations Center (CWOC) is to lead, prioritize, and direct Theater Information Grid (TIG) assets and resources to ensure they are optimized to support N&NC assigned missions and operations, and to advise the Commander N&NC of the TIG’s ability to support current and future operations. The N&NC CWOC currently consist of the DOD Information Network (DODIN) Section as well as Defensive Cyber Operations (DCO), both conducting 24/7/365 monitoring, reporting and analysis for the N&NC Command and Control Systems in support of mission objectives. CWOC personnel require in-depth advisory and technical knowledge regarding Information Assurance and Defensive Cyber Operations (DCO), command, control, communications, and computers (C4), NORAD and USNORTHCOM deployable capabilities, cyber initiatives and potential impacts to Commands’ Defense Support of Civil Authorities (DSCA) and Homeland Defense (HD) missions.

2.0. SPECIFIC REQUIREMENTS

2.1. SUBTASK 1: CWOC DCO ANALYSIS

2.1. Background CWOC Information Assurance and Defensive Cyber Operations(DCO) conducts 24X7 support required for N&NC Headquarters, service components, Joint Task Forces, and their mission partners in the areas of: Defensive Cyber Operations(DCO), Information Assurance (IA), Information Technology (IT) services, information exchange, information sharing efforts, net-centric operations, and command and control and communications processes and solutions in support of IT C4 systems operations and assessments, for information synchronization and network operations (NetOps). Contractor shall support development and integration of operational tactics, techniques and procedures (TTP) internal and external to N&NC; Playbooks; Development of Theater Net-Centric Strategies; NetOps situational awareness operations; and NetOps Concept of Operations (CONOPS); and conduct analysis on all issues associated with and required for situational awareness of N&NC systems, networks and services. To comply with DOD 8570 direction, all contractors for this subtask will maintain at a minimum IAT-II certification.

2.1.1. The Contractor shall assist in determining mission impacts to N&NC C4 systems.

2.1.1.1. The Contractor shall assist with briefing findings, assessments and recommendations at the General Officer/Flag Officer level.

2.1.2. The Contractor shall update, and develop operating procedures and related operations documentation such as, checklists, TTP and operational playbooks for a variety of information interchanges among governmental, civilian, and international organizations for C4 situational awareness and reporting for Government approval.

2.1.3. The Contractor shall provide technical assessments, risk analysis, mission impact assessments, and recommendations to mitigate N&NC degradations in compliance with N&NC Information Assurance Vulnerability Assessment (IAVA) policy.

2.1.3.1. The Contractor shall validate current policy requirements and report non-compliance using the required Department of Defense (DoD) compliance reporting system.

2.1.4. The Contractor shall provide After Action Reviews, After Action Reports, and hot-washes following each exercise and real world events for review and Government acceptance.

2.1.5. The Contractor shall provide Plans of Action and Milestones (POA&M) for review and Government acceptance.

2.1.6. The Contractor shall provide N&NC assessments of IAVA compliance and maintain global situational awareness of Information Assurance and Defensive Cyber Operations events, and shall keep J63 apprised of such events.

2.1.6.1. The Contractor shall track and report network changes to include INFOCON, Information Assurance Vulnerability Management (IAVM) system, Tasking Order (TASKORD)/Warning Order (WARNORD), Fragmented Order (FRAGO) and Operation Order (OPORD) notifications and report changes and actions taken by N&NC HQ, Subordinates, and Components.

2.1.7. The Contractor shall provide characterization and assessment of C4 incidents and issues for review and Government acceptance.

2.1.8. The Contractor shall provide situational awareness reports for review and Government acceptance.

2.1.9. The Contractor shall participate in conferences and meetings to include video teleconferences (VTC), pre-planning conferences, telephone conferences, Computer Network Event/Assessment Conferences, Threat Working Group (TWG), Information Operation (IO) Working Groups, and Joint Cyber Center meetings.

2.1.9.1. The Contractor shall provide assessments of Defensive Cyber Operations threats during Computer Network Event/Assessment Conferences, TWG, IO Working Groups, and Joint Cyber Center meetings during exercise and contingency events.

2.1.10. The Contractor shall provide meeting minutes within 24 hours after the end of each meeting attended.

2.1.11. The Contractor shall develop Work Plans, CWOC NetOps Strategy and briefings, CWOC Information Assurance (IA) Implementation Plans and briefings, CWOC NetOps CONOPS and briefings, CWOC NetOps Implementation Plan and briefings and CWOC NetOps TTP for government approval.

2.1.12. The Contractor shall develop Executive Summary’s (EXSUM), Cyber Advisories, TASKORDs, WARNORDs, FRAGOs, OPORDs, DCO Items of Interest, DCO Incident Reports for enterprise and theater concerns for government approval.

2.1.12.1. The Contractor shall use N&NC NETOps monitoring tools to create DCO briefings and reports used to develop N&NC TASKORDs, WARNORDs, OPORDs, FRAGOs, and DCO Items of Interest Reports for the network enterprise and theater DCO/IA concerns and provide for government approval.

2.1.13. The Contractor shall direct scans using Anomaly Detection Tool (ADT) or other relevant scanning capabilities available. Compile legible results interrupting the Symantec Security Information Manager (SSIM) software or equivalent capability and report/brief their findings.

2.1.13.1. The Contractor shall use Host-Based Security System (HBSS) and other tools/capabilities available to validate Command IA policy.

2.1.14. The Contractor shall monitor the CWOC organizational mailbox (OMB) for all TASKORD, Operation Order (OPORD), WARNORD, NSA Threat Operations Center (NTOC), US Computer Emergency Response Team (CERT) alerts, divisional level email, or other notifications and take appropriate measures outlined in checklist and TTP’s.

2.1.15. The Contractor shall provide Course of Action (COA) plans to mitigate N&NC degradations in compliance with N&NC IAVA policy.

2.1.15.1. The contractor shall assist with assessments and validation of N&NC compliance with DCO policy and directives.

2.1.15.2. The contractor shall assist in the coordination with N&NC Information Assurance for Risk Assessments and Information Assurance initiatives.

2.1.15.3. The contractor shall support the CWOC at various meetings addressing DCO and cyber events/exercise.

2.1.16. The Contractor shall provide weekly status updates to J63 leadership concerning CWOC and DCO Analysis activities.

2.1.17. Estimated Workload: For the purpose of the PWS, Mid-term projects are those projects estimated by the government to take less than one year to complete and Short-term projects are those projects estimated by the government to take less than one week to complete.

2.2. SUBTASK 2: CWOC DOD INFORMATION NETWORK (DODIN) ANALYSIS

2.2. Background: DODIN conducts 24x7 support required for N&NC Headquarters, Service components, Joint Task Forces, and their mission partners in the areas of: Information Technology (IT) services, information exchange, information sharing efforts, net-centric operations, and command, control, communications processes, and solutions in support of IT C4 systems operations and assessments. To comply with DOD 8570 direction, all contractors for this subtask will maintain at a minimum IAT-I certification.

2.2.1. The Contractor shall provide routine daily Theater C4 status reports.

2.2.1.1. The Contractor shall manage, maintain, distribute, post and project the J6 Daily briefing.

2.2.1.2. The Contractor shall provide technical assessments, risk analysis, mission impact, and recommendations to mitigate outages/degradations/impacts for N&NC and mission partners.

2.2.1.3. The Contractor shall assist in developing and updating operating procedures, checklists, TTP and playbooks.

2.2.1.4. The Contractor shall provide After Action Reviews, After Action Reports, and hot-washes following each exercise and real world events for review and Government acceptance.

2.2.1.5. The Contractor shall provide situational awareness reports.

2.2.1.6. The Contractor shall provide minutes and information papers from meetings and conferences within 24 hours after every meeting.

2.2.1.7. The Contractor shall provide advice on C4 Systems through participation in online conferences and meetings, VTCs, pre-planning conferences, telephone conferences and other collaborative venues.

2.2.1.8. The Contractor shall monitor, provide analysis support, and participate in Defense Red Switch Network (DRSN) Conferences.

2.2.1.8.1. The Contractor shall maintain a daily DRSN call summary report to include type of conference, quality depiction and summary of events.

2.2.1.9. The Contractor shall monitor and brief status of all Networks, Systems and Applications and generate Executive Summary’s (EXSUM), Items of Interest, Situational Reports (SITREP), COMSPOT and COMSTAT reports for enterprise and theater reporting.

2.2.1.10. The Contractor shall monitor the Cyberspace Warning and Operations Center (CWOC) organizational mailbox (OMB) for all Communications Tasking Order (CTO), Warning Order (WARNORD), TASKORDS, OPORDS, Executive Summary’s, Communication Spot Report, Communication Status and divisional level email.

2.2.1.11. The Contractor shall manage and consolidate technical assessments, risk analysis, mission impact assessments, and provide recommendations for government mitigation of N&NC degradations and outages.

2.2.1.12. The Contractor shall provide weekly status updates to J63 leadership concerning CWOC DODIN analysis.

2.2.1.13. Estimated Monthly Workload: For the purpose of this PWS Mid-term project are those projects estimated by the government to take less than one year to complete and Short-term projects are those projects estimated by the government to take less than one week to complete.

2.3. SUBTASK 3: NORAD and USNORTHCOM Department of Homeland Security (DHS) Cyber Coordinator

2.3. Background: The N&NC Cyber Coordinator ensures information sharing between N&NC and the National Cyber security and Communications Integration Center (NCCIC) and US Computer Emergency Readiness Team (CERT) related to shared awareness of cyber initiatives and potential impacts to Commands’ Defense Support of Civil Authorities (DSCA) and Homeland Defense (HD) missions and activities. To comply with DOD 8570 direction, all contractors for this subtask will maintain at a minimum IAT-II certification.

2.3.1. The Cyber Coordinator contractor position resides in Washington, DC and shall assist the N&NC Washington Office as a cyber subject matter expert to Command Groups and Staffs during visits to the DHS US-CERT and Cyber Centers.

2.3.2. The Contractor shall facilitate cyber information sharing between N&NC and US Computer Emergency Readiness Team (CERT) to provide awareness of cyber initiatives and potential impacts to N&NC DSCA and Homeland Defense missions and activities.

2.3.2.1. The Contractor shall facilitate the information sharing of cyber issues related to cyber support policies, plans and capabilities to facilitate DSCA and Homeland Defense (HD) planning and execution.

2.3.2.2. The Contractor shall provide DOD perspectives to DHS’s efforts in cyberspace operations, plans, and exercise implementation for Homeland Security/Homeland Defense and DSCA to determine capability gaps as well as impacts on DOD (N&NC) cyberspace initiatives.

2.3.2.3. The Contractor shall brief findings, assessments and recommendations at the General Officer/Flag Officer level.

2.3.2.4. The Contractor shall provide After Action Reviews, After Action Reports, and hot-washes following each exercise and real world events within five days for review and Government acceptance.

2.3.3. The Contractor shall provide N&NC input to DHS cyber development and planning activities that support and protect critical cyber infrastructure and key resources within the N&NC AOR and provide input and recommendations on the planning and execution of National Level Cyber Exercises; Cyber Storm, N&NC exercises, and other DOD/DHS combined Exercises.

2.3.4. The Contractor shall update operating procedures for cyber operations and present to the government for approval.

2.3.4.1. The Contractor shall update checklists, TTPs and playbooks.

2.3.5. The Contractor apprise J63 of global situational awareness of cyber and DCO events.

2.3.6. The Contractor shall participate in online conferences and meetings to include VTCs, pre-planning conferences, telephone conferences, Threat TWG, IO Working Groups, and Joint Cyber Center (JCC) meetings, Unified Coordination Group (UCG) activities (i.e., monthly meeting attendance, exercise participation, and Incident Planning Team support).

2.3.6.1. The Contractor shall support the N&NC JCC, bridging the correlation of cyber related information to the USCERT and NCCIC operations center.

2.3.7. The Contractor shall prepare, coordinate, and process Work Plans, NETOPS Strategy and briefings, CWOC IA Implementation Plans and briefings.

2.3.8. The Contractor shall provide weekly status updates to J63 leadership.

2.3.9. Estimated Monthly Workload: For the purpose of this PWS Mid-term project are those projects estimated by the government to take less than one year to complete and Short-term projects are those projects estimated by the government to take less than one week to complete.

2.4. SUBTASK 4: CWOC Tools Analyst and Training Evaluation

2.4. Background: The Contractor shall assist in developing NetOps Tool Concepts of Operation (CONOP), Checklists, Tactics, Techniques, & Procedures (TTP), and Standard Operating Procedures (SOP) and Playbooks for new and existing CWOC situational awareness analysis tools supporting DCO and DODIN operations. Tools include; Symantec Security Information Manager (SSIM), Host Based Security System (HBSS), First Responders Guide (FRG), Anomaly Detection Tool (ADT), Vulnerability Management System (VMS), What’s Up Gold (WUG) and Quest InTrust. To comply with DOD 8570 direction, all contractors for this subtask will maintain at a minimum IAT-II certification.

2.4.1. The Contractor shall develop and provide recommended TTPs to improve installation, integration, and employment of new and existing DCO and Enterprise Management toolsets.

2.4.1.1. The Contractor shall coordinate development with the applicable directorate or agency for implementation.

2.4.1.2. The Contractor shall perform assessment and analysis of the deployment of the CWOC/Network Operations Security Center (NOSC) Toolset and identify operational shortfalls and develop methods to improve implementation for existing and emerging tools.

2.4.1.3. The Contractor shall manage, maintain, troubleshoot, and administer DCO and Network Monitoring toolsets in support of the CWOC overall mission requirements.

2.4.2. The Contractor shall provide a training plan for the CWOC DCO and DODIN watch positions. (CDRL 0008)

2.4.2.1. The Contractor shall coordinate, facilitate and schedule training opportunities for the following: N&NC C4 Planner Course; WUG; ITW/AA; BMDS; N2C2 and DHS N&NC Network Defense Posture Level; N&NC Joint Cyber Center; CYBERCOM; N&NC C4 Planner Course; DHS; HBSS; SSIM and INTRUST.

2.4.2.2. The Contractor shall develop training aids and training plans for sustained operations, maintenance, and integration of new and existing toolsets.

2.4.3. The Contractor shall brief findings, assessments and recommendations at the General Officer/Flag Officer level.

2.4.4. The Contractor shall provide After Action Reviews, After Action Reports, and hot-washes following each exercise and real world events for review and Government acceptance.

2.4.5. The Contractor shall prepare and provide situation awareness reports.

2.4.6. The Contractor shall participate in online conferences and meetings to include video teleconferences (VTC), pre-planning conferences, telephone conferences, Computer Network Event/Assessment Conferences, Threat Working Group (TWG), IO Working Groups, and Joint Cyber Center meetings.

2.4.7. The Contractor shall provide weekly status updates to J63 leadership concerning the activities of the CWOC Tools Analyst and Training Evaluation activities.

2.4.8. Estimated Monthly Workload: For the purpose of this PWS Long Term projects will take more than one year to complete/maintain, Mid-term projects are those projects estimated by the government to take less than one year to complete and Short-term projects are those projects estimated by the government to take less than one week to complete.

2.5. SUBTASK 5: BATTLE STAFF and EXERCISE SUPPORT for CWOC

2.5. Background: The Contractor shall provide services related to Battle Staff Operational support to NORAD and USNORTHCOM (N&NC) J63 during Exercises and Contingency Operations. This includes training, decision support analysis, independent assessments of technical issues, research and support analysis, Cyber and Network Operations (NetOps) support, exercise support, military planning and operations support and strategies. This will entail 13-hour shifts for up to 10 days for approximately two major exercises and two contingencies annually.

2.5.1. The Contractor shall conduct pre-exercise studies and operations focused analysis of capabilities of current C4 systems and other systems affecting the command and control for N&NC operations with respect to communications and information support for management, oversight and technical support of battle staff and exercise related operations.

2.5.2. The Contractor shall acquire and compile material from applicable sources and develop position and concept papers concerning Doctrine, Operations, Training, Materiel, Leader Development, Personnel and Facilities (DOTMLPF) issues that impact ongoing Battle Staff operations and future exercise planning and execution.

2.5.3. The Contractor shall support N&NC exercises (i.e., Ardent Sentry, Vigilant Shield, etc.) with role players, subject matter experts and other personnel as identified in supporting exercise documents as required. This process includes working in collaboration with HQ N&NC, N&NC Subordinate’s, N&NC Component organizations, and other Commands or Agencies in developing exercise design and execution.

2.5.4. The Contractor shall provide subject matter experts (SME) to support cyber and Network Operations (NetOps), intelligence and interagency operations, and participate in exercises and battle staff events as required by N&NC.

2.5.5. The Contractor shall prepare meeting minutes on issues discussed during battle staff and exercise development, and support meetings, conferences, and forums conducted by the Government and outside Agencies. (CDRL 0004, 0006)

2.6. SUBTASK 6: Monthly Status Report: The contractor shall keep the Contracting Officer Representative (COR) informed of all activities via verbal communication and status reports. The reports shall include the status of resources, resolution of previously reported problems, summary of the preceding month’s accomplishments, new problems encountered (if any), plans for the following month, and the planned deliverables for the next month. Any changes in deliverable schedules for the original task plan will be noted. (CDRL 0007, 0009)

3.0. SERVICE SUMMARY

· Contractor successfully resolves any customer complaint within 10 calendar days of receipt or less time as specified in the task order.

4.0. GOVERNMENT-FURNISHED RESOURCES AND SERVICES:

4.1. GOVERNMENT-FURNISHED RESOURCES

4.1.1. HARDWARE: All Automated Data Processing equipment (computers, printers, copiers, fax, NIPR, SIPR, NEN and JWICS email accounts, etc.) associated with the performance of this contract in Government facilities will be provided by the Government, unless otherwise directed and coordinated.

4.1.2. SOFTWARE: All software associated with the performance of this contract in Government facilities will be provided by the Government.

4.2. GOVERNMENT FURNISHED RESOURCES:

4.2.1. FACILITIES, SUPPLIES, and SERVICES: N&NC/J63 will furnish workspace for up to 11 personnel in the Building 2 on Peterson AFB, including desk space, chairs, computers connected to NIPRNET access, SIPRNET access, and use of telephones, copier and fax machines. Any additional personnel will be required to work in the Contractor’s facility.

4.2.2. INFORMATION SOURCES: Government personnel will provide technical input, answer questions, review/approve completed work, and provide feedback regarding contractor efforts. COR will be the primary source of technical guidance for this contract.

4.2.3. GOVERNMENT-FURNISHED INFORMATION: Copies of reference materials cited in PWS paragraph 2.0 and subparagraphs will be provided to the contractor.

4.3. MATERIALS AND OTHER DIRECT COSTS (ODCs): Material and ODCs are not subject to profit, but may include applicable indirect expenses. Contractor shall obtain advance Contracting Officer approval for ODCs in support of the task order. The CO for this contract and for administration further reserves the right to request additional supporting receipts and/or vouchers to verify any costs.

5.0. GENERAL INFORMATION

5.1. SECURITY. All personnel assigned to this task order must possess a TS United States Government security clearance with SCI eligibility prior to beginning work on this PWS. Access to special access programs/activities/briefings may be required as part of this effort, and personnel assigned shall be capable of gaining such access. If personnel require access to certain special access programs, a counter-intelligence polygraph may be required. Contractor personnel shall not divulge any information about files, data, processing activities or functions, USERIDs, passwords or other information to anyone not authorized access to such information. Contractor personnel shall abide by all N&NC rules, procedures and standards of conduct.

5.2. ACCESS TO GOVERNMENT PROPERTY AND FACILITIES: The Contractor shall be allowed non-escorted access to Government buildings on Peterson AFB/Cheyenne Mountain Air Force Station, and other sites, consistent with task requirements. Contractor personnel may also enter facilities where escorted access is mandatory. If so, Contractor personnel shall be notified before entering the facility. Access to government facilities, documents, and systems shall be in accordance with DD Form 254, and Department of Defense Contract Security Classification Specifications.

5.3. PRODUCT OWNERSHIP. All products produced by the Contractor in the performance of this contract are the property of the Government.

5.4. PROPRIETARY DATA.

5.4.1. The Contractor shall request government approval prior to the use of any proprietary data or software tools to fulfill the requirements of this contract.

5.4.2. The Contractor shall be provided access to information required to accomplish assigned tasks commensurate with security clearance and on a need to know basis.

5.4.3. During the contract period, all data pertaining to this contract shall be returned to the Government upon contract expiration. The Contractor shall not retain classified or unclassified material generated or received under this contract after the contract ends without approval of the appropriate office of primary responsibility.

5.4.4. The Government has unlimited rights to all deliverables developed under this contract. The Contractor shall not use any materials pertaining to this contract for business development or any other vendor strategic purposes.

5.4.5. Contractor personnel shall be required to sign non-disclosure agreements prior to start of work.

5.5. HOURS OF WORK. The Contractor shall provide two operational centers with 24 hours, 7 days a week, 365 days a year coverage. Day staff support (i.e. DCO analyst, Tools/Training and Leads) Core hours are 0600-1800. Requirements may arise with little or no notice (e.g. an exercise or real-world contingency) requiring work hours occurring at night and on weekends in support of directorate and Command mission requirements.

5.6. PERIOD OF PERFORMANCE: The periods of performance for this task order are:

5.7. MANAGEMENT: The contractor shall appoint a project manager who shall coordinate with COR to obtain and clarify contract requirements and who will be responsible for the daily control and supervision of contractor's employees. The Project Manager shall ensure the contractor's employees understand the prohibitions imposed on the U.S. Government regarding personal services contracts and will report instances where the Government attempts to control or supervise contractors' employees to COR or contracting officer immediately. Contractor shall ensure its personnel identify themselves as contractors in accordance with applicable N&NC directives and instructions. Contractor shall ensure its personnel do not perform any inherently governmental activities. Contractor shall ensure its personnel do not attempt to represent the Government of the United States or N&NC to any other person or entity, U.S. or foreign, except for delivering a Government-approved message or position.

5.8. SERVICES DURING CRISIS:

The performances of the following services are considered to be mission essential during times of crisis. The contractor shall provide these services when required by the contracting officer. A representative of the contracting officer will verbally advise the contractor of the effort required with a written notification to follow. A representative of the contracting officer will further notify the contractor verbally when the crisis has ended with written notification to follow. Any price changes resulting from this crisis will be negotiated in accordance with DFARS clause 252.237-7023 Continuation of Mission Essential Functions, paragraph (f), Changes.

5.9. TRANSITION PERIODS:

The contractor shall include a Thirty (30) calendar day phase in/phase out period

The contractor shall facilitate the accomplishment of a seamless transition to the follow on contractor. The contractor shall ensure minimum disruption to vital Government business. The contractor shall ensure that there shall be no service degradation during or after transition. The contractor shall collaborate with the incoming/follow on contractor personnel during a 30 day phase in/phase out transition period. During the transition period, the new contractor must become familiar with performance requirements in order to commence full performance of services on the contract period of performance start date. This phase in /phase out transition period will be used to provide the items, services, and transfer of IT assets and accounts required for transition to include passing on Tactics, Techniques, & Procedures (TTPs) and Standard Operating Procedures (SOPs).