HBSS_PWS_6_Month_Extension-_9_Jan_2018_FBO_post.doc

FA2517-18-R-9015

PERFORMANCE WORK STATEMENT

FOR

The Host Based Security System (HBSS) Analysis Support NORAD and USNORTHCOM/J63 ADVISORY & ASSISTANCE (A&AS) 9 January 2018

1.0. ORGANIZATION BEING SUPPORTED:

HQ N&NC/J63

250 Vandenberg St, STE B122

Peterson AFB, CO 80919-4650

1.1. MISSION: The C4 Operations Division ensures robust, reliable, and flexible C4 and knowledge management capabilities that enable NORAD and USNORTHCOM (N&NC) and mission partners to execute the full spectrum of Homeland Defense (HD) and Defense Support of Civil Authorities (DSCA) missions in a collaborative environment; provides real-time situational awareness and analysis of cyberspace activities; anticipates, plans, and conducts C4 operations to ensure information and decision superiority; and provides expert and timely communications security, spectrum management, and deployable communications as critical enablers to mission accomplishment.

1.2. OVERVIEW OF SERVICES REQUIRED: The Host Based Security System (HBSS) Analysis Support Element develops HBSS analysis Concepts of Operation (CONOPs), Tactics, Techniques, & Procedures (TTPs), Standard Operating Procedures (SOPs) and Playbooks in support of Cyberspace Warning and Operations Center (CWOC) Defensive Cyber Operations (DCO) and Department of Defense Information Network (DODIN) operations. HBSS Analysts will provide expert analysis, written recommendations, and course of action development to assist in the creation and implementation of N&NC/J6’s overarching DCO and DODIN Defense in Depth Strategy and Execution. The Team will work closely with the Information Technology Operations and Maintenance (IT O&M) Branch, Command Cyber Security Branch, Network Operations Center (NOC) staff, and government leads.

2.0. SPECIFIC REQUIREMENTS

2.1. SUBTASK 1: HBSS Analysis

2.1.1. BACKGROUND: The Host Based Security System (HBSS) is the Department of Defense (DOD) commercial-off-the-shelf (COTS) suite of software applications used within the DOD to monitor, detect, and counter attacks and intrusions against the DOD computer networks and systems. The Enterprise-wide Information Assurance and computer Network Defense Solutions Steering Group (ESSG) sponsored the acquisition of the HBSS System for use within the DOD Enterprise Network. HBSS is deployed on both the Non-Classified Internet Protocol Routed Network (NIPRNet) and Secret Internet Protocol Routed Network (SIPRNet) networks and will be a future requirement for NORAD Enterprise Network (NEN) with priority given to operationalizing the application on the SIPRNet.

2.1.2. The Contractor shall analyze HBSS modules and operationalize the use within DCO and DODIN execution. Per OPORD 12-1016, required modules are: Host Intrusion Prevention System (HIPS), VirusScan Enterprise (VSE), Asset Configuration Control Monitor (ACCM), Device Control Monitor (DCM)/Data Loss Prevention (DLP), and Rogue Sensor Detection (RSD).

2.1.3. The Contractor shall formulate, host-based intrusion detection/prevention signatures (IDS/IPS) based on cyber threat advisories, industry best practices, and known intrusion sets to support Cyber Discovery, Analysis, and Forensic Assessment operations for the CWOC.

2.1.4. The Contractor shall support DCO incident triage to include leveraging HBSS related data to assist in determining scope, urgency, and potential impact, lead HBSS event analysis processes and validate unknown behavior with the appropriate functional group through the appropriate tuning tools.

2.1.4.1. Assist DCO Analysts with identifying whether systems are under attack or functioning improperly; support countermeasure and course of action (COA) development activities, and support diagnosis of identified rogue systems and assist in de-confliction efforts to minimize false positive identification.

2.1.4.2. Provide reports to management to maintain situational awareness of HBSS-related events, coordinate with the IT O&M’s NOC, Components, Subordinates and the Joint Cyberspace Center’s Cyber Intelligence Branches.

2.1.5. The Contractor shall collaborate and interact with the applicable Intelligence organizations to facilitate the sharing of HBSS related artifacts to including analysis reports, and spreadsheets in support of DCO and DODIN execution.

2.1.5.1. Brief findings, assessments and recommendations at the General Officer / Flag Officer level.

2.1.5.2. Provide after Action Reviews, After Action Reports, and hot-washes following each exercise and real world events for review and Government acceptance.

2.1.5.3. Prepare and provide situational awareness reports.

2.1.5.4. Participate in online conferences and meetings to include video teleconferences (VTC), pre-planning conferences, telephone conferences, Computer Network Event/Assessment Conferences, Threat Working Group (TWG), IO Working Groups, and Joint Cyber Center meetings.

2.1.5.5. Provide weekly status updates to N&NC/J63 leadership.

2.1.6. Estimated Monthly Workload: For the purpose of the PWS, Mid-term projects are those projects estimated by the government to take less than one year to complete and Short-term projects are those projects estimated by the government to take less than one week to complete.

Mid-Term Projects (e.g. document creation taking less than a year):

6 total est.

2.2. SUBTASK 2: Monthly Status Report: The contractor shall keep the Contracting Officer Representative (COR) informed of all activities via verbal communication and status reports. The reports shall include the status of resources, resolution of previously reported problems, summary of the preceding month’s accomplishments, new problems encountered (if any), plans for the following month, and the planned deliverables for the next month. Any changes in deliverable schedules for the original task plan will be noted. (CDRL 0007, 0009)

3.0 SERVICE SUMMARY

· Contractor successfully resolves any customer complaint within 10 calendar days of receipt or less time as specified in the task order.

4.0. GOVERNMENT-Furnished RESOURCES and services:

4.1. GOVERNMENT-FURNISHED RESOURCES

4.1.1. HARDWARE: All Automated Data Processing equipment (computers, printers, copiers, fax, NIPR and SIPR email accounts, etc.) associated with the performance of this contract in Government facilities will be provided by the Government, unless otherwise directed and coordinated.

4.1.2. SOFTWARE: All software associated with the performance of this contract in Government facilities will be provided by the Government.

4.2. GOVERNMENT FURNISHED RESOURCES:

4.2.1. FACILITIES, SUPPLIES, and SERVICES: N&NC/J63 will furnish workspace for one contractor personnel in the Building 2 on Peterson AFB, including desk space, chairs, and computers connected to NIPRNET access, SIPRNET access, and use of telephones, copier and fax machines. Any additional personnel will be required to work in the Contractor’s facility.

4.2.2. INFORMATION SOURCES: Government personnel will provide technical input, answer questions, review/approve completed work, and provide feedback regarding contractor efforts. COR will be the primary source of technical guidance for this contract.

4.2.3. GOVERNMENT-FURNISHED INFORMATION: Copies of reference materials cited in PWS paragraph 2.0 and subparagraphs will be provided to the contractor.

4.3. MATERIALS AND OTHER DIRECT COSTS (ODCs): Material and ODCs are not subject to profit, but may include applicable indirect expenses. Contractor shall obtain advance Contracting Officer approval for ODCs in support of the task order. The CO for this contract and for administration further reserves the right to request additional supporting receipts and/or vouchers to verify any costs.

5.0. GENERAL INFORMATION

5.1. SECURITY. All personnel assigned to this task order must possess a TOP SECRET United States Government security clearance prior to beginning work on this PWS. Contractor personnel shall not divulge any information about files, data, processing activities or functions, USERIDs, passwords or other information to anyone not authorized access to such information. Contractor personnel shall abide by all N&NC rules, procedures and standards of conduct.

5.2. ACCESS TO GOVERNMENT PROPERTY AND FACILITIES: The Contractor shall be allowed non-escorted access to Government buildings on Peterson AFB/Cheyenne Mountain Air Force Station, and other sites, consistent with task requirements. Contractor personnel may also enter facilities where escorted access is mandatory. If so, Contractor personnel shall be notified before entering the facility. Access to government facilities, documents, and systems shall be in accordance with DD Form 254, and Department of Defense Contract Security Classification Specifications.

5.3 TRAVEL: Contractor shall obtain advance COR approval for travel in support of N&NC/J63 mission requirements. The contractor shall provide trip reports. (CDRL 0006). Government will only pay for travel expenses outside the normal commuting distance designated for Government personnel.

N& NC/J63 Projected Travel (No Contractor travel anticipated)

N/A

5.4. PRODUCT OWNERSHIP: All products produced by the Contractor in the performance of this contract are the property of the Government.

5.5. PROPRIETARY DATA:

5.5.1. The Contractor shall request government approval prior to the use of any proprietary data or software tools to fulfill the requirements of this contract.

5.5.2. The Contractor shall be provided access to information required to accomplish assigned tasks commensurate with security clearance and on a need to know basis.

5.5.3. During the contract period, all data pertaining to this contract shall be returned to the Government upon contract expiration. The Contractor shall not retain classified or unclassified material generated or received under this contract after the contract ends without approval of the appropriate office of primary responsibility.

5.5.4. The Government has unlimited rights to all deliverables developed under this contract. The Contractor shall not use any materials pertaining to this contract for business development or any other vendor strategic purposes.

5.5.5. Contractor personnel will be required to Government sign non-disclosure agreements prior to start of work.

5.6. HOURS OF WORK: The Contractor shall provide performance coverage to the Government during N&NC core work hours of 0800-1700. Most support will be required during those hours, however requirements may arise with little or no notice (e.g. an exercise or real-world contingency) requiring extended work hours, or weekends in support of directorate and Command mission requirements. A contact phone number of the Task Lead shall be provided to COR for short-notice night and short-notice weekend support.

5.7. PERIOD OF PERFORMANCE: The periods of performance for this task order are:

5.8. MANAGEMENT: The contractor shall appoint a project manager who shall coordinate with COR to obtain and clarify contract requirements and who will be responsible for the daily control and supervision of contractor's employees. The Project Manager shall ensure the contractor's employees understand the prohibitions imposed on the U.S. Government regarding personal services contracts and will report instances where the Government attempts to control or supervise contractors' employees to COR or contracting officer immediately. Contractor shall ensure its personnel identify themselves as contractors in accordance with applicable N&NC directives and instructions. Contractor shall ensure its personnel do not perform any inherently governmental activities. Contractor shall ensure its personnel do not attempt to represent the Government of the United States or N&NC to any other person or entity, U.S. or foreign, except for delivering a Government-approved message or position.

5.9. SERVICES DURING CRISIS:

The performance of the following services is considered to be mission essential during times of crisis and may require extended Service Hours. Crisis, special and emergencies may cause this task to operate on an extended basis of up to 24-hours per day. The contractor shall provide these services when required by the contracting officer. A representative of the contracting officer will verbally advise the contractor of the effort required with a written notification to follow. A representative of the contracting officer will further notify the contractor verbally when the crisis has ended with written notification to follow. Any price changes resulting from this crisis will be negotiated in accordance with DFARS clause 252.237-7023, Continuation of Essential Contractor Services, paragraph (f), Changes.

5.10. TRANSITION PERIODS:

The contractor shall include a Thirty (30) calendar day phase in/phase out period

The contractor shall facilitate the accomplishment of a seamless transition to the follow on contractor. The contractor shall ensure minimum disruption to vital Government business. The contractor shall ensure that there shall be no service degradation during or after transition. The contractor shall collaborate with the incoming/follow on contractor personnel during a 30 day phase in/phase out transition period. During the transition period, the new contractor must become familiar with performance requirements in order to commence full performance of services on the contract period of performance start date. This phase in /phase out transition period will be used to provide the items, services, and transfer of IT assets and accounts required for transition to include passing on Tactics, Techniques, & Procedures (TTPs) and Standard Operating Procedures (SOPs).

Revised PWS: 6 Month Extension