Performance Work Statement - Defense Red Switch Network Cybersecurity Support.pdf

Performance Work Statement

For Cybersecurity Support of Offutt AFB

55th Strategic Communications Squadron (55 SCS)

Defense Red Switch Network and other

Nuclear Command, Control, and Communications

(NC3) Missions

TABLE OF CONTENTS

SECTION PARAGRAPH/TITLE PAGE

1. SECTION 1 – SUPPORT OVERVIEW………………………………………………………………….. 4

1.1. BACKGROUND…………………………………………………………………………..………… 4

1.2. SCOPE………………………………………………………………………………………………. 5

1.3. GENERAL CONTRACTOR REQUIREMENTS

1.3.1. PERSONNEL MANAGEMENT……………………………………………………………. 5

1.3.1.1. POINTS OF CONTACT……………………………………………………………… 6

1.3.1.2. CONTRACTOR PROGRAM MANAGEMENT…………………………………….. 6

1.3.2. TRAINING………………………………………………………………………………….. 6

1.3.2.1. OTHER GOVERNMENT-PROVIDED TRAINING………………………………… 7

1.3.2.1.1. SECURITY TRAINING………………………………………………….. 7

1.3.2.1.2. NETWORK USER TRAINING…………………………………………... 7

1.3.2.1.3. MISSION-FOCUSED TRAINING……………………………………….. 7

1.3.2.2. EDUCATION, CERTIFICATIONS, & WORK EXPERIENCE…………………

1.3.2.3. TRAINING RECORDS……………………………………………………………... 8

1.3.3. SECURITY………………………………………………………………………………….. 8

1.3.3.1. INSTALLATION ACCESS AND PHYSICAL SECURITY……………………

1.3.3.2. FACILITY SECURITY CLEARANCE (FCL)……………………………………... 8

1.3.3.3. PERSONNEL SECURITY CLEARANCE…………………………………………. 8

1.3.3.4. FACILITY ACCESS………………………………………………………………… 9

1.3.3.5. CONTRACTOR ACCESS………………………………………………………

1.3.3.6. PRIVACY ACT……………………………………………………………………… 9

1.3.3.7. NO RIGHT TO PRIVACY………………………………………………………….. 10

1.3.3.8. INFORMATION SECURITY (INFOSEC)………………………………………

1.3.3.9. SECURITY MANAGEMENT (TRANSMISSION OF CLASSIFIED MATERIAL).10

1.3.3.10. CLASSIFIED DESTRUCTION…………………………………………………

1.3.4. QUALITY ASSURANCE MANAGEMENT……………………………………………

1.3.4.1. PERFORMANCE MEETINGS……………………………………………………... 11

1.3.4.2. GOVERNMENT QUALITY ASSURANCE SURVEILLANCE PROGRAM

1.3.5. APPEARANCE AND STANDARDS OF CONDUCT…………………………………….. 11

1.3.6. CONTINUATION OF DoW CONTRACTOR SERVICES DURING CRISES…………

1.3.7. GOVERNMENT SITE RULES…………………………………………………………….. 12

1.3.8. PERIOD OF PERFORMANCE…………………………………………………………….. 13

1.4 SERVICES SUMMARY ………………………………………………………………..………….. 13

2. SECTION 2 – CONTRACTOR CYBERSECURITY SUPPORT REQUIREMENTS………………….. 16

2.1. CLIN 001 – FTE CYBERSECURITY SUPPORT SPECIALIST ..……………………………….. 17

2.1.1. GLOBAL AIRCREW STRATEGIC NETWORK TERMINAL (G-ASNT)…………… 17

CYBERSECURITY SUPPORT (55 WG)

2.1.2 NON-HARDENED AIRCREW ALERTING SYSTEM (NAAS) – KLAXON…………….. 18

CYBERSECURITY SUPPORT

2.1.3 OTHER 55 SCS CYBERSECURITY SUPPORT…………………………………………… 19

2.2. CLIN 002 – TWO FTE INFORMATION SYSTEM SECURITY OFFICERS…………………… 19

2.2.1 DRSN CYBERSECURITY SUPPORT……………………………………………………… 19

2.2.2 OTHER TERMS OF SUPPORT……………………………………………………………. 22

2.3. CLIN 003 – PROGRAM MANAGER………………………………………………………….…. 22

2.4. CLIN 004 – TDY/TRAVEL………………………………………………………………….…

3. SECTION 3 – GOVERNMENT-FURNISHED PROPERTY AND SERVICES……………………

3.1. GOVERNMENT FACILITIES……………………………………………………………..…….. 23

3.2. GOVERNMENT PROPERTY……………………………………………………………………. 23

3.3. CONTRACTOR PROPERTY MANAGEMENT………………………………………………… 23

3.4. UTILITIES………………………………………………………………………………………

3.5. INSTALLATION MAIL DISTRIBUTION………………………………………………………. 23

3.6. TELEPHONE……………………………………………………………………………………... 23

3.7. COMPUTER………………………………………………………………………………………. 24

3.8. FORMS AND PUBLICATIONS…………………………………………………………………. 24

3.9. REFUSE COLLECTION…………………………………………………………………………. 24

3.10. INSECTS AND RODENT CONTROL…………………………………………………………... 24

3.11. SECURITY POLICE……………………………………………………………………………

3.12. BASE CIVIL ENGINEERING…………………………………………………………………

3.13. EMERGENCY MEDICAL SERVICES…………………………………………………………... 24

3.14. TRANSPORTATION……………………………………………………………………………... 24

4. SECTION 4 – TECHNICAL DEFINITIONS……………………………………………………………. 25

4.1. TECHNICAL TERMINOLOGY…………………………………………………………………. 25

4.2. ACRONYMS……………………………………………………………………………………… 29

4.3. REFERENCE DOCUMENTS…………………………………………………………………….. 30

1. SUPPORT OVERVIEW

1.1. BACKGROUND

The 55th Strategic Communications Squadron (55 SCS) operates and maintains numerous nuclear command, control, and communications (NC3) systems.

The Defense Red Switch Network (DRSN) Command and Control Switching System (CCSS) provides mission-essential, critical secure and non-secure voice services to the National Command Authority (NCA), the Department of War (DoW), various federal agencies, and Foreign Allies. The Red and Black DRSN Switches (six DSS-2As) supporting the United States Strategic Command (USSTRATCOM) Global Operations Center (GOC) provide the ability to convene and manage our nation's most critical national-level secure and non-secure voice conferencing requirements. These conferences support the entire spectrum of USSTRATCOM mission assignments and may be assembled at any time to support the nation's senior leaders during times of national emergencies and crises involving USSTRATCOM and other DoW assets worldwide.

DRSN, an element of the Defense Information Systems Network (DISN), is a network of secure command and control switches that provide high-quality secure voice and conferencing capabilities to senior decision makers and staff of the Military Departments (MILDEPs), the Combatant Commanders (COCOMs), Major Commands (MAJCOMs), other Government departments and agencies, and U.S. Allies.

The mission of DRSN is to provide the capability to transfer voice and data between the MILDEPs, the National Military Command Center (NMCC), combatant commands, military services, subordinate organizations (military and civilian), and Allies (North Atlantic Treaty Organization (NATO), Canada, etc.), both locally and worldwide. DRSN also provides secure voice conferencing and gateway access to secure strategic, tactical, airborne, and seaborne equipment and platforms.

DRSN consists of four major subsystems: (1) Switching Subsystem, (2) Transmission Subsystem, (3) Timing and Synchronization (T&S) Subsystem, and (4) Network Management Subsystem (NMS).

Cybersecurity support for all subsystems and related components is required for establishing and maintaining a full DRSN Authorization to Operate (ATO).

The Global Aircrew Strategic Network Terminal (G-ASNT) is an Air Force Global Strike Command (AFGSC) nuclear command, control and communications system utilizing a satellite constellation to link national command authorities to warfighters via a protected, robust communication system to missile, nuclear bomber, and support aircraft crews in austere operational environments. Offutt Air Force Base (AFB) has a fixed G-ASNT terminal in the 55 Wing Command Post, and three transportable G-ASNT terminals in the 55 SCS. G-ASNT is being fielded in increments. Increment one supports the satellite communication requirement. Increment two, block one supports Electromagnetic Pulse (EMP)-hardened aircrew alerting (used to support USSTRATCOM’s Looking Glass mission) and Ultra High Frequency (UHF) radios. Increment three will provide High Frequency (HF) capabilities once it is designed and fielded.

The Non-hardened Aircrew Alerting System (NAAS) Klaxon is a NC3 terrestrial-based aircrew alerting system that supports National Airborne Operations Center (NAOC) aircrew alerting requirements. It is a

Windows OS-based system that operates as a stand-alone network. It has four servers, which are used individually for activating or testing the Klaxon lights and sounders.

1.2. SCOPE

This PWS identifies requirements to provide the Government with high-quality, cost-effective, dedicated cybersecurity support to the 55 SCS for its DRSN and NC3 systems. The goal is to ensure Risk Management Framework (RMF) requirements are met, ATO is granted and remains valid, all security-related documentation is kept up-to-date, and supported units have a team of cybersecurity experts on which to rely. To successfully fulfill this requirement, a combination of Cybersecurity Specialist and Information Systems Security Officer (ISSO) support shall be provided to address tasks outlined in this PWS for named NC3 systems. ISSO support is also solicited to maintain Offutt DRSN accreditation associated with segments of multiple NC3 systems that connect to Offutt DRSN, Presidential and National Voice Conferencing (PNVC), and various gateways and long local communications circuits. Additionally, personnel shall be required to assist in configuration management process reviews to ensure appropriate mechanisms are in place, update DRSN RMF Body of Evidence requirements, and support DRSN external entity audits and inspections.

1.3. GENERAL CONTRACTOR REQUIREMENTS

This PWS outlines general requirements for contractor performance in the areas outlined below:

a. Personnel Management

b. Training

c. Security

d. Quality Assurance Management

e. Standards of Conduct and Appearance

f. Continuation of Essential DoW Contractor Services During Crises

g. Government Site Rules

1.3.1. PERSONNEL MANAGEMENT

The contractor shall maintain appropriately-skilled and credentialed cybersecurity personnel and supervisory functions to deliver cybersecurity services, as defined in this PWS. The contractor shall be responsible for personnel selection, supervision, and assignment. The contractor's on-site personnel shall be easily distinguishable as contractor representatives (e.g. badge, hat, or lanyard).

The primary places of performance are USSTRATCOM, Buildings 1000 and 1022, Rooms

NL1.100A, NL1.100B, MSDC-2 (SL2.148), MSDC-4 (SL2.140), ITER A (HL2.128), ITER B

(HL2.126), and various telecommunications closets located on Offutt AFB, Nebraska. Daytime support is required Monday through Friday, with occasional weekend support under extenuating circumstances. Any scheduled and unscheduled employee absences shall be coordinated by contractor management to ensure continuity of operations with no mission degradation. Upon the retirement, resignation, reassignment, or dismissal of an employee, the contractor shall fill any vacancies with fully-qualified personnel within thirty (30) calendar days of release.

1.3.1.1. POINTS OF CONTACT (POC)

The contractor shall designate primary and alternate focal points via written correspondence to the Contracting Officer (CO) at Offutt AFB, Nebraska within thirty (30) calendar days post-contract award. The primary and alternate POCs shall be responsible cybersecurity support for the 55 SCS. At least one shall be reachable twenty-four (24) hours per day, seven (7) days per week (including Federal Holidays). POC changes shall be provided to the CO within two (2) calendar days of changes.

1.3.1.2. CONTRACTOR PROGRAM MANAGEMENT

Contractor employees shall possess all current training, qualifications, and experience necessary to accomplish the requirements of this PWS. A designated contractor Program Manager (PM) shall oversee contractor/subcontractor employees, be responsible for task direction, and interface with the Contracting Officer (CO), Contracting Officer Representative (COR), Offutt Red Switch Management Office (ORSMO), and 55 SCS leadership. The contractor shall be responsible for providing and retaining a well-qualified, professional, motivated work force, and for fostering a culture that emphasizes teamwork, integrity, continuous improvement, and effective resource management. The contractor shall integrate and coordinate all activities necessary to successfully execute these requirements within the normally-scheduled hours of 0730 - 1630.

1.3.2. TRAINING

All personnel permanently-assigned, or who will provide backfill support to designated Government sites, shall be fully-trained and qualified to oversee all ATO aspects of the complement of NC3-related equipment and services at Offutt AFB, Nebraska. The contractor shall develop a training plan that will ensure contractor personnel are adequately trained to meet the requirements of this PWS, and submit the plan to the CO for review/approval not later than thirty (30) calendar days after contract award. The contractor shall have a working knowledge of Emissions Security (EMSEC) and Telecommunications Electronics Material Protected from Emanating Spurious Transmissions (TEMPEST) concepts. On-the-job training may be accomplished using existing facilities, but only on a non-interference basis, such that system operation and operational missions are not adversely impacted. The contractor shall be authorized to send ISSOs to initial or refresher DSS-2A Switch training at the CCSS training school located at Ft Huachuca, AZ, but shall be responsible for all travel costs. To schedule training at the CCSS training school, the contractor shall coordinate training requirements with ORSMO. The Government shall only provide additional DSS-2A training to ISSOs for significant changes to CCSS equipment, or supplementary subsystems, required for sustainment of the ATO. The contractor shall also be authorized to send ISSOs to other Government-sponsored training, such as G- ASNT operator and maintenance courses, as well as Enterprise Mission Assurance Support Service (eMASS) workflow platform training, etc., as required to support RMF package development. Again, the contractor shall be responsible for any travel expenses. Contractor employees who attend the CCSS training school, and other

Government training courses, shall provide copies of their certifications to the COR/CO within thirty (30) calendar days of completion.

1.3.2.1 OTHER GOVERNMENT-PROVIDED TRAINING

The Government will provide other training necessary to support mission requirements:

1.3.2.1.1 SECURITY TRAINING

The contractor shall provide initial and refresher security training to all employees, in accordance with (IAW) Government regulations, local security policies, site-specific requirements, and classified debriefs to employees IAW 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM Rule). The contractor shall also be familiarized, and comply with, the DRSN Security Classification Guide (SCG) and other applicable SCGs, to include annual refresher reviews.

1.3.2.1.2. NETWORK USER TRAINING

Contractor personnel shall complete Network User Training by using https://jkodirect.jten.mil computer-based training prior to being granted access to the network infrastructure.

1.3.2.1.3. MISSION-FOCUSED TRAINING

The contractor shall complete all mission-focused training, e.g., Force Protection, Operational Security, Air Force Risk Management, Antiterrorism Awareness, as directed by the CO.

1.3.2.2. EDUCATION, CERTIFICATIONS, AND WORK EXPERIENCE

Cybersecurity personnel shall possess a minimum of an Associate of Science Degree in Information Technology or Cybersecurity. The contractor shall ensure employees have, and maintain, required Information Technology or Cybersecurity education, training, or certifications IAW DoDM 8140.03 and current Government directives, regulations, and policies for the role, or labor category, it is fulfilling (reference DFARS 252.239-7001).

Personnel shall possess Intermediate Level Cybersecurity Work Role experience. Any required education, certifications and work experience shall be obtained prior to any employee performing work under this PWS. Personnel filling ISSO roles shall have a minimum of four years of experience working RMF requirements and providing cybersecurity services.

Employees deficient in these qualifications shall not be permitted to work under this PWS.

1.3.2.3. TRAINING RECORDS

The contractor shall maintain all training records for each employee. These records shall be made available to the COR/CO upon request.

1.3.3. SECURITY

The contractor shall follow all security requirements (Operations and Communications Security) listed on the DD Form 254, Contract Security Classification Specification, to ensure information and documentation are protected. 32 CFR, Part 117, NIPSOM Rule shall be used as a guide.

1.3.3.1. INSTALLATION ACCESS AND PHYSICAL SECURITY

The contractor shall ensure that all employees authorized to work under this PWS obtain installation access, as required by DoDM 5200.08 Volume 3, Physical Security Program:

Access to DoD Installations. The contractor shall also be able to obtain a Government Common Access Card (CAC) to perform the tasks associated with this requirement, in accordance with DAFFARS 5352.242-9001, Common Access Cards for Contractor Personnel.

Contractor employees and property may be subject to search and seizure upon entering and leaving Government installations and facilities. Government-furnished identification shall be returned to the Government upon termination of a contractor employee. Contractor employees shall comply with Government physical security plans at Government facilities. The contractor shall be responsible for any keys provided by the Government and be accountable for their use. Contractor employees shall not duplicate or provide keys to unauthorized personnel and shall implement procedures to prevent loss or misplacement.

1.3.3.2. FACILITY SECURITY CLEARANCE (FCL)

Prior to performance, the contractor shall possess an appropriate level FCL. The FCL certifies the contractor’s ability to meet organizational clearances required for contract performance as indicated on the DD Form 254, Contract Security Classification Specification. The FCL requirement for the prime contractor includes those instances in which all classified access will be limited to subcontractors. No access to classified information shall be granted to contractor employees until a valid Interim or Final FCL has been granted by the Defense Counterintelligence and Security Agency. The contractor shall notify the 55 SCS Security Manager and COR that an Interim or Final FCL has been granted thirty (30) calendar days prior to beginning on-site performance.

1.3.3.3. PERSONNEL SECURITY CLEARANCE

Contractors shall comply with current Government regulations, manuals, and policies to ensure all employees obtain the required background checks or security clearances equal to, or greater than, the classified information for which they are seeking access. The contractor shall fully cooperate with all security checks and investigations by furnishing requested information.

Contractor personnel, excluding program manager, shall possess a Top Secret (TS) clearance with Sensitive Compartmented Information (SCI) caveat. Contractor personnel shall possess a TS clearance by contract award and obtain SCI caveat, NC2-ESI, within three (3) months after contract award. Due to the costs involved with security investigations, requests for contractor security clearances shall be kept to the absolute minimum necessary to perform service requirements. There are no clearance requirements for the program manager.

1.3.3.4. FACILITY ACCESS

The contractor shall:

a) Provide the 55 SCS Security Manager a Visitor Authorization Request (VAR) and comply with specific Government Information Systems Security Manager (ISSM) and host agency requirements for employees to gain access to specific Government facilities.

b) Provide 55 WG/SSO a VAR with the words “PERM CERT” at the top for submission to USSTRATCOM/SSO for access to the USSTRATCOM building (for duration of contractor period of performance, or three years, whichever comes first).

c) Provide an Entry Authorization List (EAL) to facility security managers and alarm monitoring agencies every six (6) months to gain access to limited access areas.

d) Develop and maintain EALs for authorized personnel granted access to contractor-limited access areas and perform occasional escort duties for contractor workcenters.

e) Comply with facility policies, instructions, and guidelines, e.g., Strategic Instruction on Foreign Travel Reporting, USSTRATCOM Personal Electronic Device (PED) Policy, and USSTRATCOM SSO Handbook.

1.3.3.5. CONTRACTOR ACCESS

a) Immediately notify the 55 SCS Security Manager and COR when employees no longer require access to the USSTRATCOM building and Offutt AFB and return all Government identification, access badges, and parking passes.

b) Immediately notify the 55 SCS Security Manager and COR when Government identification and access badges are lost or stolen.

c) Provide a monthly electronic spreadsheet of all employees and subcontractors supporting requirements on this PWS.

1.3.3.6. PRIVACY ACT

Performance on this PWS requires that some personnel have access to Personally Identifiable Information (PII). Contractor personnel shall adhere to rules and regulations regarding physical security, breach reporting timelines, appropriate document handling, adherence to the Privacy Act of 1974, Title 5 of the U.S. Code, Section 552a, and other applicable agency rules and regulations.

1.3.3.7. NO RIGHT TO PRIVACY

All activities on DoW systems and networks may be monitored, intercepted, recorded, read, copied, or captured and disclosed by authorized personnel. There is no right of privacy on these systems. System personnel may give law enforcement officials any evidence of potential crime found on DoW computer systems. Use of these systems by any user, authorized or unauthorized, constitutes consent to monitoring, interception, recording, reading, copying, or capturing, and disclosure. The contractor shall report any unauthorized use of systems and networks to the ISSM.

1.3.3.8. INFORMATION SECURITY (INFOSEC)

All documents, schematics, drawings, presentations, email, graphs, web sites (to include all source code and items produced using any application-based editor, compiler software and/or operating system), User Data Module labels, and any hard or soft copy items produced or derived from the requirements of this PWS shall be marked with the classification markings and distribution statements as required in DoDM 5200.01 Volumes 1 through 4, DoD Information Security Program, DISAC 300-115-7, Communications Security: Defense Red Switch Network Security Guidance, and the Defense Red Switch Network SCG.

1.3.3.9. SECURITY MANAGEMENT (TRANSMISSION OF CLASSIFIED

MATERIAL)

The contractor shall transmit and deliver classified material and reports IAW current Government manuals, regulations, and policies, e.g., DISAC 300-115-7.

1.3.3.10. CLASSIFIED DESTRUCTION

The contractor shall destroy classified material IAW current Government and local procedures. The Government will provide classified material burn bags and destruction shredders. Destruction facilities at USSTRATCOM are currently not available to the 55 SCS.

1.3.4. QUALITY ASSURANCE MANAGEMENT

The contractor shall ensure the quality, timeliness, and delivery of products and services within budget, and shall submit a Quality Assurance Plan within sixty (60) calendar days of contract award.

The contractor PM shall manage the contractor and any subcontractor employees, provide task direction and interface with the COR, CO, and Government management. The contractor PM shall integrate and coordinate internal audits, inspections, and activities to ensure established policies and procedures are followed, in addition to maintaining an effective preventive and corrective action system, within normally scheduled duty hours. As such, expected and unexpected employee absences shall be managed by the contractor PM. Additionally, a continuity plan shall be established to ensure no mission degradation in the event of employee turnover.

1.3.4.1. PERFORMANCE MEETINGS

When requested by the COR/CO, the contractor shall attend regularly-scheduled or impromptu program, contract, and management in-person meetings, virtual meetings, and teleconferences to discuss any contractor performance issues not resolved by other means. The contractor shall notify and invite COR to any impromptu meetings. Any deficiencies identified by the COR shall be appropriately-addressed by the contractor within three (3) business days, or as agreed upon by CO, dependent on issue complexity.

1.3.4.2. GOVERNMENT QUALITY ASSURANCE SURVEILLANCE PROGRAM

The Government shall evaluate the contractor’s performance under this PWS in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure the contractor has implemented PWS tasks in accordance with performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable Performance Thresholds. The Government may inspect the contractor using a QASP through random inspections, scheduled inspections, or any other method of inspection that the Government determines reflects the actual successful performance of this PWS. Failure of the contractor to correct validated Government complaints will be considered a failure to perform. As part of the Government’s Quality Assurance Program, the Government may:

a. Review, and, if warranted, reject any reports or other submittals required of the contractor.

b. Review performance and service records, including, if applicable, any computerized or hardcopy records maintained by the contractor documenting performance under this PWS, and require correction of any unsatisfactory conditions noted.

c. Determine the adequacy of the contractor’s Quality Control Plan (QCP), documentation, and the overall success of this program. The Government may order improvements if it determines the programs are insufficient and/or ineffective.

d. Obtain tenant satisfaction survey information and require improvements in service based on such information to the extent the results correlate with deficiencies in contract requirements.

e. Conduct random and routine physical inspections of work products and systems, to include programs and files maintained in computers and contractor’s onsite offices and work areas and require correction of any deficiencies noted.

f. Perform inspections with Government personnel or independent third-party inspectors. 55 SCS/QA personnel may assist with inspections upon request.

1.3.5. APPEARANCE AND STANDARDS OF CONDUCT

The contractor shall ensure that its employee policy for standards of conduct and personal appearance foster a professional and safe work environment conforming to the Government’s existing organizational culture. Contractor employees shall practice high standards of personal hygiene and maintain a clean, neat appearance while performing on this PWS. The contractor shall ensure compliance with all applicable standards, handbooks, Air Force Manuals, and Air Force Instructions.

Personnel shall always clearly display contractor identification badges, logoed shirts, etc.

Contractor employees who threaten the safety or welfare of the installation, or its personnel, shall be immediately removed and/or barred from the installation. The COR, or designated Government representative, may require the contractor to remove any contractor employee from the job site for reasons of misconduct, security violations, or found to be, or suspected to be, under the influence of alcohol, drugs, or other incapacitating agent. The installation Commander has the authority to bar such individuals from the installation. Removal from the job site, or dismissal from the premises, shall not relieve the contractor of contract requirements. Any contractor employee designated to be removed from the contract, as noted above, shall be replaced with a temporary employee within fourteen (14) calendar days and with a permanent employee within thirty (30) calendar days.

1.3.6. CONTINUATION OF ESSENTIAL DOW CONTRACTOR SERVICES DURING

CRISES

The Government shall notify the contractor when contingencies and emergencies are declared.

Special circumstances, or mission requirements, may preclude contractor personnel from departing facilities at normal close of business hours.

In crisis situations, to include times of war, on-base incidents, natural disasters, weather events, or other contingencies as declared by base leadership, the National Command Authority, or Office of Personnel Management (OPM), the contractor shall provide continuous cybersecurity support to sustain ongoing military missions. Within 180 calendar days of contract award, the contractor shall develop a Continuity of Operations Plan (COOP).

1.3.7. GOVERNMENT SITE RULES

In the execution of duties Offutt AFB, the contractor shall fully comply with local military installation, city, state, and federal laws, regulations, and ordinances pertaining to performance of services required under this PWS.

The contractor shall:

a) Conform to all safety and security requirements.

b) Observe all rules and regulations issued by the installation’s Senior Official pertaining to fire, safety, sanitation, severe weather, and access to the installation.

c) Take all reasonable steps and precautions to prevent accidents and preserve the life and health of all personnel associated in any way with the performance of this PWS.

d) Report all safety mishaps and violations to the COR within eight (8) hours of occurrence.

1.3.8. PERIOD OF PERFORMANCE

The period of performance shall be for one (1) base year, four (4) 12-month option years, and one (1) 6-month final option year. The period of performance reads as follows:

Base Year 1 March 2026 – 28 February 2027 Option Year I 1 March 2027 – 29 February 2028 Option Year II 1 March 2028 – 28 February 2029 Option Year III 1 March 2029 – 28 February 2030 Option Year IV 1 March 2030 – 28 February 2031 Option Year V 1 March 2031 – 31 August 2031

1.4 SERVICES SUMMARY

PERFORMANCE

OBJECTIVE

PWS PARAGRAPH

REFERENCE

PERFORMANCE THRESHOLD

Store Copies of Audit Logs 2.1.1/2.1.2/2.2.1 Ensure 100% of audit logs are up-to-date and stored/marked correctly.

Electronic Project Folders

2.1.1/2.1.2/2.2.1 100% of projects shall have an inspectable electronic folder. COR may request adjustments to the content. COR will reinspect content within one week if delinquent of requested material.

Special Security Representative (SSR) Program

2.2.1 100% of Alarm Access Letters and PINS shall be submitted to Defense Intelligence Agency (DIA), the primary SSR, within month prior to expiration every six months.

Competence and Qualifications

1.3.2.2 100% of contractor’s personnel shall possess nominal certifications per DFARS 252.239-7001.

Employee Turnover

1.3.1/1.3.4 100% of vacancies shall be filled with fully qualified personnel within

(30) calendar days of release.

Points of Contact

1.3.1.1 Establish written primary and alternate focal point to CO within 30 calendar days post-contract award. (A one-time Inspection)

DRSN Training

1.3.2 At least 66% of full-time equivalent (FTE) personnel are fully DRSN trained at any given time, six months after contract award.

Submit Initial Training Plan 1.3.2 Submit training plan to CO and ORSMO for review/approval not later than 30 calendar days after contract award.

Contractor Education and Certifications

1.3.2.2. Contractor shall abide with DFARS 252.239-7001 certification requirement.

Maintain Training Records 1.3.2.3. Performance is acceptable when contractor can present 100% of training records for all personnel upon request by the CO or COR.

CAC 1.3.3.1. All contractors shall obtain CAC cards within two weeks of being hired.

Government Furnished ID 1.3.3.1. Government-furnished identification shall be returned to the Government upon termination of an employee.

Facility Security Clearance

(FCL)

1.3.3.2. Notify the 55 SCS Security Manager and COR that an Interim or Final FCL has been granted thirty calendar (30) days prior to beginning on-site performance.

Provide the Government with MSR

2.1.1/2.1.2/2.1.3/2.2.1 Provide a monthly status report on the last business day of the month, 100% of the time.

Deficiency Management 1.3.4.1 Any deficiencies identified by the COR shall be appropriately addressed by the contractor within three (3) business days, or as agreed upon by CO, dependent on issue complexity.

Quality Assurance Plan 1.3.4 Contractor shall submit a Quality Assurance Plan within sixty (60) days of contract award.

Continuity of Operations Plan (COOP)

1.3.6 Develop a COOP within 180 days of contract award.

G-ASNT Cybersecurity Support

Manage and Document A&A Projects

2.1.1f 100% of Assessment & Authorization (A&A) projects have a folder/plan open in the appropriate Information Assurance (IA) Manager workflow platform.

Artifacts and Controls 2.1.1g Maintain 100% artifacts and controls specified within the RMF package using Excel or other specified programs.

Develop, Review, and Update Risk Management Framework Plan

2.1.1h Performance is acceptable when contractor can produce a RMF Plan in compliance with NIST SP 800-53 requirements upon request by the CO or COR.

Development of System Security Plans (SSP), Plans of Action & Milestones (POAM), and Security Policies and Procedures

2.1.1i

100% completion of SSPs and POAMs when required.

Conduct Audits on G-ASNT System

2.1.1j 100% collection of monthly audit file backups using Assured Compliance Assessment Solution (ACAS), or other scanning software.

Non-Hardened Klaxon

Manage and Document A&A Projects

2.1.2g 100% of A&A projects have a folder/plan open in the appropriate IA Manager workflow platform.

Artifacts and Controls 2.1.2h Maintain 100% artifacts and controls specified within the RMF package using Excel or other specified programs.

Develop, Review, and Update Risk Management Framework Plan

2.1.2i Performance is acceptable when contractor can produce a RMF Plan in compliance with CNSSI 1253 requirements upon request by the CO or

COR.

Development of SSPs, POAMs, and Security Policies and Procedures

2.1.2j 100% completion of SSPs and POAMs when required.

Conduct Audits on Klaxon Servers

2.1.2k 100% collection of monthly audit file backups using ACAS, or other scanning software.

Other 55 SCS Cybersecurity Support

Manage and Document A&A projects

2.1.3f 100% of A&A projects have a folder/plan open in the appropriate workflow platform (eMASS or XACTA).

Artifacts and Controls 2.1.3g Maintain 100% artifacts and controls specified within the RMF package using Excel or other specified programs.

Risk Management Framework Plan

2.1.3h Performance is acceptable when contractor can produce a RMF Plan in compliance with CNSSI 1253 requirements upon request by the CO or COR.

Develop System Security Plans and POAMs, and Security Policies and Procedures

2.1.3i 100% completion of SSPs and POAMs when required

DRSN Cybersecurity Support Audit Response Plans 2.2.1h 100% completion of appropriate Response Plans to analyses of audits for network security within thirty (30) calendar days of audit completion.

2. SECTION 2 – CONTRACTOR CYBERSECURITY SUPPORT REQUIREMENTS

This PWS defines cybersecurity task requirements for contractor performance in the areas outlined below:

a. Global Aircrew Strategic Network Terminal (G-ASNT) Cybersecurity Support

b. Non-hardened Aircrew Alerting System (NAAS) – Klaxon Cybersecurity Support

c. Other 55 SCS Cybersecurity Support

d. DRSN Cybersecurity Support

e. Program Manager

f. TDY/Travel

Audit Controls and Backups of DRSN Admin Terminals, ECCs, DSS-2A switches, and MTKs

2.2.1f/2.2.1p 100% completion of monthly audit file backups using ACAS, or other DRSN Delegated Authorizing Official (DAO)-approved scanning software.

Remote Access Documentation

2.2.1q 100% documentation of all DRSN remote access capabilities and personnel with permissions upon request by CO or COR.

Contractor Standard Operating Procedures (SOP) and Instructions

2.2.1u/2.2.1v Performance is acceptable when contractor can produce SOPs for RMF accreditation program and configuration management program to change SOPs upon request by CO or COR.

A&A Projects in XACTA 2.2.1y 100% of A&A projects have a folder/plan open in the XACTA IA Manager A&A workflow platform.

Develop System Security Plans and Create POAMs

2.2.1z 100% completion of SSPs and POAMs when required.

Obtain, Manage, and File TEMPEST Accreditation Documentation

2.2.1cc Performance is acceptable when contractor can produce Sensitive Compartmentalized Information Facility (SCIF) TEMPEST accreditation documents for their office and long local sites upon request by CO or COR..

Perform Special Security Representative Functions.

2.2.1kk Report 100% of PED violations to the COR within one business day.

XACTA Backups 2.2.1nn 100% of copies of all controls templates are available after each update.

DRSN Artifacts 2.2.1oo Maintain 100% of artifacts specified within the RMF package.

Security Control Review and Testing

2.2.1pp 100% of security controls are reviewed and tested every 3 years, per DAO requirements

VPN Registry for DRSN Long Local Circuits

2.2.1qq Complete update for 100% of DRSN long local circuits every quarter.

Manage all MOA, MOU, and AOR Letters

2.2.1rr Update 100% of the documents annually. Conduct 100% review every three (3) years on the anniversary of contract award.

Update NC3 Hardness Checklist

2.2.1tt 100% completion of NC3 hardness checklists and fix action responses to Defense Threat Reduction Agency (DTRA), Nuclear C3 Enterprise Center (NEC), or other audits within thirty (30) calendar days of audit completion.

2.1. CLIN 001 FTE CYBERSECURITY SPECIALIST

2.1.1. GLOBAL AIRCREW STRATEGIC NETWORK TERMINAL (G-ASNT)

CYBERSECURITY SUPPORT (55 WG)

The contractor shall provide ISSO support for the ground portion of the AFGSC G-ASNT for the purpose of maintaining an ATO for 55 SCS equipment in the 55 WG Command Post and 55 SCS Tactical Radio transportable equipment. The G-ASNT system provides protected, robust communication capabilities to missile, nuclear bomber, and support aircraft crews in austere operational environments. The ISSO shall serve as a primary advisor to ensure an appropriate operational security posture meets day-to-day mission objectives.

a) Provide cybersecurity support for building an initial RMF package to support the ATO for the ground element of the AFGSC Global Aircrew Strategic Network Terminal (G-ASNT) for the 55 SCS and 55 WG (Command Post).

b) Develop technical solutions that require collaboration with the G-ASNT Program Management Office (PMO) and internal experts for deep analyses and understanding of impacts on end-products and solutions.

c) Help resolve technical problems and mitigate programmatic issues that are unclear and require extensive technical knowledge.

d) Serve as the principal advisor for Offutt AFB G-ASNT customers, ensuring appropriate operational security posture for organizational mission and business systems per the G-ASNT PMO.

e) Advise on all matters involving RMF, A&A, and day-to-day security of NC3 mission systems.

f) Manage and document A&A projects to provide inputs to the G-ASNT PMO for submission in the eMASS A&A workflow platform, or other platform, as dictated by the PMO.

g) Document and track controls and artifacts using Microsoft Excel and other software products.

h) Develop, review, and update Risk Management Framework Plan and supporting documentation to comply with NIST SP 800-53 requirements in support of the ATO.

i) Advise, conduct, and document risk assessments, develop SSP, POAMs, and security policies and procedures.

j) Conduct audits on G-ASNT system.

k) Advise and guide customers in the implementation of security controls, doctrine, and policies.

l) Implement cybersecurity standards and procedures to identify, report and resolve security violations.

m) Establish and satisfy cybersecurity and security requirements based upon user, policy, regulatory, PMO, and resource demands.

n) Integrate and implement computer system security solutions.

o) Analyze general cybersecurity-related technical problems and provide support in solving these issues.

p) Attend in-person and virtual regularly-scheduled meetings, or impromptu cybersecurity-related meetings, as required.

q) Report G-ASNT cybersecurity work in an MSR.

r) Maintain a G-ASNT binder and electronic file folder on the appropriate computer network.

s) Support other G-ASNT-related tasks, as required.

2.1.2. NON-HARDENED AIRCREW ALERTING SYSTEM (NAAS) – KLAXON

CYBERSECURITY SUPPORT

The contractor shall provide cybersecurity support for NAAS, owned and maintained by 55 SCS, but utilized by NAOC and 55 WG Command Post in support of NAOC and STRATCOM Alert Aircrew Mission. More commonly known as Klaxon, the system provides modern network-based non-hardened communications and notification capabilities to support aircrews at Offutt AFB. The ISSOs shall serve as the primary cybersecurity advisors to establish the Klaxon ATO and maintain the ATO as the system evolves.

a) Provide cybersecurity support and accomplish tasks necessary for building an initial RMF package to support the ATO for the NAAS Klaxon.

b) Provide cybersecurity support services for the 55 WG Command Post NAAS KLAXON system.

c) Develop technical solutions that require deep analyses, collaboration with internal experts, and understanding of the impacts on the end-product solution.

d) Solve technical problems and issues that are unclear and require appropriate technical knowledge.

e) Serve as principal advisors in ensuring appropriate operational security posture for organizational mission systems.

f) Advise on all matters involving the RMF, A&A, and day-to-day security of mission and business systems.

g) Manage and document A&A projects using the appropriate IA Manager workflow platform.

h) Document and track controls and artifacts using Microsoft Excel and other software products.

i) Develop, review, and update Risk Management Framework Plan and supporting documentation to comply with CNSSI 1253 requirements in support of the ATO.

j) Advise, conduct, and document risk assessments, development of SSPs, POAMs, and security policies and procedures.

k) Conduct audits on NAAS Klaxon system.

l) Advise and guide customers in the implementation of security controls, doctrine, and policies.

m) Implement cybersecurity security standards and procedures to identify, report and resolve security violations.

n) Establish and satisfy cybersecurity and security requirements based upon user, policy, regulatory, and resource demands.

o) Integrate and implement computer system security solutions as the system evolves.

p) Analyze general cybersecurity-related technical problems and spearhead solving these problems.

q) Report NAAS Klaxon cybersecurity-related work in an MSR.

r) Support other 55 WG Command Post NAAS Klaxon system-related cybersecurity tasks, as required.

s) Complete monthly audit file backups of Klaxon system servers and terminals using ACAS or other scanning software.

2.1.3. OTHER 55 SCS CYBERSECURITY SUPPORT

The contractor shall support the 55th Strategic Communications Squadron in other cybersecurity-related matters. The contractor cybersecurity Subject Matter Experts (SME) shall serve as primary advisors, ensuring appropriate operational security posture for organizational mission and NC3 systems.

a) Provide cybersecurity subject matter expertise for the 55 SCS, DRSN O&M, and mission partners in defining security requirements during the design and development process.

b) Assist in developing technical solutions, specifications, and system designs that require collaboration with internal experts, extensive analyses, and understanding of impacts on end products and solutions.

c) Assist in solving technical problems and issues that are unclear and require substantial technical knowledge.

d) Serve as principal advisors on cybersecurity matters for organizational mission and business systems.

e) Advise on all matters involving the RMF, A&A, and day-to-day security of mission and business systems.

f) Manage and document A&A projects using XACTA IA Manager and eMASS A&A workflow platforms.

g) Document and track controls and artifacts using Microsoft excel and other software products.

h) Develop, review, and update Risk Management Framework Plan and supporting documentation to comply with CNSSI 1253 requirements in support of the ATO.

i) Advise, conduct, and document risk assessments, develop SSPs, POAMs, and security policies and procedures.

j) Advise and guide customers in the implementation of security controls, doctrine, and policies.

k) Implement cybersecurity standards and procedures to identify, report and resolve security violations.

l) Establish and satisfy cybersecurity and security requirements based upon user, policy, regulatory, and resource demands.

m) Integrate and implement computer system security solutions.

n) Analyze general cybersecurity-related technical problems and support in solving these problems.

o) Report other cybersecurity work in the MSR.

p) Support other 55 SCS cybersecurity efforts, including DRSN, as required.

2.2. CLIN 002 TWO FTE ISSOs

2.2.1. DRSN CYBERSECURITY SUPPORT

The contractor shall establish and continuously maintain the ATO for Offutt DRSN, related subsystems, as well as Offutt DRSN accreditation associated with segments of multiple NC3 systems that connect to Offutt DRSN, such as PNVC, various gateways, and long local communications circuits, in accordance with RMF guidelines: NIST 800-53, Rev 4, Security and Privacy Controls for Federal Information Systems and Organizations, Committee on National Security Systems Instruction No. 1253 (CNSSI 1253, Rev 4), Security Categorization and Control Selection for National Security Systems, DODI

8510.01, Risk Management Framework for DoD Systems, and DISAI 270-50-9, Life Cycle Sustainment Planning, among other risk management framework directives.

a) Provide cybersecurity support services, as ISSO, for the 55 SCS DRSN program.

b) Provide assessments on the severity of weaknesses or deficiencies discovered in the local DRSN operations environment and recommend corrective actions to address vulnerabilities.

c) Use the RMF process to identify, analyze, and oversee risk in order to maintain an active Offutt

AFB DRSN ATO.

d) Process, store, maintain, update, and validate RMF documentation in a classified network environment or all DRSN-related programs.

e) Assist in the configuration management process to maintain, update, and audit the DRSN network using methods and tools in accordance with DoW, Air Force (AF), and local policies.

f) Utilize ACAS, or other DRSN DAO-approved scanning software, to accomplish audit controls.

g) Complete monthly audit file backups of DRSN Administration Terminals.

h) Establish appropriate Response Plans to the results of audit analyses for network security, as well as procedures for notification of associated entities, to include updating Response Plans annually.

i) Participate in DRSN-related requirements discussions with stakeholders and devise cybersecurity solutions.

j) Complete updates to the DRSN RMF packages in XACTA IA Manager during all steps of the RMF process.

k) Develop, as necessary, DRSN Body of Evidence documents, including Security Plans, Security Assessment Reports (SAR), Plan of Actions and Milestones (POAM), risk assessment reports, network diagrams, rack elevations, equipment inventories, software lists, and security controls traceability matrices.

l) Develop, implement, assess, manage, and monitor DRSN security controls and RMF family policies.

m) Update POAMs as required by the AFGSC and 16th Air Force (16 AF) Assessment and Authorization (A&A) Teams.

n) Coordinate with the DRSN ISSM to implement changes within XACTA.

o) Interface with ORSMO, USSTRATCOM, DISA, Air Combat Command (ACC), DAO, DTRA, NEC, DRSN long local circuit site representatives, U.S. Allies, and other stakeholders during the RMF package A&A process.

p) Ensure monthly audit file backups of all secure and non-secure DSS-2A switches, Enhanced Command Consoles (ECC), Admin Terminals, and Maintenance Tool Kits (MTK) are accomplished, as appropriate, and document who has access to the equipment. Additionally, any equipment not requiring authentication, or waivers, shall be documented.

q) Document remote access capabilities and personnel with permissions such as DISA, Operations and Maintenance (O&M), and IA.

r) Ensure physical security, personnel security, incident handling, training validation, and other security awareness requirements, have been satisfied by all DRSN users for continued network access.

s) Schedule and complete quarterly destruction of media in accordance with USSTRATCOM and Offutt AFB policies.

t) Sanitize, remove drives, and remove memory, as applicable, from hardware and ensure destruction is accomplished according to established Government and local security procedures.

u) Work with DRSN O&M contractors and ORSMO in developing and maintaining contractor Standard Operating Procedures required for ongoing RMF Accreditation Program.

v) Assist in configuration management process reviews to establish procedures for ensuring contractor work instructions are continually updated and audited.

w) Communicate with internal and client project team members, and work to influence teams regarding solution designs, processes, and approaches.

x) Serve as the principal advisor in ensuring appropriate operational security posture for organizational mission and business systems.

y) Manage and document A&A projects using XACTA IA Manager A&A workflow platform.

z) Advise, conduct, and document risk assessments, develop System Security Plans (SSP), and create POAMs and security policies and procedures.

aa) Advise and guide customers in the implementation of security controls, doctrine, and policies.

bb) Participate in system discovery meetings to categorize systems for ATO purposes, as well as promote DRSN policy and process creation.

cc) Obtain, manage, and file SCIF and TEMPEST accreditation documents as part of the DRSN RMF Accreditation Program.

dd) Implement cybersecurity standards and procedures to identify, report and resolve security violations.

ee) Establish and satisfy cybersecurity requirements based upon user, policy, regulatory, and resource demands.

ff) Integrate and implement computer system security solutions associated with DRSN to including IP transition efforts, control Local Area Networks (LAN), Cyber Security Service Provider (CSSP) sensors, Enhanced Command Consoles, administrative terminals, Conference Management Agents (CMA), software upgrades, PNVC routers/switches, and network gateways.

gg) Analyze general cybersecurity-related technical problems in conjunction with Offutt O&M, USSTRATCOM, DISA, 55 WG, and other organizations, and provide support in solving these issues.

hh) Attend in-person or virtual regularly-scheduled or impromptu cybersecurity-related meetings, as required by the COR, and provide meeting minutes to support RMF requirements.

ii) Provide applicable…