LM Correlation Matrix - 19Jan11.xlsx
XLSX spreadsheet 24 KB Posted
- Solicitation number
- FA7037-11-R-0002
About this file
L/M Correlation Matrix
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Amendment 0002.docx | DOCX document | |
| Cyber Assessment Engineering and Technical Support Cost Model.xlsx | XLSX spreadsheet | |
| Conformed Solicitation.docx | DOCX document | |
| Amendment 0001.docx | DOCX document | |
| Q A -compiled-1-25-11.docx | DOCX document | |
| FA7037-11-R-0002 | — | |
| FA7037-11-R-0002 Atch 1.pdf | ||
| FA7037-11-R-0002 Atch 5.pdf | ||
| FA7037-11-R-0002 Atch 3.pdf | ||
| FA7037-11-R-0002 Atch 6.pdf | ||
| FA7037-11-R-0002 Atch 4.pdf | ||
| FA7037-11-R-0002 Atch 2.pdf | ||
| FA7037-11-R-0002 Atch 1.pdf | ||
| FA7037-11-R-0002 Atch 4.pdf | ||
| FA7037-11-R-0002 Atch 3.pdf | ||
| FA7037-11-R-0002 Atch 2.pdf | ||
| FA7037-11-R-0002 | — | |
| FA7037-11-R-0002 Atch 6.pdf | ||
| FA7037-11-R-0002 Atch 5.pdf | ||
| SOW - 92nd Cyber Assessment.pdf |
Show all 20
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Final
| FA7037-11-R-0002, Attachment 6 - SOW, Section L and Section M Correlation Matrix | |||||
| SOW Requirement | SOW | Section L Requirement | Sect L | Section M | Sect M |
| Mission Capability Subfactor 1: Information Assurance and Security Assessment Program and Capability Development | Para | Mission Capability Subfactor 1: Information Assurance and Security Assessment Program and Capability Development | Para | Mission Capability Subfactor 1: Information Assurance and Security Assessment Program and Capability Development | Para |
| Tool and Technology Evaluation: The contractor shall evaluate commercial and government tools for automating the assessment of each device and device type and recommend tools to be used to automate the assessment. This evaluation shall include tools for collecting, analyzing and reporting the data required to determine the security posture of the devices and device types listed in Table 1. The contractor shall define tool requirements and define, develop and modify tools and scripts, and support the 92 IOS in integrating approved tools. The contractor shall identify, document and demonstrate the proper usage of all tools developed and modified (including scripts and data base queries) under this effort and include them in the assessment package. (A016) | 3.1.4.1.2 |
3.1.4.2.3 3.1.4.3.2 3.2.4.1.2 3.2.4.2.3
| 3.2.4.3.2 | Describe your knowledge, approach and techniques utilized for identifying, evaluating and integrating Commercial Off The Shelf (COTS), Government Off The Shelf (GOTS), and Open Source assessment tools into a fielded system used for executing cyber security assessments. Include a description of your capabilities with COTS, GOTS and Open Source assessment tools and a description of your skills regarding the integration of tools into a common interface. Include information about your familiarity with the integration of commercial tools and academic research into software which is pre-existing or in development | 5.3.1 | The Government will evaluate the offeror’s approach and techniques utilized in identifying, evaluating and integrating COTS, GOTS and Open Source assessment tools into a fielded system for executing cyber security assessments to include: (1) a description of the offeror's capabilities with COTS, GOTS and Open Source assessment tools; (2) a description of the offeror's skills regarding the integration of tools into a common interface; and (3) the offeror's familiarity with the integration of commercial tools and academic research into software which is pre-existing or in development | 4.2.a |
| Tool and Technology Evaluation: The contractor shall evaluate commercial and government tools for automating the assessment of each device and device type and recommend tools to be used to automate the assessment. This evaluation shall include tools for collecting, analyzing and reporting the data required to determine the security posture of the devices and device types listed in Table 1. The contractor shall define tool requirements and define, develop and modify tools and scripts, and support the 92 IOS in integrating approved tools. The contractor shall identify, document and demonstrate the proper usage of all tools developed and modified (including scripts and data base queries) under this effort and include them in the assessment package. (A016) | 3.1.4.1.2 |
3.1.4.2.3 3.1.4.3.2 3.2.4.1.2 3.2.4.2.3
| 3.2.4.3.2 | Describe your knowledge and approach to utilize common scripting and computer languages to improve assessment methodologies which meet specific requirements | 5.3.2 | The Government will evaluate the offeror’s capabilities to utilize common scripting and computer languages to improve assessment methodologies which meet specific requirements. | 4.2.b |
| Baseline Definition: The contractor shall support the 92 IOS in identifying AESS requirements, performing trade studies and designing the architecture and system hardware, software, interface and interconnection components required to ensure the AESS meets 92 IOS mission requirements. The contractor shall provide the necessary documentation, including network diagrams, requirements documents, design criteria and test documentation to support baseline management, configuration control, and engineering activities. (A013, A014, A015, A020) | 3.1.1.1 | |||
| 3.2.1.1 | Describe your approach in designing, building, maintaining and evolving complex computer networks and systems. | 5.3.3 | The Government will evaluate the offeror’s approach in designing, building, maintaining and evolving complex computer networks and systems. | 4.2.c |
| Installation, Documentation and Testing: The contractor shall support the 92 IOS installation, documentation and testing of the AESS components. The contractor’s support shall include but not be limited to (A013, A014, A015, A020): Maintaining network configuration diagrams of AESS network components; Maintaining configuration baselines for the approved AESS; Installing, configuring, testing LAN hardware and software components and cabling; Installing vender security patches and AFNOSC NSD advisories; Implementing security recommendations; Backing up and restoring application and operating system software; Establishing and maintaining firewalls, DNS, WINS, Exchange services, routers; Implementing and enforcing security measures; Integrating approved assessment tools to the assessment platform; Modifying the assessment platform; Documenting and tracking AESS configuration and assets; Testing AESS platforms, tools, network subsystems and interfaces | 3.1.1.3 | |||
| 3.2.1.3 | Describe your plan and process for documenting and implementing software and hardware maintenance actions, upgrades and patches. Include processes for configuration control of software, hardware, and software documentation. | 5.3.4 | The Government will evaluate the offeror’s plan and process for documenting and implementing software and hardware maintenance actions, upgrades and patches, including the offeror’s processes for configuration control of software, hardware, and software documentation. | 4.2.d |
| Information Protect Certification and Accreditation. The contractor shall provide engineering and technical support to the 92 IOS to ensure the AESS system and its components achieve initial and recurring accreditation. This shall include developing and verifying acquisition and accreditation packages (A019) |
Certification and Accreditation. The contractor shall provide engineering and technical support for the Certification and Accreditation (C&A) standards and processes to achieve uniform quality and a level of consistency throughout the life cycle of the AESS. The contractor shall provide the Government support with certification and accreditation surveys and document responses into the Enterprise Information Technology Data Repository (EITDR). The contractor shall ensure the EITDR questions are answered to meet or exceed the common minimum standards as required to support annual Federal Information System Management Act (FISMA) reporting requirements. (A019, A020) DIACAP Package and FISMA Reporting. The contractor shall support the 92 IOS to develop DoD Information Assurance Certification and Accreditation Process (DIACAP) certification packages for the AESS accreditation approval. The contractor’s packages shall include, but not be limited to the following (A015, A019, A020):
System Artifacts. The contractor shall develop, review and finalize documentation necessary to satisfy IA controls which may include but not be limited to the following documentation (A019, A020). 3.1.1.5 3.1.1.5.1 3.1.1.5.2 3.1.1.5.3 3.2.1.5 3.2.1.5.1 3.2.1.5.2
| 3.2.1.5.3 | Describe your approach to reviewing, developing, and implementing DIACAP/EITDR Packages and FISMA reporting for government procured networks and systems. | 5.3.5 | The Government will evaluate the offeror’s approach in reviewing, developing, and implementing DIACAP/ EITDR Packages and FISMA reporting for government procured networks and systems. | 4.2.e | |
| System Evolution and Integration: The contractor shall support the 92IOS in defining and executing a disciplined process for controlling and evolving the AESS baseline and enhancing the AESS components. The contractor shall support the 92 IOS in utilizing this process to procure and integrate Government approved tools, hardware and software into the AESS baseline. (A013, A014, A015, A020) | 3.1.1.2 | ||||
| 3.2.1.2 | Describe your approach and process for the improvement of GOTS products. Include problems, successes and lessons learned. | 5.3.6 | The Government will evaluate the offeror’s approach and process improvement of GOTS products. | 4.2.f | |
| System Evolution and Integration: The contractor shall support the 92IOS in defining and executing a disciplined process for controlling and evolving the AESS baseline and enhancing the AESS components. The contractor shall support the 92 IOS in utilizing this process to procure and integrate Government approved tools, hardware and software into the AESS baseline. (A013, A014, A015, A020) | 3.1.1.2 | ||||
| 3.2.1.2 | Describe your approaches and techniques utilized in performing verification and validation (V&V) of security assessment tools and techniques. | 5.3.7 | The Government will evaluate the offeror’s approaches and techniques utilized in performing verification and validation (V&V) of security assessment tools and techniques. | 4.2.g | |
| Package Development and Support: The contractor shall support the 92 IOS in developing, maintaining and evolving assessment packages for each technology area listed in Table 1. The contractor shall support the 92 IOS in defining a process, steps, methodology and procedures for assessing the security posture of each device. The contractor shall conduct reviews of DoD and AF compliance directives and Industry and Government “Best Practice” suggestions and develop a comprehensive assessment packages for each device and device type. The contractor shall identify variables, heuristics or characteristics within these devices that could be exploited. The contractor shall develop checklists defining such items as the parameters to check and determine the security posture of the devices. The contractor shall define the data to be collected from each device and determine the device security posture and identify proper parameter settings (A019). The contractor shall provide personnel who are technically competent and current on the leading technologies. The contractor shall maintain all SMEs qualified, in accordance with (IAW) 92 IOS defined training requirements, at all times. The contractor shall maintain at least one (1) SME in each of the technology areas listed in Table 1 at all times. The contractor shall provide and maintain personnel certified in accordance with DoD Directive 8570.1 entitled “Information Assurance Training, Certification, and Workforce Management”. Contractor personnel performing duties as assessors shall be certified at the Information Assurance Technician (IAT) III level. The contractor assessors shall possess a Linux/UNIX OS certification and a Windows OS certification. Contractor personnel performing Client Support Administrator duties shall be certified at the IAT I level. In accordance with DoD 8570.1M, newly assigned personnel shall have completed their certification requirements prior to being assigned to the contract. | 3.1.5.1 | ||||
| 3.2.5.1 | Describe your history and approach to assessing the cyber security posture of devices in the technology areas found in Table 1 of the SOW. | 5.3.8 | The Government will evaluate the offeror’s capabilities and approach in assessing the cyber security posture of devices in the technology areas found in Table 1 of the SOW. | 4.2.h | |
| Requirements. The contractor shall provide a qualified team with the expertise, theoretical and practical knowledge of system security engineering, security technology evaluation, compliance assessments, vulnerability assessments, network penetration testing, the National Industrial Security Program Operating Manual, (NISPOM), Director of Central Intelligence Directives (DCIDS), DoD Information Technology Security Certification and Accreditation Process (DITSCAP), National Information Assurance Certification and Accreditation Process, (NIACAP) and the DOD Information Assurance Certification and Accreditation Process (DIACAP) certification and accreditation activities and risk management. The contractor shall maintain a staff of Subject Matter Experts (SMEs), to perform all tasks as listed in this SOW. The contractor’s SMEs shall be well versed in the appropriate Defense Information Systems Agency (DISA) STIG (Security Technical Implementation Guide) and applicable DoD and Air Force security policies. The SMEs shall be proficient, at a minimum, in the Technology Areas listed in Table 1 below: | |||||
| 3.0 | Describe your capabilities and approach to developing and documenting repeatable processes to assess the security posture of devices in the Technology Areas listed in Table 1 of the SOW. | 5.3.9 | The Government will evaluate the offeror’s capabilities and approach in developing and documenting repeatable processes to assess the security posture of devices in the Technology Areas listed in Table 1 of the SOW. | 4.2.i | |
| Program Development and Evolution: The contractor shall support the 92 IOS in developing and evolving a formal training and STANEVAL program to train operators to execute AESS tools and components and to assess operator skills and quantify operator ability to execute and operate the AESS. The contractor shall develop a formal training and STANEVAL program to train personnel to execute the VA, DA, and IA missions and to assess operator skills and quantify operator abilities. The contractor shall identify skill sets and expertise levels needed to qualify for device assessment training, identify the training requirements and activities for assessing the devices and identify the infrastructure requirements needed to train personnel to execute the device assessments. The contractor shall generate the training material, including presentation material, proper usage of referenced tools, test material, student guides and instructor guides necessary to teach personnel how to execute the assessment packages (A008, A009, A010, A011). | 3.1.7 |
3.1.7.1
| 3.1.7.2 | Describe your approach and capabilities in training and evaluating personnel to assess the cyber security posture of devices listed in Table 1 of the SOW. | 5.3.10 | The Government will evaluate the offeror’s capabilities and approach in training and evaluating personnel to assess the cyber security posture of devices listed in Table 1 of the SOW. | 4.2.j | ||
| Vulnerability Assessments: The contractor shall support the 92 IOS in developing, evolving, fielding, and executing the remote and on-site VA concepts and methodologies. | 3.1.4.1 | Discuss relevant tools, techniques, and procedures used in executing vulnerability assessments, penetration testing, defense assessments and intrusion assessments. | 5.3.11 | The Government will evaluate the offeror’s relevant tools, techniques, and procedures used in executing vulnerability assessments, penetration testing, defense assessments, and intrusion assessments. | 4.2.k | |
| Tool and Technology Evaluation: The contractor shall evaluate commercial and government tools for automating the assessment of each device and device type and recommend tools to be used to automate the assessment. This evaluation shall include tools for collecting, analyzing and reporting the data required to determine the security posture of the devices and device types listed in Table 1. The contractor shall define tool requirements and define, develop and modify tools and scripts, and support the 92 IOS in integrating approved tools. The contractor shall identify, document and demonstrate the proper usage of all tools developed and modified (including scripts and data base queries) under this effort and include them in the assessment package. (A016) | 3.1.4.1.2 |
3.1.4.2.3 3.1.4.3.2 3.2.4.1.2 3.2.4.2.3
| 3.2.4.3.2 | Describe your approach to transferring corporate security assessment processes, procedures and tools to the Air Force for utilization by the 92 IOS. | 5.3.12 | The Government will evaluate the offeror’s capabilities and approach to transferring corporate security assessment processes, procedures and tools to the Air Force for utilization by the 92 IOS. | 4.2.l | ||
| Mission Capability Subfactor 2: Information Assurance and Security Assessment Execution | SOW Para | Mission Capability Subfactor 2: Information Assurance and Security Assessment Execution | Sect L Para | Mission Capability Subfactor 2: Information Assurance and Security Assessment Execution | Sect M Para | |
| Program Construction: The contractor shall support the full spectrum of assessment missions and types conducted by the 92 IOS as described but not limited to in Section 1.1 Background. The contractor shall research and develop the concepts, methodology, and technology in order for the 92 IOS to fulfill its mission to conduct Cyber Assessments. The contractor shall support planning, execution and reporting on any or all parts of each assessment and mission type. | ||||||
| 3.1.4 |
3.1.4.1 3.1.4.1.1 3.2.4 3.2.4.1
| 3.2.4.1.1 | Describe your concept and methodology for conducting and reporting a cyber security assessment. Discuss how you would accomplish this type of assessment on base-level networks and weapon system networks. | 5.4.1 | The Government will evaluate the offeror’s concept and methodology for conducting and reporting a cyber security assessment.. The Government will evaluate how the contractor would accomplish this type of assessment on base-level networks and weapon system networks | 4.3.a |
| Tool and Technology Evaluation: The contractor shall evaluate commercial and government tools for automating the assessment of each device and device type and recommend tools to be used to automate the assessment. This evaluation shall include tools for collecting, analyzing and reporting the data required to determine the security posture of the devices and device types listed in Table 1. The contractor shall define tool requirements and define, develop and modify tools and scripts, and support the 92 IOS in integrating approved tools. The contractor shall identify, document and demonstrate the proper usage of all tools developed and modified (including scripts and data base queries) under this effort and include them in the assessment package. (A016) | 3.1.4.1.2 |
3.1.4.2.3 3.1.4.3.2 3.2.4.1.2 3.2.4.2.3
| 3.2.4.3.2 | Describe the tools and techniques you use to perform vulnerability assessments, penetration testing, defense assessments, and intrusion assessments. | 5.4.2 | The Government will evaluate the offeror’s knowledge and capabilities of tools and techniques used to perform vulnerability assessments, penetration testing, defense assessments and intrusion assessments. | 4.3.b |
| Program Development and Evolution: The contractor shall conduct reviews of competing assessment programs, methodologies and objectives and provide recommendations on how to improve the DA concept. The contractor shall create and refine methodologies for conducting a DA to include tools, tactics, and procedures. The contractor shall integrate the concepts of the DA into the 92 IOS methodology and 92 IOS training via documentation, presentation, and demonstration. (A004, A016) |
Threat Characterization: The contractor shall support the 92 IOS in analyzing and characterizing cyber attacks. The contractor shall review open source and specialized intelligence products to identify various attack characteristics including the vulnerabilities exploited, the methods used to exploit the vulnerabilities, the attack vectors employed, and the impact of the attack upon operations. (A019) Scenario Development: The contractor shall support the development and maintenance of scenarios used to train and prepare the warfighter to defend DoD networks. The contractor shall support the 92 IOS in developing and maintaining formal cyber attack vectors to penetrate and stimulate the network defenders. The contractor shall construct these attack vectors from validated threat information and potential technological exploits. The contractor shall correlate identified threats to identified vulnerabilities (threat-vulnerability pairs) and provide explanation of the relationships, and provide an evaluation of the likelihood and impact of a resultant risk occurrence for each Defense Scenario. The contractor shall construct the software modules needed to execute the scenarios, test the scenarios on Government test ranges, provide instructions on how to implement the scenario and identify methods to mitigate the simulated attack. The contractor shall customize scenarios to achieve the necessary training objects of a DA as appropriate. (A014, A019) 3.1.4.2 3.1.4.2.1 3.1.4.2.2 3.2.4.2 3.2.4.2.1 3.2.4.2.2
| 3.1.5.3 3.2.5.3 | Describe your concept and methodology for developing, executing and documenting the results of a Defense Assessment. | 5.4.3 | The Government will evaluate the offeror’s concept, capabilities and methodology for developing, executing and documenting the results of a Defense Assessment. | 4.3.c |
| Program Construction: The contractor shall support the full spectrum of assessment missions and types conducted by the 92 IOS as described but not limited to in Section 1.1 Background. The contractor shall research and develop the concepts, methodology, and technology in order for the 92 IOS to fulfill its mission to conduct Cyber Assessments. The contractor shall support planning, execution and reporting on any or all parts of each assessment and mission type. | ||||
| 3.1.4 |
3.1.4.1 3.1.4.1.1 3.2.4 3.2.4.1
| 3.2.4.1.1 | Describe your capabilities, approaches and techniques utilized in completing peer reviews and other technical validation of assessment plans and reports. Describe your capabilities in executing and reporting field results as part of an assessment. | 5.4.4 | The Government will evaluate the offeror’s approach, capabilities and methodology for completing peer reviews and other technical validations of assessment plans and reports. | 4.3.d |
| Program Development and Evolution: |
The current 92 IOS IA process consists of Log Analysis (LA), Traffic Analysis (TA), Host Analysis (HA), and Binary Analysis (BA). They are defined as follows:
Log Analysis: research, analyze and correlate log data from various information technologies such as host-based, proxy, firewall, routing and switching devices, and domain name servers, to identify suspicious activities relating to a potential Advanced Persistent Threat (APT) on the network.
Traffic Analysis: Analyze network traffic, at the packet level; capture and evaluate traffic patterns, traffic content; identify potential exfiltration, beaconing, and anomalous communications, in order to identify present or past existence of an APT.
Host Analysis: Determine if a host contains an APT or other suspicious activity; deploy a collection agent to each host and analyze the returned host data; analyze host event logs, configuration files, and policy implementation; identify anomalous communications between networked devices, suspicious files, or processes such as spyware, malware or any other unauthorized software.
Binary Analysis: Reverse engineer and analyze binary, executable, and other related files of interest, to include selected application data files, to identify the potential existence of an APT, spyware, adware, malware, or unauthorized software.
The contractor shall support the 92 IOS in developing, evolving, and fielding the IA concept and methodology to ensure 92 IOS capabilities and methodologies are integrated with the DoD guidance and policy. The contractor shall conduct reviews of competing assessment programs, methodologies, processes and objectives and provide recommendations on how to improve the IA concept, process and reporting. The contractor shall develop, document, and maintain methodologies that address the full spectrum of an assessment: planning, execution, and reporting. The contractor shall provide methodologies and shall include tested and proven tools (both hardware and software based), tactics, and procedures. The contractor shall update methodologies and integrate new methodologies that address the 92 IOS mission. (A003, A016) 3.1.4.3 3.1.4.3.1 3.1.4.3.2 3.2.4.3 3.2.4.3.1 3.2.4.3.2
| 3.2.4.2.3 | Describe your concept and methodology for developing, executing and documenting the results of an Intrusion Assessment. | 5.4.5 | The Government will evaluate the offeror’s concept, capabilities and methodology for developing, executing and documenting the results of an Intrusion Assessment. | 4.3.e | ||
| Mission Capability Subfactor 3: Management Support | SOW Para | Mission Capability Subfactor 3: Management Support | Sect L Para | Mission Capability Subfactor 3: Management Support | Sect M Para | |
| Assessment Mission Support: The contractor shall provide technical support to complement the existing capabilities of the 92 IOS in conducting VA’s, DA’s and IA’s of operational, support, exercise and Defense Industrial Base (DIB) networks. The assessment methodology shall be applied to operational network enclaves, the AF GIG, base information technology infrastructure, exercise networks and networks supporting mission and weapon systems and programs of records. The contractor shall provide trained technical personnel to support the following approximate number of missions annually; The contractor shall support development of the assessment plan, document all activities and results obtained during the assessment and support generation of the final report. The level and scope of the contractor’s participation in planning, execution and reporting shall be as directed by the Government for each assessment mission. All planning and reporting shall be in accordance with Government approved reporting templates. The contractor shall forecast, track and report the contractor costs and labor hours required to execute each individual assessment. (A001) | 3.1.5 | |||||
| 3.2.5 | Describe the corporate resources, processes and infrastructure available to support training, tool verification and remote assessments. | 5.5.1 | The Government will evaluate the offeror’s corporate resources, processes and infrastructure available to support training, tool verification and remote assessment. | 4.4.a | ||
| Installation, Documentation and Testing: The contractor shall support the 92 IOS installation, documentation and testing of the AESS components. The contractor’s support shall include but not be limited to (A013, A014, A015, A020): Maintaining network configuration diagrams of AESS network components; Maintaining configuration baselines for the approved AESS; Installing, configuring, testing LAN hardware and software components and cabling; Installing vender security patches and AFNOSC NSD advisories; Implementing security recommendations; Backing up and restoring application and operating system software; Establishing and maintaining firewalls, DNS, WINS, Exchange services, routers; Implementing and enforcing security measures; Integrating approved assessment tools to the assessment platform; Modifying the assessment platform; Documenting and tracking AESS configuration and assets; Testing AESS platforms, tools, network subsystems and interfaces | 3.1.1.3 | |||||
| 3.2.1.3 | Provide a process description and overview of your quality control methods for software release; technical evaluation report; and software and hardware configuration control. | 5.5.2 | The Government will evaluate the quality control methods for software release, technical evaluation report and software and hardware configuration control. | 4.4.b | ||
| Requirements. The contractor shall provide a qualified team with the expertise, theoretical and practical knowledge of system security engineering, security technology evaluation, compliance assessments, vulnerability assessments, network penetration testing, the National Industrial Security Program Operating Manual, (NISPOM), Director of Central Intelligence Directives (DCIDS), DoD Information Technology Security Certification and Accreditation Process (DITSCAP), National Information Assurance Certification and Accreditation Process, (NIACAP) and the DOD Information Assurance Certification and Accreditation Process (DIACAP) certification and accreditation activities and risk management. The contractor shall maintain a staff of Subject Matter Experts (SMEs), to perform all tasks as listed in this SOW. The contractor’s SMEs shall be well versed in the appropriate Defense Information Systems Agency (DISA) STIG (Security Technical Implementation Guide) and applicable DoD and Air Force security policies. The SMEs shall be proficient, at a minimum, in the Technology Areas listed in Table 1 below: | ||||||
| 3.0 | Provide a Staffing Plan that addresses your acquisition and retention methods for skilled personnel, including retention during times of limited taskings. Include in this plan the extent and nature of personnel that will be provided by teaming partners, or subcontractors, if any. Describe the arrangements that will ensure that these personnel are continuously available for the taskings that are assigned. | 5.5.3 | The Government will evaluate the offeror’s Staffing Plan for acquiring and keeping skilled personnel, including retention during times of limited taskings. The Government will also evaluate the extent and nature of personnel that will be provided by teaming partners, or subcontractors, if any. The Government will evaluate the arrangements that will ensure that these personnel are continuously available for the taskings that are assigned. | 4.4.c | ||
| Requirements. The contractor shall provide a qualified team with the expertise, theoretical and practical knowledge of system security engineering, security technology evaluation, compliance assessments, vulnerability assessments, network penetration testing, the National Industrial Security Program Operating Manual, (NISPOM), Director of Central Intelligence Directives (DCIDS), DoD Information Technology Security Certification and Accreditation Process (DITSCAP), National Information Assurance Certification and Accreditation Process, (NIACAP) and the DOD Information Assurance Certification and Accreditation Process (DIACAP) certification and accreditation activities and risk management. The contractor shall maintain a staff of Subject Matter Experts (SMEs), to perform all tasks as listed in this SOW. The contractor’s SMEs shall be well versed in the appropriate Defense Information Systems Agency (DISA) STIG (Security Technical Implementation Guide) and applicable DoD and Air Force security policies. The SMEs shall be proficient, at a minimum, in the Technology Areas listed in Table 1 below: | ||||||
| 3.0 | Provide a Training Plan for skilled personnel. Describe your process for introducing new personnel to the project, to include training plans and ramp-up time lines. | 5.5.4 | The Government will evaluate the offeror’s Training Plan and methodology for integrating new personnel into the unit. The Government wil also evaluate training plans and ramp up time lines. | 4.4.d | ||
| Transition Planning. The contractor shall develop a plan to ensure seamless operations at the beginning and the end of the period of performance. This plan shall include the process to be used by the contractor for assuring the following at the beginning of the contract: (1) The approach for supporting existing taskings, projects, and assessments; (2) Estimated amount of spin-up time for. existing taskings, projects, and assessments; (3) Approach to meeting requirements for immediate support for unplanned missions, and surge capabilities. |
This plan shall include the process to be used by the contractor for assuring the following at the end of the Period of Performance: (1) all Government Furnished Equipment (GFE) is returned; and (2) the method of packaging and delivering all CDRLs. The contractor shall detail their method for transitioning operations to a new contractor.(A002)
3.1.9 Provide a transition plan to ensure seamless operations at the beginning and the end of the period of performance. This plan shall include the process to be used for assuring the following at the beginning of the contract: (1) The approach for supporting existing taskings, projects, and assessments; (2) Estimated amount of spin-up time for existing taskings, projects, and assessments; (3) Approach to meeting requirements for immediate support for unplanned missions, and surge capabilities.
This plan shall include the process to be used for assuring the following at the end of the Period of Performance: (1) all Government Furnished Equipment (GFE) is returned; (2) the method of packaging and delivering all CDRLs; and (3) the method for transitioning operations to a new contractor.
| 5.5.5 | The Government will evaluate the offeror’s Transition Plan, including the beginning and the end of the period of performance. This plan shall include the process to be used for assuring the following at the beginning of the contract: (1) The approach for supporting existing taskings, projects, and assessments; (2) Estimated amount of spin-up time for. existing taskings, projects, and assessments; (3) Approach to meeting requirements for immediate support for unplanned missions, and surge capabilities. | |||||
| This plan shall include the process to be used for assuring the following at the end of the Period of Performance: (1) all Government Furnished Equipment (GFE) is returned; (2) the method of packaging and delivering all CDRLs; and (3) the method for transitioning operations to a new contractor. | 4.4.e | |||||
| Security and Security Training: Personnel shall have a final U.S. Government issued TOP SECRET security clearance and be DCID 6/4 eligible with a current SSBI. Contractor shall follow the security requirements outlined in the contract DD Form 254, Department of Defense Security Classification Specification. The contractor will be required to participate in the government's in-house and Web-based security training program under the terms of the contract. The government will provide the contractor with access to the on-line system. | 5.4 | Demonstrate your ability to provide personnel that can satisfy the Contract Security Specifications established in DD Form 254 at time of contract award. | 5.5.6 | The Government will evaluate the offeror’s ability to provide personnel that can satisfy the Contract Security Specifications established in DD Form 254 at time of contract award | 4.4.f | |
| Project Planning: The contractor shall establish, maintain and utilize the program management and financial operations necessary to plan, execute and report all costs and hours associated with each individual assessment and infrastructure support project. The Technical and Work Management Plan (TWMP) shall be the contractor’s plan on how it shall execute its approach to business management of the task. (A002) |
Financial Reporting: The contractor shall provide the program management support necessary to manage and schedule the contractor’s resources needed to execute and report on the progress of each task identified in this SOW. (A001) Program Reviews and Meeting Support: The contractor shall conduct a Kick-off meeting 10 calendar days after award and hold weekly status reviews and monthly Technical Interchange Meetings (TIMs), formal program reviews and meetings. The contractor shall present the status of the program and support meetings when requested by the Government. The contractor’s weekly status reviews shall describe: the progress, resource allocation, personnel assignment and event schedule of all tasks including (a) the personnel allocated to specific tasks/assessments; (b) the status of assigned tasks; (c) training and personnel certification status; and (d) SME status. (A008, A012) 3.1.6 3.1.6.1 3.1.6.2
| 3.1.6.3 | Describe your management approach for directing, controlling, and accounting for expenditures on a project/tasking basis. These include: (1) Ensuring that reliable cost estimates are provided (through use of an adequate cost estimating system) for tasks, (2) The use of cost reduction initiatives and efficient application of resources to the work, and (3) Submitting accurate invoices that correctly identify the work performed and billed. (4) Managing personnel resources across multiple projects (5) Tracking project progress from initial tasking through completion. (6) Reporting the planned and actual manpower, travel and financial resources allocated to each specific task. | 5.5.7 | The Government will evaluate the offeror’s management approach for directing, controlling, and accounting for expenditures on a project/tasking basis, including the offeror’s plan to (1) Ensure that reliable cost estimates are provided (through use of an adequate cost estimating system) for tasks, (2) Use of cost reduction initiatives and efficient application of resources to the work, and (3) Submit accurate invoices that correctly identify the work performed and billed. (4) Manage personnel resources across multiple projects (5) Track project progress from initial tasking through completion. (6) Report the planned and actual manpower, travel and financial resources allocated to each specific task. | 4.4.g | ||
| 3.0 Requirements The contractor shall provide a qualified team with the expertise in theoretical and practical knowledge of system security engineering; security technology evaluation; compliance assessments; vulnerability assessments; network penetration testing; defense assessments; intrusion assessments; and developmental and operational testing. The contractor shall maintain a staff of Subject Matter Experts (SMEs) to perform all tasks as listed in this SOW. The contractor’s SMEs shall be well versed in the appropriate Defense Information Systems Agency (DISA) STIG (Security Technical Implementation Guide) and all the documents listed in Appendix 1 – List of Applicable Publications. The SMEs shall be proficient, at a minimum, in the Technology Areas listed in Table 1 of the SOW. The contractor shall provide personnel who are technically competent and current on the leading technologies. The contractor shall maintain at least one (1) SME in each of the technology areas listed in Table 1 at all times. The contractor shall provide and maintain personnel certified in accordance with 92 IOS required certifications under DoD Directive 8570.1 entitled “Information Assurance Training, Certification, and Workforce Management”. At least 10% of the contractor assessors shall possess a Cisco Certified Network Associate (CCNA) certification. At least 10% of the contractor assessors shall possess a Database Certification. At least 25% of the contractor assessors shall possess a Penetration Testing Certification at the beginning of the contract. Contractor personnel performing Client Support Administrator duties shall be certified at the IAT I level. In accordance with DoD 8570.1M, newly assigned personnel shall have completed their certification requirements prior to being assigned to the contract. | 3.0 | Provide a Staffing Plan that addresses your acquisition and retention methods for skilled personnel certified in accordance with 92 IOS required certifications under DoD Directive 8570.1 entitled “Information Assurance Training, Certification, and Workforce Management”. Include in this plan the certification information which shows that the contractor assessors meet the following requirements: (1) At least 10% of the contractor assessors shall possess a Cisco Certified Network Associate (CCNA) certification, (2) At least 10% of the contractor assessors shall possess a Database Certification; (3) At least 25% of the contractor assessors shall possess a Pentration Testing Certification at the beginning of the contract. | 5.5.8 | The Government will Evaluate the offeror's Staffing Plan that addresses the offeror's acquisition and retention methods for skilled personnel certified in accordance with 92 IOS required certifications under DoD Directive 8570.1 entitled “Information Assurance Training, Certification, and Workforce Management”. . The Government will evaluate the certification information which shows that the offeror meets the following requirements: (1) At least 10% shall possess a Cisco Certified Network Associate (CCNA) certification, (2) At least 10% of the contractor assessors shall possess a Database Certification; (3) At least 25% of the contractor assessors shall possess a Penetration Testing Certification at the initial start of the contract. | 4.4.h |
| &F | &A |
| Page &P | &D |
sheet1
Sheet2
Sheet3
File details come from the government source that posted it. Updated .