Atch_2__AF_IC_Risk_Mgt_Task_0001_PWS.pdf

PERFORMANCE WORK STATEMENT (PWS) FOR

AIR FORCE (AF) INTELLIGENCE COMMUNITY (IC) ENTERPRISE

CYBERSECURITY RISK MANAGEMENT FRAMEWORK (RMF)

Task Order 0001

17 Sep 2015

1.0 DESCRIPTION OF SERVICES.

1.1 Introduction.

1.1.1 The cybersecurity and information technology (IT) security services described in this

Performance Work Statement (PWS) support the Air Force (AF) Intelligence Community (IC)

Chief Information Environment Officer (CIEO), Chief Information Security Officer (CISO) and the Authorizing Official (AO) efforts to manage risk and protect Intelligence, Surveillance, and

Reconnaissance (ISR) missions and resources. External customers are across all major commands

(MAJCOMS) throughout the Air Force.

1.1.2 This is a non-personal services contract. The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. The contractor shall manage its employees and guard against any actions that are of the nature of personal services or give the perception of personal services. The contractor shall notify the Contracting Officer (CO) immediately if they perceive any actions that constitute personal services. These services shall not be used to perform any Inherently Governmental

Functions.

1.2 Background.

1.2.1 The increase in responsibilities, our customer base, and Quick Reaction Capability (QRC) operational needs have resulted in our need to obtain contract services support. On 9 Jun 2015, the AF/A2, Cognizant Security Authority, appointed chief of the Twenty Fifth Air Force National

Intelligence Coordination Center Advanced Capabilities Communications Division (25

AF/NICC/XRC) as the AF IC CISO. In coordination with the HAF/A2 CIEO, the AF IC CISO shall ensure compliance with AF and IC information technology (IT) systems security risk management, assessments, authorization guidelines, and Federal Information Security

Management Act (FISMA) compliance and reporting. The AF IC CISO became independent of other intelligence organizations and now serves as the voting member at intelligence forums and councils for the AF IC Element.

1.2.2 The AF IC CIEO, AF IC CISO and AF IC AO scope of authority applies to Sensitive

Compartmented Information (SCI), Guest SCI, Collateral (Top Secret and below), and

Intelligence, Surveillance and Reconnaissance (ISR) (regardless of classification) data, systems and resources. These authorities are responsible to the AF/A2, the AF Chief Information Officer

(CIO), and the Office of the Director of National Intelligence (ODNI) to manage risk for the AF

IC Enterprise. They are required to implement, manage and report the status of various Risk

Management Program responsibilities such as Risk Management Framework (RMF), Computer

Network Defense (CND), Audit Collection and Sharing.

1.2.3 The AF IC AO is responsible for managing risk and determines the authorization decisions to provide or not provide an Authorization to Operate (ATO). AO authorization decisions consider security standards, the defense against threats, the confidentiality, integrity and availability category levels for information assets, and the ability to achieve vital, national-security missions. The AF CISO is also responsible for ensuring AF IC cybersecurity training of military, civilian and contractors in the positions supporting the ICD 502 and ICD 503 implementation is met.

1.2.4 The AF IC CIEO, AF IC CISO and AF IC AO responsibilities require the implementation of Intelligence Community Directive (ICD) 502, “Integrated Defense of the Intelligence

Community Information Environment,” and ICD 503, “Information Technology Systems Security

Risk Management Certification and Accreditation,”

1.2.5 ICD 501, “Discovery and Dissemination or Retrieval of Information within the

Intelligence Community,” and Intelligence Community Standard (ICS) 500-27, “Collection and

Sharing of Audit Data,” and progress is monitored by the ODNI and HAF/A2. The RMF and AF

IC integrated defense processes must be integrated throughout the lifecycle of SCI, ISR, and

Department of Defense Intelligence Information System networks, systems, databases and applications. The AO works closely with the AF Office of Special Investigation (AFOSI) to implement and maintain the AF IC Computer Network Defense (CND) Program; the AF

Distributed Common Ground System (DCGS) Program Management Office (PMO); the AF

Joint Worldwide Intelligence Communications System (JWICS) PMO; and other ISR PMOs.

1.3 Scope.

The tasks described in this PWS support the AF IC CIEO, CISO and AO in sustaining, integrating, protecting, and advancing AF IC communications capabilities; Cybersecurity management; protections; defenses; IT security planning and programming; policies;

engineering; compliance; and assessments by providing timely, reliable support to the current and future AF IC missions. IT security services support AF IC networks, systems, applications, databases, classified as SCI and ISR (regardless of classification) and s and the Air National

Guard systems. Services shall be performed at Lackland AFB TX. Tasks shall include management of the AF IC Federal Information Security Management Act (FISMA) records and reporting, a Congressionally-levied program.

1.4 Period of Performance.

The Period of Performance (POP) for this Task Order Number 0001 (TO 0001) shall be for a six

(6) month period.

2.0 SPECIFIC TASKS.

The contractor shall provide the following cybersecurity tasks in support of the AF IC CIEO, CISO, AO and REM requirement to manage risk and protect the confidentiality, integrity, availability of our AF IC missions and resources.

2.1. Program Management for Implementing AF IC Enterprise Cybersecurity Solutions.

The contractor shall serve as a program manager to implement AF IC Enterprise-wide cybersecurity solutions for the AF IC CISO, AF IC AO, AF IC REM. The contractor shall adhere to AF and IC standards and those processes as further defined by the Government Subject Matter

Expert (SME). The contractor shall conduct timely and in-depth research for policies and processes. The contractor shall provide recommendations to the Government SME by defined deadlines. Recommendations shall include test plans and procedures to ensure results support the required objectives and capabilities. The contractor shall apply IT security control requirements to address the level of security required to protect the confidentiality, integrity and availability of the system data and resources. Solutions shall be compatible with system or network hardware and software configurations and shall be approved by the configuration managers of the system and network. The contractor shall assess the “as is” and provide a “to be” for various projects. The contractor shall interact with various ISR program offices to plan and implement cybersecurity solutions throughout the enterprise. The contractor shall utilize effective communication skills to interact and push implementations to Government SME. The contractor shall use the RMF methodology to successfully implement an information technology process which shall effectively protect the element's information assets and its ability to perform its mission. The contractor shall participate in meetings and program reviews to support the implementation of ISR initiatives, goals and objectives. The contractor shall provide the AF IC CISO with the operational and economic costs of protective measures so they may be weighed against requirements for mission accomplishment. The contractor shall make edits to existing Government documents, prepare briefings to update the Government on the status of actions and coordinate with all project members to meet the goals and objectives of assigned task. The contractor shall test alternatives and provide test results to the Government for decision-making. The contractor shall review

Government documents and provide their comments in required formats. The contractor shall provide on-the-job training to military, civilians and contractors concerning the new procedures for their specific project. This is not formal training, but informal office training. Provide weekly status updates through the contractor lead for quality control and consolidation into one (1) weekly activity report to be provided to the COR. The contractor shall create, maintain and dispose of only those Government required records and supporting documentation that are specifically cited in this

Performance Work Statement (PWS) or required by the provisions of a mandatory directive. If required to implement a cybersecurity initiative, the PM shall complete the Assessments and

Authorizations (A&A) documents required to obtain an ATO. The contractor shall complete

POA&Ms for the project to address security vulnerabilities. The contractor shall complete trip reports for each trip taken and complete meeting minutes. (A001. A002, A003, A004, A005, A006, A007, A008, A009, A011, A013)

2.2. IT Security Control Assessments.

2.2.1 The contractor shall serve as a security control assessor (SCA). A SCA shall meet the minimum qualification requirements as identified by AF and IC security control assessment polices (in accordance with PWS attachment Appendix B). The SCA shall complete required reports for a risk decision from the AO or CISO. The contractor shall adhere to USAF and IC laws, standards, policies and procedures. The contractor shall conduct comprehensive IT security control assessments on systems identified within the scope of this contract. Assessments shall require physical travel to various contractor and Government sites inside and outside the continental United States (CONUS and OCONUS). Assessments shall determine the condition of the management, operational, and technical security controls employed within or inherited by an information system to determine the overall effectiveness of the controls (i.e., the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system). The contractor shall provide an assessment on the severity of weaknesses or deficiencies discovered in the information system and its environment of operation and recommend corrective actions to address identified vulnerabilities. The contractor shall create, maintain and dispose of only those Government required records and supporting documentation that are specifically cited in this Performance

Work Statement (PWS) or required by the provisions of a mandatory directive ( A013).

2.2.2 The contractor shall review the System Security Plan (SSP), prior to initiating the security control assessment and ensure the plan provides a set of security controls for the information system that meet the stated security requirements. Assessments shall include the review and validation of the message types authorized and the parsing of the data utilizing rule sets implemented within the Cross Domain Solutions (CDS) application to validate authorized processing of data and elimination of the possible spillage of classified information.

2.2.3 The contractor shall:

2.2.3.1 Advise the Information System Owner (ISO) concerning the impact values for confidentiality, integrity, and availability for the information on a system;

2.2.3.2 Evaluate threats and vulnerabilities to information systems to ascertain the need for additional safeguards;

2.2.3.3 Review and approve the information system security assessment plan, which is comprised of the SSP, the Security Controls Traceability Matrix (SCTM), and the

Security Control Assessment Procedures;

2.2.3.4 Ensure security control assessments are completed for each information system and ensure controls are working as intended and these controls protect the confidentiality, integrity and availability of IT resources at the appropriate levels;

2.2.3.5 Prepare the final Security Assessment Report (SAR) containing the results and findings from the assessment at the conclusion of each security control assessment activity;

(A013)

2.2.3.6 For each completed trip provide a trip report; (A011)

2.2.3.7 Ensure a Plan of Action and Milestones (POA&M) is initiated by the ISSO for the information system based on findings and recommendations from the SAR; (A007)

2.2.3.8 Evaluate security control assessment documentation and provide written recommendations for security authorization to the AO; (A013)

2.2.3.9 Assemble and submit the security authorization artifacts to the AO (consisting of, at a minimum, the SSP, the SAR, the POA&M, and a Risk Assessment Report (RAR); (A007, A011, A013)

2.2.3.10 Assess the proposed changes to information systems, their environment of operation, and mission needs to determine if they are security-relevant and could therefore affect system authorization;

2.2.3.11 Use AF IC Security controls defined by the AO and CISO;

2.2.3.12 Utilize the RMF methodology to successfully implement an information technology process which shall effectively protect the element's information assets and its ability to perform its mission;

2.2.3.13 Submit weekly status updates through the contractor leads for consolidation into one (1) weekly activity report to be provided to the COR; (A003)

2.2.3.14 Provide guidance to other assessors on the policies and procedures of the job;

2.2.3.15 Provide detailed assessment findings using Government-specified processes and procedures;

2.2.3.16 Provide solutions and recommendations to remedy security vulnerabilities, threats, to ultimately improve the protection of IT resources and to execute the AF ISR mission; (A006, A013)

2.2.3.17 Utilize assessment results to identify trends and to improve IA training, policies and processes.

2.3. Cybersecurity Engineering. The contractor shall serve as the security engineer and provide the Government SME with recommendations and solutions for implementing AF IC cybersecurity programs and projects. The contractor shall adhere to AF and IC standards and those processes as further defined by the Government SME. The contractor shall provide program reviews, schedules, action item updates and required procedures by established deadlines. The contractor shall conduct timely and in-depth research for policies and processes. The contractor shall apply IT security control requirements to address the level of security required to protect the confidentiality, integrity and availability of system data and resources. Solutions shall be compatible with system or network hardware and software configurations and shall be approved by the configuration managers of the system and network. Recommendations shall include test plans and procedures to ensure results support the required objectives and capabilities. The contractor shall assess the “as is” and provide a “to be” for various projects. The contractor shall use the RMF methodology to successfully implement an information technology process which shall effectively protect the element's information assets and its ability to perform its mission. The contractor shall perform

Security, Test and Evaluation (ST&E) for each system prior to the assessment phase for each system. The contractor shall perform scans of systems and architectures using AF IC -approved scanning tools during the ST&E event. The contractor shall construct and provide ST&E reports that contain the scans, Security Technical Implementation Guide (STIG) application with issues and recommendations for delivery prior to the assessment event. The contractor shall perform software security analysis and review to include software source, commercial-off-the-shelf (COTS) compatibility, original equipment manufacturer (OEM) source, source code availability and impact to system integration and operations. The contractor shall execute all applicable Supply Chain

Risk Management (SCRM) policy and procedure and create reports for all new additions of system hardware and software to determine the source from the OEM through the end supplier to ensure

SCRM is followed per policy and guidelines. The contractor shall complete reports, plans and procedures. The contractor shall participate in meetings and program reviews and support the implementation of ISR initiatives, goals and objectives. The contractor shall provide the AF IC

CISO with the technical costs of protective measures so they may be weighed against requirements for mission accomplishment. The contractor shall make edits to existing Government documents, prepare briefings as required to update the Government on the status of actions and coordinate with all project members to meet the goals and objectives of the assigned task. If required to implement a cybersecurity initiative, the PM shall complete the A&A documents required to obtain an ATO.

The contractor shall complete POA&Ms for the project to address security vulnerabilities. The contractor shall complete trip reports for each trip taken and provide weekly status updates through the contractor leads for consolidation into one (1) weekly activity report to be provided to the COR.

The contractor shall complete and provide meeting minutes to the COR. The contractor shall create, maintain and dispose of only those Government required records and supporting documentation that are specifically cited in this Performance Work Statement (PWS) or required by the provisions of a mandatory directive . (A001, A002, A003, A004, A005, A006, A007, A008, A009, A011, A013)

2.4. Plans, Policies, and Procedures. The contractor shall develop and provide well defined plans, policies, agreements and procedure recommendations on how to effectively maintain IT security control requirements and successfully meet AF and IC cybersecurity mandates. The contractor shall professionally interact with managers and site personnel and present oral and written process solutions. The contractor shall review, edit, comment, analyze documents and recommend corrections and changes. The contractor shall use the RMF methodology to successfully implement an information technology process which shall effectively protect the element's information assets and its ability to perform its mission. The contractor shall ensure risk management is integrated into the technical, physical and administrative controls throughout the network, system, database, and application lifecycle. Submit weekly status updates through the contractor leads for consolidation into one (1) weekly activity report to be provided to the COR.

The contractor shall develop and conduct technical or procedural training for military, civilian and contractor cybersecurity professionals on IA topics primarily using curriculum provided by the

Government. This is not formal training, but informal office training. The contractor shall develop and provide on-the-job training to Government, contractor and military personnel on various IT security tools, policies and procedures required to protect resources and meet standards only when tasked by the COR. The contractor shall complete trip reports for each trip taken and meeting minutes for Policy Team led meetings. The contractor shall make edits to existing Government documents, prepare briefings to update the Government on the status of actions and coordinate with all project members to meet the goals and objectives of the assigned task. The contractor shall create, maintain and dispose of only those Government required records and supporting documentation that are specifically cited in this Performance Work Statement (PWS) or required by the provisions of a mandatory directive. (A001, A003, A006, A008, A009, A011)

2.5. Content Management and Development. The contractor shall expertly manage the AF IC cybersecurity collaborative environments for successful day-to-day business operations on networks at the UNCLASSIFIED, SECRET and TOP SECRET security levels. The contractor shall maintain SharePoint and websites so customers can access the cybersecurity information required of the AF IC CISO, AO and their SMEs. The contractor shall implement high quality, scalable, and extendable SharePoint solutions using the .NET Framework, ASP.net, SharePoint

(currently using version 2013) and other advanced components of Microsoft technology. The contractor shall publish Access databases to SharePoint and develop custom forms using InfoPath.

Expert knowledge of HTML and JavaScript are required to create custom web parts. The contractor shall utilize Microsoft SharePoint Designer to customize sites and create custom workflows. The contractor shall have a solid grasp of the permissions hierarchy of the SharePoint application. The contractor shall transform customer requirements into viable SharePoint-involved solutions. The contractor shall address possible solutions and timeframes for completion with the customer for each tasking. Once the solution is implemented, access to the site, library, or object shall be controlled through permissions provided by the particular

Government SME. The contractor shall test all content management solutions followed by the end user before being deployed to production. The contractor shall field all SharePoint-related questions concerning the sites they manage including requests for site access. The contractor shall use the RMF methodology to successfully implement an information technology process which shall effectively protect the element's information assets and its ability to perform its mission. The contractor shall ensure risk management is integrated into the technical, physical and administrative controls throughout the network, system, database, and application lifecycle. The contractor shall develop and provide detailed weekly status reports to address the status of tasks accomplished for the previous week’s activities. Submit weekly status updates through the contractor leads for consolidation into one (1) weekly activity report to be provided to the COR.

The contractor shall develop and provide on-the-job training to Government, contractor and military personnel on content management and procedures and processes only when tasked by the

COR. This is not formal training, but informal office training. The contractor shall review and edit documents and recommend corrections and changes. The contractor shall create, maintain and dispose of only those Government required records and supporting documentation that are specifically cited in this Performance Work Statement (PWS) or required by the provisions of a mandatory directive. The contractor shall make edits to existing Government documents, prepare briefings to update the Government on the status of actions and coordinate with all project members to meet the goals and objectives of the assigned task. (A003, A008, A009, A013)

2.6. AF IC Security Coordination Center Support Services. The contractor shall manage twenty-four (24) hour command and control (C2) services to the AF IC CISO and the REM and appointed Government SMEs for situational awareness, analysis and reporting on the integrated defense risk for SCI and ISR resources to ODNI, AF/A2 and AF/A6. Services shall include the research, development and release of AF IC Task Orders (TASKORDS) and notifications to the AF

IC. The contractor shall comply with coordination processes and approvals, formats and reporting requirements as defined by the Government. The contractor shall create, maintain and dispose of only those Government required records and supporting documentation that are specifically cited in this Performance Work Statement (PWS) or required by the provisions of a mandatory directive.

The contractor shall complete trip reports for each trip taken and complete meeting minutes. The contractor shall complete reports, plans and. The contractor shall submit weekly status updates through the contractor leads for consolidation into one (1) weekly activity report to be provided to the COR. When tasked by the COR, the contractor shall develop and provide on-the-job training to

Government, contractor and military personnel on various IT security tools, policies and procedures required to protect resources and meet standards. This is not formal training, but informal office training. The contractor shall make edits to existing Government documents, prepare briefings to update the Government on the status of actions and coordinate with all project members to meet the goals and objectives of the assigned task. Provide situational reports to the AF

IC CISO to ODNI and A2. (A001, A002, A003, A008, A009, A010, A011, A013)

2.7. RESERVED.

2.8. Cybersecurity Training. The contractor shall conduct technical and managerial level training on information assurance, security tools and A&A workflow tools topics primarily using curriculum provided by the Government. The contractor shall developadditional technical and managerial IA training plans, guides, materials and curriculum to enable compliance with USAF, DoD, IC and other national agency standards. This training shall keep AF IC IT security professionals familiar with the various IT security tools, policies and procedures required to protect resources and meet standards. Training critiques shall be used to assess the instructor performance and update training materials. The contractor shall submit weekly status updates through the contractor leads for consolidation into one (1) weekly activity report to be provided to the COR. The contractor shall complete trip reports for each trip taken. The contractor shall complete meeting minutes. The contractor shall make edits to existing Government documents, prepare briefings to update the Government on the status of actions and coordinate with all project members to meet the goals and objectives of the assigned task. The contractor shall review and edit documents and recommend corrections and changes. The contractor shall create, maintain and dispose of only those Government required records and supporting documentation that are specifically cited in this Performance Work Statement (PWS) or required by the provisions of a mandatory directive. (A001, A003, A008, A009, A011, A012)

2.9. Document Management. The contractor shall provide services for document management supporting the AF IC CISO and staff to gather information from SMEs in the completion of various documents and tasks. The contractor shall prepare, edit, and maintain policy documentation; maintain schedules; accountability of various tasks; develop and process records management; maintain the AF file plan; review and edit staff created documents prior to internal and external dissemination; facilitate and participate in AF IC-level cybersecurity policy discussions and working groups; research, develop, update, and distribute branch related communications; coordinate the publication and distribution of new and revised policies; maintain accurate records and historical changes of policies and procedures. The contractor shall complete meeting minutes. Performs as alternate Computer

Support Liaison (formerly Information Assurance Officer) and submit request to provision/de-provision personnel and organizational network accounts and primary focal point for computer assistance. The contractor shall create, maintain and dispose of only those

Government required records and supporting documentation that are specifically cited in this

Performance Work Statement (PWS) or required by the provisions of a mandatory directive.

The contractor shall prepare briefings to update the Government on the status of actions and coordinate with all project members to meet the goals and objectives of the assigned task. The contractor shall submit weekly status updates through the contractor leads for consolidation into one (1) weekly activity report to be provided to the COR. (A001, A003, A008, A009)

2.10. Assessment and Authorization Support Analysis. The contractor shall provide analytical and documentation support to the AF IC CISO SMEs in AF IC Risk Management.

Duties shall include day-to-day support to the Delegated Authorizing Officials (DAOs) and the Security Control Assessments (SCAs) and shall include drafting and tracking Security

Impact Analyses (SIAs) used in support of Continuous Monitoring; coordinating Discovery

Meetings and ensuring updated Discovery Meeting checklists are uploaded into the A&A

Workflow tool; drafting Interim Approvals to Test (IATTs) and Authorities to Operate

(ATOs); uploading the IATTs and ATOs into the workflow tool once finalized; provide workflow tool support to site personnel; monitoring and reporting FISMA compliance and ensure ATO dates in the workflow tool match the dates in the official ATO MFRs; analyze

RMF workflow tasks prior to Assessment to ensure all processes are filled out as required.

Initiatives to support the SCAs include the review vulnerability scans and corresponding non-mitigation worksheet (this supports Continuous Monitoring requirements); and the review of software, hardware, and PPS (ports, protocols, and services) against Approved Products List, Certificates to Field, and DISA Category Assurance Levels (CAL). The contractor shall complete meeting minutes as defined by the COR. The contractor shall create, maintain and dispose of only those Government required records and supporting documentation that are specifically cited in this Performance Work Statement (PWS) or required by the provisions of a mandatory directive. The contractor shall make edits to existing Government documents, prepare briefings to update the Government on the status of actions and coordinate with all project members to meet the goals and objectives of the assigned task. The contractor shall complete trip reports for each trip taken and complete meeting minutes. The contractor shall submit weekly status updates through the contractor leads for consolidation into one (1) weekly activity report to be provided to the COR. (A001, A002, A003, A008, A009, A011)

2.11. Information Assurance Program Management Support Services.

The contractor shall perform IA support services to assist AF IC IA Program Managers and

Information System Security Officers/Managers (ISSO/ISSMs) at Joint Base Langley, VA and

Joint Base San Antonio, TX. The Contractor shall assist in maintaining an effective cybersecurity program that supports missions and adequately protects the confidentiality, integrity and availability of our AF IC information resources. The contractor shall gather data, analyze compliance and report results on the condition and progress of AF IC IA programs, security plans, plan of action and milestones (POA&M) and A&A workflow tools data, patch management, information assurance vulnerability alerts (IAVA), DoD 8570.01M certifications and FISMA compliance requirements, and ATOs. The contractor shall make edits to existing Government documents, prepare briefings to update the Government on the status of actions and coordinate with all project members to meet the goals and objectives of the assigned task. The contractor shall complete meeting minutes. The contractor shall interact with Unit ISSOs/ISSMs and commanders to provide IA guidance, complete IA assessment reports and provide solutions to commanders on how to improve their IA programs. The contractor shall submit weekly status updates through the contractor lead for quality control and consolidation into one (1) weekly activity report to be provided to the COR. The contractor shall develop and provide on-the-job training to Government, contractor and military personnel on various IT security tools, policies and procedures required to protect resources and meet standards. This is not formal training, but informal office training.

Complete trip reports for each trip taken. The contractor shall support the Cybersecurity trainers with updated information and materials for their area of responsibility for compliance with USAF, DoD, IC and other national agency standards. The contractor shall complete reports, plans and procedures as defined by the COR. (A001, A003, A006, A008, A009, A011)

3.0. DELIVERABLES.

Contract deliverables required in this PWS shall be submitted IAW the Contract

Data Requirements List (CDRL) in Exhibit 1 of this task order.

CDRL

DID

Number

DID Description PWS

Para Due Date

A001 DI-ADMN-

81505

Report, Record of

Meeting/Minutes

2.1, 2.3-

2.4, 2.6, 2.8-

2.11

6.4

Meeting minutes shall be provided NLT three

(3) working days after meeting end date.

A002 DI-

ADMIN-

80239

Information System Accreditation

Document

2.1, 2.3, 2.6, 2.10, 6.4

Draft shall be provided within thirty (30) workdays from assignment.

Government has ten

(10) workdays to provide comments;

criteria for approval shall be correct content and format. Final shall be provided within 15 workdays after receipt of Government comments.

A003 DI-

MGMT-

80368A

Status Report (Weekly Report) 2.1- 2.6, 2.8- 2.11 6.4

Shall be provided on last work day of each week to the COR.

A004 DI-NDTI-

80566A

Test Plan 2.1, 2.3, 6.4

Provide draft within ten

(10) workdays from assignment. Government has ten (10) workdays to provide comments;

criteria for approval shall be correct content and format. Provide final within ten (10) workdays from receipt of

Government comments.

A005

DI-MISC-

80508B

Technical Report-Study/Service

(Test Report)

2.1, 2.3, 6.4

Provide within ten (10) workdays of test completion.

A006 DI-MISC-

80508B

Technical Report-Study/Service

(Analysis of Alternatives;

Technical Solutions/Reports;

Research Results; Plans, Policies, and Procedures)

2.1 - 2.4, 2.11, 6.4

Provide draft within ten

(10) workdays of assignment.

Government has ten (10) workdays to provide comments; criteria for approval shall be correct content and format.

Provide final within five

(5) workdays from receipt of Government comments.

A007

DI-MISC-

80508B

Technical Report-Study/Service

(Plan of Action and Milestones)

2.1 -

2.3, 6.4

Provide document as required by the

Government Lead for each project.

A008 DI-ADMN-

81605

Briefing Material 2.1, 2.3-

2.6, 2.8

-2.11, 6.4

Provide draft as determined by the

Government Lead for each project.

Government has ten (10) workdays to provide comments; criteria for approval shall be correct content and format.

Provide final within five

(5) workdays from receipt of Government comments.

A009 DI-ADMN-

80925

Revisions to Existing

Government Documents

2.1, 2.3-

2.6,

2.8 -

2.11, 6.4

Provide draft within ten

(10) workdays of assignment.

Government has ten (10) workdays to provide comments; criteria for approval shall be correct content and format.

Provide final within five

(5) workdays from receipt of Government comments.

A010 DI-MISC-

80508B

Technical Report-Study/Service

(Security Control Center Reports;

Incident Reports, Auditing

Reports)

2.6, 6.4

Provide incident reports and auditing documents within two (2) hours of receipt. AF IC SCC report due dates will be identified by the Risk

Executive Manager, as the ops tempo cannot be predicted.

A011

DI- MISC-

81943

Report, Record of Meeting/

Minutes (Trip Report)

2.1-2.4, 2.6, 2.8, 2.10-

2.11, 6.4, 6.7

Provide report within five

(5) workdays after completion of travel.

A012

DI-ILSS-

81523B

Training Conduct Support

Documents (Lesson Plan, Trainee Guide)

2.8, 6.4 Provide draft within 15 workdays of assignment.

Government has ten

(10) workdays to provide comments;

criteria for approval shall be correct content, in compliance with ISR policy, and format.

Final shall be completed within 15 workdays from receipt of Government comments. The training schedule shall be coordinated with the

COR.

A013

DI-MISC-

80508B

Technical Report-

Study/Service (Assessment

Reports, IT Security

Solutions)

2.1-

2.3, 2.5-

2.6, 6.4

Provide reports within two

(2) duty days of completing IT security assessment. All vulnerability results shall be documented and report shall contain recommended security solutions. Reports shall be stored in the IT

Security Repository.

4.0 SERVICES SUMMARY

The Services Summary (SS) provides information on contract requirements and the expected level of contractor performance to be successful. These thresholds are critical to mission success. Procedures as set forth in the applicable Inspection clause in the contract will be used to remedy all deficiencies. The Government retains the right to inspect any item included in the contract.

Performance Objective PWS

Para Ref

Performance Threshold

The contractor shall provide research and status reports at technical reviews, program reviews, briefings, and conferences.

2.1, 2.6, 2.4, 2.7, 2.8, 2.11

Reports shall be timely and not be late more than twice in the year. Reports shall demonstrate comprehensive research and shall be technically accurate and relevant.

The contractor shall research, test, verify and provide technically accurate security recommendations

2.1, 2.2, 2.3, 2.4, 2.11

Each solution shall demonstrate comprehensive research. Each solution shall be compatible with hardware and software configurations. Each solution shall accurately describe testing process and results. Only one (1) revision is acceptable per solution.

The contractor shall develop and provide detailed weekly activity reports.

2.1-2.11 Each report shall be timely and not be late more than twice a year. Each report shall contain current status of transition.

Only minor errors are acceptable. One revision is allowed every three months.

The contractor shall report and document security assessments results and provide viable recommendations to remedy vulnerabilities.

2,2, 2.11 Assessment results shall address items identified in the Risk Management Framework

AF and IC policies using NIST 800-53, CNSSI 1253, and IC overlays as specified by the Government. Assessment reports shall contain the actual condition of controls found during the assessment.

The contractor shall provide viable technically accurate security recommendations.

2.1, 2.2, 2.3, 2.11

Recommendations shall be compatible with hardware and software configurations.

Recommendations shall maintain the level of security required to adequately protect the confidentiality, integrity, and availability of the information using the

AF and IC risk management framework methodology.

The contractor shall develop training curriculum and provide IT security training.

2.8, 2.11 Training objectives shall be kept current and contain correct data. No more than two errors for every three (3) months.

Curriculum shall contain approved

Government SME data. Submit training materials to the SMEs at least every 6 months for updates. Training shall be conducted IAW approved AF IC DAO and

AF IC CISO training curriculum.

The contractor shall support the appointed Government SME to implement projects; establish and maintain schedules; develop plans and policies and procedures;

maintain IT security documents, files and schedules; brief management on the status of actions;

and coordinate with all other members to meet the goals and objectives of the project.

2.1, 2.3, 2.11

Contractor shall provide draft documents by the deadline established by the

Government SME. There shall not be more than two (2) errors in the final document.

No more than 2 missed deadlines are allowed every year. Policy development shall be written for government review and coordination within five (5) business days of assignment; re-write shall be provided within two (2) business days.

5.0 GOVERNMENT FURNISHED PROPERTY AND SERVICES

5.1 Services.

The Government may provide facility workspace to include desk space, telephones, computers, and other items necessary to maintain an office environment. All materials shall remain the property of the Government and shall be returned to the COR upon request or at the end of period of performance.

5.2 Facilities.

When coordinated with the COR, the contractor may work at the contractor site and use contractor desk space, telephones, computers and other items as required using on-base labor rates. The contractor shall safeguard Government information as required by Enclosure 3 of

Department of Defense Instruction (DODI) 8582.01,” Security of Unclassified DoD Information on Non-DoD Information Systems.”

5.3 HOURS OF WORK

Contractor shall conform to customer agency operating hours. Normal hours of work shall be designated as core hours by the Government between the hours of 7 am to 5 pm (0700-1700), with the exception of 24/7 operations. Hours of work shall be 8 hours per day, 40 hours per week, with the exception of 24/7 operations (Task 2.6). Contractor shall work a 24/7 shift and shall and work with the Contracting Officer's Representative (COR) on schedule changes. Contractor shall respond to emergencies and recalls (excluding practice telephone recalls). Contractor shall respond within 15 minutes of being notified by the Government and if necessary respond to duty location within 45 minutes. In the event of inclement weather, heightened security concerns, or other unique events, contractor personnel shall adhere to direction of the area

Installation Commander. Deviations from the Government-designated core hours shall be coordinated by the Government COR.

5.4 RECOGNIZED HOLIDAYS.

The contractor is not required to provide service on the following days:

New Year's Day

Labor Day

Dr. Martin Luther King's Birthday

Columbus Day

Presidents' Day

Veterans Day

Memorial Day

Thanksgiving Day

Independence Day

Christmas Day

5.4.1.1 If the holiday falls on Saturday, it is observed on Friday. If the holiday falls on a Sunday, it is observed on Monday.

5.4.1.2 The contractor shall not report for duty (except for Mission-Essential Contractor Services, PWS Tasks 2.6) and will not be reimbursed by the Government when the Government facility is closed due to a Federal holiday, local or national emergencies, administrative closings, or similar Government directed facility closings.

6.0 GENERAL INFORMATION

6.1. Contractor Identification in the Government Workplace.

When conversing with Government personnel during business meetings, over the telephone or via electronic mail, the contractor shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. The contractor shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation.

6.2. Industrial Security.

The contractor shall have and maintain a final US Government issued Top Secret/Sensitive

Compartmented Information SCI (TS/SCI) security clearance. The contractor shall follow the security requirements outlined in the contract DD Form 254, Department of Defense Security

Classification Specifications.” The contractor shall be subject to random drug testing.

Documents shall be maintained and protected as required by the classification of the information. The contractor shall safeguard Government information as required by Enclosure 3 of DODI 8582.01, “Security of Unclassified DoD Information on Non-DoD Information

Systems.”

6.3. Physical Security.

The contractor shall safeguard all Government property provided for contractor use. At the close of each work period, Government facilities, property, and materials shall be secured.

6.4. Records

The contractor shall create, maintain and dispose of only those Government required records and supporting documentation that are specifically cited in this Performance Work Statement (PWS) or required by the provisions of a mandatory directive, Applicable Publications and Instructions.

The contractor shall provide the original record or a reproducible copy of any such record within the due dates using the CDRLs as defined by the type of document being submitted to the

Government. (A001, A002, A003, A004, A005, A006, A007, A008, A009, A010, A011, A012, A013)

6.5. Special Training, Certifications and Qualifications.

APPENDIX B provides a list of skill sets the contractor shall provide (however, may not be all inclusive) to meet the Government’s needs in providing these services. DoD 8570.01M

“Information Assurance Training, Certification and Workforce Management,” identifies categories and specialties within the IA workforce. Categories used in the attachment are IA

Technical (IAT) and IA Management (IAM). Specialties are Computer Network Defense Service

Providers (CND-SPs) and IA System Architects and Engineers (IASAEs). These categories and specialties are subdivided into levels and each is based on functional skill requirements and system environment focus requirements for contracted positions.

6.6 Continuation for Mission Essential Services – PWS Task 2.6 is considered mission essential. See DFARS clause 252.237-7024 Notice of Continuation of Essential Contractor

Services in IDIQ contract.

6.7 Contractor Travel.

The contractor shall travel during this contract and shall comply with the provisions of the Joint

Travel Regulations (JTR). When Government and contractor travel coincide (same dates, same destinations, same travel objective), Government will obtain rental car and miscellaneous supplies (fuel, oil, tools parking). Wherever possible, the contractor shall attempt to have identical travel and lodging arrangements as Government travelers. Travel authorization requests shall be approved by the COR before any trip can be taken. The contractor shall submit a

Letter of Identification (LOI) to the COR for coordination and approval no later than ten work days prior to any contractor travel. The contractor shall submit a trip report upon completion of each trip. A detailed trip report shall be developed and delivered no later than five (5) working days upon return. The contractor shall travel to Government, vendor, manufacturer sites within and outside the Continental United States ( OCONUS and CONUS) to successfully perform duties. Assessors shall anticipate travel between 65-85% of the time.

Short notice travel may arise due to unforeseen mission needs. Costs for travel shall be billed on a strictly cost reimbursable basis IAW, the regulatory implementation of Public Law 99-234, FAR subpart 31.205-46 entitled Travel Costs and the limitation of funds specified in this contract. (A011)

7.0. APPLICABLE INSTRUCTIONAL INFORMATION

The contractor shall comply with all publications, regulations and operating instructions provided by the Government. The contractor shall acquire and work on the latest version of the publication.

7.1 Committee on National Security Systems Publication (CNSSP) 1253, “Security

Categorization and Control Selection for National Security Systems.”

7.2. ICD 501, “Discovery and Dissemination or Retrieval of Information within the Intelligence

Community.”

7.3. ICD 502, “Integrated Defense of the Intelligence Community Information Environment.”

7.4. ICD 503, “Information Technology Systems Security Risk Management, Certification and

Accreditation.”

7.5. ICD 705, “Sensitive Compartmented Information Facilities”

7.6. IC Standard (ICS) 500-27, “Collection and Sharing of Audit Data.”

7.7. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, “Recommended Security Controls for Federal Information Systems and Organizations.”

7.8. NIST 800-37, “Risk Management Framework.”

7.9. NIST SP 800-53A, “Guide for Assessing the Security Controls in Federal Information

Systems and Organizations, Building Effective Security Assessment Plans.”

7.10. Federal Information Security Management Act of 2002, Title III – Information Security, P.L. 107-347.

7.11. DODI 8582.01,” Security of Unclassified DoD Information on Non-DoD Information

Systems.”

7.12. DoD 8570.01M, “Information Assurance Training, Certification and Workforce

Management.”

8.0. CONTRACTOR MANPOWER REPORTING

In accordance with Section 8108 of the National Defense Appropriations Act of Fiscal Year

2011 the contractor shall report, annually, the number of contractor employees performing services on Department of Defense installations in support of this contract. The contractor shall also report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via a secure data collection site. The contractor shall completely fill in all required data fields in the eCRMA (electronic

Contractor Manpower Reporting Application) located at http://www.ecmra.mil.

http://www.ecmra.mil/

Reporting inputs shall be for the labor executed during the period of performance for each

Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October* of each calendar year. Contractors may direct questions to the CMRA help desk.

*Reporting Period: Contractors are required to input data by 31 October of each year.

Uses and Safeguarding of Information: Information from the secure web site is considered to be proprietary in nature when the contract number and contractor identity are associated with the direct labor hours and direct labor dollars. At no time will any data be released to the public with the contractor name and contract number associated with the data.

9.0. PRIVACY ACT

Work on this contract requires the contractor to have access to Privacy Information. The contractor shall adhere to the Privacy Act, Title 5 of the US Code, Section 552a and applicable Agency rules and regulations.

10.0. APPENDICES

APPENDIX A – ACRONYMS AND ABBREVIATIONS LIST

APPENDIX B – CERTIFICATION MATRIX

APPENDIX C – GOVERNMENT WORKLOAD ESTIMATE

APPENDIX A - ACRONYMS AND ABBREVIATIONS LIST

Acronym/Abbreviation Definition

AF Air Force

AFB Air Force Base

AO Authorizing Official

ATO Authorization to Operate

CAL Category Assurance Levels

CDRL Contract Data Requirements List

CDS Cross Domain Solutions

CND-SPs Computer Network Defense Service Providers

CNSSI Committee on National Security Systems Instruction

CO Contracting Officer

CONUS Continental United States

COR Contracting Officer’s Representative

DCGS Distributed Common Ground System

DOD Department of Defense

FAR Federal Acquisition Regulation

HQ 25 AF Headquarters, Twenty-Fifth Air Force

IA Information Assurance

IAM Information Assurance Management

IASAEs Information Assurance Architects and Engineers

IAT Information Assurance Technical

IATT Interim Authorization to Test

IAW In accordance with

IC Intelligence Community

IC…