M E_PWS_02May14.pdf

PERFORMANCE-BASED WORK STATEMENT (PWS)

FOR

AF DCO MAINTENANCE AND ENABLER MISSION CONTRACT

rd

Network Warfare Squadron (NWS)

Lackland Air Force Base

San Antonio, Texas 78236

2 May 2014

Table of Contents

AF DCO MAINTENANCE AND ENABLER MISSION CONTRACT

1 INTRODUCTION

2 BASIC REQUIREMENTS

4 SERVICES SUMMARY AND DELIVERABLES

5. GOVERNMENT FURNISHED PROPERTY AND SERVICES

6 SPECIAL REQUIREMENTS

7 APPENDICES

1 INTRODUCTION

1.1 Objective

This contract will provide essential capabilities to provide support to the 33 NWS in conducting its mission of Defensive Cyber Operations (DCO) for the Air Force (AF) and supported unified commands and their combatant commanders. The DCO mission consists of multi-faceted roles, responsibilities, and tasks within the overarching functional areas of cyber defense, network security, network operations, information protection and mission assurance. This contract supports the 33 NWS’s 24 hours a day/seven days a week/365 days a year (24/7/365) mission to maintain current operations. Additionally, the 33 NWS expects the contractor to leverage every opportunity to identify/suggest improvements to existing AF DCO processes, operating procedures, training, systems and applications over the traditional and current operations across all functional areas. This includes support for existing systems (including training and new installations), development of new system functionality, and full system integration.

1.2 Background

1.2.1 The 33 NWS is the AF’s primary operational unit providing DCO for the AF’s cyber domain. The 33 NWS’s DCO mission activities span to functional areas of cyber defense, operations and security, protection, and mission assurance support for AF operations and missions conducted on AF computers, networks, and network enclaves, to include those of supported unified commands. DCO, cyber defense, and Computer Network Defense (CND) can be used interchangeably, although the current preferred usage is DCO.

1.2.2 The 33 NWS conducts its DCO mission in support of the 24th AF Network Operations

Commander (AF NETOps/CC), 67th Cyberspace Wing (67 CW), under the Air Force Space

Command (AFSPC). The 33 NWS also conducts responsibilities for DCO reporting to the 624th

Operations Center (OC), which supports centralized strategic AF enterprise situation awareness and command and control (C2).

1.2.3 The 33 NWS’s DCO mission is categorized in functional areas that require monitoring host computer and network activity to detect, identify, contain and respond to anomalous, suspicious and/or malicious events on the AF’s and supported unified commands’ systems and networks

[classified and unclassified internet protocol, Internet Protocol (IP)].

1.2.4 The 33 NWS is responsible for the execution of several DCO tasks to include network forensics based on identified cyber incidents/investigations, countermeasures engineering and development, computer system and blue force network vulnerability assessments, e.g. AF’s

Assured Compliance Assessment Solution (ACAS), Gateway and Information Operations

Platform (IOP) Intrusion Detection System/Intrusion Prevention System (IDS/IPS) sensor operations maintenance, mission enclave systems operations and maintenance, database management, applications, network, and system administration. These tasks and other supporting functions provide the capabilities necessary for detection, identification, isolation, containment, resolution and prevention of unlawful acts which may deny unauthorized users access to or corrupt information resident on Automated Information Systems (AIS) or network traffic traversing AF networks. Therefore, successful implementation of DCO tasks, and successful contract support provided under this PWS, will reduce risks to the Department of

Defense (DoD) warfighter and preserve the military capabilities of the AF during peacetime, crisis, and war.

1.3 Scope

The contractor shall be required to plan, implement, maintain, and document the 33 NWS-managed networks, and IDS/IPS. In addition, contractor support is required to develop, maintain, train, certify, and implement DCO tools and procedures. AF DCO tools, systems and applications are comprised of government-off-the-shelf (GOTS) and commercial off-the-shelf

(COTS) hardware and software. IDS/IPS systems include the following: Base Enclave Control

System (ECN), or Automated Security Instrument Measurement (ASIM) replacement IDS/IPS

(ex: McAfee IPS), ArcSight Logger, CyberTap, Noesis, Cisco Secure IDS, Flow Packet Capture

(PCAP) and IOP. Taskings include the following: Training, Standards and Evaluation, Operational Processes and Tasks (OP&T), Air Force Cyber Defense (ACD) Sensor Technical

Services, ACD Network Systems Administration, ACD Forensic Network System

Administration, ACD Junior Virtualization/UNIX Engineering, ACD Infrastructure Technical

Services, ACD Data Base Administration, ACD Virtualization Engineering, ACD Infrastructure

Engineering, ACD Sensor Engineering, Configuration Managing, and Systems Planning.

2 BASIC REQUIREMENTS

2.1 Business Relations

The contractor shall work with the Government Contracting Officer Representative’s (COR’s) or

Government shift lead to accomplish Government requirements, goals, and mission objectives as efficiently and effectively as possible. This shall include sharing or coordinating information resulting from the work required within this PWS or previous Government efforts and working as a team to perform tasks in concert. The contractor shall ensure minimum duplication of effort in the execution of all work specified within this PWS and build upon work previously accomplished by the Government, the contractor, or other contractors to the fullest extent practical.

2.2 Non-Personal Services

The Government shall neither supervise contractor nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor’s responsibility to notify the Contracting Officer (CO) immediately.

2.3 Contract Administration and Management

2.3.1 Work Personnel Staff. The contractor shall ensure the numbers of personnel, job category and expertise of the personnel assigned are sufficient to cover the work specified within this PWS. Contractor shall notify the COR of any personnel re-assignments and complete 33

NWS internal move processes. The contractor shall maintain proficiency in each functional area listed within this PWS at its own expense (e.g., for DoD Directive (DoDD) 8570.01-M certification and Information Assurance (IA) training found in Appendix D).

2.3.1.1 The contractor shall fully cooperate with the Government and other contractors assigned to the same functional areas, raising the level of proficiency and effectiveness as it engages the adversarial threat from around the world.

2.3.1.2 Task Lead. The contractor shall assign one of the full-time, DoDD 8570.01-M certified employees as task lead and at least one additional full-time, DoDD 8570.01-M certified employee as alternate task lead. This individual shall have full contractor authority to act in all contract matters and be responsible and accountable to the CO in representing the contractor for meeting the performance requirements of this PWS. The task lead shall be available during normal duty hours, Monday through Friday, except Federal Holidays, to meet with COR or Government shift lead to discuss program and/or technical issues. The task lead shall attend scheduled staff meetings, as requested by the COR.

2.3.1.3 In accordance with (IAW) DoDD 8570.01-M, Information Assurance Workforce

Improvement Program, all contractors assigned to perform IA, Computing Environment

(CE)/Infrastructure Support (IS), and Computer Network Defense Service Provider (CNDSP) functions shall have a current Information Assurance Technical (IAT) or Information

Assurance Managing (IAM) Level certification, and the applicable CNDSP and CE/IS specialty certification. The certificates must be provided to COR during squadron in-processing. Throughout the course of this contract, internal movement of personnel will require updated certifications prior to move. The minimum certification/training requirements shall be maintained as an electronic record through a maintained shared network drive location. Contractor personnel must provide proof of release of certification to the DoD via

Defense Workforce Certification Application (DWCA). The associated CNDSP specialty requirements are:

2.3.1.3.1 The contractor shall ensure all Mission Assurance (MA) personnel comply with procedures and standards outlined in Air Force Instruction (AFI) 33-150, Management of

Communications Activities, and Technical Order (TO) 00-33A-1001, General

Communications Activities Management Procedures and Practice Requirements.

2.3.1.3.2 The contractor shall complete 67 CW and 33 NWS required training. This shall include Operations Security (OPSEC), Force Protection, Human Relations, Security and

Information Protection training. The contractor shall also abide by AFSPC General

Memorandum (GM) 10-01 (to be replaced by AFI 10-1703 Volume 1, Cyber crew Training) when performing a Mission Ready (MR) function.

2.3.1.3.3 The contractor shall utilize approved 33 NWS mission support systems such as the

33 NWS web sites, the AF Portal, Remedy, the Computer Security Assistance Program

(CSAP) Computer Database System (CDS), ArcSight, Joint Computer Emergency Response

Team (CERT) Database, Cyber Pilot, CENTAUR, Non-secure Internet Protocol Router

Network (NIPRNET), Secure Internet Protocol Router Network (SIPRNET), and Joint

Worldwide Intelligence Communications System (JWICS) Intelink to distribute DCO information to AF units.

2.3.1.3.4 The contractor shall support the enhancement of 33 NWS tactics, techniques, and procedures (TTPs), processes, systems and applications by utilizing existing processes, and whereby suggesting possible improvements. This shall include software change requests, other automated processes, and attending operations and mission support meetings to discuss, document, and prioritize mission requirements.

2.3.1.4 AFI 11-202V3 stipulates that all personnel working on a MR position "weapon system" will have at least 12 hours of crew rest between shifts. Contractor shall ensure they provide sufficient contractor personnel to allow for 12 hour rest.

2.3.2 Contract Management

2.3.2.1 The contractor shall conduct formal Technical Interchange Meetings (TIM). The contractor shall conduct formal Program Management Reviews (PMR). The contractor or

Government may schedule additional informal meetings to review deliverables, address any issues, and review contract status. Contractor shall provide meeting minutes for both TIM and PMR. (Contract Data Requirements List (CDRL) A001)

2.3.2.2 The contractor shall provide documentation for obtaining and maintaining network certification and accreditation of network operations. The contractor shall evaluate network infrastructure to ensure compliance with security guidelines and mandates, and report any findings to the COR. (CDRL A002 and CDRL A005)

2.3.2.3 The contractor shall be required to perform emergency shut-down, start-up and recovery operations during times of network instability at any time. Additionally, the contractor shall be required to perform new systems integration, mission impacting maintenance, exercise support and inspection preparation. The contractor shall follow squadron established emergency and recall procedures to minimize network impact.

2.3.2.4 Contractor shall provide an Employee Work Schedule consisting of all personnel at least 14 calendar days in advance and notify the COR to support de-confliction of operational schedules. This document shall list employees’ names and functions they support, be updated on a continual basis as changes occur and located on a shared network drive. Any unforeseen calendar changes shall be coordinated with the COR within hours of notification of change.

This information is vital and ensures the 24/7/365 mission is covered during times of emergency and provides the 33 NWS Crew Commander a list of contract personnel who is available to contact in emergency situations. The contractor shall identify all acronyms, codes, abbreviations, signs and symbols used in each record. Contractor format is acceptable, but contractor shall use the same format for initial and all subsequent submissions of the same record unless otherwise approved by the COR (A004).

2.3.2.5 The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Air Force

DCO M&E Mission contract effort via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address http://www.ecmra.mil. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through

September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the Enterprise-wide Contractor Manpower Reporting Application (ECMRA) help desk.

2.4 Contractor Employees

2.4.1 The contractor shall not employ any person for work on this contract if such employment is identified to the contractor by the CO as a potential threat to the health, safety, security, general wellbeing, or maintenance mission of the installation and its population.

2.4.2 All contractor employees shall be able to read, write, speak and understand the English language to the extent necessary in the performance of the work.

2.4.3 The contractor shall not employ any person who is an employee of the US Government if employing that person would create a conflict of interest. Additionally, the contractor shall not employ any person who is an employee of the Department of the AF, unless such has been approved IAW DOD 5500.7-R, Joint Ethics Regulation.

2.4.4 Contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence.

2.4.5 The office environment at the 33 NWS is predominately business casual. Daily attire is considered to be business casual or contractor company logo apparel and slacks, depending on position and duties.

2.5 Contractor Common Access Cards (CAC)

The contractor personnel shall be identified with a CAC marked by a vertical green stripe. The

CAC shall be worn by employees in such a standardized manner as to be clearly visible except when in use (i.e. inserted in a computer CAC reader). The contractor personnel shall be identified by their 24 th

AF and Air Force Intelligence Surveillance Reconnaissance Agency

(AFISRA) Form 325 (Green Badge) with name, “CONTRACTOR,” and contract expiration date clearly visible and worn above the belt and below the shoulders when present within the TOP

SECRET/SECRET Sensitive Compartmented Information Facility (SCIF) as proof of proper clearance to remain unescorted within the SCIF. When exiting, the contractor personnel shall conceal their credentials from plain view. To access any Government base and certain facilities, the contractor personnel shall present and wear (if required) their contractor CAC identified by a vertical green stripe, in a similar matter as the Form 325 where clearly visible.

http://www.ecmra.mil/

2.6 Work Locations

The contractor shall support the 33 NWS’ 24/7/365 mission at the following locations. The Task

Lead will be notified of change in work location one hour in advance. All contractor personnel are expected to relocate within the one hour timeframe. One hour timeframe includes time taken by the Task Lead to reach affected personnel.

2.6.1 AF DCO M&E Operations. 33 NWS’ Air Force DCO M&E Mission contract operates in

Buildings 16000, 2000, 2169, and 2012 at the Lackland Air Force Base (AFB), San Antonio, Texas.

2.6.2 Alternate Operations Location. 33 NWS’ Alternate Operating Location (AOL) and

Building 178/179, at Kelly USA, also known as Port San Antonio or other designated AOL locations within the San Antonio metropolitan area when directed by the COR or Government shift lead.

2.6.3 Remote Continuity of Operations. 33 NWS’ Continuity of Operations (COOP) site shall be utilized in the event an interruption of service exceeds 72 hours. The Task Lead will identify contractor personnel deploying to the COOP location and provide names to the 33 rd

NWS COR

or Government shift lead.

2.7 Travel Requirements

Travel shall be required under this contract to support 33 NWS mission activities. The contractor shall be required to travel within the Continental United States (CONUS) and other than Continental United States (OCONUS) to base location(s) or AF site(s) affected by a computer incident, installation and maintenance of ACD-related equipment, planning conferences, and exercises. All travel requirements (including plans, agenda, itinerary, dates) shall be pre-approved by the CO, and are on a cost reimbursable basis. Cost for travel shall be billed IAW the Joint Travel Regulation and Federal Acquisition Regulation (FAR) 31.205-46

Travel Costs. Government contractors presenting themselves for travel shall have letters of identification and shall require passports for OCONUS travel. Government Contract City Pair fares are not available to contractors. The contractor shall submit a trip report to the COR within five business days after return. The trip report shall detail the work completed, lessons learned, and applicable recommendations. Report shall include a copy of the traveler’s submitted travel voucher. (CDRL A003).

2.8 System and Service Outages and Trouble Calls/Tickets

2.8.1 Contractor Availability. The COR or Government shift lead shall be able to contact contractor task lead or alternate task lead 100% of the time. The contractor shall respond in case of emergencies, outages, alerts, and exercises, 24 hours per day, seven days per week. If contacted, the contractor shall report for duty and provide services until the emergency, alert, or exercise is completed. Additionally, contractor personnel shall be available outside regular work hours in support of installation, implementation, and Authorized Service Interruption (ASI) efforts.

2.8.2 Scheduled Outages. Contractor shall identify, coordinate, and schedule service outages with the COR. The contractor shall schedule such outages to minimize inconvenience to users based upon Government user work schedules. This may require working outside of normal duty hours. The user must release all affected equipment and circuits prior to any service disruption.

The contractor shall follow established local procedures for scheduling and implementing scheduled outages. Notification shall include the reason for the interruption, start and stop times, duration, and the equipment, lines, and buildings affected. The contractor shall log the outage

IAW 33 NWS standards (see 33 NWS Mission Assurance Operating Instruction (MA OI) 33-

150).

2.8.3 Restoration/Completion of Outages, Trouble Calls/Tickets. The COR or Government shift lead will assign the category of the outage/trouble and establish the restoral/repair priority if an outage occurs. The contractor shall respond on site and initiate restoral/repair actions within the specified time listed below from the time the COR or Government shift lead advises the contractor of the problem. However, exceptions to time limits may be allowed with the written approval of the COR containing appropriate justification. The contractor shall restore services in the priority order determined by the COR or Government shift lead. The restoral priority detailed in the MA OI shall apply in the absence of the COR or Government shift lead. The contractor shall continue to work on repair actions until service is restored based on priority.

The contractor shall work closely with the COR or Government shift lead on all service/system outages and trouble calls/tickets and shall notify the COR or Government shift lead in writing upon restoration of service, providing the time service was restored and a description of repair action. The contractor shall coordinate with the appropriate base Network Control Center

(NCC) to restore any routing outages. The contractor shall log the outage IAW 33 NWS standards (see 33 NWS MA OI 33-150). Outage/trouble call categories are further defined as:

2.8.3.1 Critical. Contractor shall respond on-site within 60 minutes and restore service within four hours unless otherwise approved by the MA Director through written approval of the

COR.

2.8.3.2 Priority. Contractor shall respond on-site within three hours and restore service as soon as possible, but shall not exceed 48 hours.

2.8.3.3 Routine. Contractor shall respond on-site within 24 hours and restore service as soon as practical but not to exceed 10 calendar days.

2.8.4 Outage/Trouble Cause Identification. The contractor shall determine if a recorded problem or system failure is attributable to the 33 NWS or other causes. The contractor shall immediately notify the COR or Government shift lead if the malfunction is determined to be due to other causes (outside the contractor-maintained system/equipment).

2.9 System Maintenance Management. The contractor shall conduct the standard system maintenance and use procedures and standards outlined in AFI 33-150, Management of

Communications Activities, and TO 00-33A-1001, General Communications Activities

Management Procedures and Practice Requirements.

2.9.1 The contractor shall use AF-approved Maintenance Information Systems (MIS) to document maintenance/logistic activities. An AF-approved centrally managed level MIS is the tool used to track outages and other crucial data to help manage the equipment/system cradle to grave. Specifically, the contractor shall use the Integrated Maintenance Data System (IMDS) and Remedy.

2.9.2 The contractor shall implement Maintenance Data Collection (MDC) to enter systems and component failure(s) IAW TO 00-20-2, and Time Compliance Technical Order (TCTO) reporting requirements IAW TO 00-5-15, Air Force Time Compliance Technical Order

Process.

2.9.3 The contractor shall provide complete source MDC documents and forms or automated products if not directly inputting data into the MIS.

2.9.4 The contractor shall follow unit standard operations procedures for system restoral priorities; system restoral response times; maintain configuration control; and document historical records, if not using the AF-approved MIS.

2.10 Capability Maturity Model Integration (CMMI) Requirement

Contractor shall possess one or more of the following credentials, demonstrating technical proficiency.

ISO 9001-2000

ISO 9001-2008

CMMI Level II (or higher) – DEV

CMMI Level II (or higher) – SVC

3. PERFORMANCE REQUIREMENTS

The contractor shall provide sufficient personnel to meet mission requirements on a 24/7/365 basis.

3.1 DCO Training and Instruction

3.1.1 Training and instruction shall be performed during core hours (M-F 0730-1630) in the

Director of Operations-Training (DOT) flight. The contractor shall maintain certification and proficiency for its employees conducting Mission Qualification Training IAW the Squadron's current (DOT) OI 36-2201. All training requirements shall comply with the local and Higher

Headquarters (HHQ) instructions and regulations.

3.1.2 The contractor shall develop and document training objectives, in coordination with the

COR, IAW the intent of the 33 NWS/Director of Operations (DO) and the 33 NWS/Director of

MA. The contractor shall develop, document, and maintain the 33 NWS training plan, subject to approval by the COR. The contractor shall maintain all training documents in electronic form and store on maintained shared network drive location.

3.1.3 The contractor shall provide training to 33 NWS and support personnel to further enhance their organizational, analytical, and functional knowledge of computer security, system vulnerabilities, exploits, related digital signatures, hacking patterns, and countermeasures.

3.1.4 The contractor shall provide on the job training (OJT) and recurring training of individuals assigned to conduct the 33 NWS maintenance mission and technical support.

3.1.5 The contractor shall provide classroom teaching of Government personnel or other contractors newly assigned to conduct the 33 NWS maintenance mission and technical support.

3.1.6 Contractor personnel shall be trained IAW 24 AF 10-1703 vol. 1 and AFI 36-2201 for all functions before training others. Contractor personnel shall also accomplish an eight (8) hour proficiency shift every forty-five (45) days to re-establish certified functions.

3.2 Standardization and Evaluation (Stan/Eval)

3.2.1 Stan/Eval efforts shall be performed on-site in the Commander’s Stan Eval (CCV) flight during core hours (M-F 0730-1630). The contractor shall ensure all personnel performing evaluations are certified for the function they are evaluating. In order to maintain this certification and proficiency, evaluators shall perform functions, as defined in 26 Cyber

Operations Group (COG) Supplement to AFSPC GM 10-2.

3.2.2 The contractor shall serve as a central point of contact (POC) within the 33 NWS for receiving information pertaining to the integration of Stan/Eval, processes, and DCO TTPs.

3.2.3 The contractor shall develop and document 33 NWS operations, reporting, systems administration and incident response processes and tasks using available mission support systems.

3.2.4 The contractor shall maintain Evaluation Individual Qualification Folder(s) (EIQF) for all

MR squadron personnel (approximately 150).

3.2.5 The contractor shall maintain an electronic database for Stan/Eval written tests, Cyber crew Information File (CIF), and certification status dates IAW 26 COG Supplement to

AFSPC GM10-2. Currently, 33 NWS uses Patriot Excalibur (PEX) to accomplish this task until transition to Global Training Information Management System is complete.

3.3 Operational Processes and Tasks (OP&T)

3.3.1 OP&T efforts shall be performed on-site during core hours (M-F 0730-1630) in the CCV flight. The contractor shall maintain the 33 NWS/DO OP&T Handbook.

3.3.2 The contractor shall maintain the 33 NWS Operations’ library of all operations checklists.

3.3.3 The contractor shall be the squadron focal point for the review and update of operational processes/checklists.

3.3.4 The contractor shall coordinate with operational POCs/Subject Matter Experts (SMEs) when a process/checklist needs to be updated.

3.3.5 When new processes/checklists are interim approved by flight leadership, the contractor shall hold an Operational Review Board (ORB). The ORB will be held monthly to discuss and coordinate the approval of operational process/checklist changes with the COR. The contractor shall document the proceedings of the ORB to track status of updates or new TTPs.

3.3.6 The contractor shall provide squadron continuity for 24 AF CNDSP and other inspection requirements.

3.4 Air Force Cyber Defense Weapon System (ACD)

3.4.1 ACD Sensor Technical Services.

3.4.1.1 Sensor Technical services shall be performed on-site in the Mission Assurance

Operations (MAO) flight 24-hours a day (24/7/365). The contractor shall perform ACD

Sensor Technical services supporting all 33 NWS mission networks that are under the operational direction of the 33 NWS Maintenance Directorate, currently in the MAO Flight

(Operation Support Tech section). The contractor shall install, configure, troubleshoot, maintain, monitor status of, and manage the AF IDS/IPS sensor fleet. Functions include performance on IOP gateway and Fly Away Kits (FAK) sensors, Cloud Shield, Palo Alto, McAfee IDS/IPS deployments, Full Packet Capture/Network Technology and Systems

Administration (FPC/NTSA) systems, ArcSight and sensor fleet specialized applications

(such as Fidelis), emerging IDS/IPS technologies and associated network infrastructure

[Adaptive Security Appliance (ASA)/Virtual Private Network (VPN) concentrator], equipment/configurations and other Gateway, boundary and Third Party sensors. The contractor shall sustain the development and documentation of processes and checklists for maintenance associated with those systems. The contractor shall be trained, and certified by

33NWS internal Quality Assurance Evaluator (QAE) personnel IAW 33 NWS QA processes.

Additionally, the contractor shall maintain its respective certifications IAW QA processes for maintenance functions.

3.4.1.2 The contractor shall provide basic and intermediate level support as evidenced by applicable commercial certifications (see Appendix D). The contractor shall incorporate approved 33 NWS vendor trouble ticketing procedures (internal and external) for completion of ACD Sensor Tech taskings.

3.4.1.3 The contractor shall maintain and manage software upgrades and patches and perform system changes for the IDS/IPS sensors ensuring proper configuration to Defense Information

Systems Agency Security Technical Implementation Guide (DISA (STIG)) and AF (AFI and

TO) standards to minimize the potential of unauthorized intrusions. The contractor shall deploy to any DoD network gateway, boundary or third party location with the necessary equipment to install IDS/IPS sensor(s), servers and network infrastructure hardware. The contractor shall conduct the daily private key management.

3.4.1.4 The contractor shall deploy additional new string matches and alerts to all deployed

IDS/IPS sensors in support of 33 NWS mission requirements.

3.4.1.5 The contractor shall deploy correlation rule sets base boundary (aka enclave control node, ECN) to correctly identify and process system alerts in support of 33 NWS mission requirements.

3.4.1.6 The Government shift lead will notify the contractor when to filter or "omit” sensor traffic. The Government shift lead will notify the contractor when alert reporting activity does not need to be reviewed in a "real-time" operation by the 33 NWS analysts.

3.4.1.7 The contractor shall monitor the effectiveness of the IDS/IPS sensor’s ability to collect and report suspicious network activity on AF networks. The contractor shall perform immediate diagnostic testing and troubleshooting either remotely from the 33 NWS or through a local System Administration having direct access to the IDS/IPS sensor. The contractor shall ensure that response to inoperable systems is immediate.

3.4.1.8 The contractor shall conduct troubleshooting and fault isolation to sustain network connectivity between the correlators and sensor equipment, maintain COTS and GOTS sensor applications, harden Access Control Lists (ACL) to restrict unauthorized access to network, create and manage sensor user accounts, and assign the user specific rights to access network resources.

3.4.1.9 The contractor shall work with AF field units to resolve network issues and perform actions necessary to ensure IDS/IPS sensors are collecting and reporting network activity to the COR or Government shift lead. The contractor shall diagnose and resolve end user problems, and ensure the end users adhere to the proper security policies and procedures.

3.4.2 ACD Network/Systems Administration.

3.4.2.1 Systems Administration efforts shall be performed on-site in the MAO flight 24 hours a day (24/7/365). The contractor shall perform ACD Network/Systems Administration services supporting all 33 NWS mission networks under operational direction of the 33

NWS MA Directorate, currently in the MAO Flight (Systems Administration section). The contractor shall be trained, and certified by 33 NWS internal QAE personnel, IAW 33 NWS

QA processes. Additionally, the contractor shall maintain its respective certifications IAW

QA processes for maintenance functions.

3.4.2.2 The contractor shall perform 33 NWS Systems Administration Support Services on both NIPRNet and SIPRNet and supported special enclaves during mission hours. The contractor shall perform related MA activities and coordinate MA advanced actions with the

Mission Assurance Engineering (MAE) Flight, and external units (i.e., 26 Network

Operations Squadron (NOS), Integrated Network Operations and Security Center (INOSCs), 690 Information Support Squadron (ISS). The contractor shall support Systems

Administration of the 33 NWS operational networks (Patriot and Defender), the 33 NWS

COOP network, the training network, local base NIPRNet and SIPRNet Computer System

Administration (CSA) actions, and AOL deployment maintenance analysis.

3.4.2.3 The contractor shall perform basic and intermediate level installation, upgrades, daily maintenance and intermediate troubleshooting to include hardware and software consisting of

UNIX-based, Windows-based, and VMware-based operating systems, workstations/monitors, Anti-virus and software, computer printers, Cybex switches, fiber optic media, gigabit

Ethernet, and 100BaseT network operations.

3.4.2.4 The contractor shall perform all network account administrative functions to include creation, disabling, unlocking, privilege configuration, expiration of accounts, and maintenance troubleshooting.

3.4.2.5 The contractor shall create and delete user accounts within two (2) working days, track user privileges, maintain a list of current users, and show accessibility to all computer systems, network, and computer software applications, and other network components.

3.4.2.6 The contractor shall ensure ACD user work stations are secure, have the latest software patches installed, and are properly configured within Time-Compliance Network

Order (TCNO) specific deadlines to minimize the potential of unauthorized intrusions.

3.4.2.7 The contractor shall incorporate approved 33 NWS network trouble ticketing procedures (internal and external) for completion of ACD Network/Systems Administration tasking’s.

3.4.3 ACD Network/Cyber Readiness Network (CRN) (Forensic) Systems Administration.

3.4.3.1 CRN Systems Administration efforts shall be performed on-site in the Mission

Assurance Engineering (MAE) flight during core hours (M-F 0730-1630). Contractor shall perform 33 NWS Cyber Readiness Network (Forensic) Systems Administration services supporting 33 NWS Cyber Readiness Network (Forensic) mission networks currently in the

MAE Flight (Forensic Network Engineering section). The contractor shall perform related

MA activities and coordinate MA actions with ACD Core Infrastructure Engineers, MAO

Systems Administration and Operations Support Techs, and external units (i.e., 26 NOS, INOSCs, and 690 ISS). The contactor shall perform intermediate systems administration of the 33 NWS’s central management systems, forensic missions on 33 NWS operational networks (Patriot and Defender), and AOL pre-deployment network configurations.

3.4.3.2 The contractor shall perform related MA activities and coordinate MA actions with

Forensic Analysts. The contractor shall perform administration of the 33 NWS’s Forensic

Analysis Team, Blue Assessment Team, Dot Com and EnCase networks.

3.4.3.3 The contractor shall provide advanced level support as evidenced by the applicable application and operating system (OS) commercial certifications (see Appendix D).

Additionally, the contractor shall perform advanced administrative maintenance, configuration and troubleshooting actions on the EnCase software suite.

3.4.3.4 The contractor shall perform administration and maintenance on mission network servers, Storage Area Networks (SAN), and COTS/GOTS software applications. The contractor shall configure physical and virtual servers, connect network storage, develop user interfaces for specific purposes, and troubleshoot network/server/user problems beyond intermediate administrative responsibilities.

3.4.3.5 The contractor shall perform advanced level installation, upgrades, troubleshooting and daily maintenance of hardware and software consisting of Linux , Microsoft

-based and

VMware

-based operating systems, workstations, Wyse-client workstations, security event correlators, packet capture devices, SAN, computer printers, Keyboard, Video and Mouse

(KVM) switches, fiber optic media, fiber-channel connectivity, gigabit Ethernet, 100BaseT network operations, and other network and computer components.

3.4.3.6 The contractor shall perform ACD forensic network backups daily, weekly, and monthly on mission critical systems for same day recovery.

3.4.3.7 The contractor shall evaluate and document the ACD forensic systems configuration and virtual infrastructure, particularly under periods of peak usage, and determine where corrections and enhancements can be made to include removing misconfigured or excessive network components. The contractor shall provide all recommended fixes to include enhanced network server and virtual configuration information to the COR or Government shift lead.

3.4.3.8 The contractor shall perform advanced level Cisco, Linux, VMware and Microsoft integration of new ACD forensic core infrastructure and sensor systems on the forensic networks. The contractor shall be intimately familiar with all mission databases, mission networks, platforms, and software tools supporting the 33 NWS’ internal and external connectivity for mission execution, systems’ configuration control constraints, and document new system administration maintenance processes as it applies to the Cyber Readiness

Network (Forensic).

3.4.3.9 The contractor shall ensure the ACD Cyber Readiness network infrastructure, physical servers, workstations and virtual infrastructure are secure. The contractor shall ensure the latest software patches are installed and properly configured to DISA (STIG) and

AF (AFI and TO) standards to minimize the potential of unauthorized intrusions.

3.4.3.10 The contractor shall determine data gathering points throughout 33 NWS systems and networks for obtaining important ACD forensic network metrics. The contractor shall determine and identify manual processes and generate programming scripts required to automate data gathering.

3.4.4 ACD Network/Junior Virtualization/UNIX Engineering.

3.4.4.1 Junior Virtualization/UNIX Engineering shall be performed on-site in the MAE flight during core hours (M-F 0730-1630). Contractor shall perform 33 NWS advanced level

Virtualization/UNIX engineering services supporting all 33 NWS mission networks currently in the MAE Flight (ACD Core Infrastructure Engineering section). The contractor shall perform related MA activities and coordinate MA actions with MAO Systems

Administration, and external units (i.e., 26 NOS, INOSCs, & 690 ISS). The contactor shall perform advanced Virtualization/UNIX Engineering of the 33 NWS’s central management systems, 33 NWS operational networks (Patriot and Defender), the training network, local base NIPRNet and SIPRNet CSA actions, and AOL pre-deployment network configurations.

3.4.4.2 The contractor shall provide advanced level support as evidenced by the applicable

OS commercial certifications (see Appendix D). Additionally, the contractor shall perform advanced administrative maintenance, configuration and troubleshooting actions on a variety of commercial software suites.

3.4.4.3 The contractor shall perform administration and maintenance on mission network servers, Storage Area Networks (SAN), and COTS/GOTS software applications. The contractor shall configure physical and virtual servers, connect network storage, develop user interfaces for specific purposes, and troubleshoot network/server/user problems beyond intermediate administrative responsibilities.

3.4.4.4 The contractor shall perform engineering/advanced level installation, upgrades, and daily maintenance of hardware and software consisting of UNIX , Microsoft

-based and

VMware

-based operating systems, physical workstations, Zero -client workstations, security event correlators, packet capture devices, SAN, Anti-virus and vulnerability remediation systems and software (ex: ACAS), computer printers, KVM switches, fiber optic media, fiber-channel connectivity, gigabit Ethernet, 100BaseT network operations, and other network and computer components.

3.4.4.5 The contractor shall perform ACD network backups daily, weekly, and monthly on mission critical systems for same day recovery.

3.4.4.6 The contractor shall evaluate and document the ACD systems configuration and virtual infrastructure, particularly under periods of peak usage, and determine where corrections and enhancements can be made to include removing misconfigured or excessive network components. The contractor shall provide all recommended fixes to include enhanced network server and virtual configuration to the COR or Government shift lead.

3.4.4.7 The contractor shall perform advanced level UNIX, VMware and Microsoft integration of new ACD core infrastructure and sensor systems on the mission networks. The contractor shall be intimately familiar with all mission databases, mission networks, platforms, and software tools supporting the 33 NWS’ internal and external connectivity for mission execution within applicable Combat Information Transport System (CITS) Program systems’ configuration control constraints, and document new system administration maintenance processes.

3.4.4.8 The contractor shall ensure the ACD Defender and Patriot physical servers, workstations and virtual infrastructure are secure. The contractor shall ensure the latest software patches are installed and properly configured to DISA (STIG) and AF (AFI and TO) standards to minimize the potential of unauthorized intrusions.

3.4.4.9 The contractor shall determine data gathering points throughout 33 NWS systems and networks for obtaining important ACD metrics. The contractor shall determine and identify manual processes and generate programming scripts required to automate data gathering.

3.4.4.10 The contractor shall maintain all 33 NWS SharePoint sites, install/upgrade software and create/modify SharePoint objects (lists, libraries, discussion boards) in response to dynamic mission requirements. The contractor shall provide SharePoint site content management in support of the 33 NWS cyber defense mission.

3.4.4.11 The contractor shall be responsible for documentation of hardware/software logs, operating procedures, and all maintenance actions performed. The contractor shall be responsible for SharePoint setup and user training.

3.4.5 ACD Network/ Infrastructure Technical Services.

3.4.5.1 Infrastructure Technical Services shall be performed on-site in the MAO flight 12-hours a day (12/7/365 0600-1800). Contractor shall perform ACD Network Infrastructure

Technical services supporting all 33 NWS mission networks currently in the MAO Flight

(Systems Administration section). The contractor shall perform related MA activities and coordinate MA actions with the MAE Flight and external units (i.e., 26 NOS, INOSCs, and

690 ISS). The contractor shall perform intermediate administration of the 33 NWS’s central management systems, 33 NWS operational networks (Patriot and Defender), and the training and AOL network infrastructures.

3.4.5.2 The contractor shall provide intermediate level support as evidenced by the applicable commercial certifications (see Appendix D). Additionally, the contractor shall perform intermediate administrative maintenance, configuration and troubleshooting actions on a variety of commercial network management software suites such as Solarwinds and Cisco

Access Control Server (ACS).

3.4.5.3 The contractor shall perform research, troubleshooting and installation of hardware and software consisting of Cisco switches, routers, ASA, Bluecoat Proxy servers, fiber optic media, fiber-channel, gigabit Ethernet, 100BaseT network operations, and other network and computer components.

3.4.5.4 The contractor shall perform installation, administration and maintenance on mission network switches, routers, firewalls, ASA, Blue Coat proxy servers and other network infrastructure devices. The contractor shall configure network boundary and core infrastructure equipment and troubleshoot network infrastructure problems.

3.4.5.5 The contractor shall perform intermediate level installation, troubleshooting, upgrades, and daily maintenance of hardware and software consisting of Cisco Graphical

User Interface (GUI) and Command Line Interface (CLI) operating system interface, infrastructure integrations, fiber-channel switches, SAN, TACLANE’s, fiber optic media, fiber-channel connectivity, gigabit Ethernet, 100BaseT network operations, and other network and computer components.

3.4.5.6 The contractor shall perform ACD infrastructure device configuration backups monthly, or as changes occur on mission critical systems, for same day recovery.

3.4.5.7 The contractor shall evaluate and document the ACD network infrastructure configuration, particularly under periods of peak usage, and determine where corrections and enhancements can be made to include removing misconfigured or excessive network components. The contractor shall provide all recommended fixes to include enhanced network infrastructure devices and transmission media information to the COR or

Government shift lead.

3.4.5.8 The contractor shall ensure the ACD network infrastructure devices are secure, have the latest software patches installed, and are properly configured to DISA STIG and AF (AFI and TO) standards to minimize the potential of unauthorized intrusions.

3.4.5.9 The contractor shall determine data gathering points throughout 33 NWS network infrastructure for obtaining important ACD metrics, and determine and identify manual processes or generate programming scripts required to automate data gathering.

3.4.6 ACD Network/Data Base Administration (DBA).

3.4.6.1 DBA efforts shall be performed on-site in the MAO flight during core hours (M-F

0730-1630). Contractor shall perform DBA services on all 33 NWS supported mission networks (Defender, Patriot and Forensic), currently in the MAO Flight Database

Administration Section. The contractor shall provide advanced database administration, implementation, administrative maintenance, configuration and troubleshooting support for mission services.

3.4.6.2 The contractor shall provide advanced level support in specific database software as evidenced by the applicable commercial certifications (see Appendix D). Although Oracle, Microsoft SQL Server and ArcSight are the focus of current ACD DBA operations, DBAs are expected to support additional upgrades as weapons system toolsets evolve. Additionally, DBAs shall perform advanced administrative maintenance, configuration and integration troubleshooting actions with a variety of commercial software suites.

3.4.6.3 The contractor shall perform installation, upgrades, and daily maintenance of SANs consisting of UNIX-based, Windows-based, and VMware-based operating systems and other network and computer components.

3.4.6.4 The contractor shall perform ACD database backups daily, weekly, and monthly on mission critical systems for same day recovery.

3.4.6.5 The contractor shall evaluate and document the ACD network configuration and infrastructure, particularly during periods of peak usage, and determine where corrections and enhancements can be made to include Schema modifications, database configuration changes and hardware upgrades. The contractor shall provide all recommended fixes to include enhanced network configuration.

3.4.6.6 The contractor shall provide Oracle, Microsoft SQL Server and ArcSight database integration services with comprehensive testing of new systems, technologies and applications to ensure they satisfy stated requirements and provide supportable systems and networks in the future. The contractor shall make system and network recommendations and identify results to the COR or Government shift lead.

3.4.6.7 The contractor shall create and delete database related user accounts within two (2) working days, tracking user privileges and maintaining a list of current users.

3.4.6.8 The contractor shall ensure the ACD Oracle, Microsoft SQL Server and ArcSight database services are secure, have the latest software patches installed, and are properly configured to DISA STIG and AF (AFI and TO) standards to minimize the potential of unauthorized intrusions.

3.4.6.9 The contractor shall determine data gathering points throughout 33 NWS systems and networks for obtaining important ACD metrics, and determine and identify manual processes or generate programming scripts required to automate data gathering.

3.4.7 ACD Network/Virtualization Engineering.

3.4.7.1 Virtualization Engineering efforts shall be performed on-site in the MAE flight during core hours (M-F 0730-1630) Contractor shall perform expert Virtualization Engineering services on all 33 NWS supported mission networks, currently in the MAE Flight (ACD Core

Infrastructure Engineering section). The contractor shall perform related MA activities and coordinate MA actions with MAO Systems Administration, 33 NWS Sensor Technical, and external units (i.e., 26 NOS, INOSCs, 690 ISS). Support shall include advanced administration of the 33 NWS central management systems, 33 NWS operational networks

(Patriot, Defender and Cyber Readiness), and AOL pre-deployment network configurations.

3.4.7.2 ACD Network/Virtualization Engineering shall include designing technical solutions, finding system inefficiencies and performing advanced administration on virtualization…