Atch_1_IAFNOS_PWS.pdf

Performance Work Statement (PWS)

Integrated Air Force Network Operations and Services (IAFNOS)

03/02/2015

Version 1.0

Vision Statement

1 Introduction

1.1 Mission

1.2 Scope

1.3 Background

2 General Requirements

2.1 Non-Personal Services

2.2 Business Relations

2.3 Contract Administration and Management

2.3.1 Contract Management

2.3.2 Contract Administration

2.3.3 Contractor Personnel Training

2.3.4 Certifications

2.4 Subcontract Management

2.5 Location and Hours of Work

2.6 Travel / Temporary Duty (TDY)

2.7 Contractor Identification in the Government Workplace

3 Performance Requirements

3.1 Over-arching Requirements

3.2 I-NOSC

3.3 Enterprise Service Unit (ESU)

3.4 Area Processing Center (APC)

3.5 Operations Support

3.6 Air Force Information Networks (AFIN) Mission Assurance Center (AMAC)

4 Special Requirements

4.1 Security

4.1.1 Personnel Security

4.1.1.1 Access Credentials

4.1.2 Operational Security (OPSEC)

4.1.3 Information Systems Security and Force Protection

4.1.4 Physical Security

4.1.5 Key Control

4.1.6 Lock Combination

4.1.7 Visitor Group Security Agreement

4.1.8 TEMPEST/EMSEC/INFOSEC/COMPUSEC

4.2 Transition

4.3 Government Furnished Materials

4.3.1 Housekeeping

4.3.2 Refuse Collection

4.3.3 Conservation of Utilities

4.4 Safety Requirements

4.4.1 General Safety

4.4.2 Safety Mishap Notification

4.4.3 Base Traffic Regulations

4.5 Environmental

4.6 Applicable Directives

4.7 Contractor Records and Reporting

4.7.1 Contractor Manpower Reporting

4.7.2 Records

4.8 Quality

4.8.1 Quality Control

4.8.2 Quality Assurance Surveillance Plan (QASP)

4.9 Contracting Officer Representative (COR)

4.10 Continuation of Essential DoD Contractor Services During Crisis

4.11 Contingency

4.11.1 The contractor shall maintain a continuity of operations plan

4.11.2 The contractor shall implement and execute contingency operations for real world events

4.11.3 The contractor shall provide Enterprise-Level Disaster Recovery support

5 Deliverables

Performance Work Statement (PWS) Integrated Air Force Network Operations and Services

(IAFNOS)

Vision Statement

Provide services to support functions for the 690th Cyberspace Operations Group.

1 Introduction

1.1 Mission

The 690th Cyberspace Operations Group (690 COG) performs 24/7/365 Air Force Information Network (AFIN) operations that includes defensive cyberspace operations (DCO), network management, information assurance, and fault resolution activities to maintain the operational capabilities of the network, establish the domain for AF cyberspace operations, and ensure AF cyberspace superiority.

The squadrons, detachments (dets) and operating locations (OLs) that comprise the 690 COG are geographically dispersed, but they operate the Air Forces Cyberspace Security and Control System (CSCS) weapon system and the AFIN as a team. Each unit fulfills at least one of the following inter-related roles: Integrated Network Operations and Security Center (I-NOSC), Enterprise Services Unit (ESU), Area Processing Center (APC) or Operations Support. The 690 COG team is augmented by two fully integrated AF Reserve Command Reserve Associate Units (RAUs): the 860th Network Operations Squadron (860 NOS) and 960th Network Operations Squadron (960 NOS). The 690 COG also coordinates AFIN operations with the 299th Network Operations Security Squadron (299 NOSS).

I-NOSC personnel monitor and support the day-to-day operational issues associated with the bases and units they service coordinating multi-site events between them. Their mission focus is to continuously ensure that systems are operational and fully capable. They support their commanders with decision analysis and other technological capabilities. They provide technical support to the AF Network Integration Center (AFNIC) and Program Management Office (PMO) fielding activities. The I-NOSCs also coordinate activities of the base-level communication units to include Network Control Centers (NCCs)/Communications Focal Points (CFPs) for network security actions as directed by the 624th Operations Center (624 OC). I-NOSC personnel monitor, assess and respond to real-time network events; identify and characterize anomalous activity; and take appropriate response actions in accordance with (IAW) tasking orders.

ESU personnel operate, maintain and monitor associated AFIN Services 24/7/365.

APC personnel provide 24/7/365 touch maintenance, facility management services, physical security, system management and operations of all servers within an APC under guidance from the ESU. APC facilities physically house equipment required to host core service applications. Depending on Air Force (AF) strategy and Department of Defense (DoD) guidance, the APCs' future role may extend to hosting non-core, and/or non-AF applications.

The 690 NSS will provide flexibility in transitioning from a call center to managing Tier 0 automated tools, problem management and configuration management. The 690 NSS will have the following mission: operate an AFIN Mission Assurance Center (AMAC), accomplish enterprise governance and mission support for all 690 COG mission areas. The AMAC directs AFIN Operations to ensure standardized execution of I-NOSC and ESU tasks. To conduct AFIN Operations, the AMAC utilizes its 24th Air Force (24 AF) authority to issue global maintenance-related cyber orders to Air Force units. The 690 NSS will leverage the AMAC to enforce and direct policies established by its enterprise governance mission areas.

1.2 Scope

The scope of the IAFNOS effort will provide support services to operate, sustain, and assure the availability of AFIN to enable war-fighter mission execution. The I-NOSC and ESU area of responsibility (AOR) within the AFIN includes enclaves located at 690 COG locations, AF base boundaries, and APCs. The terms AF Network (AFNET) and AF Network-Secure (AFNET-S) refer to the Air Force's underlying Non-Secure Internet Protocol Router Network (NIPRNet) and Secure Internet Protocol Router Network (SIPRNet). The 690 COG is responsible to operate the core services for each of these networks. The AMAC conducts AFIN operations to ensure the availability and security of the AFIN. Operations Support has an expanded role to support units that operate and maintain the AFIN.

To date, AFIN operators have navigated numerous organizational and fiscal challenges and expect similar challenges in the future. For example, as the Air Force implements the congressionally-directed transition to cloud computing and the Joint Information Environment (JIE), several AFIN operations mission functions, particularly the data and processing centers and major functions of the ESUs, may become increasingly integrated at the Department of Defense level. The result may be a reduction in the number of data centers, associated infrastructure and services this contract will support. This may drive a change in the domains of control, responsibility and scope of IAFNOS mission requirements. Furthermore, it is uncertain to what degree AFIN operations will be tasked to support other DoD and non-DoD IT mission requirements, which may result in an increase in workload. In general, however, it is anticipated that most such changes, as well as initiatives focused on process improvement and innovation, will result in smaller footprints for AFIN operations, a requirement for less system administration, less hands-on maintenance, and, hence, less cost than the current architecture. Accordingly, a reduction in contractor manpower requirements may result over time.

With the above considerations in mind, this contract will provide services and support according to a Contract Line Item Number (CLIN) construct that has CLINs assigned to mission areas accomplished at the following operating locations:

I-NOSCs/ESUs: There is one I-NOSC and one ESU located at each of the two Continental United States Network Operations Squadrons (NOSs): the 83 NOS located at Joint Base Langley-Eustis, VA, and the 561 NOS located at Peterson AFB, CO.

APCs: 83 NOS OL-B located at Andrews AFB, MD; 561 NOS OL-B at Scott AFB, IL; and 83 NOS OL at Wright-Patterson AFB, OH.

Operations Support: The 690 COG operates an AMAC, accomplishes enterprise governance and mission support for all mission areas. Operations Support is conducted at 690 COG units at Lackland AFB, TX, 83 NOS at Joint Base Langley-Eustis, VA, and the 561 NOS located at Peterson AFB, CO.

AMAC: Conducts command and control of AFIN operations. They monitor, coordinate, and direct cyber shaping actions to assure air, space, and cyberspace operations.

The 690 COG handles incidents through a tiered support construct.

While there are two additional 690 COG units at Ramstein AB, GE, and Joint Base Pearl Harbor-Hickam, HI, their missions will be accomplished solely by Government personnel and will not be part of this contract. Likewise, the 561 NOS Det 4 located at Malmstrom AFB, MT, the 561 NOS Det 2, Randolph AFB, TX, and the 690th Intelligence Support Squadron (690 ISS) at Lackland AFB, TX will not be supported by this contract.

1.3 Background

IAFNOS is replacing three current contracts; however it should be noted that IAFNOS is not a one-for-one replacement for these contracts. The Randolph AFB detachment and the majority of the ESD mission is being decommissioned, therefore not part of IAFNOS; and there is new work, such as the AMAC, included in the new requirement.

The current AFIN II and ENSA contracts both provide support to 690 COG mission areas that include Infrastructure Operations, Network Monitoring Management, Directory & Authentication Services, Messaging & Collaboration Services, Storage & Virtualization Services, Operations Support and Network Defense. In addition, the ENSA contract provides support to Area Processing Center (APC) Operations.

All AFIN II personnel reside at Peterson AFB, CO and provide support directly to the 561 NOS. ENSA personnel reside at all other 690 COG locations and provide support to both the 83 and 561 NOSs and detachments. ENSA locations include Langley AFB, VA; Scott AFB, IL;

Andrews AFB, MD; Wright-Patterson AFB, OH, and Randolph AFB, TX.

The ESD contract provisions support for the Enterprise Service Desk mission of the 690th Network Support Squadron. ESD units manage all network user accounts and groups and provide a single point-of-contact for AFIN users to obtain resolution of issues they may have with Government-provided end-user equipment such as desktops, laptops, or mobile devices. Current ESD contract location is Lackland AFB, TX.

2 General Requirements This section describes the general requirements for this effort. The following sub-sections provide details of various considerations on this effort.

2.1 Non-Personal Services

The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental functions. All decisions relative to programs supported by the contractor shall be the sole responsibility of the Government.

2.2 Business Relations

The Contractor shall cooperate, support, and interface with military, government civilians, and other contractors for completion of all tasks.

2.2.1 The contractor shall work with the Contracting Officer Representative (COR), the authorized Government representative, to accomplish Government requirements, goals, and mission objectives as efficiently and effectively as possible. This shall include sharing or coordinating information resulting from the work required within this PWS or previous Government efforts and working as a team to perform tasks in concert.

2.2.2 The contractor shall assign one of the full-time, Department of Defense Directive (DoDD) 8570.01-M certified employees as site lead and at least one additional full-time, DoDD 8570.01- M certified employee as alternate site lead at each operating location. The Government expects the primary and alternate site lead(s) to be an additional duty. These positions serve as the primary interface with Government. The primary and alternate site lead(s) are expected to work on different shifts. A site lead, primary or alternate(s), shall be available during normal duty hours (0800 to 1600 Local), Monday through Friday, except Federal Holidays, to meet with COR or Government shift lead to discuss program and/or technical issues. The site lead shall attend scheduled staff meetings, as requested by the COR.

2.2.3 The contractor shall ensure minimum duplication of effort in the execution of all work specified within this PWS and build upon work previously accomplished by the Government, the contractor, or other contractors to the fullest extent practical.

2.2.4 The contractor shall successfully integrate and coordinate all activity needed to execute the requirement.

2.2.5 The contractor shall manage the timeliness, completeness, and quality of problem identification.

2.2.6 The contractor shall provide corrective action plans, proposal submittals, timely identification of issues, and effective management of subcontractors.

2.2.7 The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

2.2.8 The contractor shall cooperate, support, and interface with 690 COG military, Government civilians, and other contractors for completion of all tasks IAW DoD, AF, and local squadron policies, procedures, instructions, job guides, policy memorandums and downward directed guidance.

2.2.9 The contractor shall be responsive to requests for information from other work centers for accomplishing the 690 COG mission.

2.2.10 The contractor shall assist the Government in maintaining operational readiness.

2.2.11 The contractor shall comply with, participate in, and contribute to Change Management procedures and instructions for the 690 COG mission IAW Methods and Procedures Technical Order (MPTO) 33A-1100, AFNet Operational Change Management Processes.

2.2.12 The contractor shall complete and comply with information requests from the Information Assurance (IA) program.

2.2.13 The contractor shall maintain, update, and create meeting minutes for ensuring continuity of knowledge and operations. (Contract Data Requirements List (CDRL) A003 Meeting Minutes)

2.2.14 The contractor shall integrate contractor personnel into mission teams to accomplish work center Cyberspace operations, security and control missions to cover contractor workload as described in Appendix 3 Workload.

2.2.15 The contractor shall comply with DoD Freedom of Information Act (FOIA) Program requirements and requests. This provision includes compliance in handling Controlled Unclassified Information (CUI) and For Official Use Only (FOUO) materials and performing data restores.

2.2.16 The contractor shall adhere to the latest version or successor to any policies listed in this

PWS.

2.2.17 The contractor shall ensure all contractor employees submit verification to the Trusted Associate Sponsorship System (TASS).

2.3 Contract Administration and Management

The following subsections specify requirements for contract, management, and personnel administration.

2.3.1 Contract Management

2.3.1.1 The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement.

2.3.1.2 The contractor must maintain continuity between the support operations at 690 COG and the contractor's corporate offices.

2.3.2 Contract Administration

2.3.2.1 The contractor shall establish processes and assign appropriate resources to effectively administer the requirement.

2.3.2.2 The contractor shall respond to Government requests for contractual actions in a timely fashion.

2.3.3 Contractor Personnel Training

2.3.3.1 The contractor shall ensure their employees obtain initial and refresher commercial training as required to meet the PWS requirements.

2.3.3.2 The contractor shall keep current with changes on all currently supported commercial applications within the contractors area of responsibility (AOR).

2.3.3.3 The Contractor shall complete all required Government training by suspense deadlines utilizing Government training systems (i.e. Safety, Information Assurance, Security, etc.).

2.3.3.4 The contractor shall ensure their employees attend orientations for Government Off-the- Self (GOTS) systems and applications. These orientations will be provided by the Government.

2.3.4 Certifications

2.3.4.1 The contractor personnel supporting Section 3 tasks shall meet industry certification requirements as identified in Appendix 6 Certifications. Individual contractor certifications shall only apply to one task defined in Appendix 6 (Table 6.1 and 6.2) and task location defined in Appendix 5 Task Execution Location Matrix, unless designated to support multiple functional areas as denoted in Appendix 6, Table 6.3. Contractor personnel with higher level certifications that satisfy the prerequisites for a lower certification fulfill certification requirements for the lower level certifications.

2.3.4.2 The contractor shall have a current Information Assurance Technical (IAT) or Information Assurance Manager (IAM) level certification in accordance with (IAW) DoD 8570.01- M, Information Assurance Workforce Improvement Program at contract start date and maintain certifications throughout life of the contract at contractor's expense. The contractor shall provide these certificates to the COR at contract start date.

2.3.4.3 The contractor shall update certifications prior to internal movement of personnel. The minimum certification and training requirements shall be maintained as an electronic record.

Contractor personnel shall provide proof of release for certification(s) to the DoD via Defense Workforce Certification Application (DWCA).

2.3.4.4 In addition to the certification requirements in Section 2.3.4.2, the contractor, at contract start date, shall provide a core cadre of certified personnel sufficient to meet PWS performance requirements. The contractor shall meet all certification requirements within 90 days of contract start date. The contractor shall provide documentation of certifications prescribed in the PWS for each functional area and maintain certifications throughout the life of the contract at contractor's expense.

2.3.4.5 The contractor shall maintain positional qualification, currency, and proficiency for any role or position they assume to meet tasks described in the PWS. The contractor shall attend positional qualification training.

2.3.4.6 The contractor shall update and maintain, at their expense, certifications equivalent to technology owned, operated and maintained by the United States Air Force (USAF) covered by this contract. The Government will notify the contractor in writing when a new certification is required, and the contractor shall have six months to obtain the new certifications for their employees.

2.4 Subcontract Management

2.4.1 The contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement.

2.4.2 The prime contractor shall manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations.

2.5 Location and Hours of Work

2.5.1 Accomplishment of PWS tasks requires work at 690 COG, 83 NOS, 561 NOS, and their applicable geographically-separated units, detachments, and operating locations (see Appendix 5). Contractor personnel may be required to travel to various contractor, subcontractor, and Government facilities to perform temporary duties.

2.5.2 The contractor shall distribute workforce to provide 24 by 7 operations per Appendix 4.

2.5.3 Contractor employees are expected to work an eight hour day with up to an additional one hour for lunch.

2.5.4 Contractor personnel shall coordinate shift change operations to ensure effective information exchange.

2.5.5 The COR will notify contractor's Task Lead concerning any changes in work location.

2.6 Travel / Temporary Duty (TDY)

2.6.1 Travel to other government facilities may be required. All travel requirements (including plans, agenda, itinerary, or dates) shall be pre-approved by the COR and CO (subject to local policy procedures), and is on a strictly cost reimbursable basis. Costs for travel shall be billed in accordance with the regulatory implementation of Public Law 99-234 and Federal Acquisition Regulation (FAR) 31.205-46 Travel Costs.

2.6.2 The contractor shall make necessary travel arrangements for contractor's employees.

2.6.3 The contractor shall submit trip reports within three (3) business days from contractor's employees return date from travel. (CDRL A004 Trip Report)

2.7 Contractor Identification in the Government Workplace

2.7.1 Contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification at all times, such as a standardized lanyard that all contract employees wear. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal written correspondence.

2.7.2 Contractors shall be identified with a contractor Common Access Card (CAC) or unit specified identification card marked by a green stripe. When required, contractor personnel shall comply with local security policies to wear their CAC in a standardized manner, clearly visible attached to the torso of the exterior garment above the belt and below the shoulders. Except when in use (i.e. inserted in a computer CAC reader) or when in controlled areas requiring other credentials as the primary method of identification. To access any Government base and certain facilities, the contractor shall present their CAC upon demand. Upon exit from Government facilities the contractor shall conceal their credentials (CAC or other credentials) from plain view. The contractor and Contractor Security Manager/Officer shall coordinate with the COR for CAC and other credential issues.

3 Performance Requirements The following section specifies the Performance Objectives and Performance Elements for the contract.

3.1 Over-arching Requirements

Tasks in this section apply to all mission areas tasked within section 3 of the PWS.

3.1.1 Operations and Maintenance

3.1.1.1 The contractor shall monitor and maintain the health of enterprise capabilities.

This task includes:

- performing preventive maintenance (PM) of hardware and software

- performing remote administration/access, account administration, IT device configuration and installation, troubleshooting, monitoring, security and infrastructure installation.

- reviewing and verifying security implementation of operating systems (e.g., Microsoft, Unix and Solaris) to ensure proper remediation of vulnerabilities

- interacting with other organizations and vendors to conduct installation, implementation, investigation, analysis, compliance, or assessment activities (e.g., support to the AF SCOPE EDGE Team)

- performing scheduled and unscheduled maintenance

- reporting status

- reporting orders compliance in the Government approved compliance tracking database

- initiating change requests and incident tickets and managing them to resolution

- elevating change requests and incident tickets to the next tier for resolution in the event the issue cannot be solved

- providing notification (written and verbal) and corrective recommendations for any equipment, software, or service which has exceeded its life-cycle, is failing, or otherwise requires Government funding or action for maintaining the contractual service level, including lack of redundant paths or systems

- accomplishing extension requests with government approval for orders when suspense dates cannot be met

Performance Standards

a) STD: Abide by Government approved maintenance windows

b) STD: Ensure compliance with all applicable Government orders, e.g.: Notices to Airmen (NOTAMs), Time Compliance Network Orders (TCNOs), Time Compliance Technical Orders (TCTO), Maintenance Task Orders (MTO), Data Call Orders (DCO), and Network Task Orders (NTOs) issued

c) STD: Comply with DoD and AF policies, approved Network Operating Procedures (NOP), Standard Operating Procedures (SOPs), Technical Orders (TO), checklists, Local Job Guides (LJG) and work center procedures when performing any maintenance or administration on the

AFIN

d) STD: Maintain configurations of services and/or components to comply with vendor, AF, and Defense Information Systems Agency (DISA) standards

3.1.1.2 The Contractor shall support local, AF, and Joint exercises and inspections.

This task includes supporting inspections and exercises of unit operational readiness in support of the AFIN. This support occurs during the course of normal duty operations.

Contract personnel supporting any exercise shall contribute to the Lessons Learned and provide an After Action Report (AAR) for each exercise.

Performance Standards

a) STD: IAW Air Force Instruction (AFI) 10-204 - Participation in Joint and National Exercises;

and associated local policies

Deliverables A004 Trip Report A005 After Action Report

3.1.1.3 The contractor shall provide touch maintenance services for all servers and equipment in the 690 COG AOR located in Appendix 5. At all other locations, the contract shall interface with communication units that host 690 COG controlled devices to accomplish required touch maintenance.

This task includes:

- providing touch maintenance services for all servers and equipment

- interfacing with facility management services for buildings housing 690 COG AOR equipment

- conducting preventive maintenance, cable management, emergency shutdown and recovery, physical security, system management and operations of servers, server environments and storage area networks

- troubleshooting all aspects of hardware equipment (e.g., servers, switches, routers, etc.)

- maintaining physical infrastructure to include all equipment housed at each NOS, APC or other location where contract personnel are required per Appendix 5

- responding to alarms (e.g., temperature & water) and taking appropriate action to mitigate alarm conditions according to Government guidance

- maintaining equipment accounts and data facility diagrams

- developing, updating, and maintaining an inventory list of equipment to include: building, floor, room, rack, row, rack units, power requirements, thermal load, work center ownership, owning organization

- resolving assigned change requests and incident tickets received through Enterprise Information Technology Service Management (EITSM)

- updating change requests and incident tickets in EITSM with status and resolution information

- coordinating unscheduled outages, authorized service interruption (ASI), maintenance activities, and restoration actions with the I-NOSCs, ESUs, and other APCs according to established procedures

The contractor shall document daily activities on the master station log of APC activity.

Performance Standards

a) STD: Daily activities documented on master station log

3.1.1.4 The contractor shall work with 690 COG mission partners and 690 COG workcenters to perform fault-detection, fault-isolation, and recovery/resolution (FDIR) services. The contractor shall troubleshoot, resolve, and document status of network incidents and faults according to incident ticket priorities to restore services.

a) STD: IAW TO 00-33A-1100 ticket priorities

3.1.1.5 The contractor shall maintain, update, and create draft technical documentation, policies, and procedures for ensuring continuity of knowledge and operations.

3.1.1.6 The contractor shall respond to and acknowledge Quality Assurance (QA) tasking's within one (1) business day and provide a Plan of Action and Milestones (POA&M) to complete taskings.

The QA workcenter will occasionally visit technicians with the intent of extracting information or configuration settings to satisfy internal or external investigations and/or make requests to modify the authorized baseline. All work associated with this task is credited through change requests or incident tickets.

3.1.1.7 The contractor shall perform preventive and corrective maintenance for systems and components operated and managed under the terms of this PWS including testing, removing/replacing, aligning, corrosion control, cleaning, inspecting and lubricating. The Contractor shall maintain electronic records of preventive and corrective maintenance.

Performance Standards

a) STD: IAW TO 00-33A-1001 - Methods and Procedures: General Cyberspace Support Activities Management Procedures and Practice Requirements

3.1.2 Training and Knowledge Transfer

3.1.2.1 The contractor shall accomplish knowledge transfer and provide input to training plans for work within the scope of this contract.

This task includes providing informal study aids sufficient to accomplish knowledge transfer in a group or one-on-one environment. Knowledge transfer shall be conducted at the direction of the Government for functional areas within the scope of this contract.

Performance Standards

a) STD: Government employee can successfully complete the task as trained via Knowledge Transfer.

3.1.3 Information Assurance

3.1.3.1 The contractor shall provide subject matter input in support of IA efforts.

This task includes:

- providing inputs to IA audits, inspections, reviews, Staff Assistance Visits (SAVs), and Certification and Accreditation (C&A) packages

- accomplishing activities related to audits, inspections, reviews and SAVs

3.1.3.2 The Contractor shall assess change requests and incident tickets.

- reviewing change requests and incident tickets for issues affecting the security posture of the AFIN

- identifying security vulnerabilities that may result from implemented changes

- determining the overall effect to the AFIN as a result of implementing requested change

- documenting the findings and recommended fix actions in the change request or incident ticket

3.1.4 Technical Support

3.1.4.1 The contractor shall review, comment, and provide recommended changes on technical and conceptual documentation.

This task includes reviewing, commenting, and providing recommended changes to technical and conceptual documentation for operational and technical sufficiency.

a) STD: IAW Local document review policies and review task suspenses

3.1.4.2 The Contractor shall participate in technical working groups.

This task includes accomplishing project implementation, process improvement, change and incident ticket management and resolution, reorganization efforts, and equipment relocation and reconfiguration.

3.1.4.3 The Contractor shall provide in depth analysis of reportable tasks.

This task includes reporting detailed information in accordance with the escalation matrix standard for outages and events.

Performance Standards

a) STD: IAW OGV-VA-1 Escalation Matrix / Routing Matrix

Deliverables A001 Weekly Activity Report

3.1.5 The contractor shall attend meetings to recommend implementable courses of actions, address emerging capabilities, provide status updates, and participate in the development of POA&Ms.

Performance Standards

a) STD: Provide Meeting Minutes to COR within 3 business days of meeting

A003 Meeting Minutes

3.1.6 The contractor shall manage, analyze and report metrics to improve AFIN performance.

This task includes:

- establishing and testing equipment thresholds and metrics, and conducting, documenting and reporting trend analysis

- creating metrics and developing processes for improving metrics

- recommending policies and procedures to improve AFIN configuration and process standardization across all NETOPS units

- implementing improvements upon Government approval

A010 AFIN Metrics Plan

3.1.7 The contractor shall identify, recommend and implement process improvements and infrastructure changes that improve AFIN operations and standardization.

This task includes:

- managing risks associated with recommended changes

- supporting AFIN configuration and process standardization across all 690 COG units

- assessing operational effectiveness of procedures, identifying process shortfalls and propose opportunities to improve processes, training, technology and personnel utilization to attain efficiencies for the Government

- recommending IT infrastructure changes and other courses of action to ensure AFIN alignment with changing resource constraints or Government strategic direction

- implementing improvements upon Government approval

Contractor recommendations for any system replacements or changes shall include implementation and risk management plans, contractor-developed capacity, cost and risk analysis models and required process modifications.

Performance Standards

a) STD: IAW a continuous process improvement framework, Information Technology Infrastructure Library (ITIL) continual service improvement, Six Sigma or other industry best practices

A016 Process Improvement Recommendation Report

3.1.8 The contractor shall follow a two-person integrity (TPI) compliance process on all change requests or incident tickets that are categorized risk level 2 through 5 and any ticket categorized at High or Critical.

TPI technicians can consist of a combination of Military/Civilian/Contractor.

The process is as follows:

- Technician one shall perform all necessary steps to prepare the required action(s) to resolve the change request or incident ticket according to Government standards and/or procedures

- Technician two shall validate required actions are documented and ready for implementation

- Technician one shall identify Technician two as the TPI validator in the change request or incident ticket

- Technician one applies validated actions and completes documentation

Additionally, the following categories require TPI:

- Any Tier 1 ticket (i.e., Wing Commanders, General Officers or their support staff)

- Any change that will have base-wide effects or higher

- Any change to Functional Systems

- Any patch or update to System Center Configuration Manager (SCCM)

- Any changes or updates to Group Policy Objects (GPO)

- Any change to Boundary, Infrastructure, Directory Services, Messaging, Vulnerability Management, Storage, Virtual Environments, or Mobile Devices

The categorized risk (0 to 5) is applied in the change request by the change management team.

3.1.9 The contractor shall report weekly activities.

This task includes reporting events and activities from PWS Section 3 tasks.

Performance Standards

a) STD: Describe activities on Weekly Activity Report (WAR)

A001 Weekly Activity Report

3.1.10 The contractor shall report monthly activities.

This task includes reporting events and activities from PWS Section 3 tasks.

Performance Standards

a) STD: Describe activities on Monthly Activity Report (MAR)

A002 Monthly Activity Report

3.1.11 The contractor shall perform Tier II/III direct operator and user support for AFIN core services.

This task includes coordinating the establishment and resolution of change requests and incident tickets with other AFIN operators and users as required.

3.2 I-NOSC

3.2.1 Infrastructure Operations: The contractor shall configure, standardize, monitor, operate, maintain, install, administer, troubleshoot and manage 690 COG AOR infrastructure devices.

a) STD: For the assigned Infrastructure Operations mission area workload in Appendix 3, Table 3.1, complete 80% of those change requests and incident tickets within 30 days of creation.

b) STD: Ensure that no more than 15% of all the incident tickets and change requests in the Infrastructure Operations backlog are more than 60 days old unless coordinated and approved by the Government.

c) STD: Complete change request and incident tickets IAW with TPI policies

d) STD: Compliant with Appendix 6 Certifications, Section 3.2.1 Infrastructure Operations certification requirements for contractor personnel supporting this task per location

e) STD: Add and update all Infrastructure Operations controlled devices in the CMDB within 24 hours of adding or changing configuration of the device.

Deliverables A005 After Action Report A006 Technical Report A007 Briefing Materials A018 Contractor Personnel Assignments and Certifications Matrix

3.2.1.1 The contractor shall administer and manage 690 COG AOR network infrastructure devices and technologies.

This task includes:

- administering and managing infrastructure devices to include routers, switches, load balancers, and wireless local area network (WLAN) devices

- establishing standard rule sets and providing technical analysis, performance optimization, network utilization analysis and overall management of all network infrastructure

- identifying potential threats and managing resolution of security violations

- applying security measures to infrastructure devices

- responding to and resolving incident tickets and outages

- performing network improvement and clean-up

- maintaining and evaluating policies and procedures for systems and services

3.2.1.2 The contractor shall operate and maintain 690 COG AOR network

- operating and maintaining infrastructure devices to include routers, switches, load balancers, and WLAN devices

- auditing and logging all traffic flow using tools to ensure availability of services

- using Government-provided network monitoring tools to perform intrusion detection, identification, and internal/external IT threat analysis

- implementing vulnerability management to ensure security of systems IAW Government policies; applying security measures to infrastructure devices

- responding to and resolving change request actions

- creating and maintaining AS-IS documentation for network infrastructure devices

- responding to and resolving incident tickets and outages; accomplishing network maintenance and ASIs during the Government-prescribed maintenance windows and other time frames

- monitoring and employing hardware and software tools to enhance network security, ensure the confidentiality, integrity and availability of IT resources, and accomplish defensive cyberspace operations and information protection

3.2.1.3 The contractor shall install and configure 690 COG AOR network

This task includes:

- configuring and installing infrastructure devices to include routers, switches, and wireless LAN devices

- maintaining access control lists (ACL) to grant and restrict network access appropriately to users and processes per authorization rules

- installing hardware and software tools; applying security measures to infrastructure devices

- making changes, upgrades, and patches to infrastructure devices

- responding to, accomplishing, and documenting change request and incident ticket actions

3.2.2 Vulnerability Management Operations: The contractor shall administer, operate, update, patch, configure, develop, integrate, install, troubleshoot and maintain vulnerability management systems, tools, tactics, techniques and procedures.

Performance Standards

a) STD: For the assigned Vulnerability Management Operations mission area workload in Appendix 3, Table 3.1, complete 80% of those change requests and incident tickets within 30 days of creation.

b) STD: Ensure that no more than 15% of all the incident tickets and change requests in the Vulnerability Management Operations backlog are more than 60 days old unless coordinated and approved by the Government.

c) STD: IAW TO 00-33A-1109 - AF-GIG Vulnerability Management

d) STD: Complete change request and incident tickets IAW with TPI policies

e) STD: Compliant with Appendix 6 Certifications, Section 3.2.2 Vulnerability Management Operations certification requirements for contractor personnel supporting this task per location

f) STD: Add and update all Vulnerability Management Operations controlled devices in the CMDB within 24 hours of adding or changing configuration of the device.

Deliverables A005 After Action Report A006 Technical Report

3.2.2.1 Vulnerability Assessment: The contractor shall perform vulnerability assessment using AF provided tools.

This task includes:

- scanning, tracking, recording and reporting vulnerabilities using government provided tools

- reporting and uploading scan results to the DISA's Vulnerability Management System (VMS) tool, or its successor, on a monthly or as needed basis for Air Force Base's (AFB) to review and remediate

- performing trend and analysis of vulnerability scan data

- generating reports that identify security posture of the base (i.e. deficiencies, history of repeats, etc.)

- developing draft TOs, SOPs, checklists, guides, best practices and procedures for conducting vulnerability assessments

- automating procedures using scripts, Sequel (SQL)/database administration, or other available technology

- reporting repeat high vulnerabilities to the communications unit monthly

- maintaining vulnerability management tools

Performance Standards

a) STD: Report provided for bases scanned

b) STD: Monthly trend and analysis report provided

c) STD: Results of scan will be uploaded to tool within 24 hours of scan.

AQL: 99% of the time

d) STD: Complies AFI 33-115, Network Operations; TO 00-33A-1001; and TO 00-33A-1109

A012 Vulnerability Assessment Trend and Analysis Report

3.2.2.2 Patch Management: The contractor shall perform patch management for servers, workstations, and infrastructure devices.

This task includes:

- planning software pushes using approved AF enterprise patch management software

- distributing packages to test groups

- troubleshooting software package deployment

- deploying packages to required bases

- reporting status of software pushes

- ensuring servers, workstations and infrastructure devices have latest approved patches

- developing draft TOs, SOPs, checklists, guides, best practices and procedures to support patch management

- automating procedures using scripts and SQL/database administration

- updating the AF compliance tracking tool (currently the AFNet Operations Compliance Tracker (ACT))

a) STD: AFIN equipment and infrastructure devices comply with all orders as reflected in VMS or its successor

AQL: 97% average compliance

b) STD: Compliant with Appendix 6 Certifications, Section 3.2.2.2 Patch Management certification requirements for contractor personnel supporting this task per location

c) STD: Updating the AF compliance tracking tool within three days of patch completions

3.2.2.3 End Point Protection: The contractor shall deploy, manage, troubleshoot and provide technical solutions for the Host Base Security System (HBSS) agent and end point products for all AF clients.

Performance Standards

a) STD: Compliant with Appendix 6 Certifications, Section 3.2.2.3 End Point Protection

3.2.2.3.1 The Contractor shall conduct and manage HBSS operations for securing AF client systems.

The number of AFIN NIPRNet and SIPRNet HBSS managed clients is estimated to be approximately 900,000.

The number of AFNET and AFNET-S HBSS managed clients is estimated to be approximately 900,000.

This task includes:

- scanning, patching and remediating AFIN devices and systems

- configuring, monitoring, operating, managing and maintaining HBSS point products (Anti- Virus (AV), Host Intrusion Prevention System (HIPS), Policy Auditor, and Data Loss Prevention (DLP) products), Agent Handler, ePolicy Orchestrator (ePO), Super Agent Distributed Repository (SADR) servers, SQL management software, and all associated firewalls and server configurations

- developing draft TOs, SOPs, checklists, guides, best practices and procedures

- automating procedures using scripts and SQL/database administration

- providing reports to bases to remediate expired AV signatures

- bringing systems into compliance with security policies

- administering HBSS SQL database; using ePO, SADR servers, and the HBSS to scan, patch and remediate NIPRNet and SIPRNet devices and systems

- taking immediate action to avert suspected security intrusions or violations utilizing vulnerability management tools

- distributing DLP reports to bases for resolution

A013 Data Loss Prevention (DLP) Report

3.2.2.3.2 The Contractor shall ensure compliance with approved security updates, patches, baselines, associated orders, and network defense directives for all AFIN infrastructure and devices.

This task includes testing, coordinating, implementing, tracking all AFIN infrastructure and devices.

The contractor shall meet suspense dates for this task as included in Information Assurance Vulnerability Assessments (IAVA), Command, Control, Communications and Computers Notice to Airman (C4 NOTAM), TCNO, TCTO, CTO, and MTO.

3.2.3 Boundary Operations: The contractor shall administer, manage, operate, maintain, install and configure 690 COG AOR network boundary devices and technologies.

Performance Standards

a) STD: For the assigned Boundary Operations mission area workload in Appendix 3, Table 3.1, complete 80% of those change requests and incident tickets within 30 days of creation.

b) STD: Ensure that no more than 15% of all the incident tickets and change requests in the Boundary Operations backlog are more than 60 days old unless coordinated and approved by the Government.

c) STD: Complete change request and incident tickets IAW with TPI policies

d) STD: Compliant with Appendix 6 Certifications, Section 3.2.3 Boundary Operations certification requirements for contractor personnel supporting this task per location

e) STD: Add and update all Boundary Operations controlled devices in the CMDB within 24 hours of adding or changing configuration of the device.

A005 After Action Report A006 Technical Report

3.2.3.1 The contractor shall administer and manage 690 COG AOR network boundary devices and technologies.

The task includes:

- working with Communications Squadrons and other base-level authorities to maintain and administer security boundary components at locations IAW DoD and AF standards and guidance, using industry best practices

- changing, upgrading, and patching boundary devices requiring two-person compliance through established change management procedures

- participating in project management, planning, implementation and installation to ensure configuration and integration conforms to baseline architecture

- identifying potential threats

- managing resolution of security violations

3.2.3.2 The contractor shall operate and maintain 690 COG AOR network boundary devices and technologies.

This task includes:

- maintaining and operating Intrusion Prevention Systems (IPS)

- troubleshooting and correcting IPS induced service issues

- maintaining physical infrastructure to include troubleshooting and operating system patching

- granting and restricting administrative access to boundary devices according to authorization rules

- working with communication units to maintain and administer security boundary components at locations IAW DoD and AF standards and guidance

- identifying potential threats and managing resolution of security violations

- monitoring and troubleshooting intrusion prevention boundary devices using Government provided toolsets (such as SCOM, SolarWinds, SMARTS and NETCOP/NETCOOL)

- monitoring network boundaries to provide intrusion detection, identification, and internal/external IT threat analysis

- preserving, protecting, recovering and reconstituting friendly cyberspace capabilities before, during and after network attacks

- making changes/upgrades/patches to boundary devices requiring two-person compliance through established change management procedures

- responding to and accomplishing change request actions and documenting changes, upgrades, patches

- responding to outages and resolving and documenting priority incident tickets

- accomplishing network maintenance during the Government-prescribed maintenance windows

- troubleshooting web connectivity problems

3.2.3.3 The contractor shall install and configure network boundary devices and technologies.

This task includes:

- granting and restricting administrative access to boundary devices according to authorization rules

- installing, configuring, operating, maintaining, monitoring, administering, and troubleshooting of network and network defense technologies (e.g., firewalls, application-based firewalls, intrusion detection systems, web proxy devices and servers, and associated software)

- participating in project management, planning, implementation and installation to ensure configuration and integration conforms to baseline architecture

- making changes, upgrades, and patches to boundary devices requiring two-person compliance through established change management procedures

3.2.3.4 The Contractor shall manage and operate enterprise telephony systems.

- conducting centralized management and performing system maintenance on the Enterprise Telephony Management (ETM)platform

- administering ETM client user accounts for authorized personnel

- performing associated accounting management tasks to provide situational awareness of the enterprise Major Command (MAJCOM) voice networks

- operating and maintaining approved Voice Protection System (VPS) devices

- developing rule sets for VPS devices

- performing moves, adds, and changes associated with VPS policy

- responding, resolving and reporting VPS alarms and messages

- maintaining and tracking VPS data necessary to administer the system and generate reports

3.2.3.5 The contractor shall support ETM.

- sustaining and performing system preventative maintenance on the ETM platform

- creating and managing all ETM client user accounts and objects

- performing associated accounting management tasks

- providing situational awareness of all assigned voice networks

3.3 Enterprise Service…