Attachment_J-9_INSD.D10.1_5.12.15.pdf

UNCLASSIFIED//FOUO

UNCLASSIFED//FOUO

SUBJECT MATTER EXPERT SERVICES

TASK ORDER STATEMENT OF WORK (TOSOW)

INSPECTION DIVISION (INSD) – D10

SME SERVICES FOR INSIDER THREAT CENTER (InTC)

Version 1.0

Task Order INSD/D10-1

Authored by:

Lily Monir Matini

Contracting Officer’s Representative (COR)

Federal Bureau of Investigation

TASK LEAD AND COR CONTACT INFORMATION

Task Lead/COR Name Section Chief Dale R. Killinger (Task Lead) &

Lily Monir Matini (COR)

Work Phone Number 202-324-1219(Dale)

202-323-8664(Lily)

Branch/Division/Section/Unit Director’s Office/INSD/Insider Threat Center/Units

Mobile Phone Number 202-359-3506(Dale)

Fax Number 202-324-8256

E-mail Dale.Killinger@ic.fbi.gov

Lily.Matini@ic.fbi.gov

Address

J. Edgar Hoover Building

Attn: Dale R. Killinger

935 Pennsylvania Ave, NW JEH 3646

Washington, DC 20535

SOW CHANGE HISTORY

Date Version Change Description

1.0 Initial Release

3/23/2015 1.1 Updated Section 4.0 Task 2.2 mailto:Dale.Killinger@ic.fbi.gov mailto:Lily.Matini@ic.fbi.gov

Table of Contents

1.0 BACKGROUND

2.0 OBJECTIVES

3.0 SCOPE

4.0 TASKS

5.0 PERIOD OF PERFORMANCE

6.0 CONTRACT TYPE

7.0 PLACE OF PERFORMANCE

8.0 SME LABOR CATEGORY AND HOURS

9.0 SECURITY

10.0 DELIVERY/DELIVERABLES

11.0 GOVERNMENT FURNISHED PROPERTY

12.0 TRAVEL

13.0 SPECIAL REQUIREMENTS

14.0 QUALIFICATIONS

15.0 PERFORMANCE METRICS

SME Services - TOSOW

1.0 BACKGROUND

By Executive Order (E.O.) 13587, Structural Reforms To Improve the Security of Classified

Networks and the Responsible Sharing and Safeguarding of Classified Information, in conjunction with the White House Memorandum on National Insider Threat Policy and

Minimum Standards for Executive Branch Insider Threat Programs, directs all executive branch departments and agencies that have access to classified information to implement an insider threat detection and prevention program.

In 2014, the FBI established the Insider Threat Center (InTC) to act as the central coordinating component for the FBI’s Insider Threat Detection and Prevention Program. The InTC leverages the specific strengths of the present Insider Threat components in place. The InTC supports the centralization of the technical, analysis and administrative personnel within the same component at FBIHQ. The InTC will identify new tools required for a robust Insider Threat Program, identify trends, and incorporate new data sets into analysis from various sources, working closely with internal administrative and investigative components to detect and deter insider threats.

2.0 OBJECTIVES

The objective of this statement of work (SOW) is to acquire the services of a demonstrated

Contractor to provide specialized program support to the FBI’s Insider Threat Center.

3.0 SCOPE

Contractors shall support the InTC by developing and supporting processes to collect, identify, define, aggregate, conceptualize, and prioritize strategic and near-term requirements associated with the InTC’s mission.

Labor for this Task Order will be focused on Contractor Subject Matter Experts (SME’s), including but not limited to Intelligence Analysts.

Furthermore, the Contractor will provide quick reaction efforts when necessary to meet the needs of InTC. This may require personnel from any category to support the rapid development of new processes (e.g. by acquiring data for those processes or assisting in establishing new facilities).

Such actions may require increases to the number of employees supporting the effort, and the

Contractor must be able to quickly provide new qualified personnel.

4.0 TASKS

4.1 Subject Matter Expert – Insider Threat (1)

The Contractor shall provide services focused on the InTC’s operational initiatives in accordance with the InTC’s mission objectives and specific requirements. Contractor personnel supporting this task shall:

Research individuals to determine any insider threat risk /or connections to derogatory information with possible national security concerns;

Research of the FBI’s critical assets to determine security and risk concerns;

Perform the objective evaluation of intelligence and data related to who may pose an insider threat;

Perform the objective analysis of risk to the FBI and its critical assets to formulate risk assessments;

Conduct analytical and critical thinking;

Develop innovative projects to strategically and tactically analyze threat related information and entities;

Provide reactive data analysis support in response to requests from FBI

Headquarters, field offices, and other Government agencies;

Perform quality control of processes and products produced;

Write clear, concise and timely intelligence products that identify, analyze and collate disparate pieces of information;

Make accurate observations and judgments;

Assist in the development of administrative and organizational policies and procedures;

Collaborate and interact with behavioral and social science experts to conduct research and analysis;

Compare and contrast information from different sources;

Prepare, produce, and disseminate both scheduled and unscheduled general intelligence products, such as: briefings, studies, estimates, and assessments memoranda;

Promote and coordinate, where applicable, the sharing of intelligence;

Represent activity in working groups (both internal and external) and committees as substantive authority in subject area;

Define critical intelligence topics and initiate comprehensive or unique research efforts on topics as related to extensive or speculative analytical projects;

Define overall analytical objectives in relation to existing or proposed policy and identify required analytical resources;

Forecast intelligence gaps and initiate development of comprehensive collection plans to address these gaps;

Perform long-range planning in support of existing and projected organizational mission requirements; and

Make assessments as to overall resource capability to answer existing/projected requirements, and identify resource shortfalls.

4.2 Task 2 – Subject Matter Expert - Intelligence Analyst – Insider Threat (4)

The Contractor shall provide personnel services focused on the InTC’s operational initiatives in accordance with the InTC’s mission objectives and specific requirements. Contractor personnel supporting this task will:

Conduct massive data analysis to include development of query techniques, prototype programs and algorithms;

Research individuals to determine any insider threat risk /or connections to derogatory information with possible national security concerns;

Research of the FBI’s critical assets to determine security and risk concerns;

Perform the objective evaluation of intelligence and data related to who may pose an insider threat;

Perform the objective analysis of risk to the FBI and its critical assets to formulate risk assessments;

Conduct analytical and critical thinking;

Develop innovative projects to strategically and tactically analyze threat related information and entities;

Provide reactive data analysis support in response to requests from FBI

Headquarters, field offices, and other Government agencies;

Perform quality control of processes and products produced;

Write clear, concise and timely intelligence products that identify, analyze and collate disparate pieces of information;

Make accurate observations and judgments;

Assist in the development of administrative and organizational policies and procedures;

Collaborate and interact with behavioral and social science experts to conduct research and analysis;

Gather, analyze, evaluate and the prepare recommendations on insider threat matters;

Compare and contrast information from different sources;

Prepare, produce, and disseminate both scheduled and unscheduled general intelligence products, such as: briefings, studies, estimates, and assessments memoranda;

Promote and coordinate, where applicable, the sharing of intelligence;

Represent activity in working groups (both internal and external) and committees as substantive authority in subject area;

Define critical intelligence topics and initiate comprehensive or unique research efforts on topics as related to extensive or speculative analytical projects;

Define overall analytical objectives in relation to existing or proposed policy and identify required analytical resources;

Forecast intelligence gaps and initiate development of comprehensive collection plans to address these gaps;

Perform long-range planning in support of existing and projected organizational mission requirements;

Make assessments as to overall resource capability to answer existing/projected requirements, and identify resource shortfalls; and

Assist in the development of administrative and organizational policies and procedures.

5.0 PERIOD OF PERFORMANCE

Task Order Period of Performance

From: Date of Award To: 12-months commencing upon Task Order execution and includes four 12-month option periods thereafter.

6.0 CONTRACT TYPE

This task order shall be priced as Time and Materials.

7.0 PLACE OF PERFORMANCE

Performance of the contract shall primarily take place onsite at Government facilities in the

Washington, D.C. metropolitan area. Occasional meetings will occur at other locations in the tri-state area of the Washington, D.C. metropolitan area. Travel may be required within the

Continental United States (CONUS) or outside the continental United States (OCONUS). All travel shall have prior approval by the COR and/or Task Lead (TL).

Place of Performance Date

1. FBI Headquarters 935 Pennsylvania Ave; Washington D.C. 20535 Upon Award

8.0 SME LABOR CATEGORY AND HOURS

SME Labor Category Number of

Positions

Annual Hours Core Operating Hours

SME Level V 1 1860 Between 7:30 a.m. - 6:30 pm

SME Level I 4 1860/SME Between 7:30 a.m. - 6:30 pm

It is expected that work days shall be eight (8) hours per day, plus one (1) lunch break averaging thirty (30) minutes. This is based on an average of forty (40) hour work week, unless necessary swing shift arrangements are approved by the Government to accomplish mission goals. Most work performed under this contract shall be during normal working hours (e.g. between 7:30 a.m. – 6:30 pm), Monday through Friday, and within normal business hours as directed by InTC policy, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

9.0 SECURITY

Physical Security

The Contractor shall be responsible for safeguarding all Government equipment, information and property provided for Contractor use. At the close of each work period, Government information, equipment, and materials shall be secured.

Key Control

The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer.

In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the

Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the

Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the

Contractor.

The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by

Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the

Contracting Officer.

Information Security

Performance under this Agreement requires a security clearance of TOP SECRET, SI, TK G, and HUMINT (HCS) control systems as well as Sensitive Compartmented Information

(SCI). Additionally, the FBI may require the Contractor personnel to undergo a polygraph examination. The FBI reserves the right to revoke access to information, facilities, or property where such access is no longer consistent with the FBI’s mission and responsibilities. Knowing, willful, or negligent disclosure of FBI information to unauthorized persons, without prior written

FBI approval, may subject the violator to appropriate penalties and sanctions under the law.

Access to the work facility in this SOW will require the signature of a Non-Disclosure

Agreement (NDA).

All work shall be performed at a Government facility or within Government-approved space.

All contract personnel will be required to sign a NDA prior to accessing CLASSIFIED information and or CLASSIFIED Government systems as well as an NDA regarding SCI related to Insider Threat information.

All information developed as a result of this contract is for the exclusive use of the FBI. All products, threat briefings, and other documentation that are designed and produced by the

Contractor and any other agent of the contract as a result of this contract becomes the property of the FBI.

FBI Chief Security Officer (CSO) for this SOW is Kyle Malo, (202) 324-5841, Kyle.Malo@ic.fbi.gov. All Vendor staff is required to receive a security briefing by FBI CSO prior to performing work on this SOW as well as a Security Division Briefing. FBI Task Lead will coordinate this activity.

Limited Access

Due to the nature of materials relating to relating to the FBI in general, and this SOW in particular, and FBI's requirements to limit access to only those who have a need-to-know, all access to facilities and material will be strictly limited and controlled. Any access to facilities or material by Vendor personnel other than Vendor employee(s) assigned to this SOW must be coordinated through and approved by the Task Lead.

10.0 DELIVERY/DELIVERABLES

The Contractor shall be required to provide deliverables to the Government in support of this task order. The Government will have up to ten (10) business days to review each deliverable product and provide feedback. Industry standard and Commercial-Off-The-Shelf (COTS) software will be used when possible. Disapproved deliverables shall be reworked and resubmitted within ten (10) business days of Contractor notification unless other terms are mutually agreed upon by the Task Order COR and Contractor.

The Contractor employees will provide specialized support including but not limited to, program support services, general guidance, presentations, realistic scenarios and practical exercises for the InTC and the Senior Officials of the InTC.

Facilitate efforts in line with the InTC requirements mandated by the E.O. 13587 and Policy and

Standards.

Coordinate threat briefing materials for FBI Senior Officials.

Coordinate data for the Insider Threat Risk Board meetings.

Communicate regularly with the InTC Senior Officials and personnel to ensure the InTC concerns are being addressed in a timely manner.

Monthly Status Reports

As per the Master Contract, the Contractor shall provide a Monthly Status Report (MSR) due to the CO and COR by the 10 th business day of the following calendar month. The MSR shall summarize the state of the Task Order. This should contain a summary including but not limited to:

Documentation of all work activities and service assistance provided to InTC;

Summary of all service and consultation services provided;

Meeting minutes of interagency meetings, conferences, seminars attended;

summary of items discussed, information obtained, or conclusion reached;

Monthly travel activities and copies of expense reports;

Summary of oral and written briefings of projects and accomplishments required;

Upcoming milestones or significant events;

Additional/surge hours worked (if any, with prior approval from the CO/COR in writing); and

Any Contractor modifications or complications addressed during the month.

Standard Operating Procedures (SOP)

The Contractor shall prepare SOPs for this task order based upon the job taskings and submit this deliverable to the COR and Task Lead for review. This deliverable shall be updated as necessary. This deliverable will be used to train new Government employees as well as new

Contractor personnel.

Meeting Participation and Support

The Contractor shall organize and support meetings required by the Government. This support shall include scheduling, drafting presentation materials, conducting briefings, and other related activities. A list of the formal meetings the Contractor shall be expected to support the following:

Kickoff Meeting

The Contractor shall participate in a Kickoff Meeting for this effort not later than thirty (30) days after task order award. The primary focus of the Kickoff Meeting shall be to establish performance expectations and ensure an understanding of all requirements. In addition, the

Contractor and Government shall clarify any concerns about lines of communication, administrative procedures, or other items necessary to effectively execute the task order.

Periodic Reviews

The Contractor shall participate in periodic review meetings as required by the Government.

These meetings shall be held at least quarterly based on the quality assurance surveillance plan

(QASP).

Other Meetings

The Contractor shall participate in other meetings as required by the Government by preparing presentation materials relating to program status, accomplishments, issues, and deliverables including picture or graphic files. The Contractor shall prepare electronic or hardcopy materials

11.0 GOVERNMENT FURNISHED PROPERTY

The FBI will make reasonable space and support available as necessary to perform the tasks under this agreement. This includes: office space, office equipment, access to FBI computer systems, and any other materials and equipment determined by the FBI as necessary to perform the requirements of this contract. FBI facilities and equipment shall only be used in connection with official performance of the requirements herein. The Contractor is not authorized to obligate the FBI to acquire any materials, or to take any actions on behalf of the FBI that would commit the FBI to incur obligations or to pay the bill. All equipment and supplies shall remain the property of the Government and shall not be removed from government facilities.

12.0 TRAVEL

Under 50 mile trips are required Over 50 mile trips are required

Routine trips as needed Trips not mandatory, but operational need could provide opportunity for travel

13.0 SPECIAL REQUIREMENTS

13.1 Key Personnel / Continuity of Operations (COOP)

No key personnel or COOP requirements.

13.2 Performance Required Beyond Standard Workday

On occasion, Contractor personnel may need to work beyond normal operating hours. Extended service hours are defined as work performed in excess of forty (40) hours per week for a single

Contractor per rate negotiated at time of award. Extended service hours will not be billed without obtaining prior, written approval from the Task Order COR.

13.3 Special Clauses

Technical Clarification Notice

Technical Clarification Notices (TCN) will be used to clarify areas of support required by this task order. TCNs may be used to: prioritize support; further define level, location or schedule of support to be provided; and/or output (e.g. deliverable) requirements. TCNs may be generated by either the Contractor or the Government – but must be fully coordinated and approved by the

Task Order COR prior to execution. TCNs shall not be used to change the intent, scope or value of this task order.

Quick Reaction Support for New Analytic Needs

The Contractor shall support the Government in fielding quick reaction solutions in direct response to high priority analytic needs to extend, enhance, or create new capabilities as needed.

Such support may include any or all of the labor categories listed above. Quick reaction subject matter expertise support may be required on an as needed basis to support emerging missions, accomplish new or urgent objectives, or the pursuit of additional analysis based on specific results of risk management. Such support may require additional personnel or changes to the responsibilities of current personnel.

In each case, a specific Government request will be provided in writing by the Task Order COR via a Technical Clarification Notice (TCN) to the Contractor’s project manager prior to commencing work on a Quick Reaction project.

New Project or New Initiative (Surge) Support)

InTC’s dynamic environment may require responsive support for surge resources to ensure continuity of operations and capacity when major projects are impacted by changes in locations, systems, configurations, and related aspects. Surge support may require up to twenty-five percent

(25%) more man-hours. Surge support may be needed for entirely new mission objectives/initiatives, or system upgrades (hardware, software, networks, and communications) including but not limited to the following areas:

Subject Matter Experts, including but not limited to Intelligence Analysts; and the support of additional or other locations designated by the InTC in the Washington

Metropolitan Area.

The Contractor agrees to continue to provide sufficient personnel to perform critical tasks already in operation or schedule, and shall be guided by the instructions issued by the Task Order

Contracting Officer (CO) and Task Order COR.

Government Rights to Documentation

The Contractor shall furnish all documents developed under this task order on an unrestricted basis to the FBI. The FBI, at its discretion, will have the right to reproduce, alter, distribute, or otherwise make use of the entire document, or portions thereof.

Training

Training of Contractors shall be performed by the Contractor at its own expense, except:

When the Government has given prior approval for training to meet special requirements and that the training assists the FBI in maintaining knowledge of evolving and emerging technology.

Limited training of Contractors may be authorized when the Government changes hardware or software and it is determined to be of the Government’s best interest.

The Government will not authorize training for Contractor personnel to attend

Seminars, Symposiums, or user Group Conferences unless certified and approved by the COR in conjunction with the FBI CO.

14.0 QUALIFICATIONS

14.1 Educational Requirements - Task 1 Subject Matter Expert

B.A. or B.S. degree or equivalent experience in a related field. Advanced degrees are preferred.

14.2 Experience Requirements

The Contractor employee will have at 20 years general experience, inclusive of 15 years prior experience employed with a USIC agency as a Special Agent, Case Officer, Counterintelligence

Specialist, or Intelligence Analyst conducting counterintelligence investigations, or prior work experience in the security programs.

The Contractor employee shall be a demonstrated expert in relation to the requirements encompassed throughout the SOW and in the subject matter being written and briefed; shall have established credentials in ensuring the maintenance of professional standards and shall possess comprehensive experience in providing high-quality specialized support to various programs.

The Contractor employee shall provide intelligence reports and briefings to executive level audiences in the public and private sectors.

The Contractor employee should possess demonstrated capability to produce high-quality written products applicable to insider threats. Specifically beneficial is experience working counterintelligence and security matters.

Preference is for the Contractor to have extensive knowledge of FBI policies, procedures and protocols.

Excellent oral and written communication skills are required.

14.3 Educational Requirements - Task 2 Subject Matter Expert - Intelligence Analyst –

Insider Threat

B.A. or B.S. degree or equivalent experience in a related field. Degrees in economics or statistics are preferred.

14.4 Experience Requirements

The Contractor employee will have six (6) or more years of prior experience employed with a

USIC agency as a Special Agent, Case Officer, Counterintelligence Specialist, or Intelligence

Analyst conducting counterintelligence investigations, or prior work experience in the security programs including 4 years specialized experience as an intelligence analyst.

The Contractor should possess demonstrated capability in big data analytics, data modeling, or data science related to intelligence analysis. Including knowledge and demonstrated competence working with the following:

Software applications (Microsoft ACCESS, EXCEL, POWERPOINT, WORD, etc);

Public source databases (i.e. Accurint, Lexis Nexis);

Analytical tools (Analyst Notebook, Palantir, etc);

Advanced knowledge of Microsoft Excel and Microsoft Access to include creating equations, formulas and macros; and

Working knowledge of Visual Basic for Applications (VBA) and a REGEX.

Excellent oral and written communication skills are required.

15.0 PERFORMANCE METRICS

The contractor shall develop and submit a Quality Assurance Surveillance Plan (QASP) for this task order which outlines the performance standards, surveillance methods, metrics and penalties/rewards. The following shall be included in the QASP.

The following four criteria will be used to assess the quality of tasks performed and deliverables submitted in this task order:

The contractor’s overall performance on this task order as well as staffing and replacing personnel.

The Contractor response to urgent communications within 1 hour 90% of the time.

The Contractor response to routine communications within 8 hours 90% of the time.

The Contractor’s submission of deliverables in a timely manner and corrections required by the government on written documents within 10 working days.