ATTACHMENT_1_-_PWS_WEB_HOSTING_SERVICES.doc

ATTACHMENT 1

PERFORMANCE WORK STATEMENT

WEB HOSTING AND SOCIAL MEDIA SECURITY SERVICES

NSW RECRUITING DIRECTORATE

1.0 BACKGROUND

Naval Special Warfare Recruiting Directorate runs the authoritative websites sealswcc.com, leapfrogs.sealswcc.com, Training Forum, and mobile applications to inform and guide high potential candidates interested in becoming Navy SEALs (Sea, Air, Land special operators) and SWCC (Special Warfare Combatant Craft Crewmen). Intrinsic to its continued operation, the websites, forum and applications must be backed up by high quality and responsive technical support and server support to: ensure server security, database security, steady state Internet connection, and protection of the personal identifiable information (PII) of candidates participating in the forum.

2.0

OBJECTIVES

The purpose of this proposal is to contract for enhanced, comprehensive technical web hosting services. Services will ensure continuous website support for the official U.S. Navy websites, forum and apps, during both routine and extreme periods of usage. The Contractor will provide secure host servers, flexible bandwidth, security services and maintenance for Recruiting Directorate public websites, forum, and apps. The Contractor must be ready to assume website support on 12 July 2014 to ensure continuous service to the NSW Recruiting Directorate.

3.0

SCOPE

The Contractor shall provide the personnel, management, materials, and customer service required to ensure the security and continuity of the websites, forum, and apps.

4.0

REQUIREMENTS

4.1

WEB HOSTING SUPPLIES/SERVICES

The Contractor shall provide an array of web hosting services that allows for increased bandwidth, with room for growth and enhanced networking equipment as needed. These services include:

4.1.1 Managed dedicated server hosting.

4.1.2 24x7x365 emergency telephone and email technical support.

4.1.3 24x7x365 monitoring of server resources, index file change activity and latency.

4.1.4 Perimeter managed firewall protection and policy configuration.

4.1.5 Anti-virus & access protection software and virus remediation.

4.1.6 Full Root / Administrative server access to servers.

4.1.7 Client provided software installation and general website technical support.

4.1.8 Client control panel integration including website, DNS and file management.

4.1.9 Domain name management services to purchase, renew, and edit contact details.

4.1.10 Managed daily data backup service with versioning and retention.

4.1.11 File backup restoration services and remediation.

4.1.12 Microsoft operating system security updates installation and support.

4.1.13 File and folder Access Control List (ACL) permission configuration and management.

4.1.14 Raw website log compression and event log management.

4.1.15 Access to shared hosting resources including email, MySQL and MS SQL databases.

4.1.16 Microsoft Network Load Balancing (NLB) – with Class-C Affinity.

4.1.18 VV Engine file synchronization software between load-balanced servers.

4.1.18 Maintenance of shared configuration and file synchronization between load-balanced servers.

4.1.19 Maintenance and management of Internet Information Services 8.5.

4.2

BANDWIDTH SERVICES

The Contractor will provide two levels of bandwidth services as described herein and be prepared to move seamlessly from level 1 to level 2 as may be required to ensure uninterrupted web service. The Contractor will invoice each month only for the service provided under each level. The Contractor will advise the NSW Recruiting Directorate when approaching the contract limits for each level. Level 1 support is assumed to be the steady state. Level 2 will be delivered during higher website use.

4.2.1 Level 1: Sustained, committed, monthly bandwidth at a minimum of 25Mbps per month.

4.2.2 Level 2: Additional 90 days per year of committed bandwidth at 25Mbps to be made available on demand as needed for peak traffic outside normal allocated bandwidth. Unused bandwidth at this level, purchased separately and committed, may be held in reserve if unneeded and does not expire until the end of the contract year. Excess, unused bandwidth will not be billed to the Government.

4.3

TECHNICAL MANAGEMENT / HOSTING REQUIREMENTS FOR ONLINE FORUM

The Contractor will be required to provide technical and database support for an online forum, aka bulletin board, with commercial software provided by Naval Special Warfare. This forum resides on the website www.sealswcc.com.

4.4

WEB DEVELOPMENT AND CONSULTATION SERVICES

The Contractor will propose a maximum number of technical support hours, if such a limit exists, that would be made available to the NSW Recruiting Directorate in support of each of the specific requirements below. The Contractor will invoice each month only for the service provided under each item of support. In the bid proposal, the Contractor will establish maximum costs for each item anticipated over the period of performance (12 months) and may not exceed that cost without contract modification.

4.4.1 Vulnerability Scan and Security Assessment Report: Contractor will conduct a website and web server threat assessment and vulnerability test against all servers for security related issues a minimum of every six months. Contractor will prepare a report for websites, subdomains and apps. The assessment report will summarize recommendations to repair all threats discovered and will include:

1) A checking of all files to see if hacked or would otherwise enable a dangerous gateway;

2) A manual review of all databases to see if any fields have been injected with harmful code; and,

3) A review of any previous security reports to check for outstanding issues.

4.4.2 Web Application Firewall: Contractor will provide additional management and consulting services as follows:

1) On-going general configuration for the handling of false-positive reports;

2) Creation of exception policies and IP whitelist management;

3) Manual synchronization of configuration and exception configurations to the load-balanced server; and,

4) The purchase, installation and configuration of software upgrades.

4.4.3 Mobile Application Maintenance and Updates: Contractor will ensure the continuity, maintenance, and currency of the NSW Physical Screening Test (PST) Training mobile application. Initial development is not required under this Performance Work Statement.

4.4.4 General Updates to Computer Code and Software: Contractor will implement recommended security modifications and general code modifications per request.

5.0

DELIVERABLES

The Contractor shall adhere to the following deliverables table.

6.0

CONTRACTOR MANPOWER REPORTING

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Recruiting Directorate via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2013. Contractors may direct questions to the help desk at help desk at: http://www.ecmra.mil.

7.0

CONTRACTOR TRAVEL

No Contractor travel is planned or anticipated for the proper performance of this contract.

8.0

SECURITY

8.1 Perform offsite work with Personally Identifiable Information (PII) only on systems that meet Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) requirements and will be updated on an on-going basis to continue to meet DIACAP requirements. Systems must have and maintain an Authority to Operate (ATO) or if acceptable to the government, an Interim Authority to Operate (IATO).

8.2 Contractor and all Contractor personnel with access to or responsibility for nonpublic Government data under this contract shall comply with DoD Directive 8500.1 Information Assurance (IA), DoD Instruction 8500.2 Information Assurance (IA) Implementation, DoD Directive 5400.11 DoD Privacy Program, DoD 6025.18-R DoD Health Information Privacy Regulation, DoD 5200.2-R Personnel Security Program, and Homeland Security Presidential Directive (HSPD) 12.

8.3 Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data to ensure the confidentiality, integrity, and availability of government data.

8.4 Contractor systems and information networks that receive, transmit, store, or process nonpublic government data must be accredited according to DoD I 8510.01 DoD Information Assurance Certification and Accreditation Process (DIACAP) and comply with annual Federal Information Security Management Act (FISMA) security control testing. All systems subject to DIACAP must present evidence of Certification and Accreditation (C&A) testing in the form System Identification Profile (SIP), DIACAP Implementation Plan (DIP), DIACAP Scorecard and Plan of Action and Milestones (POA&M). Evidence of FISMA compliance must be presented in the form of a POA&M. The Contractor will be responsible for the cost of IA C&A and FISMA testing required for any Contractor owned and operated network, facility and/or application processing DoD information.

8.5 Contractor personnel with access to or responsibility for nonpublic Government data under this contract must comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the Common Access Card (CAC) for NSW and must:

8.5.1 Be CAC or PIV ready prior to reporting for work. At minimum all Contractor personnel must obtain/maintain a favorable FBI National Criminal History Check (fingerprint check), two forms of identity proofed identification (I-9 document), and submit a National Agency Check and Law Credit (NACLAC) vetting package for processing. Obtaining CAC or PIV ready status is the responsibility of the contracting agency. It is the responsibility of the contracting agency to notify NSW when this is complete.

8.5.2 Be citizens of the United States.

8.5.3 Maintain favorable FBI National Criminal History checks and ensure completion and successful adjudication of a NACLAC as required for Federal employment.

8.2 The Contractor shall report immediately to the COR discovery of any Privacy breach.

9.0

GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/INFORMATION (GFP/GFE/GFI)

The Government will provide electronic files for the above mentioned websites and software to operate the online bulletin board.

10.0

QUALITY CONTROL

The contractor shall implement and maintain a Quality Control Plan (QCP) to ensure work performed conforms to the scope of work and meets the requirements under this PWS. The QCP shall, at a minimum provide a method for performing inspections; identifying, correcting and preventing problems/defective service; addressing customer complaints, and improving the quality of services over the life of the contract.

11.0

QUALITY ASSURANCE

11.1 The Government reserves the right to perform inspections and surveillance to evaluate the Contractor’s compliance to the contract terms and performance of the requirements in the PWS. The Government will make every effort to ensure that the surveillance methods described below are conducted in an objective, fair, and consistent manner.

11.1.1 Periodic Surveillance. This action occurs when the COR or other Government official observes a deficiency. Examples include evidence from accidents, incidents, or delays. Regardless of where in the line-of-duty the COR observes contractual procedures not being followed, he/she has an obligation to document and report the deficiency to the Contracting Officer.

11.1.2 Customer Complaint Surveillance. This action is instituted when the COR receives a complaint from a stakeholder regarding contractor service. The COR will obtain the complaint in writing and then conduct an investigation to determine its validity. If the complaint is deemed valid, the COR will immediately notify the contracting Officer for action. The COR will notify both the Contract Manager and the complainant of the Government’s response to their complaint.

11.2 Contract Discrepancy Report (CDR). In the event of unsatisfactory contractor performance, the COR or CO will issue a CDR that will explain the circumstances and findings concerning the incomplete or unsatisfactory service. The contractor shall acknowledge receipt of the CDR and respond in writing as to how he/she shall correct the unacceptable performance and avoid a recurrence. The Government will review the contractor's corrective action response to determine acceptability and will use any completed CDR as part of an overall evaluation of Contractor performance when determining present or future contractual actions.

11.3 The table below identifies the Critical Performance Elements and the respective Performance Standards and Acceptable Quality Levels (AQLs) which the Government will use to determine contractor performance.

12.0

APPLICABLE DOCUMENTS

13.0

PLACE OF PERFORMANCE

Work shall be performed at the Contractor’s facilities and at the location of the servers to be employed.

14.0

PERIOD OF PERFORMANCE

Base Year: 12 July 2014 – 11 July 2015

Option Year 1: 12 July 2015 – 11 July 2016, if exercised

Option Year 2: 12 July 2016 – 11 July 2017, if exercised

Option Year 3: 12 July 2017 – 11 July 2018, if exercised

Option Year 4: 12 July 2018 – 11 July 2019, if exercised