Attachment_1_-_Performance_Work_Statement_(PWS).pdf

ATTACHMENT 1

PERFORMANCE WORK STATEMENT

WEB HOSTING AND SOCIAL MEDIA SECURITY SERVICES

Naval Special Warfare Assessment Team

1.0 BACKGROUND

The Naval Special Warfare Assessment Team runs the authoritative websites www.sealswcc.com, www.leapfrogs.navy, and Training Forum (embedded in www.sealswcc.com) to inform and guide high potential candidates interested in becoming Navy SEALs (Sea, Air, Land special operators) and SWCC (Special Warfare Combatant Craft Crewmen). Intrinsic to its continued operation, the websites and forum must be supported by high-quality and responsive technical and server support to: ensure server security, database security, steady state Internet connection, and protection of the personal identifiable information (PII) of candidates participating in the forum.

2.0 OBJECTIVES

The objectives of this Performance Work Statement (PWS) is to contract for enhanced, comprehensive technical web hosting services. Services will ensure continuous website support for the official U.S.

Navy websites and forum, during both routine and extreme periods of usage. The Contractor shall provide secure host servers, flexible bandwidth, security services, and maintenance for the Naval Special Warfare Assessment Team public websites and forum. The Contractor shall be ready to assume website support on 12 July 2019 to ensure continuous service to the Naval Special Warfare Assessment Team.

3.0 SCOPE

The Contractor shall provide the personnel, management, materials, and customer service required to ensure the security and continuity of the websites and forum. The Government reserves the right to incorporate any additional related services into this PWS throughout the performance of the contract.

All additions will be negotiated with the Contractor and incorporated via modification.

4.0 REQUIREMENTS

The Contractor will provide the following services and invoice each month, or as otherwise required throughout the performance of the contract.

4.1 WEB HOSTING SUPPLIES/SERVICES

The Contractor shall provide an array of web hosting services and enhanced networking equipment as needed. These services include:

4.1.1 Managed dedicated multi-homed server hosting.

4.1.2 24x7x365 emergency telephone and email technical support with immediate response.

4.1.3 24x7x365 monitoring of server resources, index file change activity and latency.

4.1.4 Perimeter managed firewall protection and policy configuration.

4.1.5 Anti-virus & access protection software and virus remediation.

4.1.6 Full Root / Administrative server access to servers.

4.1.7 Client provided software installation and general website technical support.

http://www.sealswcc.com/ http://www.leapfrogs.navy/ http://www.sealswcc.com/

4.1.8 Client control panel integration including website, DNS and file management.

4.1.9 Domain name management services to purchase, renew, and edit contact details.

4.1.10 Managed daily data backup service with versioning and retention.

4.1.11 File backup restoration services and remediation.

4.1.12 Microsoft operating system security updates installation and support.

4.1.13 File and folder Access Control List (ACL) permission configuration and management.

4.1.14 Raw website log compression and event log management.

4.1.15 Access to shared hosting resources including email, MySQL and MS SQL databases.

4.1.16 Microsoft Network Load Balancing (NLB) – with Class-C Affinity.

4.1.17 VV Engine file synchronization software between load-balanced servers.

4.1.18 Maintenance of shared configuration and file synchronization between load-balanced servers.

4.1.19 Maintenance and management of Internet Information Services.

4.1.20 Replacement/upgrade of servers in Option Year 3.

4.2 BANDWIDTH SERVICES

The Contractor shall provide sustained, committed, monthly bandwidth at a minimum of 50Mbps per month.

4.3 TECHNICAL MANAGEMENT / HOSTING REQUIREMENTS FOR ONLINE FORUM

The Contractor shall be required to provide technical and database support for an online forum, aka bulletin board, with commercial software provided by Naval Special Warfare. This forum resides on the website www.sealswcc.com.

4.4 WEB DEVELOPMENT AND CONSULTATION SERVICES

The Contractor shall support requirements below.

4.4.1 Vulnerability Scan and Security Assessment Report: Contractor shall conduct a website and web server threat assessment and vulnerability test against all servers for security related issues every three months. Contractor shall prepare a quarterly report for websites and subdomains.

The assessment report will summarize recommendations to repair all threats discovered and will include:

a) Checking of all files to see if hacked or would otherwise enable a dangerous gateway;

b) Manual review of all databases to see if any fields have been injected with harmful code; and,

c) Review of any previous security reports to check for outstanding issues.

4.4.2 Incident Response: In the event of a breach of site security, the Contractor shall:

a) Perform a vulnerability scan and provide a security assessment report within 12 hours.

b) Perform mitigation measures up to and including server isolation and quarantine.

4.4.3 Web Application Firewall: Contractor shall provide additional management and consulting services as follows:

a) On-going general configuration for the handling of false-positive reports;

b) Creation of exception policies and IP whitelist management;

http://www.sealswcc.com/

c) Manual synchronization of configuration and exception configurations to the load-balanced server; and,

d) The purchase, installation and configuration of software upgrades.

4.4.4 General Updates to Computer Code and Software: Contractor shall implement Government recommended security modifications and general code modifications as needed to maintain updates to website code or software.

5.0 DELIVERABLES

The Contractor shall adhere to the following deliverables:

Deliverable PWS Ref. Delivery Date Website and web server threat assessment and vulnerability Test Report

4.4.1 Submit quarterly written report

within 1 week of assessment completion

Incident Response 4.4.2 Submit written report within 12 hours of detected incident.

Report of PII Breach 5 Report by phone or E-mail immediately upon discovery

6.0 CONTRACTOR MANPOWER REPORTING

The Contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Naval Special Warfare Assessment Team via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk at help desk at: http://www.ecmra.mil.

7.0 CONTRACTOR TRAVEL

No Contractor travel is planned or anticipated for the performance of this contract.

8.0 CONTRACTOR SECURITY REQUIREMENTS

8.1 Contractor shall perform offsite work with Personally Identifiable Information (PII) only on systems that meet Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) requirements and will be updated on an on-going basis to continue to meet DIACAP requirements.

8.2 Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all data to ensure the confidentiality, integrity, and availability of Government data. The Contractor shall provide and maintain a 24x7x365 server technician at the location of their servers to be http://www.ecmra.mil/ http://www.ecmra.mil/ employed.

8.3 All systems subject to (DIACAP) must present evidence of Certification and Accreditation (C&A) testing in the form System Identification Profile (SIP), DIACAP Implementation Plan (DIP), DIACAP Scorecard and Plan of Action and Milestones (POA&M). Evidence of FISMA compliance must be presented in the form of a POA&M. The Contractor will be responsible for the cost of IA C&A and FISMA testing required for any Contractor owned and operated network, facility and/or application processing DoD information.

8.4 All Contractor personnel must be citizens of the United States.

8.5 The Contractor shall report immediately to the Contracting Officers Representative (COR) discovery of any Privacy breach.

9.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/INFORMATION

(GFP/GFE/GFI)

The Government will provide electronic files and administrative access for the above mentioned websites and software to operate the online bulletin board upon contract award.

10.0 QUALITY CONTROL

The Contractor shall implement and maintain a Quality Control Plan (QCP) to ensure work performed conforms to the scope of work and meets the requirements under this PWS. The QCP shall, at a minimum provide a method for performing inspections; identifying, correcting and preventing problems/defective service; addressing customer complaints, and improving the quality of services over the life of the contract.

11.0 QUALITY ASSURANCE

11.1 The Government reserves the right to perform inspections and surveillance to evaluate the Contractor’s compliance to the contract terms and performance of the requirements in the PWS. The Government will make every effort to ensure that the surveillance methods described below are conducted in an objective, fair, and consistent manner.

11.1.1 Periodic Surveillance. This action occurs when the COR or other Government official observes a deficiency. Examples include evidence from accidents, incidents, or delays. Regardless of where in the line-of-duty the COR observes contractual procedures not being followed, he/she has an obligation to document and report the deficiency to the Contracting Officer (CO).

11.1.2 Customer Complaint Surveillance. This action is instituted when the COR receives a complaint from a stakeholder regarding contractor service. The COR will obtain the complaint in writing and then conduct an investigation to determine its validity. If the complaint is deemed valid, the COR will immediately notify the contracting Officer for action. The COR will notify both the Contract Manager and the complainant of the Government’s response to their complaint.

11.2 Contract Discrepancy Report (CDR). In the event of unsatisfactory contractor performance, the COR or CO will issue a CDR that will explain the circumstances and findings concerning the incomplete or unsatisfactory service. The contractor shall acknowledge receipt of the CDR and respond in writing as to how he/she shall correct the unacceptable performance and avoid a recurrence.

The Government will review the contractor's corrective action response to determine acceptability and will use any completed CDR as part of an overall evaluation of Contractor performance when determining present or future contractual actions.

11.3 The table below identifies the Critical Performance Elements and the respective Performance Standards and Acceptable Quality Levels (AQLs) which the Government will use to determine contractor performance.

Critical Performance Element

Applicable

PWS

Section

Performance Standard

Acceptable Quality Level

24/7/365 database support & programming updates 4.1

Immediate phone or E-mail response with Client

Immediate phone or E-mail response with Client within 24 hours

Website/Forum Intrusion Prevention/PII protection/General Security

4.4.2 8.1

Industry standard protection

Quarantine and elimination of Intrusions; Zero breaches of PII, detailed reports

Website/Forum & Web Application Firewall technical support

4.4.3 Immediate phone/email response with Client

Immediate phone or E-mail response with Client within 24 hours

Bandwidth service for website 4.2 Commensurate with site visitor demand, at least 50 mbps

Commensurate with site visitor demand, at least 50 mbps

Website and web server threat assessment and vulnerability test

5.0 Industry standard

protection Quarterly

12.0 APPLICABLE DOCUMENTS

Document Web link

DoDI 8510.01, DoD Information Assurance Certification and Accreditation Process (DIACAP) http://www.dtic.mil/whs/directives/corres/pdf/851001p.

pdf

13.0 PLACE OF PERFORMANCE

Work shall be performed at the Contractor’s facilities and at the location of the servers to be employed.

For Government inspection and surveillance purposes, the Contractor’s server location shall be within a http://www.dtic.mil/whs/directives/corres/pdf/851001p.pdf http://www.dtic.mil/whs/directives/corres/pdf/851001p.pdf fifty (50) mile radius of the Government site, Naval Amphibious Base (NAB) Coronado, California.

14.0 PERIOD OF PERFORMANCE

Contract performance shall be for a 12-month base from the date of award. Four twelve month options periods will be included.