GSM-O Task Order-3 Final RFP 02-09-2011.pdf

HC1028-10-R-2000

Amendment 0002 i

GIG Services Management (GSM) – Operations (GSM-O) Task Order #GSM-O-03

GSM-O Net Assurance Support

Based on GSM-O PWS

Contract Number: (completed by the KO at time of TO award)

Task Order Number: (completed by the KO at time of TO award)

GSM-O Tracking Number: TO #GSM-O-03

Contents of this Task Order:

1 Task Monitors ………………………………………………………..……… 1 2 Task Order Title ………………………………………………..…………… 1 3 Background ………………………………………………………….……… 1 4 Objectives ……………………………………………………….………….. 2 5 Scope …………………………….……………………………….…..…….. 2 6 Performance Requirements ……………………………….……………… 3 7 Performance Standards ……………………………………….………….. 4 8 Incentives …………………………………………………………………… 4 9 Place of Performance ……………………………………………………… 4 10 Period of Performance …………………………………………..………… 5 11 Delivery Schedule ………………………………………………..………… 5 12 Security ……………………………………………………………………… 5 13 Government-Furnished Equipment (GFE)/Government-Furnished

Information (GFI) …………………………………………………………… 6 14 Other Pertinent Information or Special Considerations ……………….. 6 15 Section 508 Accessibility Standards ……………………………………… 6

Appendix A – Definitions …………………………………………………………… A-1 Appendix B – Net Assurance Location Data ………………… …………….… B-1 Appendix C – Government Furnished Equipment/Capabilities ……………...… C-1 Appendix D – Government Furnished Information (GFI) …………….………… D-1 Appendix E – Functional Requirements …………………………………….…… E-1 Appendix F – [Not Used this Task Order] ……………………………………….. F-1 Appendix G – Contract Data Requirements List (CDRLs) Items ………..…..… G-1 Appendix H – List of Data Capture Reports and Data Extracts ….……….....… H-1 Appendix I – Draft QASP for this TO ……………….……………………….....… I-1 Appendix J – DD Form 1423 (CDRL) Set for this TO …………………….....… J-1

1. Task Monitors (TMs).

a. Primary TM.

Name: TBD

Organization: TBD

Department of Defense Activity Address Code (DODAAC):

TBD

Address:

Phone Number: TBD

Fax Number: TBD

E-Mail Address: TBD

b. Alternate TM.

Name: TBD Organization: TBD

DODAAC: TBD

Address: TBD Phone Number: TBD Fax Number: TBD E-Mail Address: TBD

2. Task Order Title.

GSM-O Net Assurance Support

3. Background.

a. DISA provides networking support to its national security customers via GIG/DISN capabilities which are deployed and operated worldwide. GIG/DISN capabilities are functionally a system-of-systems entity that is in a continuing sustainment phase of its life cycle.

b. The Government (DISA) acts in the role of “the provider of DISN services” to its DISN customers; support from existing contract(s) contributes to this overall mission by outsourcing much of the labor effort needed to plan, evolve, operate and sustain the DISN capabilities. The GSM-O contract, and other GSM capabilities, will replace services from the existing DGS contract upon its expiration.

c. The GSM Program supports the GIG/DISN infrastructure (see definition in Appendix A of this Task Order (TO)) through the combined efforts of contractors from the following sources:

• Contractor support from the GSM-O contract (the basis for this TO), providing operation, sustainment and assurance of the DISN infrastructure

• Contractor support from the GSM-ETI multiple-award sources (the basis for the ETI TOs) which provide engineering and implementation services in support of the DISN infrastructure

• Contractor support from the GSM-P&S multiple-award sources which provide projects and support services in support of the DISN infrastructure

d. Contractor capabilities from GSM-O, -ETI and –P&S TOs are needed to succeed those from existing TOs from previous contracts (primarily the DGS contracts) as those contracts reach the expiration of their respective periods of performance.

e. Net Assurance capabilities are provided and applied on a per-site basis when ordered by DISA. The specific list of sites to be supported by this task order is described in the Scope paragraph below.

4. Objectives:

The Contractor shall provide Net Assurance services, as described in paragraph 6, to satisfy the performance standards stated in paragraph 7 of this TO. The services are necessary on a continuing basis to enable the Government to provide DISN services to DISN customers.

5. Scope.

a. As detailed in paragraph 6 below, the Contractor shall provide Net Assurance services by performing the functional activities that are described in the following GSM-O PWS sub-paragraphs:

• 4.2 Security

• 4.3 Reports and Controls

• 4.4 Cost Management and Reporting

• 4.5 Business-Related Metrics

• 5 Transition Activities

• 7 Net Assurance Operations

• 7.1 Computer Network Defense – Protect Activities

• 7.2 Computer Network Defense – Detect Activities

• 7.3 Computer Network Defense – Response Activities

• 7.4 Computer Network Defense Sustainment Activities

b. Note: Requirements of PWS paragraph 3 are not cited in the list above because those requirements, which apply to the performance of this TO, are all addressed by portions of this Task Order template.

c. The functional activities of this TO shall be executed in support of the named DISN site locations, and the GIG infrastructure capabilities located therein, as described in TO Appendix B, plus new or modified capabilities as ordered by the Government during the period of this TO.

6. Performance Requirements.

The performance requirements of this TO are derived from the corresponding requirements of the GSM-O PWS. The requirements described below are subject to the following conditions:

• The definitions stated in Appendix A of this TO shall be applicable to all task work.

• The functional activities described in this paragraph are to be applied at the worldwide locations as listed in Appendix B of this TO.

6.1 Transition Requirements

a. The Contractor shall satisfy the requirements of Appendix E paragraph 5, including all subparagraphs thereto, of this TO.

b. The scope of the Contract Initiation Review, responding to Appendix E paragraph 5.1, shall be based on the scope of work of this task order (i.e. TO tasks 6.2 – 6.6 including all subordinate paragraphs thereto, and 6.4). There will be CIR-related activities in the other GSM-O task orders; those activities may be combined if scheduling permits; the Government’s intent is to provide complete coverage of all PWS activities with minimal duplication of start-up actions. CDRLs that were already reviewed by the TO-1 CIR are not required to be reviewed again.

c. The scope of the Transition Plan and its execution, responding to Appendix E paragraphs 5.2 and 5.3, shall be based on the scope of work of this task order (i.e. TO tasks 6.2 – 6.6 including all subordinate paragraphs thereto, and 6.4) that the Contractor recommends be subject to verification as the basis for commencing actual work. The Government’s intent is that transition-related activities be eventually planned and executed in an integrated effort where conditions permit.

6.2 Management Requirements

The Contractor shall satisfy the requirements of Appendix E paragraph 4.2, 4.3, 4.4, and

4.5 including all subparagraphs thereto, of this TO.

6.3 Computer Network Defense – Protect Activities

The Contractor shall satisfy the requirements of Appendix E paragraph 7.1, including all subparagraphs thereto, of this TO.

6.4 Computer Network Defense – Detect Activities

The Contractor shall satisfy the requirements of Appendix E paragraph 7.2, including all subparagraphs thereto, of this TO.

6.5 Computer Network Defense – Response Activities

The Contractor shall satisfy the requirements of Appendix E paragraph 7.3, including all subparagraphs thereto, of this TO.

6.6 Computer Network Defense Sustainment Activities

The Contractor shall satisfy the requirements of Appendix E paragraph 7.4, including all subparagraphs thereto, of this TO.

7. Performance Standards.

The performance standards applicable to the requirements of paragraph 6 of this TO are initially identified in the Appendix E activities to be controlled. The table of standards is provided at the end of the draft QASP at Appendix I of this TO.

8. Incentives

a. Incentive payments, as described in the QASP for this TO, are applicable to the following tasks of this TO:

TO

Paragraph

Incentive? Type Description

6.1 with all subparas thereto

Yes QASP Perf Incentive

Transition

6.2 with all subparas thereto

Yes QASP Perf Incentive

Management

6.3 with all subparas thereto

Yes QASP Perf Incentive

CND – Protect Activities

6.4 with all subparas thereto

Yes QASP Perf Incentive

CND – Detect Activities

6.5 with all subparas thereto

Yes QASP Perf Incentive

CND – Response Activities

6.6 with all subparas thereto

Yes QASP Perf Incentive

CND Sustainment Activities

b. Specific required standards, metrics, measures, surveillance, and associated details including the composition of the incentive pool and how specific awards are to be made, are as described in the QASP.

9. Place of Performance.

a. Place of Performance: The duties of the GSM contractors shall be performed at Government Facilities (GF), including but not limited to the following locations: DISA facility Chambersburg, PA, and other locations as listed in Appendix B of this TO. The use of Contractor Facilities (CF) requires Government approval.

b. Alternate Place of Performance –Unforeseen Conditions: Contractor employees may be required to work at home, at another approved activity within the local travel area, or at the Contractor’s facility with Government approval, in cases of unforeseen conditions or situations (e.g., pandemic conditions, exercises, etc.). Any Government equipment such as laptops or phones provided to Contractor personnel shall be returned at a time mutually agreeable to both parties. Contracting Officer Representative (COR)/Task Monitor (TM) approval is required. The Contractor shall prepare all deliverables and other contract documentation utilizing Contractor resources. To the extent possible, the Contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the Contractor may request an equitable adjustment.

10. Period of Performance.

This TO period of performance is for a period of 365 calendar days after TO award. The Government, at its option, may extend the original period of performance.

11. Delivery Schedule.

a. The schedule for performance of service capabilities as described in Task Order paragraph 6 is continuous. The CND support provided at site locations shall be executed on a continuing 24x7 shift basis.

b. Each task (sub-paragraph) of paragraph 6 above identifies (in TO Appendix E) the required services outcomes. Deliverables to be provided as evidence of required performance are also identified in each task and are listed in the table at Appendix G to this TO. Each CDRL is referenced to the task activity of this TO that requires it.

c. In addition (see PWS 3.7) the Government requires that the Contractor provide data inputs (called Data Capture Records) to established tool repositories, and provide data records (called Data Extracts) of accomplished tasks in a manner that can be directly viewed by the Government. These data inputs and extracts are actions that shall be performed by the Contractor during required tasks using Government-directed tools (most of which will be part of the GSM-OSS). Where such required data inputs and records are applicable, the TO Appendix E paragraph identifies these immediately following the identification of CDRLs. These required data inputs are listed in this task order at Appendix H.

12. Security.

a. Security shall be in accordance with the GSM-O DD254. Performance required by this TO will be up to the TOP SECRET level.

b. Security access requirements for each Government site to be supported will be provided as TO Appendix D GFI.

c. The contractor shall implement and adhere to security policies and classifications of the networks in accordance with the DISA and DoD classification guides.

d. Storage and reporting of information shall be in accordance with the classification guides. The contractor shall minimize security incidents.

13. Government-Furnished Equipment (GFE)/Government-Furnished Information

(GFI).

a. The Government will provide GFE to the Contractor for the Contractor’s use in the performance of this TO, as described in TO Appendix C.

b. GFI provided to enable the Contractor to perform under this TO is described in TO Appendix D.

14. Other Pertinent Information or Special Considerations.

a. The Contractor shall comply with all locally directed training, reporting, security, and personnel requirements. These include but are not limited to Personnel Access Management (PAM) reporting, security training, and safety training.

b. The contractor shall cease all actions on network support upon Government direction of a network “freeze” condition (see Appendix A for definition).

c. The directives and instructions listed in PWS Appendix B apply, as applicable, to the requirements of this TO.

d. In compliance with U.S. Office of Management and Budget (OMB) guidance dated 28 September 2010, federal agencies are required to ensure that procurements of networked information technology comply with Federal Acquisition Regulation requirements for using the U.S. government version 6 (USGv6) profile and testing program for the completeness and quality of Internet Protocol version 6 (IPv6) capabilities. The DISA IPv6 POC will provide necessary implementing guidance applicable to the Contractor's service as GFI.

15. Section 508 Accessibility Standards.

Section 508 standards are not applicable to this TO.

Page A - 1

GSM-O TASK ORDER #3

APPENDIX A – Definitions Applicable to this TO

The following definitions shall be applicable to this task order.

DISN Infrastructure: The total set of installed networking/service capabilities as listed in the GSM asset inventory data provided as part of a draft Task Order. This includes transport fiber/circuits/services, equipment, software (both software imbedded within devices as well as functional software applications), functional services, government-designated facilities including network control centers, and associated tools used in the performance of networking O&M functions.

“Freeze” Condition: Restriction of any configuration changes, scheduled maintenance actions, and any access to the network for a period before and during scheduled mission events or real world contingency operations. This includes close coordination with commercial and government service providers, canceling/rescheduling maintenance, and the physical security of facilities, power, and network equipment.

ITIL®-Derived Definitions: This TO uses terms that are defined within documentation of the current version (currently v3) of the ITIL® Framework for Services Management. Note that ITIL® materials are trademarked; some materials are available only through subscription or comparable for-payment processes. The web link to the ITIL® governing body site is pasted here:

http://www.best-management-practice.com/officialsite.asp?DI=575004&FO=1230366

Net Assurance: The DoD activities, conducted consistent with applicable directives, focused on the protection and security of designated capabilities. The term Computer Network Defense (CND) is included within the context and definition of Net Assurance.

NetOps: The DoD-wide operational, organizational, and technical capabilities for operating and defending the GIG. NetOps includes, but is not limited to, enterprise management, net assurance, and content management.

Page B - 1

APPENDIX B – Net Assurance Location Data

Net Assurance capabilities, as describe in paragraph 6 of this TO, are required to be provided at the following site locations where GIG and/or DISA-supported Government networking capabilities are located:

Table B-1. CND Location Data

TO-3 CND Workload Locations and Scope Scope of Required Support

Location Para 6.1

CND

Protect

Para 6.2

CND

Detect

Para 6.3

CND

Response

Para 6.4

CND

Sustain

Chambersburg, PA Yes Yes Yes Yes DISA NetOps Center (DNC) CONUS Yes Yes Yes Yes Warner Robins AFB Yes Yes Yes Yes DNC Europe Yes Yes Yes Yes DNC Pacific Yes Yes Yes Yes NORTHCOM Yes Yes Yes Yes CENTCOM Yes Yes Yes Yes

Page C - 1

APPENDIX C – Government Furnished Equipment/Capabilities (GFE)

The specific list of GFE for this TO is attached hereto and includes but is not limited to the following.

(1) Site-specific support tools and test tools to be used in the operation and management of DISN infrastructure

(2) Other capabilities TBD as specified in the attachment to this herein

Page D - 1

APPENDIX D – Government Furnished Information (GFI)

GFI provided (initially as part of the RFP) to enable the Contractor to perform under this TO includes the following:

(1) The directives listed in Appendix B of the PWS, all of which are applicable to this

TO.

(2) GSM-O reference materials originally provided as part of the GFI associated with the GSM-O RFP.

(3) DISN Infrastructure data as provided in Appendix B of this TO

(4) Site security access requirements for each site to be supported

(5) DISN performance data from representative periods to support analysis of the effort required for performance-based task work

Page E - 1

APPENDIX E – Functional Requirements

a. This Appendix describes functional task requirements applicable to this Task Order.

To facilitate use of references in the PWS, the same paragraph numbers from the PWS are used in this Appendix. Note that details of outcomes, deliverables, and performance standards are provided in the description of requirements where they are applicable.

b. The term “Appendix” refers to an Appendix of this TO unless noted otherwise. The term “paragraph” refers to a paragraph of this Appendix E unless noted otherwise.

1. [This header not used in this TO.]

2. [This header not used in this TO.]

3. [This header not used in this TO.]

4. PROGRAM MANAGEMENT REQUIREMENTS

4.1 [Header not used this TO]

4.2 Security Requirements

a. Overall Security Classification Requirements for the work conducted under this PWS are as described in the DD Form 254. Classification level requirements for this work will vary, and for some activities will include up to Top Secret/Sensitive Compartmented Information (TS/SCI). Specific classification level requirements will be detailed within each Task Order.

b. The Contractor shall implement and adhere to security policies and classifications of the networks in accordance with the DISA and DoD classification guides. Storage and reporting of information shall be in accordance with the classification guides. The Contractor shall minimize security incidents and “spillage.” Applicable standards from the Acceptable Levels of Performance (ALP) table in Appendix C is/are row number 1.

c. The Contractor shall establish and implement security aspects of the contract execution environment (i.e. policies, procedures, standards, resources, controls, and outcomes to include applicable verification testing) that are compliant, effective, and reliable in the areas of personnel security (for clearances and access), information security and assurance, and physical security and protection of facilities and infrastructure. Applicable standards from the Acceptable Levels of Performance (ALP) table in Appendix C is/are row number 2.

d. The Contractor shall provide, for Government review and approval, a GSM-O Administrative Security Plan that addresses, at minimum, the following:

Page E - 2

(1) Identification of applicable Federal, DoD, Allied/Coalition, and DISA security-related policies and directives that are applicable to the DISA-provided GIG services environment

(2) Security activities, procedures, controls, and outcomes to be incorporated into other GSM-O functions and tasks

(3) Risk assessment and mitigation for applicable GSM-O areas as designated by the Government

(4) Periodic measures and controls to verify that policies, standards and practices are being executed as assigned

(5) Personnel security (for clearances and access)

(6) Information security and assurance

(7) Physical security and protection of facilities and infrastructure

e. Deliverables (CDRLs) resulting from this work are as follows:

A003 Administrative Security Plan A004 Annual Administrative Security Report

4.3 Reports and Controls

a. The Contractor shall provide, at minimum, the following types of reporting controls:

(1) Each one-time or periodic report or reporting process needed for effective control of all contract activities, including at minimum the following:

• One-time conditional reports or deliverables that document the results of an activity

• Periodic reports that provide data and other documentation on a daily, weekly, monthly, quarterly, or annual basis as applicable

• Periodic meetings and reviews conducted to review status and task outcomes

(2) The Contractor shall prepare and present a Quarterly Program Review following a Contractor’s recommended process and presentation template.

(3) The Contractor shall prepare and present a Quarterly Fiscal Review whose content covers all invoice data for the period as well as issues identified from previous reviews.

(4) When required by the applicable task order, the Contractor shall prepare and provide an Invoice Supporting Data Spreadsheet whose content and design have been approved by the Government; the intent is to provide supplementary data for Government analysis that shows how the summary data presented in the formal invoice format were derived.

(5) The Contractor shall prepare and present an annual Review of Deliverables to verify that the purpose, content and format of each deliverable is still relevant and necessary.

(6) The Contractor shall provide, annually, a planning baseline of activities and criteria to assist the Government in planning for future transition-out actions at the end of the life of the GSM-O contract.

Page E - 3

b. Deliverables (CDRLs) resulting from this work are as follows:

A005 Quarterly Program Review A006 Quarterly Fiscal Review A007 [Not Used this TO] A008 Annual Review of Deliverables A009 Report of GFE A010 Annual Termination Planning Report

4.4 Cost Management and Reporting

a. A Government objective for effective DISA-provided GIG services management is to provide seamless and efficient processes for integrating all costs of services due to GSM-O efforts to allow an accurate allocation of those costs to users, to support improved accuracy, and to promote a reduction in the costs of subscription services over time. The Contractor shall maintain accurate records of the costs of services provided for each DISA managed network and service. Applicable standards from the Acceptable Levels of Performance (ALP) table in Appendix C is/are row number 3. In managing costs for services, the following constraints shall apply:

(1) The Contractor’s invoicing procedures shall include prompt payment discounts and penalties for late billing outside the 30-day period.

(2) The Contractor shall provide activity based cost reports provided quarterly within 30 days after the end of each Calendar Quarter with all costs accurately applied to cost drivers and cost elements for reportable systems.

b. The Contractor shall identify and recommend potential productivity improvements and cost efficiency recommendations that can be implemented throughout the term of the contract to reduce cost. The Contractor shall report the achieved results of efficiencies gained to the government annually, as an appendix to the annual update of the Program Management Plan (CDRL A001).

c. Deliverables (CDRLs) resulting from this work are as follows:

A011 Activity Based Cost Report

4.5 Business-Related Metrics

a. The Contractor shall recommend, for Government approval, business metrics.

Examples could include the following:

(1) Number of invoices within the preceding 12 months that were late (i.e. outside the 30-day submission period).

(2) Percentage of assigned Contractor or subcontractor staff having all required security clearances.

Page E - 4

(3) Percentage of reported outages during past quarter/year where the required repair parts and materials were not available within the required time limit specified in Appendix C.

(4) Analysis of inventory levels of spare/repair parts within the Contractor’s control to ensure that response times are met while holding inventory costs to a minimum.

(5) Analysis of staff travel associated with outage repair activities to ensure appropriate balance between full-time staffing at hub locations and “get-there” responses to reported troubles.

b. Applicable standards from the Acceptable Levels of Performance (ALP) table in Appendix C is/are rows number 4 and 47. Deliverables (CDRLs) resulting from this work are as follows:

A012 Quarterly Business Metrics Report

5. TRANSITION REQUIREMENTS

5.1 Contract Initiation Review (CIR)

a. To ensure that both Government and Contractor understand the terms of the contract, and where applicable a task order, and are ready to launch and manage effective contract execution, the Contractor shall organize and present a one-time Contract Initiation Review (CIR) of the contract’s or task order’s terms, objectives, tasks, constraints, standards, and deliverables. The CIR shall address at minimum the following topics:

(1) Government objectives and requirements as documented in the solicitation (to ensure that all participants actually know what is in the solicitation)

(2) The purpose, content, structure/format, media, and submission schedule of each deliverable (CDRL) to be provided as a result of activities of the TO

(3) The structure of Contract Line Item Number (CLIN) items and tasks driving Contractor performance for the first year

(4) Data and resources needed by either side as conditional prerequisites to complete the design of deliverables and the execution of initial tasks

(5) A list of issues to be resolved by each side within the first 30, 60, and 90 days of contract execution

b. The CIR agenda shall be developed by the Contractor for Government approval. The CIR shall be conducted at a Government-approved facility. All named key personnel of the Contractor team shall attend. The Contractor shall submit draft dummy deliverables, for coordination of content and format, for Government review one week prior to the CIR. The Government’s target is to have the CIR presented within three weeks following award of the contract and applicable task orders.

c. Deliverables (CDRLs) resulting from this work are as follows:

Page E - 5

A013 Contract Initiation Review (CIR)

5.2 Transition Plan

a. To establish an appropriate and effective transition environment immediately following award of the contract, a Transition Plan shall be submitted as a deliverable to provide the basis for the execution of all transition activities throughout the first year of the contract. Attributes of the Transition Plan include the following:

(1) The Transition Plan shall use a Contractor -recommended design and format, include the activities of the CIR requirements as described above, and be submitted for Government review and approval within 20 days of contract start date (as established by the Contracting Officer).

(2) As part of the Transition Plan, within 30 days after assuming responsibility, the Contractor shall schedule an independent test and evaluation period lasting up to one week to assess the Government’s and Contractor Staff’s ability to meet the PWS standards, within 30 days after assuming responsibility. This requirement may be individually waived by the Government.

(3) The Transition Plan shall account for possible Government-directed Performance Acceptance Test (PAT) execution, at the Government’s option.

b. Deliverables (CDRLs) resulting from this work are as follows:

A014 Transition Plan

5.3 Transition Execution

The Contractor shall execute transition actions in accordance with the approved Transition Plan. Applicable standards from the Acceptable Levels of Performance (ALP) table in Appendix F is/are row number 5. Deliverables (CDRLs) resulting from this work are as follows:

A015 Transition Results Report

5.4 [This Header not used in this TO]

6. [This header not used in this TO.]

7. NET ASSURANCE OPERATIONS

a. In addition to the localized security support requirements described in PWS 6.2.6, the

Contractor shall also provide enterprise-level net assurance services as described in this section.

Page E - 6

b. Table 1 allocation rules are not applicable to this PWS requirement (i.e. all actions are categorized as Other-Than-Standard by definition).

c. The Contractor shall provide threat analysis and incident reports, procedures and requirements as required by CJCSI 6510.01, to meet the outcomes prescribed in the paragraphs to follow.

d. The Contractor shall provide network defense of the DISN backbone and GIG High

Value Targets (HVTs). HVTs are as described in the GFI data to be provided for the applicable task order.

e. Specific details pertaining to sites where support is to be provided, network systems to be supported, and operating hours and other details will be as stated in the applicable task order.

f. To facilitate the development of performance based task orders for future services, the Contractor shall collect performance data pertaining to tasks performed, associated constraints, standards used (or that could have been used), and deliverables provided

(or that could have been provided). The Contractor shall provide this data in the form of a cumulative analysis, with original source data, to the Government each quarter.

CDRL A039 CND Performance Data Analysis

g. The Contractor shall support the Government’s Computer Network Defense (CND)

Service Provider (CNDSP) in the areas of Protect; Monitor, Analyze and Detect;

Respond; and Sustain (as depicted in DoD Instruction 0-8530.1). These CND services define actions employed to prevent or mitigate computer network attacks that may cause disruption, denial, degradation, destruction, exploitation, unauthorized access, or information theft to computer networks, information systems, or their contents. These

CNDSP-led activities include the following as described in paragraphs 7.1 through 7.4.

7.1 Computer Network Defense – Protect Activities

a. The Contractor shall support the CNDSP by performing CND Protect activities for supported networks and services including the following:

(1) Support Red Team Functions – Provide support to serviced components and appropriate Government oversight entities by implementing DoD-wide Red

Team: notifications, reports, assessments, coordination, information collection, performance measurement, requirements identification, and feedback.

Page E - 7

(2) Support Information Condition (INFOCON) – Monitor and report status; maintain, assess, implement and comply with INFOCON actions; and assist in the continuous improvement of INFOCON definitions.

(3) Support Information Assurance Vulnerability Alerts (IAVAs) – Monitor the implementation of IAVAs; provide technical assistance to Government oversight entities; de-conflict component and information specific IAVA guidance; provide technical support for development, dissemination and management of

Component vulnerability guidance; and identify network/system vulnerabilities or threats for improvement of the IAVA system and processes.

(4) Support Vulnerability Analysis and Assessment (VAA) – Provide support for VAA, including identifying and cataloging VAAs, assessing potential impact, supporting appropriate entities in implementing Defense-wide VAA notification, reporting and coordination activities, and supporting CND and related requirements.

(5) Support Security Education, Training and Awareness (ETA) – Assist appropriate entities to identify their ETA requirements, support management and tracking systems, coordinate inclusion of ETA requirements into appropriate curricula and courseware, and provide technical support in course development.

b. Specific performance data needed to shape and quantify this support effort is not currently available. See Appendix B Table B-1 for data pertaining to current workload and staffing.

c. Applicable standards from the Acceptable Levels of Performance (ALP) table in

Appendix C is/are row number 29. Deliverables (CDRLs) resulting from this work are as follows:

A033 Red Team Support Data A034 INFOCON Status

7.2 Computer Network Defense – Detect Activities

a. The Contractor shall support the CNDSP by monitoring and detecting incidents and events in supported networks and services including the following:

(1) Monitor Sensors – Perform monitoring, detection and analysis on a 24X7 basis.

Monitor subscriber networks, protect Intrusion Detection System data, and provide failover capabilities for operations in the event of outages.

(2) Provide Attack, Sensing and Warning (AS&W) Support – Support the CND

Architect and Systems Integrator roles by: identifying requirements; developing, deploying and maintaining information systems; and identifying and analyzing emerging technologies. Participate in the MCEP IAP CND Systems Working

Page E - 8

Group. Conduct or support AS&W; ensure CND AS&W information is timely and accurate; and support Component-unique requirements and their development, deployment and maintenance. Provide: notice of suspicious/malicious network traffic or similar activities, general warnings of potential cyber attacks, and impact assessments; and provide information for customer situational awareness.

(3) Provide Indications and Warnings (I&W) – Support CND activities: by distributing information and improving communications between Government entities: by providing intelligence-based information regarding cyber threats and expected imminent actions: and by disseminating information regarding theater activities.

(4) Perform Statistical Analyses – Perform statistical analyses by gathering and analyzing metrics of incidents/events, and disseminating the resulting information to the Government.

and staffing.

c. Applicable standards from the Acceptable Levels of Performance (ALP) table in Appendix C is/are row numbers 30 and 31. Deliverables (CDRLs) resulting from this work are as follows:

A035 Security Incident and Event Statistics

7.3 Computer Network Defense – Response Activities

a. The Contractor shall support the CNDSP by providing recommended response actions to security incidents in supported networks and services with course of action to mitigate and contain risk, and minimize impact to customers, including but not limited to the following:

(1) Provide Incident Reporting – Provide monitoring and reports regarding sensor-detected events or potential events to customers and to Government oversight entities, ensuring that these incidents are populated in the DoD-mandated

Incident Reporting Structure and in accordance with the Incident Reporting

Guidelines; then file and safeguard all incident reports.

(2) Provide Incident Analysis – Provide limited analysis of incidents for the customers by: determining the incidents’ nature and formulating responses, identifying and providing the ability to surge during emergencies, correlating event and incident data, determining actions to be taken, and determining possible effects on the DISN and on networks of customers and other organizations.

Page E - 9

(3) Provide Incident Response – Recommend actions in response to incidents, coordinate responses, provide technical assistance during repair until restoration of full capability.

(4) Perform Statistical Analyses – Perform statistical analyses on incidents/events and provide results to the Government.

and staffing.

c. Applicable standards from the Acceptable Levels of Performance (ALP) table in Appendix C is/are row number 32. Deliverables (CDRLs) resulting from this work are as follows:

A036 Security Incident Analysis

7.4 Computer Network Defense Sustainment Activities

a. The Contractor shall support the CNDSP by performing Security Administration and CNDSP Information Systems sustainment activities in support of net defense operations, to include server administration and maintenance, configuration monitoring and logistics support to servers, networks and applications. This task includes but is not limited to the following:

(1) CND Server Administration and Maintenance – Provide CND server administration and maintenance of the Element Management Systems workstations, servers, intrusion detection systems, and other associated equipment. Assess server security posture, ensure security plan compliance and ensure configuration changes do not adversely impact the server security posture. Perform Net Assurance-related audits and logging; implement

Vulnerability Management System (VMS) and IAVA compliance; monitor servers;

support related hardware and software upgrades; and provide user administration and logistics support.

(2) CND LAN Support – Install, configure and monitor CND security-relevant network components, ensure that C&A requirements are satisfied, and manage requirements for classified and unclassified networks. Perform infrastructure monitoring and performance assessment and new requirements analysis and support. For new equipment: order, inspect and inventory the equipment;

determine outside support installation requirements; and update equipment

Page E - 10 security information. Maintain the Integrated Configuration and Tracking System

(ICATS) and other configuration databases, ensure security posture integrity during system outages, coordinate configuration changes with the Designated

Approving Authority (DAA) for changes in security posture or status, and maintain security documentation for hardware and software baselines and maintenance logs. Perform related installation and logistics support.

(3) CND Application Security Support – Maintain data pertaining to security-relevant applications, perform audits and log reviews, flag suspect non-conforming applications, ensure security requirements conformance and evaluate permission levels while maintaining logs for access to applications. Perform related audits, logging, and IAVA compliance activities; monitor/manage applications; support software upgrades and user administration applications; and provide related logistics support.

(4) Net Assurance Support Desk – Establish a centralized support desk for security related incidents, support or lead trouble shooting efforts, escalate Trouble

Reports as necessary to Government oversight entities, and initiate OSS trouble tickets as necessary.

and staffing.

c. Applicable standards from the Acceptable Levels of Performance (ALP) table in

Appendix C is/are row numbers 33 - 35.

d. Data Capture Records (see PWS 3.7) resulting from this work are as follows:

B013 Net Assurance Auditing and Logging

e. Data Extracts (see PWS 3.7) resulting from this work are as follows:

C012 Net Assurance Trouble Reports

Page F - 1

APPENDIX F

[Not Used this Task Order]

Note: the Table of Acceptable Levels of Performance (ALPs) formerly contained in Appendix F has been deleted. Use the ALPs table (exact same content) in the QASP at Appendix I of this TO.

Page G - 1

APPENDIX G – List of Contract Data Requirements List (CDRL) Items Applicable to this TO

Deliverables –CDRLS

Item # Title Subtitle Frequency Classification Requiring

Office TO App E Reference

A001 Thru A002

Not Used this

TO

A003 Administrative

Report Administrative Security Plan Per Task

Order FOUO

DISA

NS/GO 4.2

A004 Administrative

Report Annual Administrative Security Report Per Task

Order FOUO

DISA

NS/GO 4.2

A005 Administrative

Report Monthly Program Review Per Task

Order FOUO

DISA

NS/GO 4.3

A006 Administrative

Report Quarterly Fiscal Review Per Task

Order FOUO

DISA

NS/GO 4.3

A007 Not Used this

TO

A008 Administrative

Report Annual Review of Deliverables Per Task

Order FOUO

DISA

NS/GO 4.3

A009 Administrative

Report Report of GFE Per Task

Order FOUO

DISA

NS/GO 4.3

A010 Administrative

Report Termination Planning Report Per Task

Order FOUO

DISA

NS/GO 4.3

A011 Administrative

Report Activity Based Cost Report Per Task

Order FOUO

DISA

NS/GO 4.4

A012 Administrative

Report Quarterly Business Metrics Report Per Task

Order FOUO

DISA

NS/GO 4.5

A013 Administrative

Report Contract Initiation Review (CIR) Per Task

Order FOUO

DISA

NS/GO 5.1

A014

Technical

Report Transition Plan

Per Task Order FOUO

DISA

NS/GO

5.2

Page G - 2

Deliverables –CDRLS

Requiring

Office TO App E Reference

A015 Technical

Report Transition Results Report Per Task

Order FOUO

DISA

NS/GO 5.3

A016 Thru A0032

Not Used this

TO

A033 Technical

Report Red Team Support Data Per Task

Order Secret

DISA

NS/GO 7.1

A034 Technical

Report INFOCON Status Per Task

Order FOUO

DISA

NS/GO 7.1

A035 Technical

Report Security Incident and Event Statistics Per Task

Order FOUO

DISA

NS/GO 7.2

A036 Technical

Report Security Incident Analysis Per Task

Order FOUO

DISA

NS/GO 7.3

A037 Thru A0038

Not Used this

TO

A039 Technical

Report CND Performance Data Analysis Per Task

Order FOUO

DISA

NS/GO 7

Page H - 1

APPENDIX H – List of Data Capture Reports and Data Extracts

Appendix H – List of Data Capture Reports and Data Extracts

Requiring

Office

PWS

Reference

B001 Thru B012

Not Used this

TO

B013 Data Capture

Record Net Assurance Auditing and Logging Per Task

Order FOUO

DISA

NS/GO 7.4

C001 Thru C011

Not Used this

TO

C012 Data Extract Net Assurance Trouble Reports Per Task

Order FOUO

DISA

NS/GO 7.4

Page I- 1

APPENDIX I – Draft Quality Assurance Surveillance Plan (QASP) for this TO

The draft QASP associated with the GSM-O PWS is attached hereto as the draft QASP for this TO. Upon contract award, the GSM-O QASP will be finalized. That final document will then serve as the basis for tailoring to fit the requirements of this TO.

Logically the QASP for this TO has the same roles, responsibilities and procedures, but with the scope of performance to be assessed limited to the scope of this TO.

Page I- 2

Global Information Grid Services Management - Operations (GSM-O)

Quality Assurance Surveillance Plan (QASP)

For GSM-O Task Order #3

Page I- 3

1 INTRODUCTION

The Global Information Grid (GIG) Services Management (GSM) – Operations (GSM-O) Quality Assurance Surveillance Plan (QASP) will evaluate the performance of the GSM- O contractor in meeting the program’s requirements as described in the GSM-O Performance Work Statement (PWS). The contractor, and not the Government, is responsible for management and quality control actions to meet the terms of the contract. The Government will perform quality assurance and surveillance to verify contract performance standards are achieved.

2 PURPOSE

a. This QASP provides a quality surveillance strategy for the GSM-O contract. The primary intent of the plan is to provide a basis for the Government to evaluate performance quality. Oversight of contractor performance will assure quality performance. The plan will also allow the Contracting Officer and Contracting Officer’s Representative a mechanism to preclude major deficiencies in performance, provide input for annual contractor past performance evaluations, and assist in the decisions pertaining to the exercise of contract options.

b. The GSM QASP is intended to accomplish the following:

• Discuss the process of performance measurement;

• Describe the incentive award plan;

• Establish a governance structure for monitoring performance, comparing actual performance against the performance standards, and authorizing the invoicing (payments) for earned incentives (or the credits to the Government); and,

• Identify the key performance standards and acceptable performance levels that will be used as both a measure of success and as a basis for incentive awards.

This initial draft of the QASP will contain a set of performance standards that will be reconciled with the contractor’s proposed performance standards and subject to mutual agreement between the parties. The consolidated, negotiated standards and measures will be included in the final QASP.

3 GSM-O EXECUTION CONTEXT

a. See Government Furnished Information (GFI) provided as supplemental information with the GSM-O RFP for general background information

b. The Contractor’s work performance shall be monitored and evaluated in accordance with the contract (including the PWS) and task order (TO) requirements. In case of conflict between the contract/PWS and a task order the contract/PWS shall govern. The controls applicable to each active Task Order will be contained in the QASP included within that task order.

c. The GSM-O contract has an ID/IQ structure with a PWS that describes primary requirement areas. Each GSM-O TO specifies the scope and requirements of the PWS that are to be provided, including the specific performance measures and a separate tailored QASP

Page I- 4

d. For the GSM-O contract, QASP procedures will be applicable at the task order level.

For each task order issued by the Government during each execution year of the contract, the task order will contain its own draft QASP to be used by the Contractor in proposing a responding Quality Control Plan (QCP).

e. PWS Appendix C provides a table of Acceptable Levels of Performance (ALPs) that measure the performance of specific PWS activities. Each ALP establishes the following color-coded performance levels:

• Blue = Performance is Above-Satisfactory to a degree that merits Incentive

• Green = Performance is Satisfactory (no incentive is applicable)

• Yellow = Performance is not yet Satisfactory, but no credit to the Government is applicable

• Red = Performance is sufficiently below the Satisfactory level to justify a credit to the Government

f. Each ALP contains the following structural elements:

• Reference to PWS requirement being evaluated by the ALP

• Performance objective (e.g. “adhere to security policies and procedures to minimize classified “spillage” incidents”)

• Performance Standard for measurement (e.g. “zero spillage incidents per period”)

• Acceptable Level of Performance (e.g. “There shall be zero classified “spillage” incidents.”)

• Performance Ranges (e.g. “Blue = not applicable; Green = zero incidents; Yellow = one incident; Red = two or more incidents”)

• Surveillance Method (e.g. “Frequency: monthly; Surveillance Type: 100% monitoring; surveillance method: data analysis”)

g. The PWS table of ALPs is included in this QASP in paragraph 8 without change as the primary basis for QASP performance evaluation. Each TO may include additional appropriate measures/metrics/incentives and methods of surveillance within its respective QASP

4 WORK REQUIRING SURVEILLANCE

In the QASP for each specific TO, this section will provide applicable information about the tasks of that TO that are subject to incentives management under that QASP.

5 PRIMARY METHODS OF SURVEILLANCE

a. As outlined in FAR Part 46.4, Government Contract Quality Assurance, the QASP specifies the method and location of surveillance to ensure that the services conform to contract requirements. The place of performance will be as designated in the applicable Task Order.

Page I- 5

b. The primary methods of quality surveillance are addressed below. This list may be revised based on the contractor’s recommendations in a final negotiated QASP.

(1) 100 Percent Data Capture. If the performance of a PWS requirement (such as logging of help desk calls or resolving confirmed troubles) is documented via automated systems that capture descriptive and status data, that data can be used for QASP assessment purposes.

(2) Random or Periodic Sampling or Data Capture. The Government PMO can direct that data associated with the performance of a specific requirement be collected for purposes of QASP assessment, on either a random or periodic basis.

(3) Government Operator/Customer input. The Government can request input pertaining to perceived contractor performance from Government operations staff and from DISN end-users if/when there is direct interaction with the contractor such as in Help Desk calls or in contractor-provided assistance to resolve troubles at an end-user location. (Most GSM-O services are provided to the Government DISN PMO not to DISN end-users per se.)

6 GOVERNANCE

6.1 Roles and Responsibilities

The following roles and responsibilities will be incorporated in the QASP process as documented in the final QASP after award.

6.1.1 Contractor

The contractor will perform the work as described in each GSM-O Task Order and as requested by the Government, provide source data pertaining to task activities needed for evaluation by Government QARs for QASP related procedures.

6.1.2 Government Contracting Officer (KO)

The Government contracting officer will ensure that QASP-related processes, to include the payment of incentive payments as approved by the Incentives Determining Official (IDO) are executed in conformance with the FAR, the terms of the contract, and the final approved GSM-O QASP.

6.1.3 Government Contracting Officer’s Representative (COR)

The COR will act under Contracting Officer direction to assist in the administration of the contract at the contract level, and will coordinate with Task Monitors for each task order as applicable. The COR receives a completed incentive fee recommendation from each operative task order TM, checks that the TM’s recommendation is complete, and ensures that the recommendation is processed appropriately through the KO and IDO.

6.1.4 Government Quality Assurance Reviewer (QAR)

a. For QASP-related processes, the Government will appoint functionally qualified field staff to perform "quality assurance reviewer” (QAR) duties for each task order where QASP incentives are applicable. If a task order is divided for execution on a geographic region basis, the regional Field Commander will appoint functionally qualified field staff to perform QAR duties for QASP incentive actions in that region. Further references in

Page I- 6 this QASP to a “QAR” shall be interpreted to mean, a functionally qualified field staff appointed to perform QAR duties.

b. QARs will have responsibility for monitoring Contractor performance supporting the applicable regional Field Command, or globally if applicable, collecting applicable ALP source data from the Contractor and other sources,and interpreting that data to compute the performance color level at the end of the evaluation period for each ALP. The QAR also provides additional information related to contractor performance to the TM for consideration in the incentive fee decision process.