HC1028-13-R-0036.doc

Section B - Supplies or Services and Prices

Enterprise Attack Analysis Support

FFP

Labor in support of PWS dated 3 Apr 13.

Period of performance: 27 Sep 13 - 26 Sep 14

FOB: Destination

NET AMT

Lot

Travel/Other Direct Costs (ODCs)

COST

Travel costs will be reimbursed IAW FAR 31.205-46 and the Joint Travel Regulation (JTR). All travel/ODCs shall be approved by the Contracting Officer's Representative (COR) prior to performance and invoice submittal.

Period of performance: 27 Sep 13 - 26 Sep 14

ESTIMATED COST

FFP

Labor in support of PWS dated 3 Apr 13.

Period of performance: 27 Sep 14 - 26 Sep 15

NET AMT

Lot

COST

Travel costs will be reimbursed IAW FAR 31.205-46 and the Joint Travel Regulation (JTR). All travel/ODCs shall be approved by the Contracting Officer's Representative (COR) prior to performance and invoice submittal.

Period of performance: 27 Sep 14 - 26 Sep 15

ESTIMATED COST

FFP

Labor in support of PWS dated 3 Apr 13.

Period of performance: 27 Sep 15 - 26 Sep 16

NET AMT

Lot

COST

Travel costs will be reimbursed IAW FAR 31.205-46 and the Joint Travel Regulation (JTR). All travel/ODCs shall be approved by the Contracting Officer's Representative (COR) prior to performance and invoice submittal.

Period of performance: 27 Sep 15 - 26 Sep 16

ESTIMATED COST

FFP

Labor in support of PWS dated 3 Apr 13.

Period of performance: 27 Sep 16 - 26 Sep 17

NET AMT

Lot

COST

Travel costs will be reimbursed IAW FAR 31.205-46 and the Joint Travel Regulation (JTR). All travel/ODCs shall be approved by the Contracting Officer's Representative (COR) prior to performance and invoice submittal.

Period of performance: 27 Sep 16 - 26 Sep 17

ESTIMATED COST

Lot

FFP

PRICING MUST BE IN ACCORDANCE WITH FAR 52.217-8

Labor in support of PWS dated 3 Apr 13.

27 Sep 17 - 26 Mar 18

NET AMT

Section C - Descriptions and Specifications

PWS, 3 APR 13

PERFORMANCE WORK STATEMENT (PWS)

as of 3 Apr 13

1. Contracting Officer Representative (COR)

a. Primary COR.

Department of Defense Activity Address Code (DODAAC):

HC1047

PO Box 549

Fort Meade, MD 20755-0549

b. Alternate COR.

PO BOX 549

Fort Meade, MD 20755-0549

2. Contract Title. Enterprise Services Attack Analysis

3. Background. Defense Information Systems Agency (DISA) and the National Security Agency (NSA) were tasked to develop an Information Assurance (IA) Audit Management System that has the capability of enterprise service for logging, collecting data, and analysis of data for Enterprise Services (eg: DoD Enterprise Email, Enterprise Share Point, Enterprise Cross Domain) IA devices and systems. It will also have the capability to detect malicious threats from insiders. The technical challenge is to develop the data management architecture and manipulation tools including the use of ‘Big Data’ cloud storage and analysis technologies that will enable automated identification of critically anomalous events that indicate both internal and external malicious activity. The objective of the IA Audit Management System is to provide the capability to defend against insider threat as well as external threats to the DoD thus, vastly improving DoD’s auditing processes and Defense-in-Depth strategy. In addition, the system will also provide a large payoff for the war fighter by increasing the security of continuously-monitored systems, availability of mission information, and reduction in the time and resources required to perform repetitive and time-intensive manual reviews of audit logs that are often fruitless.

4. Objectives: Develop and support the implementation of analytical methods to the Government to support DOD Computer Network Defense (CND) analytics performed at the operational level (CYBERCOM, NSA, Combatant Commanders (COCOMs), Services, and other agencies).

5. Scope. Work performed by the contractor under this contract will support the Enterprise Attack Analysis effort that is focused on DOD enterprise service logs including enterprise service gateway logs. The contractor will also provide implementation/development support for log scripting to define such vulnerabilities as malware and attack vectoring, create analytical methods to counter the threat of malware and network vulnerabilities using web/firewall/other hardware log analysis, and provide training on log analysis by using scripting techniques to the DOD CND community. This is not exclusively a software development effort. The purpose of this effort is not primarily to develop deployable Government Off the Shelf (GOTS) software packages to the CND community, but to develop/enhance scripts (similar to macros) that will reside on Government servers at centralized locations that will pull from existing Government databases and various log files, to perform analysis of architecture to determine threats and proposed data collection and aggregation, and work with CND analysts to improve detection of attacks against the DoD Global Information Grid.

6. Performance Requirements. The contractor shall furnish the necessary personnel, materials, facilities, travel, and other services required to provide systems engineering and other related services for this effort.

6.1 Task 1 - Enterprise Management Controls

6.1.1 Subtask 1 - Integration Management Control Planning. Provide the technical and functional activities required for integration of all tasks specified within this PWS. Include productivity and management methods such as quality assurance, progress/status reporting and program reviews. Provide the centralized administrative, clerical, documentation and related functions. The contractor shall provide a Weekly Activity Report that describe what work has been performed, what problems have been encountered that may impact cost and/or schedule, potential solutions for any problems, and projected tasks for the next week. The contractor shall provide meeting minutes from the Technical Exchange meetings that document the meeting(s) that includes the interchanges between the Government and the contractor .

Deliverable: (1) Government PM Technical Exchange Meeting Minutes

Deliverable: (2) Weekly Activity Report (WAR)

6.1.2 Subtask 2 - Task Order Management. Prepare a Task Order Management Plan describing the technical approach, organizational resources and management controls to be employed to meet the performance and schedule requirements throughout TO execution. The TOMP shall be updated as required during the performance of contract to reflect changes and to further define program criteria and milestones. All modification to the TOMP shall be submitted to the Government for approval before execution. The TOMP shall include at a minimum:

· Organization

· Resources (Dynamic allocation of resources based on mission needs)

· Personnel Management

· Management structure/control (by name)

· Task Order execution plan

· Labor execution plan

· Quality Assurance/Control Plan

· Staffing Plan

· Implementation Plan

· Transition Plan (outlining activities and timeline required for the contractor to transition support services identified in the PWS from the incumbent as required).

The Contractor shall maintain a detailed Work Breakdown Structure (WBS) for each task on this contract. Provide a monthly status report monitoring the quality assurance, progress/status reporting and program reviews applied to the TO. A Draft TOMP will be required at proposal submission.

Deliverable: (3) Task Order Management Plan

Deliverable: (4) Monthly Status Report

Deliverable: (5) Work Breakdown Structure (WBS) As part of the proposal, the Contractor shall submit a draft TOMP and WBS to provide the Government with a clear understanding of the Contractor’s task order management approach.

6.1.3 Subtask 3 – Master Schedule. The contractor shall provide key milestone and activity information for the Enterprise Services Attack Analysis program or task in support of the PEO-MA Integrated Master Schedule. The contractor shall be prepared to coordinate with the PEO-MA scheduling team on a weekly basis to incorporate changes to the schedule. The contractor shall provide updates on regular or ad hoc basis to the PEO-MA Scheduling Team, based on changing events and/or on funding decisions that affect the activity of the program. The contractor shall analyze deviations from the schedule baseline once it is established, and determine impacts to the overall program.

Deliverable: (6) Master Schedule

6.2 Task 2 – Development and Implementation of the Audit Log Management Program.

6.2.1 Subtask 1 –Audit Management Information Systems Engineering. The contractor shall perform the below engineering tasks to support collection and integration of audit data in support of Computer Network Situational Awareness and Computer Network Defense. The contractor shall develop data dictionaries for data sources that for a requested document on a given data source documents available fields, field descriptions, data type (egs: string, number, address), as well as general information about the purpose of the device producing the data source as well as where the devices are located within the network stack. The contractor shall develop technical reports on potential aggregation of data fields or records of a given data source as well as analyze for protocol anomalies or other anomalies of interest. The contractor shall also develop System Engineering Artifacts addressing collection and analysis of audit data from Enterprise Services that includes any proposed changes to collection, storage, or analysis of data. Any solution must be capable of receiving, processing, transmitting or forwarding (as appropriate) records of IPv6 as well as IPv4 traffic.

Deliverable: (7) Data Dictionary

Deliverable: (8) Technical Report – Statistical Analysis & Traffic Characterization

Deliverable: (9) System Engineering Artifacts - (Operational Views, System Views, etc.)

6.2.2. Subtask 2 - Use Case and Signature Development. The contractor shall investigate the use of audit log data produced by hosts and network and IA/CND devices in support of detecting and diagnosing misuse, exploitation or attack activities against DoD systems. The contractor shall develop use cases for likely threat scenarios and produce signatures for detecting those attack scenarios. The contractor shall update use cases furnished by the Government to address malicious insider threat, Enterprise Tools and other related data sources, with a focus on unauthorized activity on restricted resources. Investigation will also be conducted to determine the most appropriate device or data source to be used for the signature. The contractor will identify existing data sources if available and make recommendation as to additional data needed where required and provide a Signature Patterns Technical Report. The contractor shall consider use case implementation by operational elements throughout the DoD. This will include an analysis of existing analytic workflows, integration of these use cases into the analytic workflows, and identification of technical requirements in order to ensure maximum use. The primary intent of the research will be to reduce false positives by developing baselines and enhanced behavioral analysis, and integrating with existing operational data sources. Detection mechanisms, once identified, will leverage existing DoD audit systems to potentially include Host Based Security System (HBSS) and devices in the existing DoD infrastructure as well as event management, storage and analysis systems. Tools to analyze data during collection and before storage may be required to enable real-time alerting on certain use cases. The contractor shall also produce use case decomposition documents for each use case or category of use case and document the Configurations management process, as requested by the Government PM. The contractor shall interface as necessary with the Network Defense stakeholders (NSA, CYBERCOM, GNSC, COCOMs, Services, and Agencies) as required for known attack behaviors and use cases.

Deliverable: (10) Use Cases

Deliverable: (11) Signature Patterns Technical Report

Deliverable: (12) Documentation of Configuration Management processes when appropriate

6.2.3. Subtask 3 –Data Analysis, Transformation, and Sharing for Enterprise Services Attack Detection, Diagnosis, and Response Actions. The contractor shall perform the below tasks and subtasks using log data from existing enterprise services (eg: Mail, File, SharePoint, Enterprise Cross Domain) to detect malicious attackers, insiders, and misconfiguration vulnerabilities and maximize operational effectiveness. The contractor shall employ rapid development techniques and extensive knowledge of the current DoD capabilities to achieve benefit as timely and efficiently as possible, and then incrementally improve the capability through additional development and assistance to information sharing efforts.

6.2.3.1 Subtask 3.1Data Analysis. The contractor shall perform analysis on audit log data in order to determine the type and verboseness of data required for detecting and diagnosing attacks and misconfigurations and produce an Audit Completeness Report. Additionally, analysis will be conducted to determine the best approach to leveraging Netflow records, Intrusion Detection System alerts, server logs, and other existing data sets commonly available to the DoD Network Defense community and produce a Logging and Correlation Feasibility Report. The contractor shall rely on extensive knowledge of the Centaur system data, current DoD tools and operations to ensure that this analysis is compatible with current analytic efforts and can be performed by DoD analysts with minimal training. The contractor shall also document network traffic scenarios and corresponding analysis for all successful analysis performed on this effort and shall produce Sample Attack Data and Whitepapers on new attack detection methods.

Deliverable: (13) Whitepapers

Deliverable: (14) Logging and Correlation Feasibility Report

Deliverable: (15) Audit Completeness Report

Deliverable: (16) Sample Attack Data

6.2.3.2. Subtask 3.2 Data Transformation & Sharing. The contractor shall produce engineering designs and architecture documentation to support a high assurance information sharing system. Details of this bi-directional information sharing system are to be defined by the Government but expect to include the use of software mediators to transform data objects into a format acceptable by other systems’ components for content examination purposes. This will allow both access and data object transfer of information from the domains containing sensor and data sources to analysts in the analytic environment

Deliverable: (17) Engineering design and architecture documentation

6.2.4 Subtask 4 – Support for Adoption for Rapid Development Tools. The contractor shall provide support for the adoption of rapid development tools created throughout the contract by the contractor. Details of this support include deployment plans and any communications with the objective of achieving awareness, understanding, and finally adoption and ownership of the rapid development tools developed throughout the contract. The contractor shall develop Network Defense Tools and Scripts to provide automated analysis capabilities to Computer Network Defenders. This support will be provided in conjunction with any training support. The contractor shall provide Analytic Concept of Operations (CONOPS) and dashboards. The CONOPS will provide the Tactics, Techniques, and Procedures (TTPs) and roles and responsibilities for the new analytic capabilities. It will also provide procedures for determining the effectiveness of the Log Aggregation Warehouse Tool (LAWT) reporting and producing metrics on the overall effectiveness of the Enterprise Tool protections. The CONOPS will not include financial, system functionality, COOP, helpdesk, or configuration management. Dashboards shall provide analysts access to specific reports and graphical representation of the data. The contractor shall develop and provide whitepapers on current audit capabilities of COTs products. The contractor shall provide test plans and test reports of these products and the contractor shall produce documented process for assessing alternative designs and technologies to support collection, storage, and analysis of audit data in support of Computer Network Defense. The contractor shall produce a Detailed Incident Case Study of a computer network attack involving an Enterprise Service and this document shall detail attack method used, how it was detected, and suggested improvements in network defense including network monitoring.

Deliverable: (18) Whitepapers on current audit capabilities of COTS products & investigation initiatives

Deliverable: (19) Network Defense Tools and Scripts

Deliverable: (20) Detailed Incident Case Studies

Deliverable: (21) Documented process for assessing alternative designs and technologies

Deliverable: (22) Documented Test plan and test report that relate back to original requirements

Deliverable: (23) Analytic CONOPS

Deliverable: (24) Analytic Dashboard

6.2.5 Subtask 5– Develop Training Materials and Provide Training Support. The Contractor shall develop and provide training material for implementing the Audit Management capability in accordance with the requirements. The Contractor shall submit the training material for approval by the Government PM or designees. Training packages will consist of, but are not limited to, training documentation, operational scenarios, computer-based trainings, story boards, and instructor notes. The Contractor shall develop and update training materials based on lessons learned and approved configuration changes. Training materials are anticipated to be developed at the classified and unclassified levels, as needed and appropriate, and will comply with Sharable Content Objective Reference Model (SCORM) industry standards.

Deliverable: (25) Training materials

Deliverable: (26) Lessons Learned Documents

7. Performance Standards.

Performance occurs with no required re-performance/ rework at least 90% of time. Problems that are encountered are minor and resolved in a satisfactory manner.

Routine Inspection of Deliverable Products/Services

When the performance threshold for a particular PWS task is not met and re-performance does not correct the problem, the contractor shall explain, within 14 days in writing to Contracting Officer’s Representative (COR) or Alternate Contracting Officer’s Representative (ACOR) why performance was unacceptable, how performance will be returned to acceptable levels, and how recurrence of the problem will be prevented in the future. The COR/ACOR will evaluate the contractor's explanation and determine what corrective action should be taken to rectify the deficiency. At the government’s discretion, payment may be withheld until the associated support and documentation is satisfactorily provided.

When re-performance does not correct the deficiency and the contractor’s explanation of degraded performance is not deemed acceptable the COR/ACOR will notify the contracting officer for appropriate recourse, at the governments discretion, payment and or a percentage of the payment may be withheld.

8. Incentives.

For both outstanding and negative performances, ratings shall be recorded in the Contractor Performance Assessment Reporting System (CPARS).

9. Place of Performance.

The primary place of performance will be at the contractor’s facility. A small portion of the work will require contractor support at the DISA Lab assisting and demonstrating progress to government engineers at the DISA Headquarters facility in Fort Meade, MD.

9.1 Alternate Place of Performance - Contingency Only.

Contractor employees may be required to work at home, another approved DISA activity within the local travel area or at the contractor's facility in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, etc.). Any equipment such as laptops or phones provided to Contractor personnel shall be returned at the termination of the engagement or at another time mutually agreeable to both parties. Contracting Officer Representative (COR)/Task Monitor (TM) approval is required. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. The contractor shall continue to provide the same level of support as stated in the SOW/PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer may request an equitable adjustment.

9.2 Telework

The Contractor may establish a telework program if coordinated with the COR/TM prior to implementation.

9.3 Travel

The Contractor shall attend meetings, conferences, and workshops at CONUS and OCONUS locations in support of the PWS requirements and as required by the Program Manager. All travel must be approved by the COR/TM prior to the trip and all travel shall support the task areas described above. Travel will be in accordance with the Joint Travel Regulation and its prevailing rates.

As directed by the COR, the contractor shall continue performance in emergency or mission essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

10. Period of Performance.

The period of performance for this contract will be a 1-year base period with three, 1-year option periods.

Base Period: September 2013 – September 2014

Option Year 1: September 2014 – September 2015 Option Year 2: September 2015 – September 2016 Option Year 3: September 2016 – September 2017

11. Delivery Schedule/Payment Plan

11.1 Delivery Schedule

Project

assurance functions

11.2 Payment Plan

Deliverables are a reflection of the support associated with particular PWS tasks. Acceptance of the deliverables is more than conformance to the delivery item format. Acceptance will take into account the associated performance standards and the task support provided.

12. Security.

12.1 Security Clearances

The security classification level expected for work performed under this PWS is up to TOP SECRET/SCI. Contractor personnel must be U.S. citizens and have an active DOD SECRET or TOP SECRET clearance and if requiring access to SCI information must: be U.S. citizens, have been granted a final DCID 6/4 security clearance by the U.S. Government, and have been indoctrinated for the applicable compartments of SCI access prior to being given any access to such information released or generated under this contract. DOD 5200.2-R, DoD Personnel Security Program, requires DoD military and civilian personnel, as well as DoD consultant and Contractor personnel, who perform on sensitive automated information systems (ISs), be assigned to positions which are designated as one of two sensitivity levels (IT-1, IT-II):

Critical-Sensitive Positions (IT-I positions): Those positions in which the incumbent is responsible for the planning, direction, and implementation of computer security program~ major responsibility for the direction, planning and design of a computer system, including the hardware and software; or, can access a system during the operation or maintenance in such a way, and with a relatively high risk for causing grave damage, or realize a significant personal gain. IT -I designated positions require a Single Scope Background Investigation (SSBI).

Non-critical-Sensitive Positions (IT-II positions): Those positions in which the incumbent is responsible for the direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority of the IT-I category to ensure the integrity of the system. IT-II designated positions require a DoD National Agency Check Plus Written Inquiries (DNACI) National Agency Check Plus Written Inquiries (NACI).

All personnel working on this task will be an IT-I or IT-II positions. The required investigation will be completed prior to the assignment of individuals to sensitive duties associated with the position. The Contractor will forward their employee clearance information to:

ATTN: Defense Information Systems Agency (DISA)

Programs and Oversight Branch, MP61

P.O. Box 549

Fort Meade, MD 20775

DISA retains the right to request removal of Contractor personnel, regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interests of the Government. The reason for removal will be fully documented in writing by the Contracting Officer. When and if such removal occurs, the Contractor will, within 5 working days, assign qualified personnel to any vacancy created. See Appendix B for more details.

12.2 IT- Position Category

12.2.1 IT-I Position

Incumbent of this position has privileged access to networks and information systems, system security and network defense systems, or to system resources. Duties are broad in scope and authority and provide access to the U.S. Government, DoD, or Component mission critical systems. The potential exists for exceptionally serious adverse impact on U.S. Government, DoD, Component or private sector information and/or operations, with worldwide or government-wide effects.

12.2.2 IT-II Position

Incumbents of this position has limited privileged access, but duties are of considerable importance to the DoD or DoD Component mission, and the incumbent is under the supervision of an individual in a higher trust position (IT-I). For example, individuals in these positions may have ability to impact a limited set of explicitly defined privileged functions, such as privileged access confined to large portions of an IT or to a local network physically isolated from other DoD or publicly accessible networks. The potential exists for moderate to serious adverse impact on DoD or Component information or operations.

12.3 DoD 8570.01-M Requirements (DFARS Clause 252.239-7001)

Per Section C2.1.4 of DoD 8570.01-M, a condition of privileged access to any information system is that personnel performing IA functions must satisfy both preparatory and sustaining DoD IA training and certification requirements. In accordance with DFARS 252.239-7001, "Information Assurance Contractor Training and Certification," the following positions are categorized per DoD 8570.01-M as follows: PWS Section 6.2.2 through 6.2.5 requires the support of IAT Level II; and PWS Section 6.2.1 requires the support of IASAE Level II.

In addition to the DoD requirements for 8570-related training, DISA has agency-specific requirements for 8570 training. Contractor personnel shall complete 8-16 hours of DISA-specific training, which will be provided by the Government after contract award. The particular training course and its associated number of hours of training required will be determined by the job duties of the personnel identified.

The Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions at the Technical Interchange Meeting (TIM). If personnel performing information assurance functions are hired after the TIM, the Contractor shall provide documentation supporting the information assurance certification status of such personnel immediately upon hire. No personnel will be allowed to perform information assurance functions without possessing the required information assurance certification.

The Contractor shall report on their DoD 8570.01-M certification status in the MSRs (see PWS Sections 6.1.2 and 11, Item Number 4). The initial MSR shall indicate that all information assurance personnel have the required certification. Future MSRs shall provide status updates for newly hired information assurance personnel

Deliverable: (27) Information Assurance Certification for all personnel performing information assurance functions (due at TIM and immediately upon hire of any information assurance personnel hired after TIM).

13. Government-Furnished Equipment (GFE)/Government-Furnished Information (GFI).

Upon identification by the Government COR of a requirement for DISN access (both SIPRNet and NIPRNet), the Government will provide such access in a Government facility when required. Specifically, the Government will provide access (at a Government location) to the ADP, computer and support equipment necessary for the contractor to access and perform work on the DISN, including computer hardware and software, from the time that the DISN access requirement is identified through the period of performance. GFE and Government Owned Equipment should be used for this Performance Work Statement (PWS) under this delivery order with following exceptions for which the contractor will be responsible for:

1.

Personal Computers (both desktops and laptops) that may be needed to perform TO related tasks outside of the Government locations.

2.

Personal telecommunication systems (both voice and data) that may be needed to perform TO related tasks outside of the Government locations.

14. Other Pertinent Information or Special Considerations.

a. Identification of Possible Follow-on Work & Possible Growth. Possible follow-on work includes additional development to meet future requirements. Dependent on changing requirements and available funding, each year, the government may require a significant increase in the level of effort provided by this contract. The government may provide up to 15% increase in the ceiling/funding to receive the increased level of service. This funding will likely be provided incrementally throughout the year.

b. Removal of Contract Personnel. The government retains the right to request removal contractor personnel, regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interests of the Government. The reason for removal will be fully documented in writing by the Contracting officer. When and if such removal occurs, the contractor will, within three (3) working days assign qualified personnel to any vacancy thus created.

c. Identification of Non-Disclosure Requirements. All Intellectual property for this effort will be owned by the Government. At Government sites, Contractor shall have access to systems and data related to IA Audit Management. The data may be classified and will be handled according to classification levels of the system in which it resides.

d. Identification of Possible Significant Growth. Dependent on changing requirements and available funding, each year, the government may require a significant increase in the level of effort provided by this contract. The government may provide up to 15% increase in the ceiling/funding to receive the increased level of service. This funding will likely be provided incrementally throughout the year.

e. Packaging, Packing, and Shipping Instructions. Packaging, packing and shipping will be in accordance with DITCO/DISA standards.

f. Inspection and Acceptance. The parts of the Audit Management pilot that reside on the SIPRNET will be accredited to the appropriate levels. The Audit Management pilot will satisfy DII COE and JTA requirements, if appropriate.

All technology deliverables shall comply with DIACAP, and be accredited at the highest level of the connection it supports. Documentation deliverables shall be grammatically correct and technically accurate. Final inspection and acceptance of all deliverables shall be performed at the place of delivery. The Government requires a period not to exceed 30 days after receipt of the final deliverable items for inspection and acceptance or rejection, unless otherwise specified. All deliverables must be submitted directly to the TM or his/her designated representative. The TM will monitor the Contractor efforts to ensure technical suitability.

If the deliverable does not meet the specified criteria, it will be returned. After notification that the deliverable did not meet the acceptance criteria, the Contractor shall re-submit the deliverable within 14 days. Upon re-submission by the Contractor, the Government will apply the same acceptance criteria. If the deliverable does not meet the acceptance criteria a second time, the Government may consider the Contractor as having deficient performance with respect to the subject task. The Contractor shall permit the KO or designated representative access at any reasonable time to all records, data, and facilities used in the performance of services.

g. Enhanced Skills Training. In the event the Contractor would like to attend training that would provide benefit to the work being performed under this contract, the Contractor may request the COR to approve attendance on a case-by-case basis. In the event the COR approves, the Contractor will be responsible for paying all tuition, per diem and travel costs, but may bill the labor hours to attend to this contract.

h. Certification and Accreditation. The Contractor’s solution(s) will be certified and accredited via the DIACAP process as applicable. The appointed Designated Approving Authority (DAA) will ensure all vulnerabilities on the product are fixed or risk mitigation is performed before granting the Authority to Operate (ATO) approval. The product must receive an ATO before it is placed on any DoD network. This process is the government's method of ensuring STIG compliance of the proposed solution(s).

i. Contractor Procurement of Hardware and Software. The contractor shall procure hardware, software and/or IT services as necessary to support this task. With Government approval, any required equipment or software may be purchased as Other Direct Costs (ODC's) under this task order. The contractor shall provide a Bill of Materials (BOM), approved by the Government COR, for any required hardware, software, or IT services. Once the COR has approved the BOM, the contractor shall procure the needed hardware, software, and/or IT services. Any COTS solutions (services, software and hardware) proposed as part of the lab and available on existing Government Enterprise Software Initiative (ESI) license agreements shall be acquired by the Contractor from the ESI contract vehicle unless the Contractor can provide better value to the Government without using the existing ESI license agreements. This decision shall be adequately justified and supported by the Contractor.

The contractor shall coordinate delivery of the needed hardware and software with the COR and when required shall receive, inventory, assemble, test, and document the configuration and deliver to the final destination. The contractor shall track all orders and report status in the Monthly Activities Report. The contractor shall submit a written request for authorization to purchase along with three (3) competitive quotes (or a sole source statement if it is a direct purchase) to the government. The COR will coordinate with the Contracting Officer for concurrence on all purchases. The contractor shall submit copies of all final invoices for hardware and or software purchased to the COR. Any required equipment/software should be purchased on a cost reimbursable basis.

j. Compliance. The contractor shall comply with the following DISA and DOD-approved architectures, programs, standards and guidelines:

1.

Defense Information Infrastructure (DII) Strategic Technical Guidance (STG), 2.

DISN Enclave Security Policy, 3.

DII Standard Operating Environment (SOE), 4.

DISA Security Technical Implementation Guides (STIGs), 5.

Defense Information Systems Network (DISN), 6.

Information Assurance Vulnerability Assurance (IAVA) Process

7.

Security Readiness Review (SRR) Process

8.

The contractor shall ensure that all contractor workstations connected to the DISANet and/or containing customer sensitive data are configured in compliance with the DISA STIG applicable for that operating system.

k. Property Accountability. All equipment purchased shall comply with the provisions and intent of DISA Instruction 270-165-2 "Property Accountability for DISA". Quarterly invoices are required by the Government and must outline location, physical ownership (who is in control of the equipment) and how the equipment is being used. The contractor shall provide asset inventory and asset tracking services that track the financial aspects of an asset to include cost and depreciation as well as contract management aspects to include leases, maintenance agreements, service contracts and location. A list of all Government Furnished Equipment (GFE) and equipment purchased for the contract, to include current location, will be reported on a quarterly basis and included in the Monthly Status Report.

l. Digital Certificates. Vendor shall use an approved digital certificate to securely communicate with the DOD and authenticate to DOD Information Systems. Vendor’s employees supporting this effort will be sponsored for a DoD Common Access Card to meet this requirement.

m. Systems Engineering and Design-type Architecture Documentation. The Contractor shall be compliant with the Department of Defense Architecture Framework (DoDAF) 2.02 and software and systems engineering principals expressed in the IEEE/EIA 12207.0, “Standard for Information Technology – Software Life Cycle Processes” standard and in the Defense Acquisition Guide (DAG). The Architecture and Design approach used by DISA is based on Model Based System Engineering (MBSE) using the System Modeling Language (SysML). Contractor personnel supporting tasks 6.2 of this PWS shall utilize and have expert knowledge with MBSE and SysML. All system documentation is required to follow the format prescribed by the current version of DISA’s Technical Capability Description template.

15. Section 508 Accessibility Standards. The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable (if box is checked) to this acquisition.

Technical Standards

FORMCHECKBOX

1194.21 - Software Applications and Operating Systems

FORMCHECKBOX

1194.22 - Web Based Intranet and Internet Information and Applications

FORMCHECKBOX

1194.23 - Telecommunications Products

FORMCHECKBOX

1194.24 - Video and Multimedia Products

FORMCHECKBOX

1194.25 - Self-Contained, Closed Products

FORMCHECKBOX

1194.26 - Desktop and Portable Computers

FORMCHECKBOX

1194.41 - Information, Documentation and Support

The Technical Standards above facilitate the assurance that the maximum technical standards are provided to the Offerors. Functional Performance Criteria is the minimally acceptable standards to ensure Section 508 compliance. This block is checked to ensure that the minimally acceptable electronic and information technology (E&IT) products are proposed.

Functional Performance Criteria

FORMCHECKBOX

1194.31 - Functional Performance Criteria

Section E - Inspection and Acceptance

QASP, 3 APR 13

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

1. Contract or Task Order Title: Enterprise Attack Analysis

2. Work Requirements:

· Task 1 - Task 1 - Enterprise Management Controls

· Task 2 - Development and Implementation of the Audit Log Management Program

3. Primary Method of Surveillance:

Periodic and Routine Inspection: Periodic inspections may occur on a pre-determined basis (e.g. daily, weekly, and/or monthly) as determined by the Contracting Officer’s Representative (COR). The results of periodic inspections may be used as the basis for subpar report documentation. Periodic inspections automatically become 100 percent evaluations or “100 % checks”. Random inspections may also be used and can occur at any time and location.

4. Scope of Performance: Work performed by the contractor under this contract will support the Enterprise Attack Analysis effort that is focused on DOD enterprise service logs including enterprise service gateway logs. The contractor will also provide implementation/ development support for log scripting to define such vulnerabilities as malware and attack vectoring, create analytical methods to counter the threat of malware and network vulnerabilities using web/firewall/other hardware log analysis, and provide training on log analysis by using scripting techniques to the DOD Computer Network Defense (CND) community. This is not exclusively a software development effort. The purpose of this effort is not primarily to develop deployable Government Off the Shelf (GOTS) software packages to the CND community, but to develop/enhance scripts (similar to macros) that will reside on Government servers at centralized locations that will pull from existing Government databases and various log files.

5. Performance Standards:

Performance occurs with no required re-performance/ rework at least 90% of time. Problems that are encountered are minor and resolved in a satisfactory manner.

Routine Inspection of Deliverable Products/Services

When the performance threshold for a particular PWS task is not met and re-performance does not correct the problem, the contractor shall explain, within 14 days in writing to Contracting Officer’s Representative (COR) or Alternate Contracting Officer’s Representative (ACOR) why performance was unacceptable, how performance will be returned to acceptable levels, and how recurrence of the problem will be prevented in the future. The COR/ACOR will evaluate the contractor's explanation and determine what corrective action should be taken to rectify the deficiency. At the government’s discretion, payment may be withheld until the associated support and documentation is satisfactorily provided.

When re-performance does not correct the deficiency and the contractor’s explanation of degraded performance is not deemed acceptable the COR/ACOR will notify the contracting officer for appropriate recourse, at the governments discretion, payment and or a percentage of the payment may be withheld.

6. Acceptable Quality Level (AQL):

The AQL is noted above in the performance standards table

7. Evaluation Method:

· The Program Manager (PM) and Contracting Officer’s Representative (COR) will periodically review the schedule to ensure it continues to accurately identify major milestones, decision points, lifecycle, dependencies, other events for the program. The COR will confirm the contractor is prepared to modify the schedule format and/or provide additional information based on management/technical requirements. The COR will confirm the date and time of updated schedules for the record.

· The PM and COR will document when each deliverable is provided and document if delivery is within established timeframes. The COR/ACOR shall provide both a verbal and written notification to the contractor of any deliverables that do not meet the AQL.

· The PM and COR will review and monitor the contractor’s weekly activities by reviewing all reports, briefings and minutes submitted by the contractor about the quality, the completeness of its contents and required format changes and document deliverables not within the specified performance thresholds.

· The COR/ACOR shall notify the DITCO Contracting Officer of performance that does not meet the AQL.

8. Incentives (Positive and/or Negative):

For both outstanding and negative performances, ratings shall be recorded in the…