HC1028-16-T-0026_PPSS_RFQ_1449.pdf

SEE ADDENDUM

(No Collect Calls)

HC1028-16-T-0026 11-Dec-2015

b. TELEPHONE NUMBER

618-229-9462

8. OFFER DUE DATE/LOCAL TIME

10:00 AM 14 Jan 2016

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

HC10289. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

TIMOTHY S. STILL

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESSX

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

DISA/DITCO-SCOTT-PL83

2300 EAST DRIVE

SCOTT AFB IL 62225-5406

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE 16. ADMINISTERED BY

SEE SCHEDULE

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$15,000,000

NAICS:

541990

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF95

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

HC1028-16-T-0026

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 12 Months MP6 Program Protection Support Services

FFP

NON-PERSONAL SERVICES

The contractor shall provide all labor, materials, and personnel to support tasks

IAW the PWS sections 6.1

Period of performance: Feb 01, 2016 through January 31, 2017

FOB: Destination

NET AMT

0002 12 Months IMN Program Protection Support Services

IAW the PWS sections 6.2

Period of performance: Feb 01, 2016 through January 31, 2017

0003 Lot Travel in support of CLIN 0001

COST

COST

TRAVEL COST-ALL TRAVEL SHALL BE IN ACCORDANCE WITH THE

JOINT TRAVEL REGULATIONS (JTR) AS STATED IN FAR 31.205-46. SEE

SECTION 6.3. OF THE PWS.

ESTIMATED COST

0004 Lot Travel in support of CLIN 0002

COST

COST

TRAVEL COST-ALL TRAVEL SHALL BE IN ACCORDANCE WITH THE

JOINT TRAVEL REGULATIONS (JTR) AS STATED IN FAR 31.205-46. SEE

1001 12 Months OPTION MP6 Program Protection Support Services

IAW the PWS sections 6.1

Period of performance: Feb 01, 2017 through January 31, 2018

1002 12 Months OPTION IMN Program Protection Support Services

IAW the PWS sections 6.2

Period of performance: Feb 01, 2017 through January 31, 2018

1003 Lot OPTION Travel in support of CLIN 1001

COST

COST

TRAVEL COST-ALL TRAVEL SHALL BE IN ACCORDANCE WITH THE

JOINT TRAVEL REGULATIONS (JTR) AS STATED IN FAR 31.205-46. SEE

1004 Lot OPTION Travel in support of CLIN 1002

COST

COST

TRAVEL COST-ALL TRAVEL SHALL BE IN ACCORDANCE WITH THE

JOINT TRAVEL REGULATIONS (JTR) AS STATED IN FAR 31.205-46. SEE

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

as of 02/Dec/2015

Contract Number: (completed by the KO at time of contract or TO award)

Task Order Number: (completed by the KO at time of TO award or N/A)

Tracking Number: (completed by the KO when complete package is received)

Follow-on to Previous Contract and

Task Order Number:

HC1047-10-C-4024

1. Contracting Officer Representative (COR).

a. Primary COR.

Name: TBD

Organization: Defense Information Systems Agency

Department of Defense Activity

Address Code (DODAAC):

HC1047

Address: Fort Meade, MD 20755

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR.

Name: TBD

Organization: Defense Information Systems Agency

DODAAC: HC1047

Address: Fort Meade, MD 20755

Phone Number:

2. Contract or Task Order Title. Program Protection Services Support Contract

3. Background. Program Protection is the holistic approach for delivering trusted systems and will ensure that programs adequately protect their technology, components, and information; it is the integrating process for mitigating and managing risks to advanced technology and mission-critical system functionality from foreign collection, design vulnerability or supply chain exploit/insertion, battlefield loss, and unauthorized or inadvertent disclosure throughout the acquisition lifecycle. The DISA Security Division, MP6, has oversight of the Agency’s

Program Protection and provides services and support for preparation and maintenance of Program Protection Plans

(PPP) for all of DISA’s programs. The services are currently performed on HC1047-10-C-4024.

4. Objectives:

The purpose of this contract is to provide: required services and support to identify DISA programs and establish/maintain a Program Protection Plan that is unique to the needs of each program; service support to ensure protection/security of Agency information systems; personnel security support; physical security support; education and training support; and support services to maintain the program protection security posture of National

Leadership Command Capabilities (NLCC) Division, IMN, which provides the critical wide area network component of tactical, strategic and enterprise information systems of the Defense Information Systems Network

(DISN).

5. Scope. The contractor will provide qualified personnel in support of DISA’s Program Protection analysis services and information system security for the Agency and the associated security support needed to perform this mission. In support of these services, travel may be required periodically to other DISA locations. The contractor will not charge G&A against the government’s reimbursement for travel. As mission requirements change, surge support may be required by the Government over the lifecycle of this order. This requirement could increase up to

10 % over the life of the contract, inclusive of option years. Surge support only covers the amount of work within scope of the tasks identified herein.

Task Area 1 – MP6 Program Protection/Information Systems Security Support Services

Task Area 2 – IMN Program Protection Support Services

Task Area 3 – Travel

6. Performance Requirements.

6.1 Task 1 – MP6 Program Protection/Information Systems Security Support Services. The Security Division, MP6, is responsible for Program Protection oversight for DISA. In support of this mission, the contractor will provide an

Onsite Program POC/Program Protection/Program Security Support Assistant, a Program Protection Security

Support Assistant, an Information Systems Security Manger Assistant, and a Special Security Representative (SSR).

6.1.1 Subtask 1 – Onsite Program POC/Program Protection/Program Security Support Assistant. The

Contractor shall provide a highly trained security person with a minimum of 20 years of experience working in the

Department of Defense Sensitive Compartmented Information (SCI) and have demonstrated experience in integrating program protection planning and execution in accordance with DoD 5200.39, Critical Program

Information (CPI) Protection within the Department of Defense and DoDI 5000.02, Operation of the Defense

Acquisition System. This position may be required to travel. The contractor will:

a) Integrate program protection planning and execution in accordance with DoD 5200.39. The contractor shall provide trained individual with a minimum of five years of experience in utilizing Intelligence

Community Directives (ICD).

b) Assist with conducting Mission Area Analysis (MAA) to assess the protection status in the supported organization(s).

c) Assist in the review/revision of protection-related documents to ensure mutual compatibility and comprehensive Agency-level protection, including but not limited to:

a. Security Classification Guides

b. Communication Strategy

c. Operations Security (OPSEC) Plan

d. Summary Statement of Intent/Delegation of Disclosure Authority Letter

e. Export Control Guidance

f. Technology Assessment/Control Plan

g. Security Standard operating Procedures (SOPs)

h. Anti-tamper Plan

i. System Security Authorization Agreement

d) Assist with documenting Agency level policy outlining the requirements and development of Program

Protection Plans.

e) When needed, assist with implementation, and as necessary improvement of protection measures.

f) At the Agency level, review and provide guidance on security classification guides development during all phases of an acquisition effort. Review proposed industry interfaces, OPSEC procedures, cover stories periodically review for continued applicability.

g) Assist with conducting Critical Program Information (CPI) assessment of Agency’s programs and projects.

h) Recommend interim protection measures upon completion of the CPI Assessment.

i) Analyze threats to CPI and other sensitive information.

a. Develop and submit necessary inputs to servicing Counterintelligence Threat

Assessment Center

b. Review threat assessment to derive program specific vulnerabilities

j) Prepare, coordinate, and submit annual reports on program security issues as required.

k) Act as the onsite program contractor POC for the government.

PWS

Task#

Deliverable Title Format Due Date Distribution/Copies Frequency and Remarks

6.1.1 DISA Program

Protection Plan

Roster

Excel Initial report due 45 days after contract award

Electronic copy to

COR

Initial

6.1.1

DISA Program

Protection Plan

Roster with

Monthly Status

Updates

Excel 5 th workday of the month for prior month’s information

Electronic copy to

COR

Monthly, on

5th workday

6.1.2 Subtask 2 – Program Protection Security Support Assistant. The Contractor shall provide a trained security person with a minimum of 10 years of experience working in the Department of Defense Sensitive

Compartmented Information (SCI) program and have demonstrated experience in writing program protection plans in accordance with DoD 5200.39, Critical Program Information (CPI) Protection within the Department of Defense and DoDI 5000.02, Operation of the Defense Acquisition System. The contractor will:

a) Assist in the review/revision of protection-related documents to ensure mutual compatibility and comprehensive protection, including but not limited to:

a. Security Classification Guides

b. Communication Strategy

c. Operations Security (OPSEC) Plan

d. Summary Statement of Intent/Delegation of Disclosure Authority Letter

e. Export Control Guidance

f. Technology Assessment/Control Plan

g. Security Standard operating Procedures (SOPs)

h. Anti-tamper Plan

i. System Security Authorization Agreement

b) Assist in the development/update of security classification guides during all phases of an acquisition effort. Review proposed industry interfaces, OPSEC procedures, cover stories periodically review for continued applicability

c) Prepare, coordinate, and submit annual reports on program security issues as required

6.1.3 Subtask 3 – Information Systems Security Manager Assistant. The Contractor shall provide a highly trained information system security specialist with a minimum of 10 years of experience with the Department of

Defense performing ISSM duties on Joint Worldwide Intelligence Communication Systems (JWICS) networks. No specific formal degree program is required for the ISSM role, however, HBSS certification, either System Security

Certified Practitioner (SSCP) or Certified Information Security Manager (CISM) certification, along with an in-depth knowledge of DoD Intelligence Information System (DoDIIS) certification/accreditation and security guidelines as prescribed in the DoDIIS C&A Guide, Intelligence Community Directive (ICD) 503,INTELLIGENCE

COMMUNITY INFORMATION TECHNOLOGY SYSTEMS SECURITY RISK MANAGEMENT,

CERTIFICATION AND ACCREDITATION, the Department of Defense Intelligence Information System

(DoDIIS) – Joint Security Implementation Guide (DJSIG), Defense Intelligence Agency Manual 50-4 DODIIS

INFORMATION SYSTEMS SECURITY PROGRAM, or subsequently updated guidance, are required. A technical background in computer science, mathematics, engineering, or a related field is extremely beneficial. While assisting with the responsibilities of the position of the ISSM, the contractor shall, as needed:

a) Assist the ISSM in maintaining a formal DoDIIS security program.

b) Assist the ISSM in maintaining an ISSM program SOP that shall be reviewed/updated annually

Implement and enforce AIS security policies.

c) Oversee all IAOs to ensure they follow established AIS policies and procedures. Ensure IAM/IAO review weekly bulletins and advisories that impact security of site information systems to include, but not limited to, AFNOSC-NSD, ACERT, NAVCIRT, IAVA, and DISA ASSIST bulletins. Ensure that periodic testing (monthly for PL-5 systems) is conducted to evaluate the security posture of the AISs by employing various intrusion/attack detections and monitoring tools (shared responsibility with

IAOs).

d) Assist IAOs to ensure proper decisions are made concerning the levels of concern for confidentiality, integrity, and availability of the data, and the protection levels for confidentiality for the system.

e) Reviews C&A documentation and assists ISSM in the preparation of documentation for systems installed without existing documentation.

f) Assist in documenting procedures for clearing, purging, declassifying, and releasing system memory, media, and output.

g) Assist the ISSM to maintain, as required by the DAA Rep/SCO, a repository for all system accreditation/certification documentation and modifications.

h) Coordinate and assist with AIS security inspections, tests, and reviews.

i) Ensure proper protection and corrective measures have been taken when an AIS incident or vulnerability has been discovered.

j) Assist the ISSM in implementing an effective DoDIIS security education, training, and awareness program.

k) Assist the ISSM in implementing procedures IAW configuration management (CM) policies and procedures for authorizing the use of hardware/software on an IS. Follow procedures for responding to security incidents, and for investigating and reporting (to the DAA/DAA Rep/SCO and to local management) security violations and incidents, as appropriate.

l) Maintain a working knowledge of system functions, security policies, technical security safeguards, and operational security measures.

m) Access only that data, control information, software, hardware, and firmware for which they are authorized access and have a need-to-know, and assume only those roles and privileges for which they are authorized.

6.1.4 Subtask 4 – Special Security Representative (SSR). The Contractor shall provide highly trained security person with a minimum of 10 years of experience in the Department of Defense Sensitive Compartmented

Information (SCI) personnel and physical programs and have excellent communicative and interpersonal skills. The contractor shall perform duties involved with Sensitive Compartmented Information security as a Special Security

Representative (SSR) involving the protection of intelligence sources or methods/intelligence systems and means of collection, verifying/obtaining individual’s eligibility to access SCI and with the physical security of Sensitive

Compartmented Information Facilities (SCIFs). The contractor will be able to:

a) Receive and respond to requests for SCI eligibility, recertification, and special purpose/interim SCI accesses, insuring validity of the requests.

b) Process SCI eligibility determinations, special purpose access and compelling need actions with

Central Adjudication Facilities (CAF) prior to indoctrination.

c) Review and act upon authorities to indoctrinate SCI personnel, including conducting pre-screening interviews and indoctrination briefings.

d) Send and receive SCI visit requests and code badges for SCIF access.

e) Ensure all assigned personnel meet/maintain the appropriate security clearance requirements in accordance with ICD 704.

f) Verify and act on requests for temporary and annual SCI courier authorizations and issue those certifications.

g) Update and query required information systems and maintains required hard-copy files to perform assigned duties.

h) Prepare and execute required periodic reporting and or audits/reviews in accordance with applicable directives, regulations, and instructions.

i) Provide continuous training and guidance in all areas of SCI security; including but not limited to, local procedures, Operations Security (OPSEC), Communications Security (COMSEC), Security

Awareness, handling/safeguarding/marking classified material/information, foreign travel requirements, entry procedures, escort procedures, document control procedures, security incident/violation reporting procedures, and classification review/guidance.

j) Update personnel security responsibilities for Special Security Representatives (SSR) and ensure SSRs are appropriately appointed and trained.

k) Analyze and assess issues with SCI personnel security and propose solutions that meet standards set by

ICD 704 and other applicable regulations, directives, and instructions.

l) Assist in maintaining accreditation for SCI Facilities (SCIFs) and SCI systems in accordance with DCI

Directive 6/9 (DCID 6/9) and ICD 705.

m) Maintain liaison with adjudicating agencies to expedite adjudication process.

6.2 Task 2 – IMN Program Protection Support Services. The contractor shall provide all personnel necessary to perform Program Protection Analysis; Personnel Security, Physical Security/Security, Education & Training, and

Information Security Support duties. To accomplish these tasks, Defense Information Systems Agency (DISA) requires support from a contractor whose primary function is working within Special Access Programs (SAPs) with proven past performance supporting senior Department of Defense (DoD) agencies, such as Office of the Secretary of Defense (OSD) and Military Compartments. All personnel must have a current Top Secret security clearance and each nominee must meet Intelligence Community Directive (ICD) 704 and JAFAN 6/4 standards. Travel may be required under this requirement. All travel will be authorized by the Government Contracting Officer's

Representative (COR)/Site POC, in writing, prior to performance and will be paid in accordance with FAR 31.205-

46 and the Joint Federal Travel Regulations. All travel invoices will be provided to the COR/Site POC for review/certification prior to submission for payment. The NLCC requires contractor support for its Program

Management Office, complete with deliverables that would affect the execution of program protection of DISA and external governance organizations, specifically in the following areas: Program Manager, Program Protection/

Program Security Support, Program Protection/Program Security Support Assistant, Physical Security Support, Personnel Security Specialist, and Information Security Support.

6.2.1 Subtask 1 – IMN Program Manager, Program Protection/Program Security Support: The Contractor shall provide a highly trained security person with a minimum of 10 years of experience working in the Department of Defense Sensitive Compartmented Information (SCI) and Special Access Programs (SAP) and have demonstrated experience in integrating program protection planning and execution in accordance with DoD 5200.39,Critical

Program Information (CPI) Protection within the Department of Defense; DoDI 5000.02, Operation of the Defense

Acquisition System and with Joint Air Force, Army, Navy (JAFAN) 6/X series. The contractor will:

a) Integrate program protection planning and execution in accordance with DoD 5200.39, and consistent with Joint Air Force, Army, Navy (JAFAN) 6/X series. The contractor shall provide trained individuals with a minimum of ten years of experience in administering/implementing the JAFAN and

Director, Central Intelligence Directive (DCID) series.

b) Conduct a Mission Area Analysis (MAA) to assess the protection status in the supported organization(s), to include:

a. In-briefs/introductions to senior leaders, key engineers, and stakeholders

b. Assist in reviewing and creating program technical briefings and materials

c. Review existing protection documentation

d. Assess the status of protection within the organization

c) Integrate and synchronize the overall protection effort by building and sustaining relationships with program protection – Program Manager (PM), Program Security Officer, Leads for Information

Systems Security, Information Assurance, Physical Security, Personnel Security, and

Counterintelligence agents. Create a plan for an integrated security environment that will protect information throughout the life cycle of the program.

d) Review, revise and provide protection-related documents to ensure mutual compatibility and comprehensive protection, including but not limited to:

a. Security Classification Guides

b. Communication Strategy

c. Operations Security (OPSEC) Plan

d. Summary Statement of Intent/Delegation of Disclosure Authority Letter

e. Export Control Guidance

f. Technology Assessment/Control Plan

g. Security Standard operating Procedures (SOPs)

h. Anti-tamper Plan

i. Counterintelligence Support Plan

j. System Security Authorization Agreement

e) Support the development of protection measure options based on:

a. Mitigation of risk

b. Feasibility

c. Cost

f) Codify protection decisions in a program protection plan

g) Assist with implementation, maintenance, and as necessary improvement of protection measures

h) Support the government Program Security Officer (PSO) in the management and execution of acquisition and operational program security as it applies to program protection and industrial security oversight of industry location/personnel involved in the applicable acquisition effort. Will have knowledge and implementation experience with Department of Defense Directive (DoDD) 5205.07 as well as security standards such as ICDs DCISs and the JAFANs.

i) Assist in developing/update security classification guides during all phases of an acquisition effort.

Review proposed industry interfaces, OPSEC procedures, cover stories periodically review for continued applicability

j) Conduct Critical Program Information (CPI) assessment of programs and projects

a. Develop agenda, recommend required, optional participants to PM/Technical Director

b. Provide in-brief/read-ahead as necessary to participants

c. Facilitate CPI assessment

d. Capture details and decisions in memoranda for the record (MFR) and staff MFR as appropriate (chain of command and classification) for government approval and signature

k) Recommend interim protection measures upon completion of the CPI Assessment

a. Provide Analysis of Alternatives (AoA) which identify protection measures that may be implemented within 60 days of CPI identification

b. Obtain approval to implement

c. Assist with implementation

d. Record interim measures

l) Analyze threats to CPI and other sensitive information

a. Develop and submit necessary inputs to servicing Counterintelligence Threat Assessment

Center

b. Review threat assessment to derive program specific vulnerabilities

m) Evaluate existing protection posture

a. Determine existing protection measures for all locations with CPI

b. Determine existing protection measures for all systems with CPI

c. Determine existing protection measures for all personnel with access to CPI

n) Conduct vulnerability assessments and risk analyses

a. Map threat collection methods to CPI format and location

b. Compare existing protection levels to appropriate protection levels

c. Prioritize vulnerabilities

Task #

Deliverable Title Format Due

Date/Frequency and Remarks

Distribution/Copies

6.2.1 Review/Update Program

Management Plan (PMP) as needed

1 Electronic MS

Word

30 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

6.2.1 Review/Update Mission

Area Analysis (MAA) report as needed

1 Electronic MS

Word

40 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

6.2.1 Review/Update

Summary Statement of

Intent/ Delegation of

Disclosure Authority

Letter

1 Electronic MS

Word

15 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

6.2.1 Review/Update

Technology

Assessment/Control Plan

1 Electronic MS

Word

45 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

6.2.1 Monthly Reports 1 Electronic MS

Word

Monthly IMN

POC/PSO/COR,

ALT COR

6.2.1 Review/Update Security

Classification Guide

1 Electronic MS

Word

30 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

6.2.1 Review/Update

Communications

Strategy

1 Electronic MS

Word

45 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

6.2.1 Review/Update

Operations Security

(OPSEC) Plan as needed

1 Electronic MS

Word

45 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

6.2.1 Review/Update Export

Control Guidance

1 Electronic MS

Word

15 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

6.2.1 Review/Update Security

Standard Operating

Procedures (SOP)

1 Electronic MS

Word

15 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

6.2.1 Review/Update Anti-

tamper Plan

1 Electronic MS

Word

30 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

6.2.1 Review/Update

Counterintelligence

Support Plan

1 Electronic MS

Word

90 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

6.2.1 Review/Update Critical

Program Information assessment report

1 Electronic MS

Word

40 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

6.2.1 Review/Update Road

map Document to

Identifying Security

Controls

1 Electronic MS

Word

30 Business days from Exercise of

Contract

IMN

POC/PSO/COR,

ALT COR

6.2.1 Review/Update Systems

Security Plan

1 Electronic MS

Word

30 Business days from Exercise of

Contract

IMN

6.2.2 Subtask 2 – Program Protection/Program Security Support Assistant. The Contractor shall provide a trained security person with a minimum of 5 years of experience working in the Department of Defense Sensitive

Compartmented Information (SCI) and Special Access Programs (SAP) and have demonstrated experience in writing program protection plans in accordance with DoD 5200.39, Critical Program Information (CPI) Protection within the Department of Defense; Operation of the Defense Acquisition System and with Joint Air Force, Army, Navy (JAFAN) 6/X series. The contractor will:

a) Support the government Program Security Officer (PSO) and the Program Manager, Program

Protection/Program Security Support in the management and execution of acquisition and operational program security as it applies to program protection and industrial security oversight of industry location/personnel involved in the applicable acquisition effort. Will have knowledge and implementation experience with Department of Defense Directive (DoDD) 5205.07 as well as security standards such as ICDs DCISs and the JAFANs.

b) Assist in the review, revise and provide protection-related documents to ensure mutual compatibility and comprehensive protection, including but not limited to:

a. Security Classification Guides

b. Communication Strategy

c. Operations Security (OPSEC) Plan

d. Summary Statement of Intent/Delegation of Disclosure Authority Letter

e. Export Control Guidance

f. Technology Assessment/Control Plan

g. Security Standard operating Procedures (SOPs)

h. Anti-tamper Plan

i. Counterintelligence Support Plan

j. System Security Authorization Agreement

c) Assist in the development/update of security classification guides during all phases of an acquisition effort. Review proposed industry interfaces, OPSEC procedures, cover stories periodically review for continued applicability

d) Assist in the review of Public Release and Freedom of Information Act (FOIA) requests and prepare associated correspondence for the staffing of said requests

e) Assist with investigating of security violation/incident documentation, providing recommendations to the government security official

f) Review industry SOPs, providing written correspondence for government signature recommending approval or capture comments requiring further clarification from the submitter

g) Prepare, coordinate, and submit annual reports on program security issues as required

6.2.3 Subtask 3 – Physical Security Support. The Contractor shall provide trained security personnel with a minimum of 5 years of experience working in the Department of Defense Sensitive Compartmented Information

(SCI) and Special Access Programs (SAP) and have demonstrated experience in significant application of risk management processes to analyze assets, threats, and vulnerabilities; calculate risks; and determine physical security countermeasures. Develop a comprehensive security education and awareness program that meets criteria outlined in JAFAN 6/0, Executive Order (EO) 13526, EO 12829, DoD Manual 5220.22 and DoD 5200.1-R. The contractor must have successfully completed the following training courses; Applying Physical Security Concepts (PY201.01), DNI/SCC ICD 705 Physical Security Course, Orientation to SAP Security Compliance Inspections (SA210.01) and

SAP Mid-Level Security Management (SA201.01). The contractor will:

a) Coordinate physical security planning, design, and advice on government and contractor facilities storing, processing, and discussing classified information in accordance with the following:

a. Joint Air Force, Army, Navy Manual (JAFAN) 6/0

b. Joint Air Force, Army, Navy Manual (JAFAN) 6/9

c. Director, Central Intelligence Directive (DCID) 6/9

d. DoD 5105.21 M-1, Sensitive Compartmented Information Administrative Security Manual

e. ICD 705

b) Evaluate government and industrial facility plans for physical security accreditation. Prepare correspondence for submission to higher authority that identifies discrepancies in submitted plans or approve/accredit the facility. All correspondence will be prepared in accordance with the applicable security classification guide and in the government supplied format

c) Provide direction with physical security operating procedures, inspection checklists, required by DoD , SCI and SAP physical security and TEMPEST requirements

d) Draft Technical Security Countermeasures requests

e) Assist the government in conducting security reviews and staff assistance visits at government and industry locations applying regulatory directives to ensure the location being reviewed is in compliance

f) Develop a comprehensive security education and awareness program that meets criteria outlined in

JAFAN 6/0, Executive Order (EO) 13526, EO 12829, DoD Manual 5220.22, DoD 5200.1-R, and Air

Force Instruction (AFI) 31.401 as agreed to by the SSO

g) Develop, disseminate, and present security education materials that provide blended learning opportunities.

h) Administer security review program, establishing the review schedule, generate correspondence for government signature, maintain security review files, track status of findings, and monitor follow-up reports from sites reviewed as agreed to by the SSO

i) Maintain distribution list of all program locations and disseminate correspondence, directives

j) The individual shall also assist the DISA PSO in the daily administration of satellite facilities located in the DISA complex in accordance with JAFAN 6/0

Deliverable Title Format Due

Date/Frequency and Remarks

Distribution/Copies

6.2.3 Annotate Compliance

Security

1 Electronic MS

Word

30 Business days from initiation of

IMN

Education/Training

Awareness Program for

Annual Self-Assessment contract ALT COR

6.2.3 Maintain a Foreign

Travel/Foreign Contact

Program

1 Electronic MS

Word

30 Business days from initiation of contract

IMN

6.2.4 Subtask 4 – Personnel Security Specialist. The Contractor will provide a trained security personnel with a minimum of 5 years of experience working in the Department of Defense Sensitive Compartmented Information

(SCI) and Special Access Programs (SAP) and have demonstrated experience in security disciplines such as history, laws, and regulations; personnel security investigations; security clearances; and sensitive positions and the process for making personnel security determinations through consistent application of policy guidelines. The contractor must have successfully completed the following training courses; Intelligence Community Directive 704

Adjudications Course, DoD SCI Security Officials (SCI201.01) and SAP Mid-Level Security Management

(SA201.01). The DoD Advance Personnel Security Adjudications course is not mandatory but it would be a plus if it was successfully completed. The contractor will:

a) Conduct 1 st Tier adjudication on all PAR submissions in accordance with the following:

a. Joint Air Force, Army, Navy Manual (JAFAN) 6/0

b. Joint Air Force, Army, Navy Manual (JAFAN) 6/4

c. Director, Central Intelligence Directive (DCID) 6/4

d. DoD 5105.21 M-1, Sensitive Compartmented Information Administrative Security Manual

e. DoD 5200.2R, Personnel Security Management

b) Review/track/maintain Personnel Access Requests (PARs)

c) Establish and maintain a tracking of all PAR related actions from initial submission through indoctrination

d) Upon review of pertinent information submitted for consideration, record derogatory information found during the review and forward the completed package to the government decision maker for eligibility decision

e) If additional information is required, the contractor shall prepare associated notifications, suspense receipts and consolidate information for government review and eligibility determination

f) Update and maintain JPAS, Scattered Castles, and local personnel security databases

g) Prepare and maintain personnel dossiers and file all applicable personnel security documentation in accordance with JAFANs into the individual files

h) Interface with Government Oversight Agency/Access Approval Authority (AAA) and contractor industry security personnel on a daily basis ensuring a smooth flow of data interchange

i) Assist the Government in conducting security reviews and staff assistance visits at Government and industry locations applying regulatory directives to ensure the location being reviewed is in compliance. Provide input to the Governments final report

j) Administer foreign travel/foreign contact program as it applies to accessed personnel to include maintenance of personnel security files

k) Have knowledge of ICDs 704 as well as DCID 6/4, JAFAN 6/4

l) Have a working knowledge of DoDD 5205.07

m) Process and maintain Non-Disclosure agreements (NDAs)

n) Document and administer program indoctrinations

o) Use applicable security databases and technical procedures to verify visitor clearances and send visit access request (VARs)

p) Maintain all facility access rosters

q) Develop and administer a foreign travel/foreign contact program

Deliverable Title Format Due

Date/Frequency

Distribution/Copies and Remarks

6.2.4 Track/Maintain

Personnel Access

Requests (PAR) Plan

1 Electronic MS

Word/or Excel

14 Business days from initiation of contract /

Monthly once developed

IMN

POC/PSO/COR,

ALT COR

6.2.4 Track/Maintain Current

Status of program indoctrinations

1 Electronic MS

Word

14 Business days from initiation of contract /

Monthly once developed

IMN

6.2.5 Subtask 5 – Information Security Support. Performs cyber security (monitor, audit, analyze) Enterprise information systems for events to include, but are not limited to: unauthorized access, insider threat, hacking or penetration attempts from known threats, identifying presence of unauthorized software or malicious code on both classified and unclassified networks, such as Active Directory, firewalls, intrusion detection systems, log files, and remote access servers. Individual has the skills and experience to take necessary actions to proactively address issues and guide support personnel to preclude system failures or disruptions; identifies vulnerable computers that may be used in exploitation, data infiltration, and data compromise. Contractor possesses the ability to communicate effectively both orally and in writing. Possess experience and skill sets in: Network Intrusion Detection and

Computer Forensics and Investigations; has knowledge of inquiries, investigations, operations and insider threats;

proficient in oral communication and investigative writing. Proficient in either or both Microsoft and Linux based

Operating Systems in addition to a full command of MS Office applications. At least 4 years of experience.

a) The Contractor shall provide services in the field of Intrusion analysis; secure network engineering, vulnerability assessments, intrusion detection, risk assessment and vulnerability research. Contractor shall provide custom support to address unique computer security requirements

b) The Contractor shall configure and test security solutions to satisfy mission requirements and provide training for personnel designated by the COR or team lead

6.3 Task 3 – Travel. All travel will be authorized by the Government Contracting Officer's Representative

(COR)/Site POC, itemized in writing, prior to performance and will be paid in accordance with FAR 31.205-46 and the Joint Federal Travel Regulations. All travel invoices will be provided to the COR/Site POC for review and certification prior to submission for payment. The contractor will not charge general and administrative (G&A) costs against the government’s reimbursement for travel.

7. Performance Standards.

Performance Standard Acceptable Quality Level (AQL) Method of Surveillance

Subtasks 6.1.1 -6.2.4 90% of reports are submitted on time with no errors. Problems that occur are minor and are resolved in a satisfactory manner.

100% inspection upon delivery of monthly and initial reports

8. Incentives. N/A

9. Place of Performance. Primary place of performance for services acquired under this contract is at the DISA's facilities at 6910 Cooper Ave, Ft. Meade, MD, a Government agency in Warrenton, VA, and other Government agencies. Travel in and around the primary place of performance may be required throughout the period of performance. Additional travel within CONUS or OCONUS may be required to support the requirements of this

PWS. A detailed/itemized travel voucher will be submitted to the Government Contracting Officer's Representative

(COR), in writing, no less than 5 working days prior to travel start date and will be paid in accordance with FAR

31.205-46 and the Joint Federal Travel Regulations. All final travel invoices, to include a detailed itemized breakout of expenses with receipts, will be provided to the COR for review/certification no more than 5 working days after completion of travel and prior to submission for payment. The contractor will not charge G&A against travel reimbursement.

Alternate Place of Performance - Contingency Only. As determined by the Contracting Officer’s Representative

(COR), contractor employees may be required to work at an alternate place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather, etc.). Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources.

10. Period of Performance. The period of performance is for one (1) base year of 12 months and one (1) 12-month option year. As directed by the COR, the contractor shall continue performance in emergency or mission essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

11. Delivery Schedule.

Task#

Deliverable Title Format Due Date Distribution/Copies Frequency and Remarks

PWS

Task#

Deliverable Title Format Due Date Distribution/Copies Frequency and Remarks

6.1.1 DISA Program

Protection Plan

Roster

Excel Initial report due

45 days after contract award

Electronic copy to

COR

6.1.1

DISA Program

Protection Plan

Roster with Monthly

Status Updates

Excel 5 th workday of the month for prior month’s information

Electronic copy to

COR

Monthly, on

6.2.1

Review/Update

Program

Management Plan

(PMP)

1 Electronic

MS Word

30 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

Mission Area

Analysis (MAA) report

1 Electronic

MS Word

40 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

Draft/Review/Update

Summary Statement of Intent/Delegation of Disclosure

Authority Letter

1 Electronic

MS Word

15 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

Technology

Assessment/Control

Plan

1 Electronic

MS Word

45 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

Monthly Reports 1 Electronic

MS Word th workday of the month for prior month’s information

IMN

POC/PSO/COR,

ALT COR

Monthly, on

Security

Classification Guide

1 Electronic

MS Word

30 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

Initial

6.2.1 Review/Update

Communications

1 Electronic

MS Word

45 Business days from initiation of

IMN

Strategy contract ALT COR

6.2.1 Review/Update

Operations Security

(OPSEC) Plan

1 Electronic

MS Word

45 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

Initial

6.2.1 Review/Update

Export Control

Guidance

1 Electronic

MS Word

15 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

Security Standard

Operating Procedures

(SOP)

1 Electronic

MS Word

15 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

Review/Update Anti-tamper Plan

1 Electronic

MS Word

30 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

Counterintelligence

Support Plan

1 Electronic

MS Word

90 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

Critical Program

Information assessment report

1 Electronic

MS Word

40 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

Review/Update Road map Document to

Identifying Security

Controls

1 Electronic

MS Word

30 Business days from Exercise of

Contract

IMN

POC/PSO/COR,

ALT COR

Systems Security

Plan

1 Electronic

MS Word

30 Business days from Exercise of

Contract

IMN

POC/PSO/COR,

ALT COR

Initial

6.2.3 Review/Update

Physical Security

Education &

Training Support

Plan

1 Electronic

MS Word

30 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

Initial

6.2.3 Develop/Administer

a Foreign

Travel/Foreign

Contact Program

1 Electronic

MS Word

30 Business days from initiation of contract

IMN

POC/PSO/COR,

ALT COR

Initial

6.2.4 Track/Maintain

Personnel Access

Requests (PAR) Plan

1 Electronic

MS Word/or

Excel

14 Business days from initiation of contract / Monthly once developed

IMN

POC/PSO/COR,

ALT COR

Initial

6.2.4 Track/Maintain

Current Status of program indoctrinations

1 Electronic

MS Word

14 Business days from initiation of contract / Monthly once developed

IMN

POC/PSO/COR,

ALT COR

Initial / Then

Monthly on th workday

12. Security Requirements. The work on Task 1 is TOP SECRET/SCI and the work on Task 2 TOP

SECRET/SCI/SAP.

This section shall be considered a supplement to block 13 of the Government provided DD 254, Contract

Classification Specification. The following security requirements shall apply to this effort.

References:

a. DOD 5200.2-R, DOD Personnel Security Program.

b. DISAI 240-110-36, Personnel Security.

c. DOD 5220.22-M, National Industrial Security Program Operating Manual.

d. DOD 5220.22-R, Industrial Security Regulation.

e. DISA Computing Services Directorate (CSD) Security Handbook.

f. DODM 5200.01-M, Information Security Program, 24 February 2012

12.1 Facility Security Clearance. The work to be performed under this contract is up to the Top Secret level and will require Sensitive Compartmented Information (SCI) access eligibility for some personnel. Therefore the company must have a final Top Secret Facility Clearance (FCL) from the Defense Security Service (DSS) Facility Clearance

Branch (FCB) at time of award.

12.2 Security Clearance and Information Technology (IT) Level. All personnel performing on this contract will be

U.S. citizens. There is one level of personnel security requirements under this contract covering eight (8) types of positions.

12.2.1 The following types of positions require a minimum of final Top Secret security clearance and final IT-I

(privileged level systems access) eligibility when performance starts. Immediately upon hire, the contractor will require Sensitive Compartmented Information (SCI) access eligibility adjudicated by the Defense Intelligence

Agency (DIA) to perform their duties. SCI Processing for SCI eligibility will be coordinated with the supporting

Government Security Manager and will begin immediately upon start of duty performance under this contract.

1. Program Manager, Protection/Program Security Support Assistant

2. Program Protection/Program Security Support Assistant

3. Protection Security Support Assistant

4. Information Systems Security Manager Assistant

5. Special Security Representative (SSR)

6. Physical Security Support

7. Personnel Security Specialist

8. Information Security Support

12.3 Investigation Requirements. All personnel requiring SCI, Top Secret or IT-I eligibility under this contract must undergo a favorably adjudicated Single Scope Background Investigation (SSBI) as a minimum investigation. The

SSBI will be maintained current within 5-years and requests for Special Background Periodic Review (SBPR) will be initiated 90 days prior to the 5-year anniversary date of the previous SSBI or SBPR.

12.4 Adjudication for IT access. Adjudication of investigations for granting of interim or final IT-I access will be accomplished through DISA Security. An exception to this is that individual contractor employees with an SSBI or

SBPR (within a 5-year scope) that is favorably adjudicated for a Top Secret security clearance by any of the

Department of Defense adjudication facilities (DoD CAF and DICAF) will be automatically accepted for final IT-I access.

12.5 Interim IT access. Pending completion of a SSBI (for IT-I) and final adjudication for security clearance, contractor employees may be granted interim authorization to perform duties designated as IT-I. The interim authority for IT sensitive positions is the DISA Personnel Security Office.

12.5.1 Following are the requirements, which must be met prior to granting of interim IT-I authorization:

The request for SSBI (E-QIP or Word Fillable SF 86 and fingerprint cards) must be submitted by the contractor Facility Security Officer (FSO) through the Defense Security Service (DSS) to the

Office of Personnel Management (OPM) and the Department of Defense (DoD) Personnel

Security Data Base (JPAS) must reflect that the investigation is open. A copy of the E-QIP or SF

86 forms must be submitted to the DISA Field Security Office, Security Manager (SM). The SM will forward the forms along with a written request for interim IT-I authorization to DISA

Personnel Security for approval.

The National Agency Check (NAC) portion of the SSBI or a previous valid NCLC/DNACI/NAC or ENTNAC must be completed and favorably adjudicated before interim IT-I access will be granted. An interim security clearance (either Top Secret or Secret, as appropriate for the position) should be requested by the company FSO for those contractor employees without a previous investigation.

12.6 Visit Authorization Letters. The Contractor will forward a Visit Authorization Letter (VAL) to the COR at the address listed in paragraph 1 above for all employees prior to the beginning of each contracting/task order period of performance and as new contractor employees are assigned to the contract:

The VAL shall be on company letterhead or pre-fabricated form and contain the following information:

Contract number with start and end dates

CAGE CODE

Company point of contact (POC) and telephone number

Government POC/COR name and telephone number

Complete legal name of employee(s)

Social Security Number

Security Clearance level, date granted, and

Adjudication facility name, i.e. DISCO

Type of personnel security investigation (PSI) pending or completed

Date PSI completed

Security Contacts. DISA Security Personnel can be contacted for security related questions as follows:

For Industrial Security related issues:

Dontia Costin, phone: (301) 225-1206

Defense Information Systems Agency

ATTN: MPS61, Industrial Security

Command Building

6910 Cooper Ave.

Fort Meade, MD 20755-7088

For Personnel…