Solicitation_HC102818R0098.docx

HC102818R0098

Section SF 1449 - CONTINUATION SHEET

PWS

PERFORMANCE WORK STATEMENT (PWS)

as of 16 January 2018

1. Contracting Officer’s Representative (COR).

a. Primary COR.

Department of Defense Activity Address Code (DODAAC):

HC1040

b. Alternate COR.

2. Contract or Task Order Title. Organizational Messaging Service (OMS) and National Gateway Center (NGC) System Software and Security Engineering Services

3. Background. The OMS and NGC Command and Control (C2) messaging systems originated with Automated Digital Network (AUTODIN) in the late 1960s. It was the first messaging system to provide worldwide organizational messaging capabilities to the warfighter and allies. AUTODIN provided the backbone for C2 messaging services until 1999. The Defense Messaging Service (DMS) target architecture and implementation strategy was approved in 1988. The following year, Office of the Secretary of Defense (OSD) directed the transition to DMS. DMS was implemented world-wide providing organizational messaging from the unclassified to Top Secret classification levels. Through the transition from AUTODIN to DMS, the Government implemented a three-site DMS Transition Hub (DTH) network composed of legacy, transitional and DMS components. In 2003, the three-site DTH architecture was migrated to two primary NGC sites, Fort Detrick and the Pentagon Telecommunications Service Center (PTSC) with a back-up infrastructure at Raven Rock Mountain Complex. In 2013, the NGCs transitioned from DMS to OMS. Each NGC is composed of a legacy messaging system, providing users with unique messaging requirements. For example, the architecture provides the intelligence and allied communities’ gateway components, providing interoperability between legacy and Organizational Messaging (OM) users. In addition, the Message Conversion System (MCS) provides message routing, OMS backbone components and C2 messaging systems/tools, to include OMS Asset Distribution System (OADS). The NGCs continue to deliver C2 messaging capabilities to the warfighter, intelligence community, non-Department of Defense (DoD) users and allies. As system manager for the NGCs, Defense Information Systems Agency (DISA) provides software maintenance and operational analysis for the legacy, transitional and support system components. A series of the Government contracts have been awarded over the years for software life cycle maintenance (LCM), network engineering services and OMS support product security engineering services. These contracts provide experienced technical and management support facilitates maintenance of high messaging standards, system performance and availability bolstering user interoperability. Enforced through the years, system reliability, message integrity and guaranteed delivery comprise messaging standards maintained in support of the warfighter. This contract provides support for the following NGC requirement areas:

1) The OADS electronically provides for the distribution of OMS software, global message directory information, operational procedures, documentation and other operational information via the World Wide Web. OADS incorporates sophisticated role-based access controls, providing configuration control over distribution of Organizational Messaging (OM) software, Messaging Conversion System (MCS) software, Plain Language Address Distribution System (PLADS) software, routing data and operational documentation. The Government approves the master OMS software implementation prior to posting the software on the master National Gateway Center located at Ft Detrick, MD (NGC-Detrick) OMS OADS server.

2) The NGC-Detrick OMS Sustainment Facility (OSF) backbone has multiple test labs and user network segments. In addition, the OSF network provides networking for the OSF lab, the Government administrative workstations and various contractor offices. Emphasis on Information Assurance (IA) compliance and immediate correction of known system vulnerabilities is vital to the security of all backbone, tests, components and network infrastructure necessary in ensuring operational status and accreditation in of the NGC-Detrick OMS mission.

3) The following are the major security products and processes currently required for all systems maintained under this PWS:

The Information Assurance Vulnerability Management (IAVM) process was established to address actual and potential threats to the DoD information systems and networks. This process reduces risk and vulnerabilities down to the system asset level. Security Technical Implementation Guidance (STIG) documentation and checklists direct application of proper security configurations and policy at component and system levels. The contractor must comply with the IAVM process for the network components, OADS, the Government and contractor administration workstations and operational infrastructure systems. The OSF, OADS and contractor networks are scanned weekly generating reports that are emailed from the DISA Enterprise Information Services (EIS) centrally managed Assured Compliance Assessment Solution (ACAS) security center. The contractor shall monitor ACAS generated reports for the OSF, OADS and all contractor networks. The contractor shall provide analysis of reports and technical recommendation for remediation of identified vulnerabilities.

The Host Based Security System (HBSS) provides IA compliance monitoring at the component level. The Non-Classified Internet Protocol Router Network (NIPRNET) and Secret Internet Protocol Router Network (SIPRNET) HBSS scans components, watches for threats at the host level and pushes anti-virus updates, security policies and configurations out to the OMS backbone components via a variety of ePolicy Orchestrator (ePO) modules. The Government Risk Management Executive (RME) certifiers inspect the test and operational systems at NGC-Detrick during Site Assistance Visits (SAVs), System Accreditation and Command Cyber Readiness Inspection (CCRI), Assess and Authorize (A&A) and Security Test and Evaluation (ST&E) visits. RME visits require additional security preparation and technical product specific functions for the on-site RME team. Based upon past experience, the Government anticipates additional security requirements and procedures will emerge as new IA directives are issued and requirements for maintaining system operational status are implemented. Taskings under this contract must fully comply with current and future Government IA security policy and procedures.

4. Objectives. Contract objectives include providing software maintenance, system administration, component and network IA compliance and operational technical analysis required to meet the Government’s NGC 99.9% reliability management threshold. This includes the network LINUX servers, which house the Intrusion Detection System (IDS), the Domain Name Servers (DNSs), the logging servers used to store the firewall and router system logging files and the firewalls, along with the routers and switches to provide critical routing and security functions. Additionally, contract objectives ensure the provision of OMS messaging capabilities for the NGC OMS support system and OADS, including all user uploaded data repositories. Controlled access to all files uploaded to OADS is a mandatory requirement. OADS administrative functions need to be performed in a timely manner with 100% security compliance to maintain the high level of security compliance required for the web based OADS.

5. Scope.

· Task Area 1– Enterprise IT Policy and Planning

· Task Area 12 – Communications Engineering

· Task Area 13 – Security Engineering Certification and Accreditation

· Task Area 16 – Web Services

· Task Area 17 – Operations Support

· Task Area 19 – Software

6. Performance Requirements.

6.1. Task 1 - Task Order Management.

6.1.1 Subtask 1 - Integration Management Control Planning. The contractor shall address the technical and functional activities in the Task Order Management Plan at the contract level needed for the integration of all tasks specified within this PWS. The contractor shall include productivity and management methods such as quality assurance, progress/status reporting and program reviews. The contractor shall provide the centralized administrative, clerical, documentation and related functions.

Deliverables: Task Order Management Plan

6.1.2 Subtask 2 – Task Order (TO) Management. The contractor shall provide a weekly status report of assigned current and future taskings. The contractor shall also provide a quarterly status report of all contract accomplishments and projected near term taskings.

The contractor shall coordinate all taskings with the Contracting Officer’s Representative (COR)/Alternate Contracting Officer’s Representative (ACOR). The contractor shall identify and communicate issues and risks to the Government and offer recommendations on how issues/risks should be mitigated to successfully satisfy the requirements. The contractor shall notify the COR/ACOR immediately if they believe any activity/non-activity may impact performance schedule or cost.

Deliverables: Weekly Status Reports Quarterly Status Reports

6.2. Task 2 - OMS Asset Distribution System OADS Analysis.

6.2.1 Subtask 1 - OADS Software Life Cycle Maintenance, Data Maintenance and Administration. The contractor shall provide a qualified software engineer that hold a Top Secret/SCI clearance and have a minimum of 3 years’ experience working in the OADS messaging environment. The contractor shall provide software maintenance and technical analysis for the development, NIPRNET, and SIPRNET operations OADS. The contractor shall provide software LCM of the OADS which shall include: software coding changes required to correct software deficiencies and add user required functionality changes; software testing and quality assurance practices to ensure correction of software deficiencies, proper functioning of expanded or modified functionality without introducing adverse effects; server software changes required to maintain IA compliance; configuration management of OMS OADS software and related policies/procedures and documentation for all generation software updates. The contractor shall provide expertise in the re-design of the OADS user interface and internal design for future requirements of the Government operated OM systems, including requirement and design documentation and hardware and software changes.

The contractor shall administer the NIPRNET and SIPRNET OADS servers at NGC-Detrick. The contractor shall also perform system administration functions such as: 1) administration of NIPRNET and SIPRNET user accounts and permissions; 2) monitor NIPRNET and SIPRNET mailboxes providing user assistance; 3) post the Field Engineering Notice (FEN) Matrix; 4) maintain the IAVM matrix and 5) upload documents, FENs and advisories. The contractor shall ensure quality control of the information and software data distributed on the OADS servers and in consultation with the Government team lead, archive data no longer required for current operational systems. The contractor shall maintain the primary NIPRNET OADS daily, ensuring only tested and configuration managed changes are loaded. On a daily basis the contractor shall create a CD containing one or more of the following updates depending upon the current requirements: anti-virus, operating system (OS), security, messaging related reports produced by the PLADS program, global routing database, updated OADS application software that has been successfully tested and any other OADS data uploaded by OADS users to the NIPRNET within the last 24 hours. The OADS system administrator shall then transport the CD into the Sensitive Compartmented Information Facility (SCIF) using established Two Person Integrity (TPI) procedures and load the OADS updates onto the SIPRNET OADS server.

The contractor shall maintain the OADS user interface and data presentation. Semi-monthly server backups shall be completed and safe stored frequently enough to prevent data/software loss due to hardware failure or a catastrophic site event (fire, bomb, terrorist attack). The contractor shall generate reports/statistics on OADS user usage as requested by the Government. The contractor shall add additional data files, folders and access permissions to the OADS as the volume of OMS OADS information expands. The contractor shall work with the Government in determining which documents are no longer accessed by OADS users and should be archived off the OADS system. The contractor shall ensure the OADS system response time is not adversely affected by the addition of data or user capabilities.

Deliverables: OADS Software Releases Monthly OADS Backups and Archivals OADS Application Documentation Reports and Statistical Analyses

6.2.2 Subtask 2 - OADS Technical Analysis (During Non-Duty Hours). The contractor shall provide OADS technical analysis during non-duty hours as required. The contractor shall be required to report to NGC-Detrick within 4 hours of problem notification. Problem analysis and resolution or a secure work-around shall be accomplished prior to the contractor leaving the site. No more than 2 times a year is the OADS system administrator required to provide on-site technical analysis for an OADS issue during non-duty hours. Remote technical analysis may be used if the problem can be analyzed and corrected via this method.

6.2.3 Subtask 3 – OADS Product End-of Life Maintenance Changes. The contractor shall monitor the security posture and maintainability of the OADS, Commercial Off-the-Shelf (COTS) or Open Source (OS) software products and hardware. The contractor shall ensure updated versions are implemented in a timely manner to maintain the OADS operational posture. The contractor shall notify the Government when COTS or OS products are approaching end-of-life or no longer meet product operational or security requirements. The contractor shall research the current available products and platforms and provide a White Paper to the Government detailing the contractor’s recommendations of which products and platforms are necessary to refresh the OADS system. The contractor shall provide technical specifications and procurement source information for replacement of obsolete software and platforms. Following the Government concurrence and the acquisition of the new platforms and/or software, the contractor shall complete all changes necessary to port the OADS product to a new platform and/or new COTS/OS software base in a timeframe that prevents adverse operational or IA compliance impact. The contractor shall make all software documentation and security changes necessary for the product port and shall provide project implementation tracking information as requested by the Government. The contractor shall migrate OADS to the new system without an adverse operational impact or extended system downtime of no more than 4 hours. The contractor shall provide the necessary training to the NGC-Detrick personnel on the new OADS hardware and/or software.

6.3. Task 3 – Network Technical Analysis.

6.3.1 Subtask 1 - Operational NGC and OM Backbone Network Technical Analysis. The contractor shall provide administrative and engineering processes for the NGC-Detrick OMS backbone network components to include the OSF Firewalls, DNSs, routers, switches, IDSs, logging servers and NIPRNET/SIPRNET connectivity. The contractor shall provide qualified Network Engineers that hold a Top Secret/SCI clearance and have a minimum of 4 years’ experience designing and maintaining an OMS message network. The contractor shall administratively sustain the OMS backbone network components at a level which maintains the Government NGC’s 99.9% reliability management threshold for organizational messaging. System administration shall include a product implementation, application of required software updates, completion of site specific component configuration modifications, completion of component back-ups, component hardening against security risks, maintenance of access control lists on network devices such as routers, firewalls and switches, monitoring IDSs for anomalies and suspicious activity, monitoring the network with various tools, enhancing network security via NAC (Network Access Control), maintaining and upgrading network device hardware and software to stay compliant with security patches, capturing all network device and server logs, implementing DNS solutions, monitoring and maintaining efficient NIPRNET Wide Area Network (WAN) connectivity, maintaining network documentation and maintaining network topology and network device configuration documentation. When a network component technical refresh is required, the contractor shall recommend component specifications, the specific platform and COTS software purchase recommendations and provide justification for system refresh platforms and COTS security compliance software, appliances and utilities. The contractor shall research hardware and software products to ensure recommended products provide the highest level of system efficiency and security with reasonable cost investment.

The contractor shall provide on-site and/or remote network technical maintenance for NGC-Detrick. This maintenance may be in response to a site request for assistance or a network reported problem. Additionally, the contractor shall provide network technical analysis of system/circuit changes and outages. The contractor shall respond to a request for assistance of an operational problem within 1 hour after being notified by the Government. If the problem cannot be resolved remotely, the contractor shall report to NGC-Detrick to analyze and resolve the problem and/or provide technical assistance. In order to provide the level of operational network maintenance required, the contractor shall ensure there is a qualified network person available 24/7/365 to ensure the 1 hour response time is met. If a solution cannot be immediately provided, the contractor shall propose a work-around procedure or avoidance practice until a solution can be determined The contractor shall provide administrative tasks for the Government, Messaging Network Control Center (MNCC) personnel and contractors to analyze and resolve DISA Network (DISANET) related problems.

Deliverables: Network Design Documentation Network Device Configuration Documents Operational Policy and Procedure Documents System and Event Log Back-ups and Archivals Custom Programs, Scripts, Utilities Developed to Automate Administration Technical Reports

6.3.2 Subtask 2 - Network Viability Technical Analysis. The contractor shall analyze and provide backbone architecture re-design recommendations to ensure network redundancy remains sufficient for operational survivability requirements. Network design analysis shall ensure no single point of failure isolates any element of the operational NGC-Detrick system. Analysis shall also identify inefficiencies that could be eliminated in an effort to reduce administrative costs.

The contractor shall conduct the initial implementation of network components installed to meet hardware/software refresh requirements and system architecture re-design. The contractor shall load, configure and establish any required rule sets and generate required operational policies and procedures necessary for operational implementation. The contractor shall then generate, plan and schedule implementation and cutovers in a manner which minimizes adverse operational impact. The contractor shall notify the Government of all required site drawing changes necessitated by new/replacement product implementation. The contractor shall document all equipment relocation by means of a report or a network topology diagram.

The contractor shall be responsible for the OADS, OMS Operational NIPRNET network, OSF network, contractor networks and the Government administration network’s topologies and configurations. The contractor shall document and design the OMS operational NIPRNET and OSF network’s topology. The contractor shall provide domain names and network addressing information for all OMS DNSs, OADS and the OSF network.

Deliverables: Network Design Documents Product Analysis Reports Product Specifications Lists (Bill of Materials) for Equipment Purchases System Implementation Plans Network Topology Drawing

6.4 Task 4 - Information Assurance. Cyber security threats continue to increase and transform, generating an upsurge in the frequency and magnitude of security engineering taskings employed for threat mitigation. The contractor shall be proactive in keeping current with security policy, requirements, best practices, products, checklists and skills. . In addition, the contractor shall plan and prepare for evolving and surging security requirements to meet mission demands. The contractor shall perform the security requirements identified in this PWS, but shall also plan for the increase and evolution of OMS security requirements as attack techniques become more invasive, vulnerability detection capabilities improve and cyber security requirements change within the DoD.

Deliverables: Technical Analysis Reports

6.4.1 Subtask 1 - Network Information Assurance. The contractor shall ensure all network components are compliant in accordance with (IAW) the Government and U.S. Cyber Command mandated guidance. The contractor shall complete actions required to maintain 100% compliance with Joint Task Force-Communications Tasking Orders (JTF-CTOs), Operations Orders (OPORDs), Warning Orders (WARNORDs) and IAVMs by installing/executing the required security updates. The contractor shall implement network component changes to increase network security compliance, reduce network security vulnerabilities, maintain allowable port and protocol compliance and prevent, detect and report network intrusions of the OMS Operational NIPRNET network, OSF network, contractor networks and the Government administration network. The contractor shall monitor security abnormalities via the DoD IDS, Barracuda web filtering and DNS/router/firewall logs analysis. The contractor shall ensure network intrusions and security penetrations are continually analyzed to determine the frequency and potential impact. The contractor shall recommend/implement procedures and/or configure security monitoring products to reduce the number and impact of future recurrences. The contractor shall provide proactive suggestions for implementation of tools and/or procedures to increase network security and to prevent unauthorized network access and misuse. The contractor shall monitor network usage as requested by the Government; reporting high system usage levels which could adversely affect essential mission priorities. The contractor shall also implement web access limitations for all users as defined by the Government. The contractor shall monitor the network and report any internal or external user misuse of the Government systems to the COR/ACOR.

The contractor shall implement procedures and tools that provide confidentiality, integrity, availability, authenticity, secure access control, survivability and non-repudiation of information on agency software, hardware or networks. The contractor shall implement mechanisms to provide the capability to preserve, protect, detect, react and recover from threats, intrusions and denial of services. Procedures or mechanisms shall be implemented to adequately protect network, server, workstation and physical facilities. The contractor shall apply required security updates on the OMS Operational NIPRNET network, OSF network, contractor networks and the Government administration network necessary for maintaining operational IA compliance and accreditation. The contractor shall also apply required anti-virus updates necessary to meet component security requirements. The contractor is required to address all current Network STIGs, to include Infrastructure Router – CISCO, Perimeter Router – CISCO, Infrastructure Layer 3 – CISCO, Network Layer 2 – CISCO, Network Firewall, Network Intrusion Detection System/Intrusion Prevention System (IDS/IPS), Network Policy, Red Hat 6, Red Hat 7, Domain Name System and Windows Operating Systems. If product vulnerabilities cannot be corrected in the required timeframe, the contractor shall generate a Plan of Action and Milestones (POA&Ms) and provide them to the Government IA team lead. The contractor shall prepare for and participate in RME SAV, A&A, and CCRI visits. Pre-visit preparation tasks, include thoroughly reviewing the latest applicable STIGs, implementing necessary security updates and running security scripts/disks/scans to ensure no unaddressed platform vulnerabilities. During the RME visit, the contractor shall provide one-on-one technical counsel to the RME team for the OADS and network component reviews. If vulnerabilities are discovered, the contractor shall correct the vulnerabilities within the RME required timeframe or provide a POA&M to describe how the vulnerability will be mitigated.

Deliverables: System Security Plan Network Activity and Usage Reports Allowed Ports and Protocol List Documents Privileged User Account Reports Responses to Intrusion Detections OA&Ms

6.4.2 Subtask 2 - OADS IA Security Compliance. The contractor shall ensure all OADS components are compliant IAW the Government and U.S. Cyber Command mandated guidance. The contractor shall examine the applicability of issued IAVM notices, assess the impact of any applicable vulnerabilities and apply the patch or obtain a waiver if corrective actions cannot be implemented within the compliance timeframe. If a waiver is requested, the contractor shall provide a POA&M depicting the assessment of the risk, identifying how OADS will be monitored for exploitation and outlining the corrective action plan with a completion date. The contractor shall ensure vulnerability remediation is properly applied to the development and operational OADS servers within the compliance timeframe.

The contractor shall run appropriate security scripts/scans and complete the checklists/vulnerability analysis on an OADS platform when a patch is tested or a component platform is rebuilt. The contractor shall research and correct component/product security findings identified by ACAS, Security Readiness Review (SRR), STIGs and checklists. The contractor shall ensure NGC-Detrick test and operational OADS servers are compliant with current security policy, contain the latest security software updates and provide technical direction for the RME re-certification visits to NGC-Detrick. The contractor shall provide one-on-one counsel with RME team POCs for evaluating the OADS OS and application components. Preparation and technical maintenance for RME team visits are considered top priority requirements. All other tasking will be completed on a time available basis after RME requirements.

Deliverables: OADS System Security Plans Application Security STIG Documentation Required for the OADS Application POA&Ms

6.4.3 Subtask 3 – System Authorization and CCRI Analysis. The contractor shall generate and maintain all the artifacts and evidence documentation required for obtaining the Authority to Operate (ATOs) and remaining compliant for OADS, OMS Operational NIPRNET network, OSF network, contractor networks and the Government administration network.

The contractor shall facilitate site CCRI with tasks such as: generation of documentation, site assistance visits, component preparation, RME on-site assistance and completion of the After Action Plan requirements.

The contractor shall contribute to the system certifier (RME) in performing Certification and Assessment (C&A) activities and providing other requested documentation required to analyze a certification recommendation for system authorization. The contractor shall complete pre-visit preparation, to include verification of successful runs of security scripts/disks on system components and accurate POA&Ms. The contractor shall provide reports from the Cyber Security reporting systems essential for C&A readiness. The contractor shall provide updates, corrections and analysis/response to any findings. The contractor shall contribute to the system assessor in completing product scans and checklists and answering any product/system/architecture related questions.

6.4.4 Subtask 4 – Security Vulnerabilities. The DoD IAVM process was developed in response to the Deputy Secretary of Defense direction requiring all DoD functional Combatant Commanders, Military Services and Defense Agencies to develop and implement a positive control methodology to ensure System Administrators receive, acknowledge and comply with DoD issued vulnerability notifications. The Government manages the DoD IAVM process and dissemination of vulnerability notifications. The Government, as the OMS IAVM Program Manager (PM), forwards vulnerability notices generated by the DoD Computer Emergency Response Team to the OMS community. Vulnerabilities are categorized into 3 vulnerability types based upon the threat level: IA Vulnerability Alerts (IAVAs) are generated for the most severe threat and for which corrective action is of the highest priority; IA Vulnerability Bulletins (IAVBs) are issued for vulnerabilities that do not pose an immediate threat but if corrective action is not taken, could escalate; and IA Technical Advisories (IATAs) are generally issued for lower risk vulnerabilities. The contractor shall respond to IAVAs/IAVBs/IATAs on applicability/non-applicability for each product (e.g., CISCO, Fortinet, Barracuda, Red Hat, Windows or other software product(s) used on the OMS components) for which the contractor has life-cycle responsibility IAW OMS program standard response times (normally 2 working days). In every case the response shall be within sufficient time to allow completion of remedial actions IAW U.S. Cyber Command compliance times documented for each IAVM. The contractor shall ensure the issuance of software patches to correct the IAVA/IAVB/IATA vulnerability and meet the required compliance date. If a vulnerability fix cannot be issued in time to meet the required compliance date, the contractor shall generate a POA&M substantiating why the threat level is reduced and correction deferred as well as schedule milestones for providing and implementing corrective actions. POA&Ms shall be documented and coordinated with the Government 2 weeks before the established mitigation date for submission to the DISA Infrastructure Directorate (IE) Information Security System Manager (ISSM) and DISA Action Officer (AO) for extension approval.

The Government RME reviews a wide variety of vulnerability related information for applicability at the DoD level. The RME collects and evaluates this information and incorporates it into the STIG process. The contractor shall evaluate released STIG updates for applicability to products/components for which they provide LCM. The contractor shall have the responsibility for working with the manufacturers to achieve and maintain compliance of the products IAW current STIGs.

The contractor shall test and apply the security software patch to all applicable components to which the contractor has life-cycle responsibility. The contractor shall provide security engineering maintenance in analyzing and responding to U.S. Cyber Command issued CTOs, Coordinated Alert Messages (CAMs), Fragmentary Orders and other required U.S. Cyber Command taskings. The contractor shall monitor U.S. Cyber Command’s SIPRNET and NIPRNET websites for newly issued taskings. The contractor shall review each new directive for applicability, analyze required actions, document areas requiring clarification, complete the required actions and generate the required documentation to satisfy/report compliance with U.S. Cyber Command taskings for the OMS program.

The contractor shall review the Continuous Monitoring and Risk Scoring (CMRS) reports on a regular basis for compliance. The contractor has the responsibility for determining how the U.S. Cyber Command taskings affect their own software product and those of the third party product vendors. Working in conjunction with the product vendors, the contractor shall ensure the proper software fix or platform configuration changes generated by the vendor to meet the security requirements determined by U.S. Cyber Command.

6.4.5 Subtask 5 – Assured Compliance Assessment Solution (ACAS). ACAS is an integrated software solution for system compliance monitoring. The ACAS provides required automated network vulnerability scanning, configuration assessment, application vulnerability scanning and device configuration assessment. The OADS, OMS Operational NIPRNET network, OSF network, contractor networks and the Government administration network are scanned on a weekly basis, generating a report to be emailed from the DISA EIS centrally managed ACAS security center. The contractor shall provide analysis of the weekly reports and provide technical recommendation to the Government for remediation of identified findings for the NIPRNET and SIPRNET OADS, OMS Operational NIPRNET network, OSF network, contractor networks and the Government administration network. The contractor shall review all ACAS reports to ensure STIG and IAVM compliance. The contractor shall take action to correct and test the patch or configuration change for any findings that appear on an ACAS report. The contractor shall provide a POA&M to the Government IA team lead within the compliance timeframe, if a finding is not able to be fixed during that period. The ACAS scan and HBSS data are rolled up to the Government’s CMRS system. The CMRS system provides the Government with a holistic overview and assessment of current risk factors.

6.4.6 Subtask 6 – Host Based Security System (HBSS). The Enterprise-Wide Cyber-Security and Computer Network Defense Solutions Steering Group acquired the HBSS to address their identified lack of security for DoD end-point systems to allow reconstitution of systems following an attack/security event. The HBSS is comprised of the ePO management suite, which provides the central security management function that enables installation, the management and configuration of the HBSS components, and a back end Structured Query Language (SQL) database serving as the central repository for HBSS component logs. The HBSS scans components, watches for threats at the host level, provides report/monitoring status escalation and pushes anti-virus updates, security policies and configurations out to the OADS, OMS backbone components and contract networks via a variety of ePO modules.

Assets reporting to the designated OMS HBSS servers include both test and operational components at the NGC-Detrick. The contractor shall install agents on all workstations, servers and network devices of which they have LCM responsibility. The contractor shall troubleshoot the networks and OADS to ensure the HBSS is not negatively impacting either ones functionality. The contractor shall work to mitigate anomalies caused by HBSS. The contractor shall install all the latest patches and ePO modules. The contractor shall continually monitor the ePO modules to ensure the latest up-to-date modules are applied. The contractor shall follow HBSS policies.

Deliverables: HBSS Anomaly Analyses

6.4.7 Subtask 7 - Security Training Required for Administrators. Upon contract award, the contractor shall have 75% of its staff certified IAW DoD 8570.01M compliant and the other 25% of its staff certified within 6 months. All contractor staff shall be required to perform hands-on system administration and/or information assurance functions to perform the tasks on this contract. At a minimum the contractor staff shall possess a Security+ or equivalent certification and a Level I IAM/IAT certification as defined in DoD 8570.01M. New hires or reassigned contractors must obtain required DoD 8570.01M certification within 6 months of being assigned functions requiring IAM/IAT certification. The contractor lead shall report any changes to the staff’s security certification status and compliance with DoD 8570.01M during the weekly contractor status meetings.

The contractor staff shall stay current with security training requirements and certification required to access the Government and DoD computer systems, complete system administration responsibilities and maintain platform security. The Government will allow the contractor to bill for the contractor staff’s time necessary to complete the mandatory training required by the Government or the Army building host during the course of the contract. The contractor shall be expected to finance employee security training classes/certifications not mandated by the Government, but which enhances employee security expertise.

Deliverables: Certification Certificates

6.5. Task 5 – Continuity of Operations (COOP). The contractor shall be responsible for the annual COOP exercises for the OADS and the OSF Network. The contractor shall be able to take part in all COOP scenarios. The contractor shall provide technical analysis at the COOP planning meetings. The contractor shall have accountability for on-site COOP tasks during planned COOP exercises. The contractor shall conduct the test scenarios appropriate to the COOP exercise, provide technical assistance to resolve problems during execution of the COOP and develop after-action lessons learned reports following completion of COOP exercises.

In addition to the on-call 24/7/365 COOP accountability for normal operations, the contractor shall provide on-site operational analysis during unplanned COOPs caused by extreme acts of nature, acts of terrorism or site-specific environmental conditions (such as power outages/water damage from burst pipe, etc.). Since a real COOP situation cannot be planned or scheduled, the contractor shall be on-call 24/7/365 during volatile world or local conditions. If conditions at NGC-Detrick require initiation of a COOP, the contractor shall be on-site at the designated COOP location to analyze real COOP situations within 2 hours after the Government notification. The contractor shall provide sufficient task management to complete Tier 2 operational functions (management of the COOP components) 24 hours a day for undetermined and possibly indefinite periods of time. On-site responsibilities shall at a minimum include: assurance that the COOP component’s software, security and configuration replicates the on-line component being replaced; completion of platform administration to implement any required software and security related changes; problem analysis and resolution; and the Government coordination and status reporting. During extended periods of COOP activations, it is expected that other non-critical contract requirements identified by the Government will be placed on-hold to allow manning resources to concentrate solely on the COOP.

7. Performance Standards.

100% Inspection and Customer Input

8. Incentives. The tasks under this contract are critical to the Government’s provision of C2 messaging for the warfighter. The PWS standards for performance are high to ensure provisions are at the level required for the C2 messaging mission. It is imperative that the contractor fully meet and strive to exceed the high standards established for PWS messaging requirements. Maintaining the Government system reliability standard 24/7/365 is critical to DoD C2 missions. The contractor’s performance will be continually monitored by the Government through evaluation of deliverables and level of service provided. Poor contractor performance will be discussed with the Contracting Officer (KO) promptly to allow the contractor an opportunity to correct the issue. If the contractor does not immediately address the issue and work with the Government on a remediation plan, the COR/ACOR will complete a negative CPARS evaluation that could negatively affect the contractor’s potential in receiving future the Government contract awards. When unacceptable performance occurs, the Government will withhold payment for services until corrective action is taken. Upon Government acceptance of the corrected action the contractor will be permitted to invoice for the service fee.

9. Place of Performance. The work required under this contract shall be performed at a Government site – NGC-Detrick 1671 Nelson Street, Fort Detrick, Maryland. The Government shall provide work space, DISANet laptops, terminal access to the OMS LAN, routers, switches, network server hardware, OADS development and operational servers and access to other NGC-Detrick test and operational components required to complete contract taskings. Phone service required for contract completion will also be provided.

Alternate Place of Performance. Travel in and around the primary place of performance may be required throughout the period of performance. Additional travel within CONUS may be necessary to meet the requirements of this PWS. All local and TDY travel shall be pre-coordinated with the COR/ACOR. There will be a travel plug of $4,000.00 for the base year and each option year.

Alternate Place of Performance - Contingency Only. As determined by the COR/ACOR, contractor employees may be required to work at an alternate place of performance (e.g., home, the contractor's facility or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, Government closure due to inclement weather, etc.). Non-emergency/non-essential contractors should not report to a closed Government facility. The contractor shall prepare all deliverables and other contract documentation utilizing Government issued DISANet laptops. To the extent possible, the contractor shall use best efforts to provide the same level of work accomplishments as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the KO or the contractor may request an equitable adjustment pursuant to the changes clause of the contract.

The contractor may establish a telework program that allows implementation on an ad hoc or contingency basis following COR/ACOR approval. Prior COR/ACOR approval must be received for personnel requesting duty assignment(s) remote from Fort Detrick, Maryland.

10. Period of Performance. The period of performance will consist of a 12 month base year plus 4 one-year options, totaling 5 years, with the contract award start date of 7/7/2018. As directed by the COR/ACOR, the contractor shall continue performance in emergency or mission essential conditions. Additionally, the contractor shall be responsible to account for their daily (Monday-Friday) whereabouts using the Government Personnel Accountability Management (PAM) located on the Government Corporate Management Information System (CMIS) website.

11. Delivery Schedule.

Final – 30th of month