HC108419R0001.pdf

CODE

(Hour)

PAGE(S)

until local time

X

A

X B

X C X D

EX

X

G

F 66 - 72

73 - 86

X H 87 - 93

RATING PAGE OF PAGES

7. ISSUED BY

(Date)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

Previous Edition is Unusable 33-134 STANDARD FORM 33 (REV. 9-97)

Prescribed by GSA

FAR (48 CFR) 53.214(c)

1 93

(If other than Item 7)

15A. NAME 16. NAME AND TITLE OF PERSON AUTHORIZED TO

AND

ADDRESS

SIGN OFFER (Type or print)

OF

OFFEROR

AMENDMENT NO. DATE

15B. TELEPHONE NO (Include area code) 17. SIGNATURE15C. CHECK IF REMITTANCE ADDRESS

IS DIFFERENT FROM ABOVE - ENTER

SUCH ADDRESS IN SCHEDULE.

18. OFFER DATE

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

2. CONTRACT NO.

HC1084 8. ADDRESS OFFER TO

See Item 7

9. Sealed offers in original and copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in

CAUTION - LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME (NO COLLECT CALLS)

11. TABLE OF CONTENTS

SOLICITATION/ CONTRACT FORM

SUPPLIES OR SERVICES AND PRICES/ COSTS

1 - 2

3 - 7

X I CONTRACT CLAUSES

DESCRIPTION/ SPECS./ WORK STATEMENT X

PACKAGING AND MARKING

8 - 21

J LIST OF ATTACHMENTS

INSPECTION AND ACCEPTANCE

DELIVERIES OR PERFORMANCE

X K

REPRESENTATIONS, CERTIFICATIONS AND

OTHER STATEMENTS OF OFFERORS

CONTRACT ADMINISTRATION DATA 25 - 28 X

SPECIAL CONTRACT REQUIREMENTS

OFFER (Must be fully completed by offeror) 29 - 31 X M

L INSTRS., CONDS., AND NOTICES TO OFFERORS

EVALUATION FACTORS FOR AWARD

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52.232-8)

14. ACKNOWLEDGMENT OF AMENDMENTS

(The offeror acknowledges receipt of amendments

AMENDMENT NO. DATE

to the SOLICITATION for offerors and related documents numbered and dated):

FACILITY

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period

SOLICITATION, OFFER AND AWARD

X

(X) SEC. DESCRIPTION (X) SEC. DESCRIPTION PAGE(S)

PART I - THE SCHEDULE

26. NAME OF CONTRACTING OFFICER (Type or print) 27. UNITED STATES OF AMERICA 28. AWARD DATE

EMAIL:TEL: (Signature of Contracting Officer)

CODE CODE

B. TELEPHONE (Include area code) C. E-MAIL ADDRESS

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT 21. ACCOUNTING AND APPROPRIATION

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

10 U.S.C. 2304(c)( ) 41 U.S.C. 253(c)( ) (4 copies unless otherwise specified)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN ITEM

24. ADMINISTERED BY (If other than Item 7) CODE 25. PAYMENT WILL BE MADE BY CODE

PART IV - REPRESENTATIO NS AND INSTRUCTIO NS

PART III - LIST O F DO CUMENTS, EXHIBITS AND O THER ATTACHMENTS

32 - 64

PART II - CO NTRACT CLAUSES

DISA/DITCO-SCOTT-PL84

2300 EAST DRIVE

SCOTT AFB IL 62225

FAX:

TEL:

FAX:

TEL:

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

SOLICITATION

6. REQUISITION/PURCHASE NO.5. DATE ISSUED4. TYPE OF SOLICITATION

SEALED BID (IFB)

NEGOTIATED (RFP)

[ X ]

3. SOLICITATION NO.

HC108419R0001

Section A - Solicitation/Contract Form

CLAUSES INCORPORATED BY REFERENCE

52.203-19 Prohibition on Requiring Certain Internal Confidentiality

Agreements or Statements

JAN 2017

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Lot MES-C Services - Fixed Price

FFP

Fixed Price (FP) All Variations - This CLIN applies to all variations of contract types under fixed price. See Schedule B labor rate tables.

Period of Performance: Five (5) year base period - Contract Years 1 through 5.

FOB: Destination

NET AMT

0002 1 Lot Other Direct Costs (ODC)

FFP

Cost Reimbursable ODC's - IAW Section

0003 1 Lot Minimum Guarantee

FFP

Minimum guarantee payment will be satisfied through attendance of the MES-C III

Post-Award Conference

1001 1 Lot OPTION MES-C Services - Fixed Price

FFP

1002 1 Lot OPTION Other Direct Costs (ODC)

FFP

2001 1 Lot OPTION MES-C Services - Fixed Price

FFP

2002 1 Lot OPTION Other Direct Costs (ODC)

FFP

3001 1 Lot OPTION MES-C Services - Fixed Price

FFP

3002 1 Lot OPTION Other Direct Costs (ODC)

FFP

4001 1 Lot OPTION MES-C Services - Fixed Price

FFP

4002 1 Lot OPTION Other Direct Costs (ODC)

FFP

MINIMUM GUARANTEE/IDIQ

This is an Indefinite-Delivery/Indefinite-Quantity (ID/IQ) contract against which it is planned to award

Fixed Price (FP), all types, task orders in accordance with FAR Subpart 16.5 - Indefinite-Delivery

Contracts. The total amount of all orders placed against the contract resulting from this solicitation shall not exceed $100,000,000 for the one (1) year base period of performance and four (4) one-year option periods. The guaranteed minimum amount is $500.00 for the awardee.

Section C - Descriptions and Specifications

PERFORMANCE WORK STATEMENT

Performance Work Statement (PWS) for

Mobility Enterprise Services – Classified

(October 12, 2018)

C1. INTRODUCTION

1.1 Mission: The Mobility Portfolio Management Office (PMO) is the Department of Defense (DoD) enterprise service offering made up of the Defense Mobility Classified Capability (DMCC) Programs for the Top Secret (TS) and Secret (S) capabilities. DMCC is a DoD enterprise service offering which enables Commercial Solutions for

Classified (CSfC) approved customer owned mobile devices access to the classified Department of Defense

Information Network (DoDIN) and commercial information services. The Mobility PMO requires CSfC Programs compliant, in an open platform for the MES-C solution. This system is comprised of an Enterprise Mobility

Management (EMM) suite, network gateways, Tier III service support, commercial mobile devices (which provide classified voice and data services), and an identity management system.

1.2 Background: Since 2013, the DoD Mobility Program, as directed by the DoD Commercial Mobile Device

Implementation Plan, has led the development of an enterprise solution to support controlled unclassified and classified information mobility requirements that leverages carrier infrastructure and provides entry points for wireless capabilities to meet the DoD needs. The DoD Mobility, as a program, encompasses multiple subcomponents that when integrated, provide mission partners with enterprise-level secure classified protected communication services, ensuring interoperability, increased security, access to information, and reliable service anywhere, at any time.

A phased series of operational pilots have been conducted and allow DoD to incorporate lessons learned, ensure interoperability, refine the requirements for a secure architecture to support EMM, influence commercial standards, and create cost and operations’ efficiencies for DoD enterprise mobile users. This ultimately will provide DoD with the ability to lower the cost of the DMCC EMM suite as well as address security and increase DoD productivity goals. The PMO will offer the enterprise classified mobility services to the DoD community in the same way DISA provides other enterprise capabilities today. The DISA Mobility PMO will provide enterprise services such as voice, video, and data to the customer via a mobile platform but will not implement its own enterprise services. This ensures costs within the Department are not duplicated and that current and future enterprise services are maximized to increase value and efficiency.

The DoD EMM Suite as it relates to DMCC includes:

Mobility Gateways

- Mobility Gateways are intermediate systems that interconnect traditional enterprise IT services, such as Voice over Secure Internet Protocol (VoSIP) and Defense

Enterprise Email-Secret (DEE-S), with wireless and mobile network transport

- Specific mobility gateway functions include: Remote access authentication and access control, security proxies for critical enterprise systems, network routing and perimeter security (firewalls and intrusion detection)

- Mobile devices are allowed to securely access DoD enterprise network via CSfC infrastructure

Device Management

- System Center Configuration Management

- Mobile Device Management

Mobile Apps Network Operation Center (NOC)/Network Operations

- The DMCC capabilities interface with DISA Enterprise Network Operations Services

These services provide operational views into individual systems that make up the DMCC capabilities

- The Mobility PMO does not own Network Operations/NOC infrastructure but it is required to share mobility related operational status with the operational community

Mobile Devices including iOS, Android tablet devices managed by the MDM and

Windows 10 based tablets managed by Microsoft System Center Configuration

Manager

DISA Offered Enterprise Services

- DEE-S

- Unified Communications (UC) including Voice Over IP (VoIP) ,Chatting and Video conferencing

- UVDS Streaming Video

- SharePoint

- Variety of HTTPs based web pages

Virtual Desktop Infrastructure (VDI).

Ticketing system that tracks and generates helpdesk trouble tickets

- Since the Mobility PMO is engaged in the helpdesk operation, interfacing with the current

Enterprise ticketing system (e.g. Remedy) is required

Business Support System(s) (BSS) is one of the mobility subsystems supporting the business side in mobility operations including billing and contract management support

Mobility Operational Support System(s) (OSS) is a supporting subsystem to support mobility operations and Network Operations requirements

Secure Mobile SIPRNet Connectivity with mobile Virtual Private Networks (VPNs)

Public Key Infrastructure (PKI)/Public Key Enablement (PKE) is associated with PKI enablement efforts including:

- Trusted Platform Module (TPM)/derived credential enablement

- Trusted Execution Environment/ derived credential enablement

- Additional mobility related PKE initiatives (e.g. Next generation multi-factor authentication.

1.3 Objectives: The objective of this contract is to provide classified mobility capabilities, professional and engineering services, and enterprise-wide support. The MES-C solution shall be capable of supporting the following two classifications: Secret and Top Secret. This contract will not only provide core mobility system integration and testing efforts, but also support additional engineering activities to interface with other sub-systems and partner networks as well as Tier III support. Engineering activities will also need to be provided from impact assessment to deployment of resultant new equipment/software for addressing new/updated CSfC capability packages and

Components List changes. Future task orders may include innovation tasks commensurate with the rapidly changing mobile environment. Classified references within this contract can assume Secret, Top Secret, and Sensitive

Compartmented Information (SCI) level classification, where applicable.

1.4 Scope: The scope of this requirement is to utilize current and future Mobility capabilities to enhance DISA’s ability to provide classified mobile communication services to the entire DoD. Mobility solutions encompass a range of capabilities from old legacy systems to new, emerging solutions and the Mobility mission will continue to expand and change. as a result of technology evolution, industry standard changes, and DoD regulatory requirements. The contractor shall provide the necessary personnel, equipment, services, and other items needed to support operations, maintenance, and sustainment requirements of DoD Mobility Program Office. Services and support anticipated under this contract exist within the scope of the following performance areas:

Performance Area 1 – Contract and Program Management

Performance Area 2 – Information Assurance

Performance Area 3 – Gateway Solution

Performance Area 4 – System Engineering Support

Performance Area 5 - Test and Evaluation (T&E)

Performance Area 6 – Logistic and Asset Management

Performance Area 7 – Network and Operational Support

Performance Area 8 – Mobility Capability Integration and Innovation

2.1 Contract Requirements

2.1.1 Commercial Solutions for Classified (CSfC): The Contractor shall be a CSfC Integrator. The CSfC process is endorsed by the National Security Agency (NSA) and enables commercial components to be utilized in layered solutions as an endeavor to protect classified data/systems.

2.1.2 Annual In Progress Reviews (IPR): The Government will conduct annual IPRs for the life of this contract, unless otherwise notified by the Government. The IPRs will address overall contract status and provide details regarding technical, programmatic, scheduling, capability implementation, operations, administration, and contract issues. IPR dates and locations will be coordinated in advance by the designated Contracting Officer.

2.1.3 Information Sharing: The Government may use and disclose reported information (e.g., information regarding threats, vulnerabilities, incidents, or best practices) that does not include attribution information, at its discretion to assist entities in protecting information or information systems (e.g. threat information products, threat assessment reports); provided that such use or disclosure is otherwise authorized in accordance with applicable statutes, regulations, and policies.

2.1.4 Periodic Government Inspections: The contractor is subject to Government inspections and reviews to assure compliance with both DISA and DoD Supply Chain Risk Management (SCRM) requirements throughout the contract performance period. The contractor shall be responsible for taking corrective action based upon the impact and severity of identified weaknesses.

2.1.5 Post Award Task Order Meetings/Conferences: Technical meetings and/or post award orientation conferences may be necessary to resolve problems and to facilitate understanding of the requirements of the contract and/or of each awarded task order. Participants at these meetings/conferences shall be members of the contractor's technical staff and technical representatives of the Government. These meetings/conferences shall be scheduled by agreement of the parties and arrangements made between the Contracting Officer, his/her representative, and the contractor. Records of these meetings/conferences shall be made by the contractor and submitted to the Government within five (5) business days after conclusion of the meetings/conferences. All costs associated with the attendance at these meetings/conferences shall be at no direct charge to the contract.

3.1 Performance Area 1 – Contract and Program Management: The contractor shall provide all materials, services, personnel, planning, direction, coordination, and control necessary to provide the services required by this contract. The Contractor must perform program management, project management, and contract management to ensure timely and effective performance.

3.1.1 Program Management: Manage and oversee all activities performed by Contractor personnel (including subcontractors and teaming partners, as applicable) to satisfy all performance requirements. Effectively plan, manage, and monitor work activities and supervising Contractor personnel to support effective performance.

Escalate problems or concerns to the Contracting Officer and COR.

3.1.2 Program Management Plan: Develop a plan documenting the contractor’s management approach, operating procedures, staffing approach, and overall work Breakdown Structure. Staffing Plans regarding resource assignments by task may be required at the task order level.

3.1.3 Documentation: Provide support necessary to draft, review, revise, and deliver documents required in conjunction with the contract. Separate and distinct deliverables and/or documentation will be identified at the task order level.

4.1 Performance Area 2 – Information Assurance (IA): The contractor will be required to provide all technical, engineering, and implementation support services in maintaining and complying with the following Security requirements: Security Recommendation Guides (SRGs), Security Technical Implementation Guides (STIGs), IA

Vulnerability Management (IAVM), various Capability Package Requirements for Mobile Access Capability

Package (MACP), DAR and Multi-Site Connectivity as well as any other applicable security policies applicable to the infrastructure components of the overall system solution. The contractor will support Certification and

Accreditation submission, management, and compliance. Mobile devices, MDM and any unified capabilities (UC) infrastructure utilized shall be UC approved and product list compliant. Mobile devices and MDM shall also be

NIAP certified per the appropriate protection profile.

4.1.1 Certificate Management: Manage and integrate system/infrastructure software and hardware certificates, device certificates, Certificate Revocation List (CRL) management, and Certificate Authority (CA) management and support, as well as issue and manage cryptographic key (software and hardware) certificates in support of the infrastructure and approved mobile devices. The contractor will be responsible for developing a MACP compliant

Key/Certificate Management Plan to describe how keys/certificates are issued, supported, maintained/renewed, stored, and safeguarded. In addition to Government keys, generate and distribute commercial keys as authorized by the Government.

4.1.2 Cyber Security: Evaluate devices, systems and products for security and SCRM vulnerabilities. Provide in-depth technical analysis and research results to identify possible vulnerabilities and threat vectors in mobile technologies. Work with vendors to engineer and implement possible mitigations to resolve vulnerabilities found in the system.

4.1.3 IA Tools: Develop procedures and tools (information assurance software, hardware and network) that will provide confidentiality, integrity, availability, authenticity, access control, survivability and non-repudiation of information. Security shall be provided to protect all information and data in accordance with Federal, DoD, Joint

Chief of Staff, DISA, Designated Approval Authority (DAA), and Mobility PMO security policies. Fully integrated and complaint with Host Based System Security (HBSS) and Information Assurance/Intrusion Detection (IA/ID), as well as the Assured Compliance Assessment Solution (ACAS).

4.1.4 Risk Management Framework (RMF) Cyber Remediation: Actively analyze and remediate within the applicable DoD/DISA timeframes and in accordance with US CYBERCOM Information Assurance Vulnerability

Management Notices, Directives, and Orders. Maintain ongoing visibility of operating system updates and impact to the enclave. Identify a trend analysis tracking mechanism for projecting operational impact of identified vulnerabilities. Weekly vulnerability scans and HBSS real-time monitoring is performed on systems in accordance with RMF guidelines.

4.1.5 IA Documentation: The contractor will be responsible for assisting in the compiling, evaluating, submission and maintenance of all Information Assurance accreditations to include RMF and CSfC Capability Packages such as

MACP, DAR and Multi-Site Connectivity. The contractor will also be responsible for the development, integration and Tier III support of Cyber Defense systems that are focused on identifying, thwarting and reporting any Cyber

Attack or incident. In the event of an incident, the contractor shall respond and address incidents in accordance with

MAC system Level 2 requirements within the ITSM database

5.1 Performance Area 3 – Gateway Solution: The Contractor shall provide technical support and engineering services necessary to develop comprehensive DoD/DISA classified architectures. The Contractor shall assist in designing and developing MES-C technical documentation (ex. technical diagrams, Operational Views, System

Views, and other DoDAF diagrams).

5.1.1 MACP Compliant Infrastructure: Engineer, design, architect, manage, and sustain a MACP compliant, end-to-end, Government owned solution comprised of CSfC approved Commercial Off The Shelf (COTS) non-proprietary components. The infrastructure is anticipated to grow and support up to 10,000 users. Produce engineering documents, cost estimations, solution implementation, and plans for long-term support of the system.

5.1.2 Virtual Private Network (VPN): Engineer a National Information Assurance Partnership (NIAP) certified

IPsec VPN client and server in support of the NSA CSfC Suite B cryptography outer tunnel. Initially, the VPN tunnel will be established using IPsec key exchange and authentication operations. Once the VPN tunnel is established, the mobile device’s traffic is routed to an internal firewall that will permit only Transport Layer

Security (TLS) traffic.

6.1 Performance Area 4 – System Engineering Support: The Contractor shall support and perform all activities related to the system engineering process (SE). The SE process ensure all requirements are identified then properly incorporated into the design phase then integrated into the capabilities. The SE process spans from the tasking of developing new capability requirements to the operational hand off to DISA Ops of stated capability.

6.1.1 Tier III Support: Support shall be responsible for overall network architectural design, network evolution, large-scale requirements assessments/solutions, incident management, design configuration management, provisioning, and problem management and resolution for operational issues escalated by Tier II. Tier II functions are performed by DISA engineers and the support contractors responsible for software, hardware, system administration and maintenance.

6.1.2 Network Engineering: Assist with configuration management, patch deployments, and system troubleshooting/trouble management, as well as coordinate and communicate with operations and other engineering personnel.

6.1.3 Service Desk: Provide Tier III engineering level support, collaborate with external third-party Tier III vendor support, and coordinate with Tier II, system administrators and operational support personnel, service desk support personnel, and Mobility PMO, as appropriate.

7.1 Performance Area 5 - Test and Evaluation (T&E): The contractor is required to support integration T&E events to perform functional and performance support, as well as support the Government and/or third party contractors in the execution of T&E events. Testing support shall require generating test objectives, plans, and reports, as required. Testing including regressive testing on changes to the network ranging from security patches to adding new capabilities while meeting the requirements of the CSfC MACP on a consistent basis.

7.1.1 Enterprise Mobility Testing: Assist with developing a test plan and procedures to address successful deployments of all aspects of the DoD/DISA Mobility enterprise systems. The Contractor shall include in the test plan components of the DoD/DISA Mobility enterprise system to include mobile devices, MDM/MAS Gateways, sub-systems, partner network interfaces with the DoD MDM/MAS, and mobile applications.

7.1.2 Mobility T&E Lab Management: Manage a mobility research and development lab and provide services to operate, test, and maintain the Mobility system baseline. Manage all phases of engineering cycles in the lab.

8.1 Performance Area 6 – Logistic and Asset Management: The contractor shall provide support in asset inventory and asset tracking services that track the financial aspects of an asset to include management, forecasting, renewal, reporting, and delivery of managed devices under the MES-C solution.

8.1.1 Asset Accountability: Track and manage all third Party hardware maintenance and software licensing support by maintaining a 100% accountability of all asset(s). Manage and track all system and device/application licenses, to include expiration, for DMCC on all network and compute infrastructure and production applications, as executed under each task order. Provide a detailed list of required licenses (sortable by license type and specific device) to the Government and deliver licenses to DISA for installation on DMCC devices and systems not later than 60 days prior to license expiration.

8.1.2 Logistics Management: Work with respective parties to ensure that all equipment (hardware and software) goes through this process in accordance with DISA policies and regulations.

8.1.3 Demand and Forecast Management: Support common practices for ordering assets, tracking orders and assets, and (for hardware/equipment) tagging (to include barcoding) the assets. Assist the Government in capacity planning, providing analysis of current systems equipment and/or software licenses are optimal to support additional influxes of capacity.

8.1.4 Shipping and Receiving: Ship and receive equipment at the government’s request. The Contractor must have certified personnel to send, receive, and handle cryptographic COMSEC equipment.

9.1 Performance Area 7 – Network and Operational Support: The contractor shall provide support to include but not limited to enclave administration, fault management, trouble analysis, network administration, equipment and circuit management, incident handling and reporting, system status reporting, implementation testing and acceptance, general system administrative tasks, and enclave terminal administration.

9.1.1 Performance Management: Engineer a capability to provide network performance reports, metrics, and data for real-time status as well as for non-real-time analysis. Non-real time data would consist of admin logs that are aggregated, captured, and recorded over a given period of time that have been manipulated into a report format to indicate a status of the system health, network availability, port blocking, etc. Real time should be reflected as it occurs through a built in capability to monitor the system. To ensure continuous system performance, system status should maintain a minimal of 99.5% availability.

9.1.2 System/Device Status Reporting: Various system and device reporting shall be required. Demonstrate the capability to provide manual and automated status and trend reports based on system and network availability, peak use, device use data, and other trend analysis.

9.1.3 Monitoring: The solution shall be engineered as a part of the DoD and DISA Services Infrastructure and shall be configured to provide a machine to machine data feed to the DISA designated information aggregation location

(for faults, alarms, alerts, and information supporting the monitoring of security events) to facilitate the integration of the capability to the Network Operations and Security Monitoring systems. Operational support shall consist of assisting stakeholders in investigating security events, refining and developing analytics, and/or alerts. Enables effective incident triage and response to reduce risk to the system and the network. Ensures real-time visibility to all infrastructure components, mobile devices, and the data that traverses the enclave. Supports export of data sets, audit logs, and incident reports for analysis by other information systems. Stays current with risks and ensures dynamic monitoring of new threats. Supports Network Operations with access to all infrastructure components’ system logs and Sourcefire Intrusion Detection System (IDS) data, which increases the breadth of visibility across the black, gray and red zones.

9.1.4 Mobile Data Management: Develop a solution to incorporate a MDM to provide basic device controls to the local Tier I such as provisioning Personal Identification Number (PIN), device wipe, password reset etc., solution addresses mobile security, risk management, and compliance. Support ability to centrally manage mobile devices and enterprise mobility infrastructure, monitor and verify system integrity, detect tampering and compromises, maintain policy compliance, and ensure compliance in an auditable fashion. Provide the end-to-end security and management of mobile devices; provide a solution for a secure container on the device for email, browsing, PIM tools, documents, and applications encrypted and under administrator control. Provide a solution for services monitors mobile devices in the enterprise to ensure they start, and remain, in a known trusted state. The service prevents unwanted changes to policy and configuration files, operating system (OS) rooting or jail breaking, the installation of unverified or blacklisted applications, and other potential compromises that can lead to a state of non-compliance and put the device or corporate data at risk.

9.1.5 Provisioning: Engineer a solution for an automated provisioning process for each classified solution. Provide supporting training of the process.

10.1 Performance Area 8 – Mobility Capability Integration and Innovation: The contractor will perform in-depth research on mobility technologies, cyber security systems, current applications, services, gateway management improvements, and any new applications that improve the current operational capability. The

Contractor shall work with industry to identify future technologies such as hardware, software and services that could be included in the classified portfolio.

10.1.1 Operational Capability Assessment: Perform operational assessments to determine any technology, policy, procedures gaps or shortcomings of the current DoD/DISA architecture and develop/provide architecture roadmaps/transition plans based on “as is” architecture and the “to be” DoD/DISA architecture derived from the approved “to be” requirements based on applicable resources (e.g. CSfC Capability Packages, DISA/DoD Security, DISA Requirements Analysis Office, etc.).

10.1.2 Mobility Device Capability Assessment: All current and future classified devices must be CSfC NIAP approved per the Mobile Device Fundamental (MDF) Protection Profile (PP), as well as have the ability to integrate with the proposed gateway. Identify next generation DMCC devices (i.e. phones, tablets, hotspots) for use under the

DMCC enterprise offering.

10.1.3 DMCC Capabilities: Integrate existing and emerging capabilities for voice, classified email, Unified Video

Dissemination System (UVDS), and integrate commercial carrier private networks.

10.1.4 Virtual desktop infrastructure (VDI): Implement the use of VDI, which shifts file manipulation from the device to the back-end infrastructure. Thus the device, if compromised, has no residual data on the device itself.

11.1 Performance Standards

The following standards for MES-C shall be directed at the overall contract level. Each subsequent task order will contain specific performance standards based on the performance areas detailed above.

11.1.1 Specifications and Standards. Service and component requirements shall be satisfied with commercial items, specifically, those items listed on the CSfC Components List Index to the maximum extent practicable.

Additionally, the contractor will be responsible for transitioning archived components within two years of the “date removed.”

Contract Level Performance Standards.

Performance Standard Acceptable Quality Level (AQL) Method of Surveillance

Acceptable contract performance Contractors shall maintain a satisfactory performance on all

MES-C task orders

Routine inspection CPARS/PPIRS

Timely and accurate submission of required Reports

Reports submitted within the designated timeframe (i.e. 30 days, 60 days)

Routine inspection of deliverable products and services

11.1.2 Section 508 Compliance for IT Accessibility: Unless specifically exempted, to include the exemptions located at FAR 39.204, all task orders issued under this contract shall comply with Section 508 of the Rehabilitation

Act of 1973 and Amendments of 1998 as well as 36 CFR § 1194 to ensure IT accessibility to disabled persons.

Only in situations where an approved exception to Section 508 is provided by the Chief Information Officer (CIO) of the requiring agency/organization, will a task order be issued that exempts the contractor from complying with

Section 508 requirements contained in the contract. Information on Section 508 compliance can be obtained at http://www.disa.mil/About/Legal-and-Regulatory/Accessibility. As applicable, the following specifications are incorporated into each task order issued through the contract:

§ 1194.21 - Software Applications and Operating Systems

§ 1194.22 - Web Based Intranet and Internet Information and Applications

§ 1194.23 - Telecommunications Products

§ 1194.31 - Functional Performance Criteria

§ 1194.41 - Information, Documentation and Support

11.2 Incentives

At the end of the base period and at the completion of the option period, ratings shall be recorded in the Contractor

Performance Assessment Reporting System (CPARS) that will document both outstanding and negative performances.

Any and all other incentives will be identified at the task order level.

11.3 Place of Performance

Project support will require access to various classified and unclassified facilities and networks that will require some of the support Contractors to have permanent space assigned while others may conduct work off-site. DISA has allocated (TBD) on-site workspaces that will be dedicated to provide this support at a Government site. Those identified as required on-site Contractors will be identified in the PWS and approved by the government personnel section (OC/SE) through a space waiver. Others may be accommodated as needed for access to Government classified databases and classified email and other For Official Use Only (FOUO) access requirements through hot seating of available hotel cubes or other spaces where assigned Government personnel are not in the office (i.e., TDY, CWS, and telework).

The contractor will be required to perform work associated with task order in the United States, specifically on-site at

DISA (Government) facilities and customer facilities, as well as any customer site or other alternate work area based on prior Government approval.

Alternate Place of Performance - Contingency Only. As determined by the COR, Contractor employees may be required to work at an alternate place of performance (e.g., home, the Contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather, etc.). Non-emergency/non-essential Contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing Contractor resources. To the extent possible, the Contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting

Officer or the Contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

11.4 Period of Performance. The period of performance is a 1-year base period and four 1-year options.

12.1 Security Requirements. This section shall be considered a supplement to Block 13 of the Government provided DD Form 254, Contract Classification Specification. The following security requirements shall apply to this effort.

References:

a. DISA Form 786, DISA Statement of Information System Use and Acknowledgement of User

Responsibilities

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISAI 240-110-8, Information Security

d. DISAI 240-110-36, Personnel Security

e. DISAI 240-110-38, Industrial Security

f. DISA Instruction 630-230-19, Cybersecurity

g. DoDM 5200.01, Vol 1-4 Information Security Program, 24 February 2012

h. DOD 5200.2-R, DoD Personnel Security Program

i. DOD 5220.22-M, National Industrial Security Program Operating Manual, February 2006 Incorporating

Change 02 May 2016

j. DOD 5220.22-R, Industrial Security Regulation

k. DoDM 5105.21 Sensitive Compartmented Information (SCI) Administrative Security Manual:

Administration of Information and Information Systems Security (if applicable)

12.2 Facility Security Clearance. The work to be performed under this contract/order is up to the Top Secret level and will require Sensitive Compartmented Information (SCI) access eligibility for some personnel. Therefore, the company must have a final Top Secret Facility Clearance from the Defense Security Service Facility Clearance

Branch.

12.3 Security Clearance and Information Technology (IT) Level. All personnel performing on or supporting a

DISA contract/order in any way will be U.S. citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance and interim or final IT-level eligibility delineated in the table below when performance starts.

PWS Task /

Subtask

Clearance

Level

IT Level

Access

Level of

Classified Access Justification for Access to Classified

TBD TBD TBD TBD

TBD TBD TBD TBD

Individuals supporting PWS Tasks / Subtasks that require(s) a final Top Secret security clearance and a final IT-I

(privileged level systems access) will, immediately upon hire, require Sensitive Compartmented Information (SCI) access eligibility adjudicated by the Defense Intelligence Agency or other federal adjudications facility to perform their duties. SCI processing for SCI eligibility will be coordinated with the supporting Government Security

Manager and will begin immediately upon start of duty performance under this contract/order. The following tasks require SCI: (Task- TBD)

All SCI* work under this contract/order will be monitored by TBD.

The following positions require a minimum interim Secret security clearance and interim IT-1 eligibility when per formance starts; furthermore, the Contractor shall initiate TS security clearance requests no later than 30 days after task order award:

Project Manager

Senior Systems Engineer- Top Secret Program

Senior Systems Architect

Senior Information Security Lead

Senior Network Engineer- Top Secret Program

Senior Voice Engineer (VOIP)

12.4 Investigation Requirements. All personnel requiring SCI, Top Secret or IT-I access under this contract/order shall undergo a favorably adjudicated Tier 5 investigation (formerly known as a Single Scope Background

Investigation (SSBI)) as a minimum requirement. The Tier 5 will be maintained current within 5-years and requests for Tier 5 reinvestigation (T5R formerly known as Single Scope Background Period Reinvestigation (SBPR) or

Phased Periodic Reinvestigation (PPR)) will be initiated prior to the 5-year anniversary date of the previous Tier 5.

All personnel requiring Secret access under this contract/order shall undergo a favorably adjudicated Tier 3 (T3)

Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access

National Agency Check and Inquiries as a minimum investigation. The Tier 3 Investigation will be maintained current within 10-years and requests for Secret Periodic Reinvestigations will be initiated by submitting a Tier 3R investigation prior to the 10-year anniversary date of the previous Tier 3 Investigation.

Contractor personnel that do not meet the investigation requirements for Secret IT-I access may be granted such access by the DISA Personnel Security Office (DISA PSO) provided there is no disqualifying information within the adjudicative guidelines that cannot be mitigated. The DISA PSO will request the Contractor personnel complete an

Electronic Questionnaire for Investigation Processing (e-QIP). The DISA PSO will review the e-QIP and if there is no disqualifying information, the individual may be eligible for Interim Secret IT-I access. Once favorable results are returned from the Federal Bureau Investigation (FBI) name and fingerprint check, the National Agency Check portion of the investigation is completed favorable, DISA PSO may grant the Interim Secret IT-I provided all other conditions are met. Contract personnel found ineligible for Interim Secret IT-I access will not be allowed to support a DISA contract requiring Secret IT-I access and must wait for final favorable adjudications by the appropriate adjudication facility.

12.5 Adjudication for Secret IT-I access. Favorable Adjudication of any previous T5, T5R, SSBI, SBPR or PPR by any of the DoD Central Adjudication Facility or other federal adjudications facilities within a five-year period will be automatically accepted for final Secret IT-I access.

Prior to granting interim Secret IT-I authorization, the supporting security manager will forward a written request for interim Secret IT-I authorization to DISA PSO for approval. The request for SSBI (e-QIP, FBI name and fingerprint check) must be submitted by DISA PSO to the OPM.

12.6 Visit Authorization Letters: The Contractor will forward a Visit Authorization Letter (VAL) to the COR for all on-site employees prior to the beginning of each task order period of performance and as new contractor employees are assigned to the contract:

The VAL shall be on company letterhead or pre-fabricated form and contain the following information:

Contract number with start and end dates

CAGE CODE

Company point of contact (POC) and telephone number

Government POC/COR name and telephone number

Complete legal name of employee(s)

Social Security Number(s) of employee(s)

Security Clearance level with date granted for employee(s), and

Adjudication facility name, i.e. DISCO

Type of personnel security investigation (PSI) pending or completed

Date PSI completed

12.7 Security Contacts. DISA Security Personnel can be contacted for Industrial or Personnel Security related issues at (301) 225-1235 or via mail at:

Defense Information Systems Agency Defense Information Systems Agency

ATTN: MP61, Industrial Security ATTN: MP62, Personnel Security

Command Building Command Building

6910 Cooper Ave. 6910 Cooper Ave.

Fort Meade, MD 20755-7088 Fort Meade, MD 20755-7088

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

Security Manager Contact Information:

Name:

Phone Number:

E-mail:

13.1 Information Security and other miscellaneous requirements.

Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the government facility.

Contractor employees shall be required to comply with all Government security regulations and requirements.

Initial and periodic safety and security training and briefings will be provided by Government security personnel.

Failure to comply with Government security regulations and requirements shall require the company to provide the

Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the Contractor will not be able to provide service on this contract/order.

Contractor employees with an incident report in JPAS who have had their access to classified suspended will not be permitted to provide to fill positions requiring access to classified information on a DISA contract/order.

The Contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

DISA retains the right to request removal of Contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

Contractor personnel will generate or handle documents that contain For Official Use Only information at the

Contractor and/or Government facilities. Contractor shall have access to generate and handle classified material only at the location(s) listed in the place of performance section of this document. All Contractor deliverables shall be marked in accordance with DoDM 5200.1, Vol. 3, Vol. 4, Information Security, DoD 5400.7-R, Freedom of

Information Act Program, unless otherwise directed by the Government. The Contractor shall comply with the provisions of the DoD Industrial Security Manual for handling classified material and producing deliverables. The

Contractor shall comply with DISA Instruction 630-230-19.

The Contractor shall afford the Government access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in performance of the contract/order. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of data or to the function of information technology systems operated on behalf of DISA or DoD, and to preserve evidence of computer crime.

13.2 Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government-

Furnished Information (GFI). Any GFP, GFE, and/or GFI will be determined at the task order level.

14. Other Pertinent Information or Special Considerations.

(a) Identification of Potential Conflicts of Interest (COI). If any COIs become known to the Government, as defined by FAR Part 9.5, they will be identified. However, if the contractor has access to sensitive information, the remedy to which is discussed in paragraph 11.b. detailed below.

(b) Identification of Non-Disclosure Requirements. The contractor shall have access to information, records, and live data which may be sensitive and/or proprietary, including information about government files, source selection activities and processes, system vulnerabilities, data processing activities or functions, user

IDs, passwords, and other sensitive information. The Contractor shall not divulge information about government files, source selection activities and processes, or any other sensitive information to anyone not authorized to receive such information. The Contractor shall ensure that other persons are authorized to receive sensitive information before releasing it to them. See Section J, Attachment C.4, Non-Disclosure

Agreement (NDA), for Contractor Personnel. Unless waived by the Contracting Officer, the NDA must be executed between the contractor employee and the Government before the employee has access to government furnished information. The Contractor is responsible for identifying that all personnel, to include any new personnel on the contract, have executed the DISA-provided NDA in the Monthly Status

Report, applicable at the task order level.

(c) Packaging, Packing and Shipping Instructions. Will be determined at the task order level.

(d) Inspection and Acceptance Criteria. Will be determined at the task order level.

(e) Property Accountability. Will be determined at the task order level. For all applicable task orders, the contractor shall submit the attached Electronic Product List (see Section J, Attachment C.2) in addition to complying with all requirements of DFARS 252.211-7003. See DARS 252.211-9000, Requirement to

Submit an Electronic Product List for additional information.

(f) Travel. Travel may be required at the task order level.

Prior to incurring any long distance travel expenses, the contractor shall obtain written approval from the COR approving the travel dates, expected duration, origin and destination, purpose, estimated costs, and the number and names of personnel traveling.

Travel Authorization Requests must be completed and pre-approved by the government COR.

Reimbursement for travel will be in accordance with FAR Part 31.205-46. Travel compensation will not exceed the government allowance for travel and per diem. Copies of all travel receipts must be attached in WAWF to ensure timely invoice approval.

All travel associated with this contract shall be in accordance with FAR 31.205-46. The COR will certify invoices prior to processing for payment.

Local travel will not be reimbursed, unless otherwise specified in the applicable task order.

Industry Standard Local Travel is hereby defined to mean any and all travel within fifty (50) mile radius of the place of performance.

(g) Supply Chain Risk Management (SCRM). This contract and its associated delivery/task orders are subject to the Federal SCRM policies and regulations including the Defense Federal Acquisition Regulation

Supplement (DFARS) 252.239-7017 Notice of Supply Chain Risk, DFARS 252.239-7018 Supply Chain

Risk, DoD Instruction 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and

Networks, Section 806 of theFY2011 NDAA Requirements for Information Relating to Supply Chain Risk, and internal DISA SCRM Processes and Procedures.

The Contractor shall submit a SCRM plan, as part of its proposal, that describes how the Contractor will reduce and mitigate Supply Chain Risk using the security controls outlined below (further described in

CNSSI 1253, Appendix D and NIST SP 800-53), as applicable to your contract. The SCRM plan shall describe the supply chain risks associated with the product and/or service being provided, and how the contractor will reduce and mitigate those supply chain risks.

As indicated at the task order level, the contractor will execute their SCRM Plan and provide a SCRM Plan

Update in the event of changes that affects supply chain risk. At a minimum, the following events substantiate the need for an update: changes in company ownership, changes in senior company leadership, supplier changes, subcontractor…