HC108419R00010001.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to provide answ ers to vendor questions and a revised RFP and attachments.

Questions/comments are due no later than 3:00 pm (CST) on January 7, 2019 and proposals are due no later than 3:00 pm (CST) on January 24, 2019.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 45

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 02-Jan-2019

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X HC108419R0001

X 9B. DATED (SEE ITEM 11)

27-Nov-2018

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer X is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

02-Jan-2019

CODE

DISA/DITCO-SCOTT-PL84

2300 EAST DRIVE

SCOTT AFB IL 62225

HC1084 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

HC108419R0001

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION B - SUPPLIES OR SERVICES AND PRICES

CLIN 0002

The CLIN description has changed from Other Direct Costs (ODC) to Removed.

The CLIN extended description has changed from:

Cost Reimbursable ODC's - IAW PWS 6.3, 6.4, 6.6 and 9.2

To:

Removed

CLIN 1002

CLIN 2002

CLIN 3002

CLIN 4002

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

The following have been modified:

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

As of January 2, 2019

Contract Number:

Task Order Number:

Contractor Name:

Tracking Number:

Follow-on to Previous Contract and Task Order Number:

1. Contracting Officer’s Representative (COR)

a. Primary COR

Name:

Organization:

Department of Defense Activity Address Code (DODAAC):

Address:

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR.

Organization:

DODAAC:

Address:

Phone Number:

Fax Number:

E-Mail Address:

2. Title: Mobility Enterprise Services- Classified (MES-C)

C1. INTRODUCTION

1.1 Mission: The Mobility Portfolio Management Office (PMO) is the Department of

Defense (DoD) enterprise service offering made up of the Defense Mobility Classified Capability (DMCC) Programs for the Top Secret (TS) and Secret (S) capabilities. DMCC is a DoD enterprise service offering, which enables Commercial Solutions for Classified (CSfC) approved customer owned mobile devices access to the classified DoD Information Network (DoDIN) and commercial information services. The Mobility PMO requires CSfC Programs compliant, in an open platform for the MES-C solution. This system is comprised of an Enterprise Mobility Management (EMM) suite, network gateways, Tier III service support, commercial mobile devices (which provide classified voice and data services), and an identity management system.

1.2 Background: Since 2013, the DoD Mobility Program, as directed by the DoD

Commercial Mobile Device Implementation Plan, has led the development of an enterprise solution to support controlled unclassified and classified information mobility requirements that leverages carrier infrastructure and provides entry points for wireless capabilities to meet the DoD needs. The DoD Mobility, as a program, encompasses multiple subcomponents that when integrated, provide mission partners with enterprise-level secure classified protected communication services, ensuring interoperability, increased security, access to information, and reliable service anywhere, at any time.

A phased series of operational pilots have been conducted and allow DoD to incorporate lessons learned, ensure interoperability, refine the requirements for a secure architecture to support EMM, influence commercial standards, and create cost and operations’ efficiencies for DoD enterprise mobile users. This ultimately will provide DoD with the ability to lower the cost of the DMCC EMM suite as well as address security and increase DoD productivity goals. The PMO will offer the enterprise classified mobility services to the DoD community in the same way DISA provides other enterprise capabilities today.

The DISA Mobility PMO will provide enterprise services such as voice, video, and data to the customer via a mobile platform but will not implement its own enterprise services.

This ensures costs within the Department are not duplicated and that current and future enterprise services are maximized to increase value and efficiency.

The DoD EMM Suite as it relates to DMCC includes:

• Mobility Gateways o Mobility Gateways are intermediate systems that interconnect traditional enterprise IT services, such as Voice over Secure Internet Protocol (VoSIP) and Defense Enterprise Email-Secret (DEE-S), with wireless and mobile network transport o Specific mobility gateway functions include: Remote access authentication and access control, security proxies for critical enterprise systems, network routing and perimeter security (firewalls and intrusion detection) o Mobile devices are allowed to securely access DoD enterprise network via CSfC infrastructure

• Device Management o System Center Configuration Management o Mobile Device Management

• Mobile Apps Network Operation Center (NOC)/Network Operations o The DMCC capabilities interface with DISA Enterprise Network Operations

Services. These services provide operational views into individual systems that make up the DMCC capabilities o The Mobility PMO does not own Network Operations/NOC infrastructure but it is required to share mobility related operational status with the operational community

• Mobile Devices including current Android tablet/smartphones and with possible iOS devices in the future managed by the MDM and Windows 10 based tablets managed by Microsoft System Center Configuration Manager

• DISA Offered Enterprise Services o DEE-S o Unified Communications (UC) including Voice Over IP (VoIP) ,Chatting and

Video conferencing o UVDS Streaming Vide o SharePoint o Variety of HTTPs based web pages

• Virtual Desktop Infrastructure (VDI)

• Ticketing system that tracks and generates helpdesk trouble tickets o Since the Mobility PMO is engaged in the helpdesk operation, interfacing with the current Enterprise ticketing system (e.g. Remedy) is required

• Business Support System(s) (BSS) is one of the mobility subsystems supporting the business side in mobility operations including billing management support, DISA Storefront.

• Mobility Operational Support System(s) (OSS) is a supporting subsystem to support mobility operations and Network Operations requirements

• Secure Mobile SIPRNet Connectivity with mobile Virtual Private Networks (VPNs)

• Public Key Infrastructure (PKI)/Public Key Enablement (PKE) is associated with PKI enablement efforts including:

o Trusted Platform Module (TPM)/derived credential enablement o Trusted Execution Environment/ derived credential enablement o Additional mobility related PKE initiatives (e.g. Next generation multi-factor authentication.

1.3 Objectives: The objective of this contract is to provide classified mobility capabilities, professional and engineering services, and enterprise-wide support. The MES-C solution shall be capable of supporting the following two classifications: S and TS. This contract will not only provide core mobility system integration and testing efforts, but also support additional engineering activities to interface with other sub-systems and partner networks as well as Tier III support. Engineering activities will also need to be provided from impact assessment to deployment of resultant new equipment/software for addressing new/updated CSfC capability packages and Components List changes. Future task orders may include innovation tasks commensurate with the rapidly changing mobile environment. Classified references within this contract can assume S, TS, and Sensitive Compartmented Information (SCI) level classification, where applicable.

1.4 Scope: The scope of this requirement is to utilize current and future Mobility capabilities to enhance DISA’s ability to provide classified mobile communication services to the entire DoD. Mobility solutions encompass a range of capabilities from old legacy systems to new, emerging solutions and the Mobility mission will continue to expand and change. Because of technology evolution, industry standard changes, DoD regulatory requirements as well as CSfC Capability Package updates. The Contractor shall provide the necessary personnel, equipment, services, and other items needed to support operations, maintenance, and sustainment requirements of DoD Mobility Program Office. Services and support anticipated under this contract exist within the scope of the following performance areas:

Performance Area 1 – Contract and Program Management Performance Area 2 – Information Assurance Performance Area 3 – Gateway Solution Performance Area 4 – System Engineering Support Performance Area 5 - Test and Evaluation (T&E) Performance Area 6 – Logistic and Asset Management Performance Area 7 – Network and Operational Assistance Performance Area 8 – Mobility Capability Integration and Innovation

2.1 Contract Requirement

2.1.1 CSfC: The Contractor shall be a CSfC Integrator. The CSfC process is endorsed by the National Security Agency (NSA) and enables commercial components to be utilized in layered solutions as an endeavor to protect classified data/systems.

2.1.2 Annual In Progress Reviews (IPR): The Contractor will conduct annual IPRs for the life of this contract, unless otherwise notified by the Government. The IPRs will address overall contract status and provide details regarding technical, programmatic, scheduling, capability implementation, operations, administration, and contract issues. The designated Contracting Officer will coordinate IPR dates and locations in advance.

2.1.3 Information Sharing: The Government may use and disclose reported information

(e.g., information regarding threats, vulnerabilities, incidents, or best practices) that does not include attribution information, at its discretion to assist entities in protecting information or information systems (e.g. threat information products, threat assessment reports); provided that such use or disclosure is otherwise authorized in accordance with applicable statutes, regulations, and policies.

2.1.4 Periodic Government Inspections: The Contractor is subject to Government inspections and reviews to assure compliance with both DISA and DoD Supply Chain Risk Management (SCRM) requirements throughout the contract performance period. The Contractor shall be responsible for taking corrective action based upon the impact and severity of identified weaknesses.

2.1.5 Post Award Task Order Meetings/Conferences: Technical meetings and/or post award orientation conferences may be necessary to resolve problems and to facilitate understanding of the requirements of the contract and/or of each awarded task order.

Participants at these meetings/conferences shall be members of the Contractor's technical staff and technical representatives of the Government. These meetings/conferences shall be scheduled by agreement of the parties and arrangements made between the Contracting Officer, his/her representative, and the Contractor. Records of these meetings/conferences shall be made by the Contractor and submitted to the Government within five (5) business days after conclusion of the meetings/conferences. All costs associated with the attendance at these meetings/conferences shall be at no direct charge to the contract.

3.1 Performance Area 1 – Contract and Program Management: The Contractor shall provide all materials, services, personnel, planning, direction, coordination, and control necessary to provide the services required by this contract. The Contractor must perform program management, project management, and contract management to ensure timely and effective performance.

3.1.1 Program Management: Manage and oversee all activities performed by Contractor personnel (including subcontractors and teaming partners, as applicable) to satisfy all performance requirements. Effectively plan, manage, and monitor work activities and supervising Contractor personnel to support effective performance. Escalate problems or concerns to the Contracting Officer and COR.

3.1.2 Program Management Plan: Develop a plan documenting the Contractor’s management approach, operating procedures, staffing approach, and overall work

Breakdown Structure. Staffing Plans regarding resource assignments by task may be required at the task order level.

3.1.3 Documentation: Provide support necessary to draft, review, revise, and deliver documents required in conjunction with the contract. Separate and distinct deliverables and/or documentation will be identified at the task order level.

4.1 Performance Area 2 – Information Assurance (IA): The Contractor will be required to provide all technical, engineering, and implementation support services in maintaining and complying with the following Security requirements: Security Recommendation Guides (SRGs), Security Technical Implementation Guides (STIGs), IA Vulnerability Management (IAVM), various Capability Package Requirements such as but not limited to Mobile Access Capability Package (MACP), DAR and Multi-Site Connectivity as well as any other applicable security policies applicable to the infrastructure components of the overall system solution. The Contractor will support Certification and Accreditation submission, management, and compliance. Mobile devices, MDM and any unified capabilities (UC) infrastructure utilized shall be UC approved and product list compliant.

Mobile devices and MDM shall also be National IA Partnership (NIAP) certified per the appropriate protection profile.

4.1.1 Certificate Management: Provide technical assistance in the areas of, to include but not limited to the engineering/integration/operation/management of system/infrastructure software and hardware certificates, device certificates, Certificate Revocation List (CRL), and Certificate Authority (CA) support, as well as the issue and management of cryptographic key (software and hardware) certificates in support of the infrastructure and approved mobile devices. The Contractor will also be responsible for developing a MACP compliant Key/Certificate Management Plan to describe how keys/certificates are issued, supported, maintained/renewed, stored, and safeguarded as well as tracked for expiration and renewal. When dictated by the Government, provide technical assistance, and actual key support if required, in the generation and distribution of commercial keys as authorized by the Government.

4.1.2 Cyber Security: Evaluate devices, systems and products for security and SCRM vulnerabilities. Provide in-depth technical analysis and research results to identify possible vulnerabilities and threat vectors in mobile technologies. Work with vendors to engineer and implement possible mitigations to resolve vulnerabilities found in the system.

4.1.3 IA Tools: Develop procedures and update/replace tools (IA software, hardware and network), if need be, after analyzing current available tools, such that process and tools will provide confidentiality, integrity, availability, authenticity, access control, survivability and non-repudiation of information. Security shall be provided to protect all information and data in accordance with Federal, DoD, Joint Chief of Staff, DISA, Designated Approval Authority (DAA), and Mobility PMO security policies. Fully integrated and complaint with Host Based System Security (HBSS) and IA/Intrusion Detection (IA/ID), as well as the Assured Compliance Assessment Solution (ACAS).

4.1.4 Risk Management Framework (RMF) Cyber Remediation: Actively analyze and remediate within the applicable DoD/DISA timeframes and in accordance with US CYBERCOM IAVM Notices, Directives, and Orders. Maintain ongoing visibility of operating system updates and impact to the enclave. Identify a trend analysis tracking mechanism for projecting operational impact of identified vulnerabilities. Weekly vulnerability scans and HBSS real-time monitoring is performed on systems in accordance with RMF guidelines.

4.1.5 IA Documentation: The Contractor will be responsible for assisting in the compiling, evaluating, submission and maintenance of all IA accreditations to include RMF and CSfC Capability Packages such as MACP, DAR and Multi-Site Connectivity. The Contractor will also be responsible for the development, integration and Tier III support of Cyber Defense systems that are focused on identifying, thwarting and reporting any Cyber Attack or incident. In the event of an incident, the Contractor shall respond and address incidents in accordance with MAC system Level 2 requirements within the ITSM database

5.1 Performance Area 3 – Gateway Solution: The Contractor shall provide technical support and engineering services necessary to develop comprehensive DoD/DISA classified architectures. The Contractor shall assist in designing and developing MES-C technical documentation (ex. technical diagrams, Operational Views, System Views, and other DoDAF diagrams).

5.1.1 MACP Compliant Infrastructure: Engineer, design, and architect a MACP compliant, end-to-end, Government-owned solution comprised of CSfC approved Commercial off the Shelf (COTS) non-proprietary components. The infrastructure is anticipated to grow and support up to 10,000 users. Produce engineering documents, cost estimations, solution implementation, and plans for long-term support of the system.

5.1.2 Virtual Private Network (VPN): Engineer a NIAP certified IPsec VPN client and server in support of the NSA CSfC Suite B cryptography outer tunnel.

Initially, the VPN tunnel will be established using IPsec key exchange and authentication operations. Once the VPN tunnel is established, the mobile device’s traffic is routed to an internal firewall that will permit only Transport Layer Security (TLS) and inner IPSec VPN tunnel traffic per CSfC requirements.

6.1 Performance Area 4 – System Engineering Support: The Contractor shall support and perform all activities related to the system engineering process (SE).

The SE process ensure all requirements are identified then properly incorporated into the design phase then integrated into the capabilities. The SE process spans from the tasking of developing new capability requirements to the operational hand off to DISA Ops of stated capability.

6.1.1 Tier III Support: Support shall be responsible for overall network architectural design, network evolution, large-scale requirements assessments/solutions, incident management, design configuration management, provisioning, and problem management and resolution for operational issues escalated by Tier II. Tier II functions are performed by DISA engineers and the support Contractors responsible for software, hardware, system administration and maintenance.

6.1.2 Network Engineering: Assist with network analysis, configuration management, patch deployments, and system troubleshooting/trouble management, as well as coordinate and communicate with operations and other engineering personnel.

6.1.3 Service Desk: Provide Tier III engineering level support, collaborate with external third-party Tier III vendor support, and coordinate with Tier II, system administrators and operational support personnel, service desk support personnel, and Mobility PMO, as appropriate. Interface with the DISA ticketing system (e.g. Remedy).

7.1 Performance Area 5 - Test and Evaluation (T&E): The Contractor is required to support integration T&E events to perform functional and performance support, as well as support the Government and/or third party Contractors in the execution of T&E events. Testing support shall require generating test objectives, plans, and reports, as required. Testing including regressive testing on changes to the network ranging from security patches to adding new capabilities while meeting the requirements of the CSfC MACP on a consistent basis. Testing will also include network engineering/analysis for troubleshooting test setup and/or execution when required.

7.1.1 Enterprise Mobility Testing: Assist with developing a test plan and procedures to address successful deployments of all aspects of the DoD/DISA Mobility enterprise systems. The Contractor shall include in the test plan components of the DoD/DISA Mobility enterprise system to include mobile devices, MDM/MAS Gateways, sub-systems, partner network interfaces with the DoD MDM/MAS, mobile applications as well as supported Enterprise Services when testing interaction is required.

7.1.2 Mobility T&E Lab Management: Manage a mobility research and development lab and provide services to operate, test, and maintain the Mobility system baseline. Manage all phases of engineering cycles in the lab.

8.1 Performance Area 6 – Logistic and Asset Management: The Contractor shall provide support in asset inventory and asset tracking services that track the financial aspects of an asset to include management, forecasting, renewal, reporting, and delivery of managed devices under the MES-C solution.

8.1.1 Asset Accountability: Track and manage all third party hardware maintenance and software licensing support by maintaining a 100% accountability of all asset(s). Manage and track all system and device/application licenses, to include expiration, for DMCC on all network and compute infrastructure and production applications, as executed under each task order. Provide a detailed list of required licenses (sortable by license type and specific device) to the Government and deliver licenses to DISA for installation on DMCC devices and systems no later than 60 days prior to license expiration.

8.1.2 Logistics Management: Work with respective parties to ensure that all equipment (hardware and software) goes through this process in accordance with DISA policies and regulations.

8.1.3 Demand and Forecast Management: Support common practices for ordering assets, tracking orders and assets, and (for hardware/equipment) tagging (to include barcoding) the assets. Assist the Government in capacity planning, providing analysis of current systems equipment and/or software licenses are optimal to support additional influxes of capacity.

8.1.4 Shipping and Receiving: Ship and receive equipment at the Government’s request. The Contractor must have certified personnel to send, receive, and handle cryptographic COMSEC equipment.

9.1 Performance Area 7 – Network and Operational Technical Assistance: The

Contractor shall provide technical assistance to the DMCC Mobility Gateway operations NetOps Contractor in the areas of, to include but not limited to, enclave administration, fault management, trouble analysis, network administration, equipment and circuit management, incident handling and reporting, system status reporting, implementation testing and acceptance, general system administrative tasks, and enclave terminal administration. This also includes using established repeatable processes such as the use of system debugs and other tools (software, hardware, feature sets) to determine expected and unexpected behaviors within the DMCC gateways. Lastly, the establishment of Subject Matter Expert (SME) knowledge within the organic team on all included DMCC gateway systems as well as the utilization of vendor reach back to enhance the knowledgebase (as required) in support of above Network and Operational Technical Assistance areas.

9.1.1 Performance Management: Engineer a capability to provide network performance reports, metrics, and data for real-time status as well as for non-real-time analysis. Non-real time data would consist of admin logs that are aggregated, captured, and recorded over a given period of time that have been manipulated into a report format to indicate a status of the system health, network availability, port blocking, etc. Real time should be reflected as it occurs through a built in capability to monitor the system. To ensure continuous system performance, system status should maintain a minimal of 99.5% availability.

9.1.2 System/Device Status Reporting: Various system and device reporting shall be required. Demonstrate the capability to provide manual and automated status and trend reports based on system and network availability, peak use, device use data, and other trend analysis.

9.1.3 Monitoring: The solution shall be engineered as a part of the DoD and DISA

Services Infrastructure and shall be configured to provide a machine to machine data feed to the DISA designated information aggregation location (for faults, alarms, alerts, and information supporting the monitoring of security events) to facilitate the integration of the capability to the Network Operations and Security Monitoring systems. Operational support shall consist of assisting stakeholders in investigating security events, refining and developing analytics, and/or alerts. Enables effective incident triage and response to reduce risk to the system and the network. Ensures real-time visibility to all infrastructure components, mobile devices, and the data that traverses the enclave. Supports export of data sets, audit logs, and incident reports for analysis by other information systems. Stays current with risks and ensures dynamic monitoring of new threats. Supports Network Operations with access to all infrastructure components’ system logs and Sourcefire Intrusion Detection System (IDS) data, which increases the breadth of visibility across the black, gray and red zones.

9.1.4 Mobile Device Management: Develop a solution to incorporate a MDM to provide basic device controls to the local Tier I such as provisioning Personal Identification Number (PIN), device wipe, password reset etc., solution addresses mobile security, risk management, and compliance. Support ability to centrally manage mobile devices and enterprise mobility infrastructure, monitor and verify system integrity, detect tampering and compromises, maintain policy compliance, and ensure compliance in an auditable fashion.. Provide a solution for a CSfC Components List secure encrypted Data-at-Rest (DAR) solution container on the mobile device for the utilization of email, browsing, PIM tools, documents, and applications under administrator control. Provide a solution for services monitors mobile devices in the enterprise to ensure they start, and remain, in a known trusted state. The service prevents unwanted changes to policy and configuration files, operating system (OS) rooting or jail breaking, the installation of unverified or blacklisted applications, and other potential compromises that can lead to a state of non- compliance and put the device or corporate data at risk.

9.1.5 Provisioning: Engineer a solution for an automated provisioning process for each classified solution. Provide supporting training of the process.

10.1 Performance Area 8 – Mobility Capability Integration and Innovation: The

Contractor will perform in- depth research on mobility technologies, cyber security systems, current applications, services, gateway management improvements, and any new applications that improve the current operational capability. The Contractor shall work with industry to identify future technologies such as hardware, software and services that could be included in the classified portfolio.

10.1.1 Operational Capability Assessment: Perform operational assessments to determine any technology, policy, procedures gaps or shortcomings of the current DoD/DISA architecture and develop/provide architecture roadmaps/transition plans based on “as is” architecture and the “to be” DoD/DISA architecture derived from the approved “to be” requirements based on applicable resources (e.g. CSfC Capability Packages, DISA/DoD Security, DISA Requirements Analysis Office, etc.).

10.1.2 Mobility Device Capability Assessment: All current and future classified devices must be CSfC NIAP approved per the Mobile Device Fundamental (MDF) Protection Profile (PP), as well as have the ability to integrate with the proposed gateway. Identify next generation DMCC devices (i.e. phones, tablets, hotspots) for use under the DMCC enterprise offering.

10.1.3 DMCC Capabilities: Integrate existing and emerging capabilities for voice, classified email, Unified Video Dissemination System (UVDS), and integrate commercial carrier private networks.

10.1.4 Virtual desktop infrastructure (VDI): Implement the use of VDI, which shifts file manipulation from the device to the back-end infrastructure. Thus the device, if compromised, has no residual data on the device itself.

11.1 Performance Standards: The following standards for MES-C shall be directed at the overall contract level. Each subsequent task order will contain specific performance standards based on the performance areas detailed above.

11.1.1 Specifications and Standards: Service and component requirements shall be satisfied with commercial items, specifically, those items listed on the CSfC Components List Index to the maximum extent practicable. Additionally, the Contractor will be responsible for transitioning archived components within the specified period as dictated by CSfC replacement policy requirements from the date the product(s) is removed from the CSfC Components list.

Contract Level Performance Standards.

Performance Standard Acceptable Quality Level

(AQL)

Method of Surveillance

Acceptable contract performance

Contractors shall maintain a satisfactory performance on all MES-C task orders

Routine inspection

CPARS/PPIRS

Timely and accurate submission of required Reports

Reports submitted within the designated timeframe (i.e. 30 days, 60 days)

Routine inspection of deliverable products and services

11.1.2 Section 508 Compliance for IT Accessibility: Unless specifically exempted, to include the exemptions located at FAR 39.204, all task orders issued under this contract shall comply with Section 508 of the Rehabilitation Act of 1973 and Amendments of 1998 as well as 36 CFR § 1194 to ensure IT accessibility to disabled persons. Only in situations where an approved exception to Section 508 is provided by the Chief Information Officer (CIO) of the requiring agency/organization, will a task order be issued that exempts the Contractor from complying with Section 508 requirements contained in the contract. Information on Section 508 compliance can be obtained at http://www.disa.mil/About/Legal-and-Regulatory/Accessibility. As applicable, the following specifications are incorporated into each task order issued through the contract:

§ 1194.21 - Software Applications and Operating Systems § 1194.22 - Web Based Intranet and Internet Information and Applications § 1194.23 - Telecommunications Products § 1194.31 - Functional Performance Criteria § 1194.41 - Information, Documentation and Support

11.2 Incentives: At the end of the base period and at the completion of the option period, ratings shall be recorded in the Contractor Performance Assessment Reporting System (CPARS) that will document both outstanding and negative performances.

Any and all other incentives will be identified at the task order level.

11.3 Place of Performance: Project support will require access to various classified and unclassified facilities and networks that will require some of the support Contractors to have permanent space assigned while others may conduct work off-site. DISA has allocated fifteen (15) on-site workspaces, to be identifed at the task order level, that will be dedicated to provide this support at a Government site. Those identified as required on-site Contractors will be identified in the PWS and approved by the government personnel section (OC/SE) through a space waiver. Others may be accommodated as needed for access to Government classified databases and classified email and other For Official Use Only (FOUO) access requirements through hot seating of available hotel cubes or other spaces where assigned Government personnel are not in the office (i.e., TDY, CWS, and telework).

The Contractor will be required to perform work associated with task order in the CONUS and Outside Continental United States (OCONUS), specifically on-site at DISA (Government) facilities, (Defense Enterprise Computing Centers (DECCs)), and contractor facilities, as well as any customer site or other alternate work area based on prior Government approval.

Alternate Place of Performance - Contingency Only. As determined by the COR, Contractor employees may be required to work at an alternate place of performance (e.g., home, the Contractor's facility, or another approved activity within the local http://www.disa.mil/About/Legal-and-Regulatory/Accessibility http://www.disa.mil/About/Legal-and-Regulatory/Accessibility travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather, etc.). Non-emergency/non-essential Contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing Contractor resources. To the extent possible, the Contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the Contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

11.4 Period of Performance: The period of performance is a 1-year base period and four 1-year options.

12.1 Security Requirements: This section shall be considered a supplement to Block 13 of the

Government provided DD Form 254, Contract Classification Specification. The following security requirements shall apply to this effort.

References:

a. DISA Form 786, DISA Statement of Information System Use and

Acknowledgement of User Responsibilities

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September

c. DISAI 240-110-8, Information Security

d. DISAI 240-110-36, Personnel Security

e. DISAI 240-110-38, Industrial Security

f. DISA Instruction 630-230-19, Cybersecurity

g. DoDM 5200.01, Vol 1-4 Information Security Program, 24 February 2012

h. DOD 5200.2-R, DoD Personnel Security Program

i. DOD 5220.22-M, National Industrial Security Program Operating Manual, February 2006 Incorporating Change 02 May 2016

j. DOD 5220.22-R, Industrial Security Regulation

DoDM 5105.21 Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Information and Information Systems Security (if applicable)

The work to be performed under this contract/order is up to the TS level Sensitive Compartmented Information (SCI) access eligibility for some personnel. TS SCI level may be required to allow the Contractor to access TS SCI systems in support of the DMCC-TS Program. The final clearance/classification level will be determined at the Task Order level.

12.2 Facility Security Clearance: The work to be performed under this contract/order is up to the TS level and will require SCI access eligibility for some personnel. Therefore, the company must have a final TS Facility Clearance from the Defense Security Service Facility Clearance Branch.

12.3 Security Clearance and Information Technology (IT) Level: All personnel performing on or supporting a DISA contract/order in any way will be U.S. citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance and interim or final IT-level eligibility delineated in the table below when performance starts.

Table 1: Security Requirements

PWS Task / Subtask

Clearanc e Level

IT

Level Access

Level of Classified Access

Justification for Access to Classified

PA 1-

Contract and

Program Management

TS-

SCI

IT-II TS-SCI System may be classified

TS-SCI

PA2-

Information

Assurance

TS-

SCI

IT-I TS-SCI System may be classified

TS-SCI

PA3- Gateway Solution

TS-

SCI

IT-I TS-SCI System may be classified

TS-SCI

PA4- System Engineering

Support

TS-

SCI

IT-I TS-SCI System may be classified

TS-SCI

PA5- Test and Evaluation

TS-

SCI

IT-I TS-SCI System may be classified

TS-SCI

PA6- Logistic and Asset

Management

TS-

SCI

IT-II TS-SCI System may be classified

TS-SCI

PA7- Network and

Operational Assistance

TS-

SCI

IT-I TS-SCI System may be classified

TS-SCI

PA8- Mobility Capability

Integration and

Innovation

TS-

SCI

IT-I TS-SCI System may be classified

TS-SCI

Individuals supporting PWS Tasks / Subtasks that require(s) a final Top Secret security clearance and a final IT-I (privileged level systems access) will, immediately upon hire, require Sensitive Compartmented Information (SCI) access eligibility adjudicated by the Defense Intelligence Agency or other federal adjudications facility to perform their duties.

SCI processing for SCI eligibility will be coordinated with the supporting Government Security Manager and will begin immediately upon start of duty performance under this contract/order. The following tasks require SCI: (Reference Table 1 – Security

Requirements)

All SCI* work under this contract/order will be monitored by COR/ACOR.

*The COR/ACOR must be indoctrinated into SCI to monitor the work.

The following positions require a minimum interim Secret security clearance and interim IT-1 eligibility when performance starts.

Project Manager Senior Systems Engineer – TS Program Senior Systems Architect Senior Information Security Lead Senior Network Engineer – TS Program Senior Voice Engineer (VOIP)

12.4 Investigation Requirements: All personnel requiring SCI, TS or IT-I access under this contract/order shall undergo a favorably adjudicated Tier 5 investigation (formerly known as a Single Scope Background Investigation (SSBI)) as a minimum requirement. The Tier 5 will be maintained current within 5-years and requests for Tier 5 reinvestigation (T5R formerly known as Single Scope Background Period Reinvestigation (SBPR) or Phased Periodic Reinvestigation (PPR)) will be initiated prior to the 5-year anniversary date of the previous Tier 5.

All personnel requiring S access under this contract/order shall undergo a favorably adjudicated Tier 3 (T3) Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. The Tier 3 Investigation will be maintained current within 10-years and requests for Secret Periodic Reinvestigations will be initiated by submitting a Tier 3R investigation prior to the 10-year anniversary date of the previous Tier 3 Investigation.

Contractor personnel that do not meet the investigation requirements for Secret IT-I access may be granted such access by the DISA Personnel Security Office (DISA PSO) provided there is no disqualifying information within the adjudicative guidelines that cannot be mitigated. The DISA PSO will request the Contractor personnel complete an Electronic Questionnaire for Investigation Processing (e-QIP). The DISA PSO will review the e-QIP and if there is no disqualifying information, the individual may be eligible for Interim Secret IT-I access. Once favorable results are returned from the Federal Bureau Investigation (FBI) name and fingerprint check, the National Agency Check portion of the investigation is completed favorable, DISA PSO may grant the Interim Secret IT-I provided all other conditions are met. Contract personnel found ineligible for Interim Secret IT-I access will not be allowed to support a DISA contract requiring Secret IT-I access and must wait for final favorable adjudications by the appropriate adjudication facility.

12.5 Adjudication for Secret IT-I access. Favorable Adjudication of any previous T5, T5R, SSBI, SBPR or PPR by any of the DoD Central Adjudication Facility or other federal adjudications facilities within a five-year period will be automatically accepted for final Secret IT-I access.

Prior to granting interim Secret IT-I authorization, the supporting security manager will forward a written request for interim Secret IT-I authorization to DISA PSO for approval. The request for SSBI (e-QIP, FBI name and fingerprint check) must be submitted by DISA PSO to the OPM.

12.6 Visit Authorization Letters (VAL): Visit requests shall be processed and verified through the Joint Personnel Adjudication System (JPAS) to SMO DKABAA10.

(Include other JPAS SMO codes as applicable. A complete list of DISA JPAS SMO codes can be found at https://disa.deps.mil/ORG/MP6/mp61/industrialsecurity/Shared%20Documents/Form s/AllItems.aspx). JPAS visits for contracts/orders are identified as “Other” or “TAD/TDY” and will include the Contract/Order Number and ADP/IT-Access level of the contract/order in the Additional Information section. Contractors that do not have access to JPAS may submit visit authorizations by e-mail in a password protected .pdf to the Contracting Officer Representative (COR) or Alternate COR specified in Section 1.0.

If JPAS is not available, the VAL must contain the following information on company letterhead

• Company name, address, telephone number, facility security clearance

• CAGE CODE

• Contract/Order Number

• Name, SSN, date and place of birth, and citizenship of the employee intending to visit

• Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date, adjudication date & agency, and IT access level)

• Name of COR/Alt COR

• Dates or period the VAL is to be valid

12.7 Security Contacts. DISA Security Personnel can be contacted for Industrial or

Personnel Security related issues at (301) 225-1235 or via mail at:

DISA DISA

ATTN: MP61, Industrial Security ATTN: MP62, Personnel Security Command 6910 Cooper Ave. Building Command Building Fort Meade, MD 20755-7088 6910 Cooper Ave.

Fort Meade, MD 20755-7088

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at the following:

Security Manager Contact Information:

Phone Number:

E-mail:

13.1 Information Security and other miscellaneous requirements: Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the government facility.

Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan;

furthermore, failure to comply with such requirements can be cause for removal and the Contractor will not be able to provide service on this contract/order.

Contractor employees with an incident report in JPAS who have had their access to classified suspended will not be permitted to provide to fill positions requiring access to classified information on a DISA contract/order.

The Contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

DISA retains the right to request removal of Contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

Contractor personnel will generate or handle documents that contain For Official Use Only information at the Contractor and/or Government facilities. Contractor shall have access to generate and handle classified material only at the location(s) listed in the place of performance section of this document. All Contractor deliverables shall be marked in accordance with DoDM 5200.1, Vol. 3, Vol. 4, Information Security, DoD 5400.7-R, Freedom of Information Act Program, unless otherwise directed by the Government. The Contractor shall comply with the provisions of the DoD Industrial Security Manual for handling classified material and producing deliverables. The Contractor shall comply with DISA Instruction 630-230-19.

The Contractor shall afford the Government access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in performance of the contract/order. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of data or to the function of information technology systems operated on behalf of DISA or DoD, and to preserve evidence of computer crime.

13.2 Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government- Furnished Information (GFI): Any GFP, GFE, and/or GFI will be determined at the task order level.

Laptops and Mobile Devices will follow the following GFP process:

The GFP provided to the contractor may include, but is not limited to, laptops and mobile devices to perform the services needed under this contract/order. The contractor shall manage GFP in accordance with Federal Acquisition Regulation (FAR) Part 45 and Defense FAR Supplement (DFARS) Part 245 and associated clauses incorporated in this contract. The contractor shall include a complete list of all GFP within the contractor's Monthly Status Report for verification by the COR and/or Property Administrator. The list shall include Item name, Item Description, NSN, Cage, Part #, Model #, Serial #, UII, QTY, Unit of Measure, Unit Cost, and indication of Use As Is. It is mandatory that the format be completed to the maximum extent possible.

14. 1 Other Pertinent Information or Special Considerations.

(a) Identification of Non-Disclosure Requirements. The Contractor shall have access to information, records, and live data, which may be sensitive and/or proprietary, including information about government files, source selection activities and processes, system vulnerabilities, data processing activities or functions, user IDs, passwords, and other sensitive information. The Contractor shall not divulge information about government files, source selection activities and processes, or any other sensitive information to anyone not authorized to receive such information. The Contractor shall ensure that other persons are authorized to receive sensitive information before releasing it to them. See Section J, Attachment C.4, Non- Disclosure Agreement (NDA), for Contractor Personnel. Unless waived by the Contracting Officer, the NDA must be executed between the Contractor employee and the Government before the employee has access to government furnished information. The Contractor is responsible for identifying that all personnel, to include any new personnel on the contract, have executed the DISA-provided NDA in the Monthly Status Report, applicable at the task order level.

(b) Packaging, Packing and Shipping Instructions. Will be determined at the task order level.

(c) Inspection and Acceptance Criteria. Will be determined at the task order level.

(d) Property Accountability. Will be determined at the task order level. For all applicable task orders, the Contractor shall submit the attached Electronic Product List (see Section J, Attachment C.2) in addition to complying with all requirements of DFARS 252.211-7003.