Attachment_3_-_DTRA_ITSS_PWS_for_Task_Order_2_-_Cybersecurity_Support_Services_Final_Draft.docx

DTRA Agency-Wide Information Technology Support Services Core IT Services Contract –

HDTRA1-18-R-0002

DRAFT Performance Work Statement (PWS) for Task Order 2; Cybersecurity Support Services

1. Introduction: This PWS provides agency-wide cybersecurity support services to ensure DTRA and its partners have secure and efficient IT capabilities and services necessary to perform the critical DTRA mission, and compliant with DoD mandates and INFOCON requirements.

1.1. Mission: The DTRA mission is to safeguard the United States and its allies from global weapons of mass destruction and improvised threats by integrating, synchronizing and providing expertise, technologies and capabilities. The DTRA Information Integration and Technology Services Directorate (I2TS)/Chief Information Officer’s (CIO) mission is to provide the IT services and capabilities necessary for DTRA’s business and mission functions and support transforming how the agency uses knowledge, technologies, and capabilities to meet the DTRA mission.

1.2. Background: The I2TS is responsible for providing Agency-wide information management services, supporting in excess of 5,000 world-wide Agency customers utilizing Unclassified, Secret, and Top Secret/Special Compartmented Information (TS/SCI) Networks (for a more detailed description of the current networks see Attachment 1). DTRA personnel supporting the Agency’s mission require common IT services in areas such as, but not limited to, help desk support, systems administration, networks and application administration and design, engineering, and architecture development and implementation. Although the functional requirements are similar across the DTRA mission, the activities involved vary widely by specific mission area. Various short and long-term efforts must be undertaken to continually modernize, integrate and secure functions and systems. Continuous IT support must meet the needs of the Agency and other internally (including JIDO) and externally supported customers to include first responders, Combatant Commands (COCOMS) and other U.S. Government entities. The intent is to provide seamless and integrated communications among all supported elements, for the purposes of office automation, data collaboration and knowledge management, support of exercises, experimentation and operational support across three principle security domains: Sensitive but Unclassified (SBU), Secret and Top Secret/SCI. The DTRA mission supports a diverse set of customers and unique mission requirements. As the organization evolves, the demands on information technology (IT) and associated cybersecurity controls increase accordingly.

1.3. Scope: In support of the DTRA mission and CIO priorities, the contractor shall provide the full range of cybersecurity support services (to include, information assurance (IA) planning, computer network defense (CND)). The goal is to provide an integrated delivery of cybersecurity services and solutions to support IT requirements across the agency. The contractor shall strive to improve the confidentiality, availability, and integrity of DTRA IT systems, modernize the security infrastructure to maintain and improve compliance with DoD mandates and INFOCON requirements.

2. Applicable Documents: The contractor shall comply with all documents listed below as “Mandatory”. Documents listed as “Non-Mandatory” are provided as information only and for use at the contractor’s discretion.

2.1. Mandatory Documents: (updated versions may be applicable)

2.1.1. DoD IT Security Regulation

2.1.2. DTRA Security Regulation

2.1.3. DoDI 8500.01, Cybersecurity

2.1.4. DoDI 8510.10, Risk Management Framework (RMF), Change 1

2.1.5. NIST Special Publication 800-53, Version 4, Security and Privacy Controls for Federal Information Systems and Organizations

2.1.6. CNSSI No.1253, Security Categorization and Control Selection for National Security Systems

2.1.7. DoDD 8140.01, Cybersecurity Workforce Management

2.1.8. DOD 8570.01M, Information Assurance Workforce Improvement Program

2.1.9. DTRA/SCC-WMD Directive 8570.01, Information Assurance Training, Certification, and Workforce Management

2.1.10. Standard Operating Procedure (SOP) – 8570 Compliance

2.2. Non-Mandatory Documents:

2.2.1. DTRA Strategic Plan

2.2.2. DTRA J6, CIO Information Operations Strategic Plan 2017 - 2020

2.2.3. DTRA Cloud Strategy

3. Performance Requirements: This section of the PWS defines the performance requirements and results against which the government intends to measure the contractor’s performance. These performance requirements address the full scope of this task order and support the higher-level goal stated in paragraph 1.3 above. They provide the full range of support actions and resources necessary to improve the confidentiality, availability, and integrity of DTRA IT systems, modernize the security infrastructure, and to maintain and improve compliance with DoD mandates.

3.1. Performance Requirement #1, Task Order Management. The contractor shall provide the necessary resources to effectively oversee the performance of all requirements defined in this task order. Within this responsibility, the contractor shall develop and implement a quality control and management oversight plan to effectively manage the staff and the performance per the standards established herein. The contractor shall plan for surge support requirements associated with unforeseen incident resolution, inspections, audits, and exercises. The contractor shall develop and deliver a monthly status report (MSR) per CDRL A001. Performance measures for this requirement are defined in the Performance Requirements Summary (PRS) in Section 5 below and include timeliness of staff on-boarding, timeliness of deliverables, and consistency in meeting other performance measures within this task order.

3.2. Performance Requirement #2, Information Assurance (IA) Policy and Planning. The DTRA Senior Information Security Officer (SISO) serves as the focal point and principal advisor for all DTRA information technology matters on behalf of the CIO to ensure compliance with overarching cybersecurity regulations. The SISO also serves as the Authorizing Official for DTRA systems. In support of the SISO, the contractor shall coordinate DTRA's IA tasks, controls, and activities in accordance with Agency and DoD policies. This task includes such activities as IA policy review, interpretation, and applicability, IA policy development, strategic planning, and policy rollout, IA compliance tracking, enforcement, and reporting. (CDRL A006) This task also includes additional tasks to include Authorizing Official Designated Representative (AODR) support to include risk assessment, risk management, POA&M management and tracking. Performance measures for this requirement are defined in the PRS below and focus on xxxxx.

3.3. Performance Requirement #3, Assessment and Authorization Support Services. In direct support of the DTRA J6 Authorizing Official, the contractor shall assess all DTRA networks, communication conduits, systems, devices, and applications to ensure DTRA personnel, data and operations remain secure thereby enabling the accomplishment of DTRA's mission to detect and deter the use of weapons of mass destruction. Performance measures for this requirement are defined in the PRS below.

3.4. Performance Requirement #4, Security Test & Evaluation / Continuous Monitoring. In support of the DTRA I2TS IOC Cybersecurity department, the contractor shall evaluate, track, and assure the security posture of DTRA systems to achieve compliance with Agency and DoD system requirements, Command Cyber Readiness Inspection (CCRI), Authority to Operate (ATO), Annual Security Review (ASR), and Technical Security Review (TSR). This task includes the continued transition and implementation of DoDI 8510.01 Risk Management Framework (RMF). Technical analysis and recommendations shall be documented and delivered per CDRL A003. Performance measures for this requirement are defined in applicable DoD Instructions/Regulations.

3.5. Performance Requirement #5, Cross-Domain Solutions. The contractor shall provide the full range of resources and services necessary to support the secure transfer of data between different security domains and provide multi-network access solutions that allow analysts to view multiple networks of different security levels from a secure workstation. The DTRA Cross Domain Support Element (CDSE) interprets mission requirements and works with the enterprise cross domain solution providers to fulfill these needs. Technical analysis and recommendations shall be documented and delivered per CDRL A003. Performance measures for this requirement are defined in the PRS below and focus on xxx. (Seeking contractor input for meaningful metrics in this area)

3.6. Performance Requirement #6, Supply Chain Risk Management. In support of the DTRA J6 IOC Cybersecurity department, the contractor shall review and incorporate protective measures during the acquisition planning process, and implement agency security practices throughout the lifecycle of IT systems, to minimize and mitigate risk and vulnerabilities in government information and communications technology (ICT) systems. Performance measures for this requirement are defined in the PRS below and focus on xxx. (Seeking contractor input for meaningful metrics in this area)

3.7. Performance Requirement #7, Cybersecurity Service Provider (CSSP) Support Services. In support of the DTRA I2TS IOC Cybersecurity department, the contractor shall provide the required resources and expertise to monitor computer network defense services in a manner that effectively safeguards the confidentiality, integrity, and availability of DTRA-supported network environments and Information Technology infrastructure. The contractor shall provide the required resources and expertise to ensure compliance with DoD CSSP Evaluators Securing Metrics (ESM). The contractor shall provide support within the existing CSSP structure which includes four simultaneously running processes tooled to assist and defend the system subscriber. These processes include a Protect Team, a Detect Team, a Response Team, and a Sustain Team.

3.7.1. The Protect team serves as the Subscriber Cybersecurity Liaison and provides dedicated IA support. Specific CSSP Protect services include:

· Vulnerability Analysis and Assessments (VAA) (Regular Assured Compliance Assessment Solution (ACAS) or other tool reporting verification and high level guidance)

· Coordinates external Blue/Red Team assessments

· Conducts Blue Team, vulnerability, and compliance assessments.

· Vulnerability Management (VM) (Liaise and coordinate, Regular validation and high level guidance)

· Virus/Malware Protection (Regular validation and high-level guidance)

· Information Operations Condition (INFOCON)/Cyber Protection Condition (CPCON) (Regular validation and high-level guidance)

· Service Level Agreement (SLA) monitoring and support

· Customer Outreach and product development

· Plan for and conduct annual internal CSSP ESM compliance assessments. The first annual audit shall be completed no later than, 90 days after contract award.

3.7.2. The CSSP Detect Team continuously monitors the DTRA enterprise network for unauthorized activity. Performs all source cyber threat research and analysis. Performs tending and analysts of the security posturer of the agency and its subscribers. Performs proactive “hunting” for cybersecurity vulnerabilities and areas of concern.

3.7.3. The CSSP Response Team supports incident response, analysis, and reporting as appropriate to the Tier I US CyberCom and DTRA Leadership. (CDRL A006)

3.7.4. The Sustain Team maintains the integrity and security of the CSSP SecureNet enclaves and associated security tools, to include ArcSight (ESM and Logger), Splunk, Bro, Symantic, Cisco Firepower, security enclave, network taps, Sidewinder firewalls, etc., and ensures compliance with the new Risk Management Framework (RMF) requirements.

3.7.5. Performance measures for this requirement are defined in the PRS below and focuses on consistent compliance to cybersecurity standards and passing all DoD CSSP Evaluators Securing Metrics (ESM) reviews. The next re-certification will occur 3rd Quarter FY19.

3.8. Performance Requirement #8, Promoting Cybersecurity throughout the Agency Workforce. Working with and in support of the DTRA I2TS IOC Cybersecurity department, the contractor shall develop and implement strategies and programs to ensure employees in cybersecurity/IA roles, Computer Network Defense (CND) roles, and any positions requiring privileged access remain in compliance with DoD Directive 8140.01, "Cyberspace Workforce Management". This task includes maintaining, revising and making available requisite cybersecurity training in alignment with end user position requirements and designated IA workforce levels. The contractor shall also ensure appropriate measures are available to efficiently track DTRA end-user compliance with required cybersecurity training. (CDRL A005) Performance measures for this requirement are defined in applicable DoD Instructions/Regulations.

3.9. Performance Requirement #9, Communication Security (COMSEC). The contractor shall provide the full range of network engineering, administration and Communications Security (COMSEC) management and administration support for the Agency network domains and architectures from the Unclassified level up through Top Secret SCI, to include 24x7 support as defined by the Agency. Performance measures for this requirement are defined in applicable DoD Instructions/Regulations.

3.10. Performance Requirement #10, Procurement. The contractor shall procure security response items and/or mission critical items that are in-service and fail/failing or are deemed by the I2TS/Agency to be immediate response requirements. Network monitoring equipment/sensors, security response items are used to ensure continuous and uninterrupted CND operations. Fail or Failing items are defined as mission critical components that have failed or are in a non-repairable status that poses imminent risk of near-term failure and poses a critical risk to Agency mission. Immediate response requirements are items that may be required to immediately secure Agency supported (may be a customer/subscriber) systems against a previously unknown threat. Any procurement under this CLIN will be authorized by the Contracting Officer and approved by the COR.

3.11. Performance Requirement #11, Task Order Transition In. The contractor shall plan for and execute a transition-in strategy to provide for the on-boarding of appropriately qualified personnel, with the required DoD security clearances and eligibilities, needed to support a smooth and seamless transition from the incumbent support team to “full performance” within 60 calendar days of task order award. Transition-in includes all staffing activities, as well as the necessary knowledge transfer and capture to ensure “work-in-progress” is smoothly transitioned, and mission support is not interrupted. Performance measures for the first 60 days will be recorded and reported for monitoring purposes, but they will not be used as performance indicators until the completion of the 3rd month of performance. The exception to this suspension of performance measures will be measures associated with this transition-in requirement. The performance measure for this requirement is defined in the PRS below and focuses on the on-boarding of support staff per the transition-in plan included in the contractor proposal.

3.12. Performance Requirement #12, Task Order Transition Out. The contractor shall plan for and support the smooth and seamless transition-out at the end of the performance period. The contractor shall develop and deliver a transition-out plan (CDRL A004) defining their knowledge transfer plan with specific emphasis on transiting work-in-progress. The contractor shall coordinate with the incoming workforce (government or contactor) as necessary to enable a seamless transition with minimum interruption of mission support. The contractor shall remain accountable for performance consistent with the PRS below until the end of the contract period of performance.

4. Deliverables: In support of the requirements in this PWS, the contractor shall develop and deliver a variety of reports, analyses, recommendations, and plans. The specific requirement for content, format, and delivery timing for each deliverable is defined in the Contract Data Requirements Lists (CDRL; DD Form 1423) which will be specifically associated with the PWS paragraph for the corresponding work scope. Unless specifically stated otherwise in the CDRL, all deliverables shall be submitted electronically in either a MS Office compatible or PDF format. The specific format for each deliverable shall be at the contractor’s discretion unless otherwise specified in the CDRL. The following table summarizes the contract deliverables associated with this PWS.

4.1. Deliverables Summary Table

5. Period of Performance. The period of performance will be one base-year with four one-year options.

5.1. Base: Task order award + 12 Months

5.2. Option 1: To be specified at award

5.3. Option 2: To be specified at award

5.4. Option 3: To be specified at award

5.5. Option 4: To be specified at award

6. Support Hours The contractor shall provide support during the core Government hours 52 weeks a year. The standard schedule must encompass the DTRA core hours of 9 AM to 3 PM (0900 – 1500). Additionally, the contractor may be required to provide support outside of standard hours based on loss of service and mission impact or Agency need. The CSSP support services (paragraph 3.7) are 24x7x365 requirements. Standard work hours shall be Monday through Friday during normal duty hours except for the following Federal Holidays:

7. Place of Performance/Travel

7.1. Place of Performance: Currently the majority of these tasks are performed at the Defense Threat Reduction Center, 8725 John J. Kingman Road, Fort Belvoir, VA 22060-6201, however; DTRA maintains a global mission and contractor personnel may be required to work at locations other than the NCR. DTRA relies on distributed operations between the NCR and DTRA Albuquerque, NM. As DTRA becomes more virtualized, and physical space within the DTRA facilities become a premium commodity, support and operations from locations other than DTRA may be necessary to reduce the physical contractor onsite footprint. For situational reasons, contractor personnel may work at an alternate location/worksite using Government Furnished Equipment (GFE) with COR approval.

7.2. Travel may be required based on Agency requirements to any DTRA facility world-wide. The Contractor shall provide a detailed estimate of any desired travel in advance to the COR via memorandum or email. Travel costs shall not exceed on a daily basis the maximum per diem rates in effect at the time of travel as set forth in the Federal Travel Regulation. All travel shall be approved by the COR in writing via memorandum or e-mail prior to the contractor incurring any travel expenses and prior to any departure.

8. Security: (Reference DD Form 254, DoD Contract Security Classification Specifications) The contractor employees working on this program must be U. S. citizens, and they will require a minimum of a DoD SECRET clearance in order to provide the required support. Selected individuals may require Top Secret or higher clearances (SCI Access). Rationale: All employees performing services on this contract have the potential to access classified systems up to TS-SCI (JWICS) as a normal requirement in the performance of their duties.

The contractor shall comply with the Security Agreement (DD Form 441) including the National Industrial Security Program Operating Manual (NISPOM) and any revision, notice of which has been furnished to the contractor. The contractor's employees performing work under this contract shall be U.S. citizens and be granted appropriate security clearances based on the need for access to specific classified information. That is SECRET clearance based on favorably adjudicated National Agency Check with Law and Credit Check (NACLC) or a TOP SECRET clearance based on Single Scope Background Investigations favorably adjudicated by the Defense Security Service, Defense Industrial Security Clearance Office.

All contractors in privileged user positions must have a completed single scope background investigation (SSB I) in accordance with DODI 8500.2 prior to filling the position. Privileged users are defined as, but not limited to, persons in the following roles or positions: Information Assurance Managers/Officers, supervisors of IT positions, systems administrators, and maintainers of IA-enabled products.

In support of this task order it is anticipated that up to 75% of staff will require TS/SCI clearance within 6 months of contract award.

9. Government Furnished Property, Equipment or Material (GFP/GFE/GFM) The Government will provide office space, desks, computers, use of telephone, copiers, faxes, paper, and other administrative materials on-site for personnel assigned to this task order.

9.1. Government Furnished Property for Contractor Use

DTRA may provide Government equipment to the contractor for use offsite. The contractor shall comply with the contract clauses for accountability of Government Property in the possession of contractors.

The contractor shall update the Master Government Property List (MGPL) when any new equipment is issued to the contractor by the government. (The MGPL shall include all equipment/property provided to the contractor, including equipment transferred between projects, broken and obsolete equipment, and items purchased outside the United States. The MGPL shall be delivered electronically in a spreadsheet using Microsoft Office Excel. Abbreviations are not allowed. Ninety (90) days prior to contract expiration, the Contractor shall submit a final MGPL suitable for close-out purposes containing use/disposition recommendations. (CDRL A007)

10. Section 508 Contract Data Requirements List (CDRL) deliverables, in Section 4 above, should meet applicable accessibility requirements and should not adversely affect accessibility features of existing EIT technologies. Information, documentation, and support requirements from 36 CFR part 1194 Subpart D have been determined to apply to this acquisition. Solicitation respondents must describe how the information, documentation, and support proposed for Contract Services deliverables will meet at least those information, documentation, and support requirements identified as applicable in the attached Government Product/Service Accessibility Template (GPAT).

Task Order 2; DRAFT PWS for Cybersecurity Support Services (DRAFT 2017 12 05)

11. Performance Requirements Summary (PRS)

After the initial transition period, the contract shall ensure staffing is available as required to meet performance requirements, and unplanned staff vacancies are held to a minimum.

Staff Transition Metric = # of planned staff positions fully on-boarded at DTRA / # of staff positions scheduled to be onboarded at end of performance period.

Average Staff Availability Metric (Key Personnel) = (Total hours accumulated within period for Key Personnel) / (# of key personnel positions X available workhours in period) Average Staff Availability Metric (Non-Key Personnel) = (Total hours accumulated within period for Non-Key Personnel) / (# of key personnel positions X available workhours in period) 1st Month AQL > 85% 2nd Month AQL > 95% 3rd Month AQL > 98%

Metric begins after transition period AQL for Key Personnel > 95%

AQL for Non-Key Personnel > 90% Data will be collected from Monthly Status Report and compared to Staffing Plan in the Proposal. Metrics will be as of the cut-off date of the MSR. Metric can be validated using DTRA security records.

Data will be collected from MRS and will be as of the cut-off date of the MSR for each period.

NOTE: on-time deliverable assumes the item is accepted as compliant by the government reviewer. A rejected deliverable will be withdrawn from the delivered count and the metric will be recalculated.