Bidders Library Ref - BSA PWS.pdf

Defense Threat Reduction Agency (DTRA)

Balanced Survivability Assessment (BSA) Performance Work Statement (PWS)

04 April 2019

Revision 01 - 06 March 2020

1. BACKGROUND/INTRODUCTION

The Defense Threat Reduction Agency (DTRA), Nuclear Enterprise Support Directorate (NE), Mission Assurance Department (MA) performs integrated, multidisciplinary, Balanced Survivability Assessments (BSAs) that assess survivability of critical U.S. and allied national/theater mission systems, networks, architectures, infrastructures, and assets.

BSA teams aim to ensure continuity to DoD missions and critical infrastructure by assessing the vulnerabilities and survivability of these infrastructures against a broad spectrum of threats including accidents, natural disasters, technological failure, information system attacks, terrorists, radio frequency weapons (RFW), sabotage, and weapons of mass destruction (WMD).

These assessments are generally requested by the DoD Chief Information Officer; Combatant Commands (CCMDs); Undersecretary of Defense Acquisition and Sustainment (USD(A&S));

Undersecretary of Defense Intelligence (USD(I)); Defense Information Systems Agency (DISA);

and other Department of Defense (DoD) and Federal agencies, and are coordinated through the Joint Chiefs of Staff and DTRA.

2. APPLICABLE DOCUMENTS (and as amended)

2.1 DoDD 5105.62: Defense Threat Reduction Agency

2.2 DoDD O-5100.30: DoD Command and Control

2.3 DoDD O-5100.44: Defense and National Leadership Command Capability (DNLCC)

2.4 DoDD 3020.40, Mission Assurance

2.5 DoDD 5105.62, Defense Threat Reduction Agency

2.6 DoDD 3020.26, DoD Continuity Programs

2.7 DoDD 3020.44, DoD Policy & Responsibilities for Critical Infrastructure Protection

2.8 DoDD S-5210.81, US Nuclear Weapons Command and Control, Safety, and Security

2.9 DoDI 3000.08: Balanced Survivability Assessments (U/FOUO)

2.10 DoDI 2000.16, DoD Antiterrorism Standards

2.11 DoDI 6055.17, DoD Installation Emergency Management Program

2.12 DoDI 3020.52.17, DoD CBRNE Preparedness Standards

2.13 DoDI 2000.12, DoD Antiterrorism Program

2.14 DoDI 3020.39, Mission Assurance for DIE

2.15 DoDI 3020.45, Mission Assurance Construct

2.16 DoDI 5200.08, Security of DoD Installations and DoD Physical Security Review Board

2.17 DoDI 8500.01, Cybersecurity

2.18 DoDI 8510.01, Risk Management Framework for DoD Information Technology

2.19 DoD 5200.08-R, CH-1, Physical Security Program

2.20 CJCSI 5119.01B, Charter for Centralized Direction, Management, Operation, and

Technical Support of the Nuclear C3 System

2.21 DTM 09-12, Interim Policy Guidance for DoD Physical Access Control

2.22 National Military Command System Concept of Operations

3. SCOPE

In order to ensure continuity of DoD Missions and to maintain continuous operations of critical infrastructure, it is imperative to have fully functional BSA teams (1) to conduct Blue Team Assessments; (2) to provide specific SME assistance to Technical Support Projects (TSPs); and (3) to provide Design Review assistance. The size and skillsets of each team will vary and include those required to execute each mission. The resource needs of each mission and/or stakeholder request will be identified and managed by DTRA.

BSAs are conducted in accordance with (IAW) DoDI 3000.08 BSA to identify system vulnerabilities in strategic systems and/or architectures. Components of these assessments include but are not limited to examining surveillance operations, physical security, telecommunications (e.g., video, voice and data, commercial and military), information operations (e.g., computer networks, IA tools use, operations security), structural protection and response (to include blast effects modeling and consideration of anti-terrorism/force protection standards), utility subsystems (e.g., power and heating, ventilation, and air conditioning reliability and endurance), weapons of mass destruction protection, emergency operations (e.g., emergency preparedness, fire protection, emergency response, disaster control and recovery, continuity of operations), and electromagnetic protection (e.g., electromagnetic pulse and radio frequency weapon susceptibility, lightning protection). The BSA mission, by necessity, is fluid and requires the teams operating within these environments to be adaptable.

BSA teams may be deployed to high-threat but permissive environments anywhere in the world.

The Contractor shall ensure that all on-site personnel assigned to this contract are ready to begin work within 45 days of contract award. The Contractor shall provide support to the NE-MA Department by attending and participating in all Department, Directorate, and Agency trainings, meetings, or other efforts to enable the Department, Directorate, and Agency to align its missions.

The Contractor personnel must be ready to brief, present or collaborate on its area of expertise.

4. BALANCED SURVIVABILITY SUPPORT

The Contractor shall provide adequate personnel with the requisite skills, certifications and/or licenses, in order to maintain fully operable BSA teams to accomplish the mission as defined in DoDI 3000.08. BSA Teams consist of a mix of contractor personnel and Government personnel.

The Contractor is responsible for ensuring that its personnel are cleared at the TS/SCI level, ready to be in-processed, and ready to begin training/certification to be a BSA Team assessor. The Government must be prepared to adapt to the changing needs of the environments and the threats to critical infrastructure.

All Contractor personnel must possess knowledge, skills, and abilities to ensure well-balanced, safe operations of all missions and taskings of the BSA team. At a minimum, personnel shall have knowledge and understanding of the following:

Antiterrorism Force Protection Program and surveillance procedures against US personnel while deployed in an OCONUS environment.

Understanding of foreign Intelligence Collection against US Personnel.

Furthermore, for each of the missions, the Contractor shall provide an out-brief that describes the mission, the methodology used for its assessments and analysis, an initial list of findings and assessment, and an initial list of recommended actions. The final briefing shall be tailored to each end-user’s needs.

4.1 BLUE TEAM BSA

The Contractor shall provide personnel for the execution of each BSA mission. The Contractor is responsible for providing its personnel all logistics and any ancillary support required to accomplish the mission. The size and make-up of each BSA team will be determined by the DTRA Team Chief (TC). Each BSA will be conducted using a three phased approach:

4.1.1 Phase I: Pre-Assessment

The Contractor personnel shall acquire as complete an understanding as possible of the mission by reviewing all available information and identifying any other available information or uncertainties in order to properly scope the assessment.

The BSA team will be required to conduct a pre-site survey (PSS) approximately one month prior to the beginning of Phase II. Contractor personnel will be required to travel and participate in the PSS as part of Phase I. Tasks performed in this phase include:

Conduct open-source research regarding the mission Perform mission analysis Conduct BSA team Mission Brief Conduct the PSS Review documents Review drawings Develop the Target Intelligence Packet (TIP) Determine applicable threats and hazards

4.1.2 Phase II: Assessment

During the assessment phase, team members gather information, perform initial analysis, conduct on-site assessments, and assist with any documentation necessary for this Phase. The additional tasks performed in this phase include:

Validate key data Conduct interviews Review documents Review drawings Develop understanding of systems Identify vulnerabilities Verify information Recommend improvements, or other actions to strengthen the infrastructure Review data with site Out-brief the end-user and DTRA of the initial assessment and findings

4.1.3 Phase III: Post-Assessment

The Contractor personnel shall support the Government in the preparation of the Final Assessment Report. The Final Assessment Report shall be submitted not later than 60 days after the completion of Phase II and will comply with the process outlined in NE-MAB Division SOPs. The Contractor shall also provide technical support as required to implement the list of recommended actions, including any mitigation tasks identified by DTRA.

4.2 TECHNICAL SUPPORT PROJECTS

The Contractor shall provide personnel to perform Technical Support Projects (TSP) as identified by the DTRA Program Manager (PM) or the DTRA BSA Division Chief / TC. TSPs are projects resulting from specific requests from end-users or other stakeholders to DTRA and can take many forms including short studies conducted by a single specialist, studies involving several specialists, and studies or limited assessments accomplished by a team of SMEs/specialists. All TSPs, and TSP participants, will be coordinated and led by a government TC or other government representative. Tasks performed under the TSP include, but are not limited to:

4.2.1 Gathering information, performing initial analysis, conducting any necessary on-site assessments and providing a “roll up” analysis. The Contractor shall prepare and submit any required briefings and reports related to the appropriate TSP activities.

Briefings and reports must address the TSP focus statement and any work plan identified at the beginning of the project.

4.2.2 Briefing the end-user or stakeholder of findings.

4.2.3 The Contractor shall also provide technical support as required to implement the list of remedial actions, including any mitigation tasks identified by DTRA.

4.3 DESIGN REVIEWS

The Contractor shall provide personnel to perform Design Reviews as identified by the DTRA PM or the DTRA BSA Division Chief / TC. Design Reviews vary from a single specialist to an entire BSA team reviewing new construction or renovation drawings to ensure mission survivability design practices are included.

4.3.1 The Contractor shall review and analyze the design. The Contractor shall provide comments and feedback addressing the assessment of the design as specified above. The Contractor shall prepare and submit any required briefings and reports related to the Design Review. Briefings and reports must address the Design Review focus statement and any work plan identified at the beginning of the project IAW the DTRA BSA Standard Operation Procedure (SOP).

4.3.2 The Contractor shall also provide technical support as required to implement the list of remedial actions, including any mitigation tasks identified by DTRA.

4.4 BSA TEAM STANDARD OPERATING PROCEDURES

The Contractor shall assist in updating the DTRA BSA Team’s SOPs bi-annually or as required by providing feedback, comments, and recommendations to the DTRA PM or the DTRA BSA Division Chief / TC.

5.0 PROVIDE PROGRAM SUPPORT

The Contractor shall actively manage this contract by coordinating closely with the DTRA COR and DTRA PMs. As part of its management, the Contractor shall submit monthly progress reports in accordance with CDRL A001. The Contractor shall submit all reports on-time and with strict adherence to the instructions specified in each CDRL. At the COR’s request, the Contractor shall review statuses on any open task or assignment and travel reports with the COR.

5.1 PLACE OF PERFORMANCE

The Contractor is responsible for providing services to DTRA at the Fort Belvoir, VA and Crystal City, VA location or other location as the mission requires. On Federal holidays or when DTRA is closed for business due to local or national emergencies, administrative closings, or similar Government directed closings, the Contractor is not expected to report to DTRA unless the mission requires performance. When DTRA is open for business but the DTRA facility is closed, the Contractor may conduct business offsite as directed by the DTRA COR. The Contractor will have access to the facility 24 hours a day, seven days a week but must coordinate reporting times and dates with Government personnel prior to reporting to the building outside of normal business hours. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks identified within this PWS when the Government facility is not closed for one of the above reasons.

5.2 RECRUITMENT, RETENTION, REPLACEMENT, AND PERSONNEL PLAN

When hiring personnel, the Contractor shall keep in mind that stability and continuity of the workforce are essential. The Contractor shall establish a transition plan for its personnel to ensure a seamless transition between in-coming and out-going contractor personnel. The Contractor shall also maintain a Personnel Recruitment, Retention, and Replacement plan to ensure that it remains agile and ready to meet the BSA mission requirements. All personnel shall possess all the required qualifications enumerated in Appendix 1.

The Contractor shall replace lost personnel within 45 days.

Some of the on-site personnel assigned to this contract are considered to be essential to the work being performed hereunder and are considered to be Key Personnel as specified in Section H of the contract (to be provided after award of the contract). Prior to removing, replacing, or diverting assigned Key Personnel, the Contractor shall notify the COR as soon as practicable of any departures. No Key Personnel substitutions or replacements shall be made by the Contractor without the prior written consent of the COR. The Government reserves the right to review qualifications of each substitution or replacement prior to consenting to the substitution or replacement.

5.3 TRAVEL

The Contractor personnel shall travel both CONUS and OCONUS in support of the DTRA NE- MA mission and in execution of the requirements of this PWS. When traveling to locations designated by the Department of State as a danger/hazard pay post, the Contractor shall allocate the cost of the danger/hazard pay, consistent with the allowances provided by the Department of State, to the Travel CLIN on this contract.

5.3.1 All travel must be compliant with the Joint Travel Regulations (JTR) unless otherwise specified by the COR. The Contractor shall follow CDRL A002 for submittal/approval of all proposed and actual travel.

5.3.2 The Contractor shall at all times use reasonable efforts to pursue the most economical travel arrangements and minimize the cost of travel.

5.3.3 The Contractor shall coordinate closely with the COR to arrange travel overseas, specifically when contractor personnel are to fall under a Status of Forces Agreement (SOFA) or other host nation agreements and/or when Synchronized Pre-deployment & Operational Tracker (SPOT) requirements are triggered. The Contractor shall comply with all requirements of the SPOT clauses included in the contract in a timely manner.

5.3.4 The contractor employees shall comply with all DTRA mandatory travel reporting policies.

5.4 GOVERNMENT FURNISHED PROPERTY OR EQUIPMENT (GFP/GFE)

Contractor personnel performing work under this contract on-site will be provided with a Government workspace, a laptop, computer peripheries, Common Access Cards (CACs), DTRA e-mail accounts, access to Government file servers while off-site, and office supplies. However,

5.4.1 The contractor personnel shall not use Government furnished equipment (GFE) for personal use. GFE may only be used by the Contractor for the execution of the tasks specified in this contract.

5.4.2 The Contractor shall submit requests for replacement of GFE to the COR for processing. Lost or stolen GFE shall be verbally reported immediately, and followed up in writing within 24 hours of incident to the COR.

5.4.3 The Contractor shall submit a Master Government Property List (MGPL) IAW CDRL A003 and the contract clauses.

Any accommodations not identified in this section are the responsibility of the contractor for their personnel.

5.5 TRAINING

The Contractor shall comply with and attend all DTRA mandatory training requirements including deployment readiness training, security training, computer-based training, and quarterly and annual department training. Furthermore, the Contractor shall ensure that personnel assigned to this contract complete any and all specialized training in order to maintain professional expertise and certifications in SME functional areas. The Contractor shall maintain and keep updated training records, including certifications, for all personnel assigned to this contract for the duration of the contract. Additionally, the contractor shall identify certifications attained and schools/conferences attended to maintain required professional expertise in the Monthly Status and Progress Report. Contractor personnel assigned to this contract will support and participate in MA Department Training as directed by the Mission Assurance Department Chief and/or the DTRA COR.

5.6 SECURITY

The Contractor shall possess a DOD TOP SECRET clearance with an SCI caveat Facility Clearance.

Contractor employees working on this program must be U.S. citizens and will require a DOD TOP SECRET clearance with an SCI caveat granted by the Defense Security Service (DSS). Clearances must be in place prior to contract award. A Visit Authorization Letter (VAL) must be provided for each contractor employee working on this contract who will require access to any DTRA site. The VALs for collateral security clearance shall be submitted in JPAS, contain the information specified in paragraphs 6-103, 6-104 and 6-105 of the National Industrial Security Program Operating Manual (NISPOM), and be submitted to the DTRA Security Support Branch (Visitor Control). The term of the VAL shall be for the term of the contract. The Contractor shall provide proof of U.S. citizenship for all contracted employees prior to entering the DTRC. The contractor shall comply with all terms of the DD 254, the NISPOM, the DoD 5220.22-M, NATIONAL INDUSTRIAL SECURITY PROGRAM, and any revisions to that manual. The contractor shall provide all forms and information, apply for clearances, and be responsible for any expense incurred in obtaining TOP SECRET/SCI security clearances for the contractor employees.

5.6.1 The contractor will produce some SECRET and/or TOP SECRET documents. The contractor shall comply with all DoD requirements for marking, handling, storing and transporting classified documents, working papers, notes, media, etc. (herein referred to as documents) while in the possession of the contractor. This includes any document the contractor may generate in performance of this contract.

5.6.2 The contractor shall demonstrate sound and proven OPSEC practices, ensuring unclassified/sensitive information will be properly protected at all times, and abide by all DTRA OPSEC policies.

5.6.3 The contractor shall adhere to all facility access control policies and procedures.

Contractor personnel shall wear security identification badges at all times while in DTRA facilities, as access cards and Identification Cards (IDs) are presented upon request at all entry control points. Lost or stolen IDs or badges shall be verbally reported immediately and followed up in writing within 24 hours of incident to the

DTRA COR.

5.6.4 The contractor must be responsible for safeguarding all Government property provided for contractor use. At the end of each work period, all Government property, equipment, and materials must be secured.

6. PERFORMANCE REQUIREMENTS SUMMARY

The contractor service requirements specified above are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success. Contractor service requirements, performance metrics, and remediation plans are provided below.

PWS

Section

Performance Objective

Performance Threshold

Method of Surveillance

Incentive/Disincentive

Section 4 Perform all tasks specified in Section 4 without interruption.

Tasks and deliverables are completed 100% of the time with accurate and complete information.

100% review and inspection of documents submitted, and daily surveillance of performance.

If Contractor meets or exceeds the performance threshold, it will:

(i) contribute to a positive Schedule rating in

CPARS.

(ii) increase likelihood of option exercise.

If Contractor does not meet contract performance, remedies at FAR Clause 52.246-4 will be pursued, and/or likelihood of option exercise will be decreased.

Section 5 Provide sufficient personnel to perform all tasks specified in Section 4 without interruption.

Replace any departing personnel within 45 days.

Onsite surveillance.

Section 5 The Contractor shall keep current all required certifications to perform the duties/roles of the appropriate LCAT.

At all times, the Contractor shall ensure its on-site personnel maintain and keep current all certifications.

Review of Progress Reports.