HPCS PWS.pdf

PERFORMANCE WORK STATEMENT

HYDROPOWER CONTROL SYSTEM MAINTENANCE

1. GENERAL

The Contractor shall provide non-personal services to the Government for the purposes of maintaining a secure and proper functioning hydropower control system (HPCS) utilized at the Harry S. Truman and Stockton Power Plants.

2. LOCATIONS AND WORK HOURS

The Harry S. Truman Power Plant is located in Warsaw, MO, and the Stockton Power Plant is located in Stockton, MO. Onsite work will occur at both locations, the schedule to be determined. Acceptable onsite work hours are 06:00 to 16:30, Monday thru Friday, excluding Federal holidays. Work hours may be adjusted with approval of Contracting Officer’s Representative.

3. REFERENCES

The publications listed below form a part of this section to the extent referenced. The publications are referred to within the text by the basic designation only.

DOD Directive 8140.01 (2015) Cyberspace Workforce Management

DOD 8500.01 (2014) Cybersecurity

DOD 8510.01 (2014; Change 1-2016) Risk Management Framework (RMF) for DoD

Information Technology (IT)

DOD 8570.01-M (2005; Change 4, 2015) Information Assurance Workforce Improvement

Program

NIST FIPS 140-2 (2001) Security Requirements for Cryptographic Modules

NIST SP 800-37 (2018; Revision 2) Risk Management Framework for Information

Systems and Organizations

DA AR 25-2 (2019) Army Cybersecurity

DA PAM 25-2-6 (2019) Cybersecurity Training and Certification Program

DA PAM 25-2-13 (2019) Army Identity, Credential, and Access Management and Public

Key Infrastructure Implementing Instruction

4. PERIOD OF PERFORMANCE

The period of performance is for one year or 365 days from the date of award with two OPTION years.

OPTIONs may or may not be awarded by the Government dependent upon need and budget.

5. SITE SAFETY

All onsite work shall comply with the applicable requirements of the U.S. Army Corps of Engineers Safety and Health Requirements Manual, EM 385-1-1. The safety manual may be found at the following website:

http://www.usace.army.mil/SafetyandOccupationalHealth/SafetyandHealthRequirementsManual.apx.

The Contractor is required to submit an Accident Prevention Program Administrative Plan (Appendix A of EM 385-1-1) and an Activity Hazard Analysis (POD Form 184- E (REV) Nov 11) prior to the start of onsite work.

6. ANTITERRORISM/OPERATON SECURITY REQUIREMENTS

6.1. All contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

6.2. All contractor and all associated sub-contractors employees will receive a CORPS Watch information paper (provided by the authorized government representative) and provide a written acknowledgement to the COR, no later than 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract.

6.3. The Contractor must pre-screen candidates using the E-verify Program (http://www.dhs.gov/E-

Verify) website to meet the established employment eligibility requirements. The vendor must ensure that the candidate has two valid forms of government issued identification to ensure the correct information is entered into the E-verify system. An initial list of verified/eligible candidates must be provided to the COR no later than 3 business days after the initial contract award.

6.4. Per the E-Verify Website the following exemptions apply: Employers whose contracts are exempt from the E-Verify federal contractor rule are not required to enroll in E-Verify. A contract is considered exempt if any one of the following applies: (1) It is for fewer than 120 days. (2) It is valued at less than $150,000, the simplified acquisition threshold (Source:

http://www.uscis.gov/e-verify/federal-contractors/exemptions-and-exceptions).

6.5. All contract employees, including subcontractor employees who are not in possession of the appropriate security clearance, will be escorted in areas where they may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas.

7. CONTRACTOR PERSONNEL

7.1. The Contractor shall have a minimum of five years of experience with AVEVA/Wonderware based control systems used for power generation, distribution, and transmission.

7.2. Contractors performing cybersecurity functions shall have or obtain the appropriate DoD approved cybersecurity baseline certification prior to being engaged. The Contractor shall ensure that personnel accessing information systems have the proper and current cybersecurity certification to perform cybersecurity functions:

7.2.1. DOD Directive 8140.01, Cyberspace Workforce Management.

7.2.2. DOD 8570.01-M, Information Assurance Workforce Improvement

7.2.3. Program, Information Assurance Technical (IAT). See https://public.cyber.mil/cwmp/dod-approved-8570-baseline-certifications/ for Approved Baseline IAT Certifications.

7.2.4. DA PAM 25-2-6, Cybersecurity Training and Certification Program

7.3. Submit Contractor personnel qualifications for acceptance a minimum of 30 days after award.

7.4. All Contractors who will have access to make changes on the control system or network configurations are required to sign the ICS/SCADA Acceptable Use Policy (AUP) prior to accessing the control system or network configurations.

8. CONTRACTOR PORTABLE ELECTRONIC DEVICES (PED)

8.1. All Contractor personnel and equipment that will connect to USACE-owned systems are subject to the requirements of this paragraph. This includes all Contractor equipment, including laptops and other portable devices.

8.2. All Contractor PEDs shall be approved by the Contracting Officer (KO) or Contracting Officer's

Representative (COR) for connection to USACE-owned systems prior to connection.

8.3. For compliance, security, and network maintenance purposes, authorized individuals within USACE may monitor equipment, systems, and network traffic at any time, per the existing acceptable use and audit policies. USACE reserves the right to audit networks and systems on a periodic basis to ensure compliance with Army policy. Users connecting to USACE-owned equipment with approved PEDs consent to monitoring and inspection of their equipment.

8.4. PEDs approved for connection to USACE-owned systems equipment shall meet the following requirements:

8.4.1. Be subject to scanning or checking by designated USACE personnel before being connected to any USACE-owned equipment.

8.4.2. This process will be repeated before connection each time the PED goes off-site (crosses the facility boundary).

8.4.3. Undergo regular maintenance ensuring the PED is patched and up to date and a current full antivirus scan has been completed within the previous 10 days.

8.4.4. Ensure the PED firewall is enabled and set to "Public".

8.4.5. Demonstrate that all required patching and software/firmware updates are applied, and compliance with any applicable STIGS (Security Technical Implementation Guides) version and release is achieved.

8.4.6. Employ data-at-rest encryption to protect information stored on the device. The types of information that must be protected include the following: site specific drawings;

configuration files; project files; vulnerability data; and any specific information that could potentially lead to a compromise.

8.5. If limited connectivity to the Internet is required to update software patches and retrieve updated virus definitions, the following requirements shall be met:

8.5.1. The host based firewall on the computer shall be enabled and the network identifier for the Internet connection must be set to "Public".

8.5.2. After the software patches are applied and the virus definitions updated, the computer shall be isolated from the Internet connection, and a full scan with the Antivirus Software completed, resulting with no detections, prior to connection to the USACE-owned equipment.

8.5.3. Prior to connecting to the equipment, network, or system, antivirus definition files shall be verified to be less than seven days old and a full scan has been completed.

8.6. In the event that an authorized or approved non-USACE-owned PED is lost or stolen, user shall immediately notify the Contracting Officer or Contracting Officer's Representative.

8.7. Under no circumstances are users authorized to engage in any activity that is illegal under local, state, federal or international law while utilizing authorized or approved USACE-owned or non- USACE-owned resources related to work on this contract. The following activities are strictly prohibited with regards to connecting authorized or approved USACE-owned or non-USACE-owned PEDs to USACE-owned equipment, with no exceptions:

8.7.1. Using SCADA or other related monitoring and/or control systems for any personal use.

8.7.2. Connecting unauthorized or unapproved non-USACE PEDs to USACE equipment, systems, or networks.

8.7.3. Intentional introduction of malicious programs into the network or server (e.g., viruses, worms, Trojan horses, e-mail bombs, etc.).

8.7.4. Port scanning or security scanning without prior notification to the KO, in coordination with designated site IT personnel.

8.7.5. Executing any form of network monitoring which will intercept data not intended for the user's host, unless this activity is a part of the user's normal job/duty.

8.7.6. Hotspot-capable PEDs are not permitted to broadcast Wi-Fi signals as an access point (i.e.

function as a router for a wireless network) within and/or around certain areas of the USACE facility premises (e.g., control room and computer server room, unit control equipment enclosures such as RTU cabinets, digital governor or exciter cabinets, etc.) and shall not be connected to USACE equipment, systems, or networks.

8.7.7. PEDs shall not be loaned or otherwise given to any person other than whom the device is assigned to.

8.7.8. Exporting software, technical information, encryption software or technology, which is in violation of international or regional export control laws. Notify the KO or COR of any material that is in question. Material in question shall only be exported with KO or COR approval.

8.8. Any use of email on SCADA and any related monitoring/control of USACE systems or networks is prohibited.

9. HPCS INFORMATION

The HPCS is a real-time industrial control system used to monitor, alarm, and control various power plant and switchyard functions at the Truman and Stockton Power Plants. The Stockton Power Plant is remotely operated from the Truman Power Plant. The HPCS includes but not limited to AVEVA/Wonderware runtime and development applications and licensing, Microsoft SQL databases, custom reporting application, Microsoft Windows servers and workstations, programmable logic controllers, and managed networking hardware. It utilizes various industrial and information systems protocols and ports. Specific system information such as network diagrams, programs, configurations, hardware lists, and software lists cannot be provided to the Contractor until after approval of the Contractor personnel qualifications. The HPCS complies with the various requirements of the standards referenced in paragraph 3.

10. MAINTENANCE SERVICES

The Contractor shall provide non-personal services as request by the Contracting Officer or the Contracting Officer’s Representative including but not limited to:

10.1. Provide patches, firmware, service packs, and updates for applications and operating systems

10.2. Testing of software, patches, firmware, service packs, updates on a virtual and/or live environment

10.3. Perform vulnerability scanning with provided tools

10.4. Perform vulnerability remediation

10.5. AVEVA/Wonderware, database, application, controller, and etc. scripting and/or programming

10.6. Configuration and settings changes

10.7. Provide various written products regarding services.

10.8. Installation and configuration of hardware and software

10.9. Integration of computer based and/or digital standalone controls/systems

10.10. Troubleshooting various issues

10.11. Cybersecurity consulting

11. AVEVA/WONDERWARE LICENSING

11.1. The Contractor shall provide AVEVA/Wonderware licensing, patches, updates, and service packs to maintain the Government’s software. The 2012 and 2014 versions of Wonderware are deployed on the HPCS.

11.2. For bidding purposes, anticipate a migration to the 2017 version or higher of

AVEVA/Wonderware. The cost shall include all supplies/materials, labor, travel, incidentals, and services including license agreements to provide and install the patches, updates, service packs, and etc. onsite at the Truman and Stockton Power Plants.

12. OFFSITE AND ONSITE SERVICES

12.1. The Contracting Officer or the Contracting Officer’s Representative shall be the only Government personnel to schedule services performed under this PWS. Communication will be made via phone or electronic means. If communication is made by other than phone then the Government will follow up with an email. The Contractor should be able to accept communications Monday through Friday during normal business hours. The contractor shall provide a reasonable response time to all inquiries and requests. Allow services performed shall be in compliance with the applicable requirements of the standards referenced in paragraph 3.

12.2. The Contractor shall provide offsite services as requested and scheduled. Offsite services is a

NOT TO EXCEED number of hours at a flat hourly rate. The time spent on assigned tasks shall be accounted for in half hour (30 minute) increments. The Contractor shall keep a log documenting all tasks performed, who performed the task, the dates performed, and the amount of time spent on each task each day. Any personal time shall be be borne by the Contractor. The Contractor shall submit supporting documentation along with invoices to the Contracting Officer’s Representative for review and processing. Any discrepancies, errors, and mistakes will be returned to the Contractor for correction.

12.3. The Contractor shall provide onsite services as requested and scheduled. Onsite service will occur at one or both power plants; schedule to be determined. For bidding purposes, a site visit shall consist of 20 man-hours onsite by one Contractor personnel. The cost for each site visit shall include all labor, travel expenses, and materials/supplies.