HQ003416Q0005_Cybersecurity_Support_PWS_final.pdf

PERFORMANCE WORK STATEMENT (PWS)

FOR

Energy Security Technology Certification Program (ESTCP)

FOR THE

OFFICE OF THE ASSISTANT SECRETARY OF DEFENSE (ENERGY,

INSTALLATIONS & ENVIRONMENT) (OASD(EI&E))

PART 1: GENERAL INFORMATION

1.1 Background: The Office of the Assistant Secretary of Defense (Energy, Installations and

Environment) oversees the Department of Defense (DoD) Facility Energy Program and progress towards achieving facility energy goals. The OASD(EI&E) is responsible for issuing facility energy policy and guidance, coordinating the Defense Department’s facility energy strategy, engaging with DoD Components, and coordinating all congressional reports related to facility energy.

1.2. Objectives: Provide subject matter and knowledge and assist in the review of Energy

Security Technology Certification Program (ESTCP) proposals. Intent is to assist ESTCP management in determining if proposed technology has considered all of the needed and appropriate requirements for investment consideration.

1.3. Scope: The Energy Security Technology Certification Program (ESTCP) funded ten projects in FY16 that focus on demonstration of various aspects of microgrids. These projects interact with Control Systems (CS) on Military Networks and require obtaining authority to operate (ATO) in order to perform the demonstrations. Some of these projects also focus on demonstrating technology designed to enhance or improve cybersecurity posture of Military Industrial Control Systems.

The process for obtaining ATO for these technologies is not well understood by the project teams and the technologies used in these demonstration projects all have common elements. Each project has budgeted for consultants with subject matter expertise, at significant cost, to assist with navigating the Risk Management Framework in order to obtain an ATO. The simultaneous implementation of these demonstration projects at multiple sites across different services provides an opportunity to collect lessons learned and share best practices to improve project execution efficiency and reduce cost.

Additionally, the collective experience gained by these similar projects going through the

RMF provides opportunity to identify specifications for this type of technology that could be used to expedite the process for like-technology in the future.

The ESTCP Program Office requires support from a Cybersecurity subject matter expert

(SME) to act as an advisor to the Program Office to monitor the project teams’ efforts toward obtaining an ATO, and facilitate information sharing across project teams to improve project execution efficiency.

The workload estimate for this requirement is approximately 433 hours annually for the base period and 433 hours annually for each option period, of which 433 hours per year is expected to be on-site. Of the 433 hours, 100% of the hours are dedicated to technical support. The workload estimates are provided solely to assist the Contractor in its assessment of the anticipated workload required and to ensure its quotation includes pricing consistent with the anticipated workload. This is not a labor hour contract. The

PWS requirements must be performed at the proposed prices regardless of the number of hours quoted or performed.

PART 2: GOVERNMENT PROVIDED PROPERTY

The Government shall facilitate access of Contractor staff to DoD offices, employees, and data necessary to perform this PWS.

At the request of the Government, or at completion of this effort, the Contractor will immediately return any Government-provided property, including any equipment, specialized or off-the-shelf software, and all other property provided by the Government for the Contractor to use to complete this effort.

2.1 Information: Upon commencement of this contract, unless otherwise indicated, the

Government will provide access to relevant Government facilities, studies, reports, data, and staff as necessary to perform this PWS.

2.2 Facilities: The Government will provide office space, supplies and computer support.

The Government will also provide a Common Access Card if the support personnel does not already have one. The Contractor may be required to support local meetings at other

Government facility or office. The Contractor will be allowed access to the

Government's facilities, as specified below:

2.2.1 OASD EI&E work spaces are at the Mark Center, Alexandria, VA and the

Pentagon. The contactor shall provide Visit Request identifying the individuals requiring access and the visit frequency. The COR shall be the Government representative for building access lists.

2.3 Proprietary Rights

All analyses, reports, documentation, data, briefings, methodologies, in whatever medium or format, developed and conducted under this task order are Government property. The

Government will retain sole right to use, distribute, and publish the above as it sees fit.

2.4 Travel

The Contractor will only be reimbursed for travel from the National Capital Region to outside the National Capital Region. The Government is not responsible for Contractor’s travel costs within the National Capital Region.

The term "National Capital Region" means the geographic area located within the boundaries of the District of Columbia; Montgomery and Prince Georges counties in

Maryland; and Arlington and Fairfax Counties, plus the cities of Alexandria, Fairfax, and

Falls Church in Virginia plus Loudoun and Prince William counties in Virginia.

All travel shall be approved by the COR prior to commencement of travel. The

Contractor shall be reimbursed for actual allowable, allocable, and reasonable travel costs incurred during performance of this effort in accordance with FAR 31.205-46, “Travel costs” and Federal Joint Travel Regulation/Joint Travel Regulations.

PART 3: CONTRACTOR FURNISHED PROPERTY

Except for those items specifically stated to be Government Provided Property in Part 2, the

Contractor shall furnish everything required to perform the PWS.

PART 4: SPECIFIC REQUIREMENTS

4.1 Places of Performance: The Contractor will predominantly work in Government owned work space. The Contractor is responsible for conducting technical support between the hours of 8:00 am to 5:00 pm EST one (1) day per week except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate work force for the uninterrupted performance of all deliverables defined within this PWS when the Government facility is not closed for the above reasons.

4.2 Recognized Holidays: The Contractor is not required to perform services under this effort on the Federal Holidays listed below:

New Year’s Day Labor Day

Martin Luther King Jr.’s Birthday Columbus Day

President’s Day Veteran’s Day

Memorial Day Thanksgiving Day

Independence Day Christmas Day

4.3 Period of Performance: The period of performance shall be for one (1) 12-month period and one (1) 12-month option period.

4.4 Tasks

The Contractor shall provide the following support:

4.4.1. Task 1 – Program Office Support

A. Advise the ESTCP Program Office on Cyber Security related questions from project teams and installation representatives.

B. Collect lessons learned from FY16 project teams’ efforts in obtaining an ATO and develop a report on findings.

C. Facilitate information sharing across project teams on RMF process and issues related to obtaining an ATO.

PART 5: ADMINISTRATIVE REQUIREMENTS

The following security requirements (sections 5.1, 5.2, and 5.3) are mandatory and non-negotiable:

5.1 Security Clearances - All deliverables associated with this task order are “unclassified” unless otherwise specified. Contractor personnel assigned under this PWS are NOT required to have an active security clearance but shall have the requisite clearance required to have unescorted access to the Mark Center and Pentagon. It is anticipated that all work and deliverables under this PWS will be classified.

5.2 Security Requirements

5.2.1 Physical Security: The Contractor shall be responsible for safeguarding all

Government property provided for Contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured in accordance with regulations stated in Section 5.1, Security Clearances

5.2.2 Disclosure of Information: Performance of this PWS may necessitate the need for the Contractor to access and use data and information proprietary to a Government agency or Government Contractor, which is of such a nature that its dissemination or use, other than in performance of this PWS, would be adverse to the interests of the

Government and/or others. The Contractor and/or Contractor personnel shall not divulge or release data or information developed or obtained in performance of this contract, until made public by the Government, except to authorize Government personnel or upon written approval of the contracting officer. The Contractor shall not use, disclose, or reproduce proprietary data other than as required in the performance of this PWS.

Nothing herein precludes the use of any raw data independently acquired by the

Contractor without such limitations or prohibits an agreement at no cost to the

Government between the Contractor and the data owner, which provides for greater rights to the Contractor. The Contractor shall be responsible for any damage caused by

Contractor operations related to the above. Information made available to the Contractor by the Government for the performance or administration of this effort shall be used only for those purposes and shall not be used in any other way without the written consent of the Contracting Officer (CO) or COR. Contractor and Contractor personnel will not divulge or release data or information developed or obtained in performance of this effort, until made public by the Government, except to authorized Government personnel or upon written approval of the CO or COR. The Contractor will not use, disclose, or reproduce proprietary data other than as required in the performance of this effort.

Nothing herein will preclude the use of any raw data independently acquired by the

Contractor without such limitations or prohibit an agreement at no cost to the

Government between the Contractor and the data owner which provides for greater rights to the Contractor.

5.2.2.1. The Contractor agrees to assume responsibility for protecting the confidentiality of Government records, which is not considered public information. Each Contractor or employee of the Contractor to whom information may be made available or disclosed shall be notified in writing by the

Contractor that such information may be disclosed only for purposes and to the extent authorized herein. The Contractor shall not release any information related to this contract to the public, media or other unauthorized persons or organizations (e.g., posting information to a public website) unless the government has conducted the appropriate security review and granted written approval. Performance of this effort may require the Contractor to access and use data and information proprietary to a Government agency or Government

Contractor which is of such a nature that its dissemination or use, other than in performance of this effort, would be adverse to the interests of the Government and/or others.

5.3 Organizational Conflicts of Interest: The Contractor warrants that to the best of its knowledge and belief and except as otherwise disclosed, he or she does not have any organizational conflict of interest, which is defined as a situation in which the nature of work under a Government contract and a Contractor's organizational, financial, contractual or other interests are such that: award of the contract may result in an unfair competitive advantage; or the Contractor's objectivity in performing the contract work may be impaired. Specific tasks under this PWS may require the Contractor to provide advisory and assistance services which may be areas for potential organizational conflicts of interest addressed in FAR 9.505. Performance of such tasks may preclude the

Contractor from consideration for award of related programs. The Contractor is required to advise the contracting officer whether it considers that an actual or potential conflict of interest exists.

5.4 Non-Disclosure Agreement: In the course of performance pursuant to this PWS, it is unlikely that the Contractor will access nonpublic information, including Planning, Programming, Budgeting and Execution (PPBE) information and cost information. In the event this type of information is accessed, the Contractor shall agree that it will not use or disclose any such information unless authorized by the COR. The Contractor shall further agree that it will use its best efforts to ensure that its employees and others performing services under this contract will not use or disclose any such information unless authorized by the COR or contracting officer. The Contractor shall protect information in accordance with the Privacy Act of 1974 (5 U.S.C. 552a) and the Freedom of Information Act (5 U.S.C. 552, as amended). To that end, the Contractor shall agree that each of its employees and others performing duties under this contract will sign a

Non-Disclosure Agreement provided by the Government.

PART 6: PERSONNEL REQUIREMENTS

The Contractor personnel supporting this PWS will have experience with the desired levels as described below.

6.1 Cybersecurity SME: The Contractor shall provide a resume for the cybersecurity

SME with a Master's Degree in an engineering related discipline that is relevant to the contract, and demonstrates the following:

Minimum 20 years experience with Department of Defense (DoD);

Minimum 10 years control systems (includes industrial control systems, SCADA, platform information technology, etc.) architecture design, secure networking, relevant security control selection, cybersecurity expertise of embedded electronic control systems, website security, strong familiarity with the DoD CIO, USCYBERCOM, the National Institute of Standards and Technology (NIST), the

DHS ICS-CERT, the Department of Energy (DOE), and organizations such as

SANS, the Defense Industrial Base, Manufacturers Association, and Cyber

Ranges;

Experience in providing a minimum of 20 instances of education, training and presentations to government and commercial on cyber securing energy related control systems;

Published in trade magazines and websites (minimum of 3 different publications).

Knowledge of DoD polices (AT&L, CIO, USCYBERCOM, Services) Unified

Facilities Criteria (UFC), technical letters and RMF KS Portal;

Knowledge and demonstrated experience in conducting energy-related control systems cybersecurity assessments;

Familiarity with the Defense Information Systems Agency Unified Capability

Approved Product List;

Demonstrable experience with DoD savings-to-investment ratios and strategy;

Knowledge of IP and Legacy control systems protocols in support of real-property related control systems; and, Experience in technology evaluation and review for DoD energy and cyber security investment.

PART 7: DELIVERABLES

All deliverables must meet professional standards and meet the requirements set forth in contractual documentation. The Contractor will be responsible for delivering all end items specified. All deliverables developed under this task order become the property of the US

Government and shall be submitted to the COR, unless otherwise agreed upon (in writing) before submission. The Contractor shall submit these products as electronic documents in the appropriate format (e.g., Microsoft Office Word, PowerPoint, Excel or, depending on size, in compressed or PDF format). Comments and edits to draft products shall be fully addressed or incorporated before deliverables are accepted for formal coordination.

7.1 General - The deliverables required shall be prepared in accordance with the directions provided by the ESOH technical point of contact. Prior to submittal, each deliverable must be:

Written in plain English.

Peer reviewed.

Prepared in sufficient detail to ensure that a professionally qualified third party can understand the report logic.

Deliverables: Unless otherwise specified, the Government will have a maximum of ten

(10) working days from the day the draft deliverable is received to review the document, provide comments back to the Contractor, and approve or disapprove the deliverable(s).

The Contractor will have a maximum of ten (10) working days from the day comments are received to incorporate all changes and submit the final deliverable to the

Government.

All days identified below are intended to be calendar days unless otherwise specified.

The format for individual deliverables will be the Contractor’s standard format for written reports and client presentations to the government. All documents will be provided in either hard copy and/or electronically as requested by the COR. Products that reflect the Contractor’s analysis and opinion (e.g., studies or analyses) may be in

Contractor format. Products that are to be used by the Government in the execution of program responsibilities (e.g., draft reports, briefings etc.) will be in a specified

Government format.

Electronic documents will be provided in the appropriate Microsoft Office format (e.g., Word or PowerPoint); if appropriate, the Government may be asked that they be provided in compressed or PDF format.

In fulfillment of this effort, the Contractor shall provide the deliverables identified in this section. All deliverables shall be submitted to the COR and selected representatives, unless otherwise agreed upon.

7.2 Specific Deliverables

Deliverable* Task

Reference

Schedule/Quantity

1 Technical Questions and Analyses Task 1 Ongoing/As Needed

2 Lessons Learned Paper Task 1 Ongoing/As Needed

3 ATO and RMF Completion Analysis Task 1 Ongoing/As Needed

* All deliverables, unless specified otherwise, shall be submitted to the COR.

PART 8: PERFORMANCE OBJECTIVES

8.1 Quality Assurance Surveillance Plan (QASP): The Government shall evaluate the

Contractor’s performance under this PWS in accordance with the BPA Quality Assurance

Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards.

It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

8.2 Performance Thresholds: The Contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success. General quality measures, as set forth below, will be applied to each work product received from the Contractor under this PWS.

Accuracy - Deliverables will be accurate in presentation, technical content, and adherence to accepted elements of style. Written documents will be in formats as specified above and shall be 99% free of grammar and spelling errors.

Appearance - All deliverables will be neat and attractive, reflecting the role that the

ESOH Directorate fulfills and the level at which work products will be used.

Clarity - Deliverables will be clear and concise. Any/all diagrams shall be easy to understand and be relevant to the supporting narrative.

Consistency to Requirements - All deliverables must satisfy the requirements of this

PWS.

File Editing - All text and diagrammatic files will be editable by the Government.

Format - Deliverables will be submitted in hard copy (where applicable) and in media mutually agreed upon prior to submission. Hard copy formats shall follow any specified Directives or Manuals.

Timeliness - Deliverables will be submitted on or before the due date specified in this performance work statement or submitted in accordance with a later scheduled date determined by the Government.

PART 9: ACRONYMS AND DEFINITIONS

BPA Blanket Purchase Agreement

CAC Common Access Card

CO Contracting Officer

Contracting Officer’s Representative (COR) - A representative from the requiring activity assigned by the Contracting Officer to perform surveillance and to act as liaison to the Contractor

Defective Service - A service output that does not meet the standard of performance associated with it in the Performance Work Statement.

ESOH Environment, Safety and Occupational Health

MIPRs Military Intergovernmental Purchase Requests

NGO Non-Governmental Organization

OASD (EI&E) Office of the Assistant Secretary of Defense (Energy, Installations &

Environment)

PWS Performance Work Statement

Quality Assurance - Those actions taken by the Government to assure services meet the requirements of the Performance Work Statement.

Quality Assurance Surveillance Plan (QASP) - An organized Government written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

Quality Control - Those actions taken by a Contractor to control the performance of services so that they meet the requirements of the PWS.