Attachment J-01 - ITMA PWS v29 - 20170622.pdf

HQ0147-18-R-0004

Attachment J-01 ITMA PWS

July 2017 1

TECHNICAL, ENGINEERING, ADVISORY and

MANAGEMENT SUPPORT (TEAMS)

Performance Work Statement (PWS) for Information Technology Management and Analysis

(ITMA)

July 2017 2

1. Top Level Functional Requirements/Scope

1.1. Purpose

The Missile Defense Agency's (MDA) mission is to develop, test, and field an integrated, layered, ballistic missile defense system (BMDS) to defend the United States, its deployed forces, allies, and friends against all ranges of enemy ballistic missiles in all phases of flight.

The MDA Chief Information Officer (CIO), a Senior Executive Service (SES) appointment compliant with Clinger-Cohen Act (Pub. L. 104-106), is responsible for providing MDA with Enterprise (Agency-wide) Information Technology (IT) capabilities for Administrative and General Services (GENSER) capabilities servicing the MDA administrative and business requirements as well as general services for BMDS Research, Development, Test, and Evaluation (RDT&E) requirements; plus the cybersecurity lead for the BMDS fielded capabilities and MDA Enterprise. The MDA CIO appoints the MDA Information Systems Authorizing Official (AO) for all of MDA to include the BMDS fielded capabilities.

Approved for Public Release 16-MDA-8540 Figure 1.1: The Ballistic Missile Defense System

Missile defense technology being developed, tested and deployed by the United States is designed to counter ballistic missiles of all ranges—short, medium, intermediate and long. Since ballistic missiles have different ranges, speeds, size and performance characteristics, the BMDS

July 2017 3 is an integrated, "layered" architecture that provides multiple opportunities to destroy missiles and their warheads before they can reach their targets.

Ballistic missile trajectories are commonly divided into three phases of flight: boost, midcourse, and terminal. Each element will play an important role in a robust system intended to defend against hostile missiles in any phase of flight.

The BMDS system's architecture includes:

• Networked sensors (including space-based) and ground- and sea-based radars for target detection and tracking;

• Ground- and sea-based interceptor missiles for destroying a ballistic missile using either the force of a direct collision, called "hit-to-kill" technology, or an explosive blast fragmentation warhead; and

• A command, control, battle management, and communications network providing the operational commanders with the needed links between the sensors and interceptor missiles.

The BMDS elements are:

• Aegis Ballistic Missile Defense (BMD)

• Command, Control, Battle Management and Communications (C2BMC)

• Ground-based Midcourse Defense (GMD)

• Sensors

• Terminal High Altitude Area Defense (THAAD)

Each BMDS element has multiple unique components, such as: interceptors, fire control, unique sensors, element internal and external communications capabilities, unique command and control configurations, etc.

1.2 Background

The MDA mission is to develop, test, and field an integrated, layered, BMDS to defend the United States, its deployed forces, allies, and friends. The BMDS weapon system, as depicted in Figure 1.1, is made up of several elements and components. MDA is identified as a rapid acquisition agency with the mission to expedite BMDS capabilities development and testing.

MDA then fields demonstrated BMDS program capabilities as soon as they are available.

Information is a strategic asset to MDA, and as such shall be appropriately secured, shared, and made available to the maximum extent possible throughout the information life cycle to MDA workforce.

The MDA CIO office provides MDA with enterprise services, defined as: a common set of information resource capabilities designed to provide awareness of, access to, and delivery of information. Information is defined as: any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, July 2017 4 cartographic, narrative, or audiovisual forms. This advisory and assistance services requirement will:

• Improve upon information solutions with reliable, timely, accurate information that is protected, secure, and resilient against information warfare, terrorism, criminal activities, natural disasters, and accidents.

• Improve IT investment portfolio alignment with the required DoD Information Enterprise policies and guidance

• Improve operational effectiveness and efficiency through superior IT Services delivery

• Improve resilient communications and computing infrastructure

• Improve organizationally-tiered reviews, oversight, and execution to ensure IT investments are in compliance with architectures at various levels, IT standards, and related policy requirements

The MDA CIO office provides administrative net-centric enterprise services to all of MDA through a robust, globally-interconnected network environment (including infrastructure, systems, processes, and people) in which data are shared timely and seamlessly among users, applications, and platforms. MDA uses mostly DoD available shared administrative (DoD business mission area) tools, such as the Defense Agencies Initiative (DAI) electronic-business suite for government time cards, or the Defense Travel System (DTS) for government travel arrangements, or the DoD Civilian Acquisition Workforce Personnel Demonstration Project’s (AcqDemo) Contribution-based Compensation and Appraisal System (CCAS) CAS2Net system for government civilian appraisal processes. The MDA unique administrative services are all based on commercial-off-the-shelf (COTS) tools, so that sitting in a normal office environment in Alaska one can schedule the conference room for meetings while on travel to the Von Braun complex. Likewise, some administrative services are based on DoD negotiated COTS procurements, such as Microsoft Office for emails, calendars, presentations, spreadsheets, documents, etc.

The MDA CIO office provides general net-centric enterprise services (both unclassified and classified) to MDA supporting the MDA mission for BMDS RDT&E. The general services are based on the globally interconnected, end-to-end set of information capabilities for collecting, processing, storing, disseminating, and managing information on demand to MDA government and contractor teams. The enterprise general services support such things as globally dispersed Engineering Design Reviews; test readiness reviews; element developmental laboratories technical coordination; test execution; and Executive Management Review Boards. The classified enterprise general services system is considered a ‘national security system’.

The MDA CIO has two major data centers, one on Redstone Arsenal, AL (commonly referred to as Huntsville (HSV)) and the other on Schriever Air Force Base (AFB), CO (commonly referred to as Colorado Springs (COS)) both identified as Special Purpose Processing Nodes (SPPN). The HSV data center is the MDA Unclassified Center, and the COS data center is the MDA Classified Center, with each providing disaster recovery, continuity of operations (DR/COOP) services to the other. Concept of Operations (CONOPS) governing the Enterprise utilizes the Information Technology Infrastructure Library (ITIL) framework and methodologies and a well-defined set of Role Based Administration (RBA) crew categories and

July 2017 5 responsibilities. The Enterprise CONOPS provides the guidance necessary to manage the increasingly complex computer and network environments while providing customers high quality supported and sustained IT services.

The MDA Enterprise includes but is not limited to: 4 Principal Sites (Fort Belvoir, VA (Headquarters - HQ); Naval Surface Warfare Center Dahlgren Division, VA (Dahlgren - DHL);

Redstone Arsenal, AL (Huntsville - HSV); and Schriever AFB, CO (Colorado Springs - COS)), 10 Major Sites, and over 135 Remote Sites connected by Wide Area Network (WAN) Services with over: 260 network enclaves connected to the MDA managed network transport as well as numerous isolated special purpose networked systems; various connections to other DoD networks; 14,000 users with about 18,000 user accounts; 3,000 wireless device users; 2,200 production servers and 400 RDT&E servers; numerous print servers with 1,000 network printers;

over 300 VTCs nodes in conference areas and office suites; and VOIP classified and unclassified telephone services.

The MDA CIO office activities related to the administrative and general services net-centric enterprise services are: plan, design, acquire, manage, build, populate, operate, protect, defend, maintain, and decommission.

There are many Federal and DoD regulations for implementing ITMA, see paragraph 2.1 below.

MDA is a component of DoD. The MDA Director is referred to as a “DoD Component Head” or “Head of DoD Component.” The MDA CIO is referred to as a “DoD Component CIO.”

2. Organizational Description

The CIO mission is to ensure that MDA information technology services, management and resources are administered, acquired, managed, and operated in compliance with the priorities set by the MDA Director and the goals and directives of existing statutes and DoD regulations. The MDA CIO vision is to provide effective, secure and affordable enterprise information capabilities for missile defense. MDA has standardized the delivery of core enterprise services and applications into eight Service Lines: End User Support, Unified Communications, Cybersecurity Information Assurance (IA)/ Computer Network Defense (CND), Business Automation, Portal & Data Management, Networks and Infrastructure, Data Center, and IT Planning & Solutions. See Figure 2.1 for the MDA CIO Mission, Vision, and Services depiction. MDA CIO strives to deliver integrated services through the eight Service Lines. The MDA SPPN data center configurations are both DoD Architecture Framework (DoDAF) and Global Information Grid (GIG) compliant and provide processing, storage, and transport of information, human interaction, systems and network management, information dissemination management, and cybersecurity functions.

July 2017 6

Figure 2.1: MDA CIO Mission, Vision, and Services

The MDA CIO organization is depicted in Figure 2.2. Within the below CIO organization depiction the blue highlighted boxes reflect the associated requirement organizations for this contract.

• Within Figure 2.2 right below the CIO is the Architecture & Engineering (A&E) Team.

The A&E Team is part of the CIO organization, comprised of Government and Contractor members. The A&E Team recommends the future MDA Enterprise (Admin/GENSER) configuration within the roadmap for implementation. The A&E Team Support requirements are contained in Performance Objective #1.

• Within Figure 2.2 in the middle is the MDA 3-letter organization ICT, Information

Management & Technology Operations. The ICT organization oversees the day-to-day execution of the world-wide MDA Enterprise (Admin/GENSER). The ICT requirements are contained in Performance Objectives #2 through #6.

• Within Figure 2.2 in the far right hand column, is the Regional IT Support for the major

MDA locations. The Regional IT Support organizations are the CIO’s local interface to the MDA workforce. The Regional IT Support requirements are contained within Performance Objective #2.

Customer Centric Focus

Federal laws, Directives and DoD policy

Vision: Provide effective, secure and affordable enterprise information capabilities for missile defense.

Mission: Ensure that information management and information technology resources are acquired, managed, operated and protected IAW Federal laws and DoD policy.

Integrated Service Delivery

SERVICES

Cyber-security

End User Support

SPPN* Portal & Data Management

Unified Comms

IT Planning & Solutions

Business Automation

*Special Purpose Processing Node

Unified DoD Direction

MDA Direction

CIO Direction

Transparent Portfolio to Align budget & bodies around a unified direction

Services to customers that are timely and effective

Clearly articulate the service portfolio patterns of performance over time

JR2

Continuous alignment with mandates & MDA mission with continuous improvement

July 2017 7

Figure 2.2: MDA Chief Information Officer (CIO) Organization Chart

2.1 Regulatory Guidelines

Specific regulatory guidelines are applicable throughout this requirement for accomplishment of performance objectives in Section 3. The below list identifies the regulatory guidelines and their current version, but the regulatory guidelines associated with this requirement are not limited to the below guidelines, their current version, or superseding regulations.

ICTA HQ

ICTM HSV

ICTO COS Integration & Ops Center

ICTP DHL

ICTT West

Regional IT Support MDIOC Senior Offical & Infrastructure / Event

Support

Cyberspace Management Office

Information Management &

Technology Operations

Chief Information Officer

Authorizing Offical Team Architecture &

Engineering Team

ICM ICV ICT

Headquarters

Von Braun Complex

Dahlgren Division

Western Support

IT Networks & Systems

Information Mgmt

Enterprise Ops & Eng

IT Policy & Planning

Unified Communications

July 2017 8

Figure 2.3: Regulatory Documentation

# Title 1 National Security Presidential Directive, NSPD-23, National Policy on Ballistic Missile Defense, 16 Dec 2002 2 DoDD 5134.09, Missile Defense Agency (MDA), 17 Sep 2009 3 OMB Circular No A-130 Revised, Managing Federal Information as a Strategic Resource, 28 Jul 2016 4 Clinger Cohen Act

5 OMB Memorandum, “Myth-Busting 2”: Addressing Misconceptions and Further Improving Communication During the Acquisition Process, 7 May 2012

6 CJCSI 6510.01F, Information Assurance (IA) and Support to Computer Network Defense (CND), 9 Feb 2011 7 CJCSM 6510.01B, Cyber Incident Handling Program, 10 Jul 2012 8 CNSSP No. 22, Cybersecurity Risk Management, 31 Aug 2016 9 CNSSI No. 1015, Enterprise Audit Management Instruction for National Security Systems, 14 Apr 2016

10 CNSSI No. 1253, Security Categorization and Control Selections for National Security Systems, 27 Mar 2014

11 CNSSI No. 4014, National Information Assurance Training Standard for Information Systems Security Officers, April 2004

12 CNSSI No. 4016, National Information Assurance Training Standard for Risk Analysts, November 2005

13 DoD CIO Memorandum, Updated Guidance on the Acquisition and Use of Commercial Cloud Services, 15 Dec 2014

14 DoD CIO Strategy for Implementing the Joint Information Environment (JIE), 18 Sep 2013 15 DoD CIO Enterprise Service Management Framework, Edition II, 08 Nov 13 16 DoD CIO Information SharingStrategy, 04 May 2007 17 DoD CIO Lifecycle Standards for OSD IT Equipment, 15 Oct 2009 18 DoD CIO Memorandum, Migration to Windows 10 Secure Host Baseline, 20 Nov 2015

19 DoD CIO Memorandum, Delegation of Title 40/CCA Confirmations for Major Defense Automation Program/Major Automation Information Systems Programs, 18 May 2012

20 DoD CIO Memorandum, Department of Defense Commercial Mobile Device Implementation Plan, February 21, 2013

21 DoD CIO Net-Centric Services Strategy, 4 May 2007 22 DoD CIO Net-Centric Spectrum Management Strategy, 3 Aug 2006 23 DoD CIO Net-Centric Data Strategy, 9 May 2003 24 DoD CIO NetOps Strategic Vision, Dec 2008 25 DoD CIO Reference Architecture Description, Jun 2010

26 DoD CIO Memorandum, OMB Strategic Plan for Improving Management of Section 508 of the Rehabilitation Act of 1973, 16 Jul 2013

27 DoD CIO Information Enterprise Strategic Plan, 2010-2012 28 DoD CIO Cloud Computing Strategy, Jul 2012 29 DoD CIO Information Enterprise Architecture (DoD IEA), Version 2.0, Jul 2012 30 DoD CIO Memorandum, DoD Information Enterprise Architecture 2.0, 20 Aug 2012

31 DoD Program Manager's Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System Acquisition Lifecycle, May 2015

32 DoD Cybersecurity Test and Evaluation Guidebook, 1 July 2015 33 DoD Cybersecurity Culture and Compliance Initiative, 30 Sep 2015 34 DoD IEA Version 2.0, Volume I – Management Overview, Jul 2012

Regulatory Documentation

July 2017 9

Figure 2.3: Regulatory Documentation, continued

35 DoD Information Resources Management Strategic Plan, Version 1.0, 1 Apr 2015 36 DoD IT Business Case Analysis Template, 22 Oct 2014 37 DoDI 1100.22, Policy and Procedures for Determining Workforce Mix, 12 Apr 2010 38 DoDD 3020.44, Defense Crisis Management, 4 Jun 2007 39 DoDI 3222.03, DoD Electromagnetic Environmental Effects (E3) Program, Incorporating Change 1, 8 Jan 2015 40 DoDD 3600.01, Information Operations (IO), 2 May 2013 41 DoDI 4000.19, Support Agreements, 25 Apr 2013

42 DoDI 4630.8 Procedures for Interoperability and Supportability of Information Technology (IT) and National Security Systems (NSS), 30 Jun 2004

43 DoDD 4640.13, Management of Base and Long-Haul Telecommunications Equipment and Services, 5 Dec 1991 44 DoDI 4650.01, Policy and Procedures for Management and Use of the Electromagnetic Spectrum, 9 Jan 2009 45 DoDI 4650.10, Land Mobile Radio (LMR) Interoperability and Standardization, July 28, 2015 46 DoDD 4715.1E, Environment, Safety, and Occupational Health (ESOH), 19 Mar 2005 47 DODI 5015.02, DoD Records Management Program, 24 Feb 2015 48 DoDD 5144.02, DoD Chief Information Officer (DoD CIO), 21 Nov 2014 49 DoDI 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks, 5 Nov 2012

50 DoDI 5205.13, Defense Industrial Base (DIB) Cyber Security/Information Assurance (CS/IA) Activities, 29 Jan 2010

51 DoDI 5230.24, Distribution Statements on Technical Documents, 23 Aug 2012 52 DoDD 5400.11, DoD Privacy Program, 29 Oct 2014 53 DoDI 5400.16, DoD Privacy Impact Assessment (PIA) Guidance, 14 Jul 2015 54 DoDI 5505.15, DoD Contractor Disclosure Program, 16 Jun 2010 55 DoDI 6055.01, DoD Safety and Occupational Health (SOH) Program, 14 Oct 2014

56 DoDI 7041.04, Estimating and Comparing the Full Costs of Civilian and Active Duty Military Manpower and Contract Support, 3 Jul 2013

57 DoDD 8000.01 Management of the Department of Defense Information Enterprise, February 10, 2009

58 DoDI 8100.02, Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG), 14 Apr 2004

59 DoDI 8110.01, Mission Partner Environment (MPE) Information Sharing Capability Implementation for the DoD, 25 Nov 2014

60 DoDD 8115.01, Information Technology Portfolio Management, 10 Oct 2005 61 DoDD 8140.01 Cyberspace Workforce Management, 11 Aug 2015

62 DoDI 8220.02, Information and Communications Technology (ICT) Capabilities for Support of Stabilization and Reconstruction, Disaster Relief, and Humanitarian and Civic Assistance Operations, 30 Apr 2009

63 DoDI 8310.01, Information Technology Standards in the DoD, 2 Feb 2014

64 DoDI 8320.02, Sharing Data, Information, and Information Technology (IT) Services in the Department of Defense, 5 Aug 2013

65 DoDI 8320.05, Electromagnetic Spectrum Data Sharing, 18 Aug 2011

66 DoDI 8320.06, Organization Unique Identification (OUID) Standards for Unique Identification of External Department of Defense Business Partners, 26 Sep 2012

67 DoDI 8330.01, Interoperability of Information Technology (IT), Including National Security Systems (NSS), May 21, 2014

July 2017 10

68 DoDM 8400.01-M, Procedures for Ensuring the Accessibility of Electronic and Information Technology (E&IT) Procured by DoD Organizations, 3 Jun 2011

69 DoDI 8420.01, Commercial Wireless Local-Area Network (WLAN) Devices, Systems, and Technologies, 3 Nov 2009

70 DoDI 8440.01, DoD Information Technology (IT) Service Management (ITSM), 24 Dec 2015 71 DoDI 8500.01, Cybersecurity, 14 Mar 2014 72 DoDI 8500.2, Information Assurance (IA) Implementation, 6 Feb 2003 73 DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), 12 Mar 2014 74 DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, 24 May 2011 75 DoDI 8540.01, Cross Domain (CD) Policy, 8 May 2015 76 DoDI 8551.01, Ports, Protocols, and Services Management (PPSM), 28 May 2014

77 DoDI 8560.01, Communications Security (COMSEC) Monitoring and Information Assurance (IA) Readiness Testing, 9 Oct 2007

78 DoDM 8570.01-M, Information Assurance Workforce Improvement Program, 24 Jan 2012 79 DoDI 8580.01, Information Assurance (IA) in the Defense Acquisition System, 9 Jul 2004

80 FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004

81 FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006 82 FIPS PUB 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors, August 2003 83 NIST SP 800-30, Guide for Conducting Risk Assessments, September 2012 84 NIST SP 800-34, Revision 1, Contingency Planning Guide for Federal Information Systems, May 2010

85 NIST SP 800-37, Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems, February 2010

86 NIST SP 800-39, Managing Information Security Risk, Organization, Mission, and Information System View, March 2011

87 NIST SP 800-53 Rev 4, Security and Privacy Controls for Federal Information Systems and Organizations, 22 Jan 2015

88 NIST SP 800-53A revision 4, Assessing Security and Privacy Controls in Federal Information Systems and Organizations - Building Effective Assessment Plans, December 2014

89 NIST SP 800-60, Volume I: Guide for Mapping Types of Information and Information Systems to Security Categories, August 2008

90 NIST SP 800-64, Security Considerations in the System Development Life Cycle, October 2008

91 NIST SP 800-70 rev 2, National Checklist Program for IT Products-Guidelines for Checklist Users and Developers, February 2011

92 NIST SP 800-115, Technical Guide to Information Security Testing and Assessment, September 2008

93 NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, September 2011

94 NSAID Net-Centric Enterprise Information Assurance (IA) Strategy Annex to the DoD IA Strategic Plan, Revision 1.0, 26 Apr 2006

95 USD(ATL) Memorandum, Better Buying Power 2.0: Continuing the Pursuit for Greater Efficiency and Productivity in Defense Spending, 13 Nov 2012

96 USD(ATL) Memorandum, Implementation Directive for Better Buying Power 2.0 -Achieving Greater Efficiency and Productivity in Defense Spending, 24 Apr 2013

97 USD(ATL) Fact Sheet, Better Buying Power, Nov 2013

July 2017 11

2.2 Data Rights

The contractor shall comply with government data rights in accordance with the Defense Federal Acquisition Regulations Supplement (DFARS), as identified below in the PWS and incorporated in the contract:

All technical data (TD) and computer software (CS), algorithms and related models (see DFARS 252.227-7013 and 252.227-7014) to be produced or developed under this contract shall be delivered to the Government with unlimited data rights. The TD and models shall be delivered to the contracting officer in its entirety at any point during the period of performance (POP) of this contract upon written request of the contracting officer or by the end of the contract. The TD and models are to be developed with only Government funds. Do not use open source computer software unless prior written approval is received from the contracting officer. All copyrights for updated and newly developed technical data and models will be assigned to the Government (see DFARS 252.227-7020, incorporated herein).

3. Performance Objectives and Detailed Requirements

98 USD(ATL) Memorandum, Update on DoD Implementation Plan for Electronic Subcontract Reporting System ( eSRS), 23 Aug 2006

99 USD(ATL) Memorandum, Cash Flow Tool for Evaluating Alternative Financing Arrangements, 27 apr 2011 100 USD(ATL) DoD Efficiencies Key Points 2010 101 USD(ATL) Memorandum, Document Streamlining - Life-Cycle Sustainment Plan (LCSP), 14 Sep 2011 102 USD(ATL) Research and Technology Protection Plans, 30 Jun 2000

103 USD(ATL) Memorandum, Improving the Accessibility of Government Information through Section 508 of the Rehabilitation Act of 1973, as Amended (29 U.S.C. § 794d), 15 Mar 2012

104 USD(ATL) Memorandum, Update to Policy for Unique Identification (UID) of Tangible Items, 3 Sep 2004

105 USD(ATL) Memorandum, Update to Policy for Unique Identification (UID) of Tangible Items New Equipment, Major Modifications, and Reprocurements of equipment and Spares, 26 Nov 2003

106 USD(CPO) Memorandum, Advance Payments to Non-Department of Defense (DoD) Federal Agencies for Interagency Acquisitions, 1 Mar 2007

107 MDA 5013.78-M, Organizational Conflict of Interest, 13 Mar 2013 108 MDA 8000.01-INS, Information Management-Information Technology Investments and Governance 109 MDA 8000.02-DIR, Missile Defense Agency Knowledge Online Portal Management and Operations 110 MDA 8100.02-INS, Wireless Mobile Devices, Date: TBD, 2016 111 MDA 8110.01-INS, Privacy Program 112 MDA 8180.01-DIR, Enterprise Records Management 113 MDA 8190.01-DIR, Electronic Collaboration with Commercial, Educational, and Industry Partners 114 MDA 8260.02-INS, MDA Master Data Catalog 115 MDA Records Management Program and Procedures Guide

July 2017 12

Table 3.0 below contains the Performance Objectives Index outlining the objectives to be performed in accordance with this Performance Work Statement (PWS). Required products for each performance objective shown in Table 3.0 are included within respective PWS paragraphs.

While the Performance Objectives stovepipe specific activities, the contractor performance in conjunction with the Government team and other CIO related contracts are to perform as an integrated team, with the MDA workforce defined as the customer. Our cross organization cross contract coordination is the key to the success in servicing the MDA workforce. It is the Governments’ intent to revise this PWS during the contract period of performance as needed based on, but not limited to: DoD IT and Cybersecurity direction/guidance changes, ever changing cybersecurity threats, IT technology required modifications and upgrades, and/or BMDS RDT&E requirement changes.

Performance Objective Index Location(s)

1) Architecture & Engineering Team Support COS

2) Executive, Regional, and IT Planning Services HQ, DHL, HSV, and

COS

3) IT Network & Systems Services HSV and COS

4) Information Management Services HSV and COS

5) Enterprise Operations & Engineering Services HSV and COS

6) Unified Communications Services HSV and COS

Table 3.0: Performance Objective Index and Locations

3.1 Performance Objective #1: Architecture & Engineering (A&E) Team Support

3.1.1 The contractor shall improve upon information solutions with reliable, timely, and accurate information that is protected, secure, and resilient against information warfare, terrorism, criminal activities, natural disasters, and accidents by performing the Information Assurance Workforce System Architecture and Engineering functions, as defined in Federal and DoD regulatory guidance.

The contractor shall advise and provide assistance to the Government A&E Team members by performing consolidated integrated architecture and engineering activities to include, but not limited to, a full Enterprise network management analyses and A&E recommendations, a full Enterprise IT systems analyses and A&E recommendations, and a full Cybersecurity analyses

July 2017 13 and A&E recommendations for the Enterprise unclassified, Secret and Top Secret/Sensitive Compartmented Information (TS/SCI) environments.

The contractor shall perform the functions as identified in Figure 3.1.1 containing the list of A&E Team Support IASAE Level II and III Functions, while executing the tasks in paragraph 3.1.3, producing the Key Products/Technical Data identified in paragraph 3.1.4.

Figure 3.1.1: A&E Team Support IASAE Level II and III Functions

# IASAE Level II Functions 1 Identify information protection needs for the Network Environment (NE).

2 Define NE security requirements in accordance with applicable DoD IA requirements.

3 Design secure architecture for use within the NE.

4 Design secure architecture for new or existing network system(s).

5 Architect/Engineer network security measures that provide confidentiality, integrity, availability, authentication, and non-repudiation.

6 Develop approaches to mitigate NE vulnerabilities and recommend changes to network or network components as needed.

7 Ensure network/system designs support the incorporation of DoD directed IA vulnerability solutions, e.g., IAVAs.

8 Develop IA architectures and designs for DoD IS/PIT.

9 Assess threats to and vulnerabilities of the NE.

10 Identify, assess, and recommend IA or IA-enabled products (compliant with DoD evaluation and validation requirements) for use within an NE

11 Ensure that the implementation of security designs properly mitigate identified threats.

12 Evaluate security architecture and design adequacy and effectiveness.

13 Ensure the implementation of NE IA policies into system architectures.

14 Ensure the implementation of subordinate Computing Environment (CE) IA policies is integrated into the NE system architecture.

Architecture and Engineering (A&E) Team Support

July 2017 14

Figure 3.1.1: A&E Team Support IASAE Level II and III Functions, continued

3.1.2 Any and all of the above defined A&E Team Support IASAE Level II and III Functions may be executed for the MDA Enterprise. The IASAE must comply with the BMDS Security Classification Guide (SCG) and the respective element/component unique SCG and Program Protection Plans. Per DoDI 8500.01 personnel filling IASAE positions must be qualified and sign a Statement of Acceptance of Responsibilities.

# IASAE Level III Functions 1 Identify information protection needs for the enclave environment.

2 Define enclave environment security requirements in accordance with applicable DoD IA requirements.

3 Design secure architecture for use within the enclave environment .

4 Design secure architecture for new or existing enclave environment system(s), network(s), and computer(s).

5 Architect/Engineer enclave environment security measures that provide confidentiality, integrity, availability, authentication, and non-repudiation.

6 Develop approaches to mitigate enclave environment vulnerabilities and recommend changes to system or system components as needed.

7 Ensure enclave system, network, and computer designs support the incorporation of DoD directed IA vulnerability solutions, e.g., IAVAs.

8 Assess threats to and vulnerabilities of the enclave environment.

Identify, assess, and recommend IA or IA-enabled products (compliant with DoD evaluation and validation requirements) for use within an enclave environment.

10 Ensure that the implementation of security designs properly mitigate identified threats.

11 Evaluate security architecture and design adequacy and effectiveness.

12 Ensure that enclave (systems, networks, and computers) incorporate security architecture guidelines.

13 Ensure the implementation of enclave environment IA policies into system architectures.

14 Ensure the implementation of subordinate Computing Environment (CE) and NE IA policies are integrated into the enclave system architecture.

Architecture and Engineering (A&E) Team Support

July 2017 15

Cross-CIO-Contracts (CCC) phraseology means crossing all CIO organizations as well as current and future contracted activities, to include current contracts: Joint National Integration Center Research and Development Contract (JRDC), prime Northrop Grumman; MDA Information Technology Collaborative Services (MICS), prime NMR Consulting; SAP / Joint Worldwide Intelligence Communications Systems (JWICS) IT Services, prime General Dynamics Mission Systems; MiDAESS Task Order IC-02 Cybersecurity Compliance and Risk Management, prime Torch; BMDS Cybersecurity Management (CSM) and Computer Network Defense (CND) Bridge, prime Booz Allen Hamilton; and SAP/JWICS CSM, prime Booz Allen Hamilton.

A&E consolidated integrated recommendations, once approved by the CIO, may be executed on the JRDC, MICS, and/or SAP/JWICS IT Services or follow-on contracts, with reviews and impact analysis from the BMDS CSM/CND, ITMA, CCRM and/or SAP/JWICS CSM contracts, with post installation controls validation testing by the CCRM contract.

3.1.3 The contractor shall perform the following A&E Team Support activities by executing the IASAE Level II and III Functions, listed in Figure 3.1.1, plus the regulatory guidance identified in paragraph 2.1:

a. Establish, within 30 days of contract start, and maintain the MDA Unclassified Knowledge Online (UMKO) portal site, Classified Knowledge Online (CMKO) portal site, JWICS portal site, and enterprise SAP system file repositories where all key products/technical documentation (compliant with DoDAF v2.0 requirements) such as Annual Plans with procedures, briefings, analyses, and recommendation information (plans, data, and reports); as well as metrics, trip reports, weekly activity reports, and schedules are organized, presented to the Government A&E Team members and posted to the appropriate classification portal site.

b. Establish, within 45 days of contract start, and maintain, annually, the plans with supporting procedures, to include as a minimum: CCC Current Enterprise Environment Analysis and Recommendation coordination, and reporting; Decomposing Architectural Concept Recommendations into steps/phases for contracting executable projects; and Architectural Prioritization Strategy for Decomposed Project Execution.

c. Perform annually consolidated integrated CCC Current Enterprise: Network

Management Analysis and Recommendation; IT Systems and Data Analysis and Recommendations; Cybersecurity Analysis and Recommendation; and as CCC Strategic Architectural Weaknesses Analysis and Recommendation. Provide and post the Current CCC Enterprise Strategic Analysis and Recommendation Report to the Government A&E Team for review, modification, and concurrence, and then to the CIO for review, modification, and approval.

d. Perform annually a consolidated integrated CCC Enterprise Strategic Architecture Plan, compliant with Federal, DoD (such as Information Enterprise Architecture (IEA) v2 and Architecture Framework (DODAF) v2), and MDA repositories, that recommends the big conceptual vision and concepts on improving secure Enterprise IT services over the next five years addressing: the identified Current CCC Enterprise Strategic Analysis and

July 2017 16

Recommendation Reports, DoD IT and Cybersecurity direction/guidance compliance, ever changing cybersecurity threats, ever changing IT technology, emerging user requirements/issues, and/or BMDS RDT&E requirement changes. Provide and post the consolidated integrated CCC Enterprise Strategic Architecture Plan to the Government A&E Team for review, modification, and concurrence; provide to the CCC for coordination and review; and then provide and post the updated plan to the CIO for review, modification, and approval.

e. Based on the approved consolidated integrated CCC Enterprise Strategic Architecture

Plan, establish the annual CCC Enterprise Roadmap that is compliant with Federal, DoD (such as Information Enterprise Architecture (IEA) v2 and Architecture Framework (DODAF) v2), and MDA repositories for execution over the next 5 years containing the decomposed Architectural Concepts into portfolios with timelines, and service level targets for contracting executable projects; the prioritization strategy for the decomposed project execution; and any technology refresh re-alignments or challenges that may need to be addressed. Provide and post the CCC Enterprise Roadmap to the Government A&E Team for review, modification, and concurrence; provide to the CCC for coordination and review; and then provide and post the updated roadmap to the CIO for review, modification, and approval.

f. Based on the approved annual CCC Enterprise Roadmap, prepare a briefing and present the CCC Enterprise Roadmap to the CCC (IC community) for: Future Years Defense Program (FYDP) / Capital Planning and Investment Control (CPIC) planning, budgeting, and funding;

portfolio management; and contract project initiation and execution.

g. Based on the approved annual CCC Enterprise Roadmap, track the actual portfolio and contract projects, timelines, and post installation service level performance improvements.

Provide the Government A&E Team and CIO with a monthly metrics report based on this tracking. Modify future Plans and Roadmaps based on this tracking.

h. Actively participate in the MDA chartered CIO Portfolio Management and Integration

Board (PMIB) defined processes: the Project Steering Committee (PSC) review of the requirements, providing Procurement Initiation Documents (PID) package requirement content, and Engineering and Architecture Board (EAB) reviews of the design and implementation.

i. Develop and maintain a detailed schedule looking three months forward (3-month plan) and one month back (actual dates executed) containing A&E Team timelines, technical data deliveries, executive meetings, travel, and etc.

j. Prepare and deliver a weekly activity report to the Government A&E Team.

k. Actively participate in the A&E Team regular coordination meetings with the CIO;

presenting schedules, metrics, technical analysis findings, reports, plans, and roadmap.

3.1.4 A&E Team Support Key Products/Technical Data: plans; Current CCC Enterprise Strategic Architectural Weakness Analysis Report; CCC Enterprise Strategic Architecture

July 2017 17

Plan; CCC Enterprise Roadmap; technical positions, analysis, findings, recommendations, briefings, and reports; schedules; trip reports; monthly metrics; Executive meetings and briefings; weekly activity report; and portal sites.

Performance Objective #1 Standards Objective Standard AQL

A&E Team Support

Quality – Error-free and technically accurate

No more than two validated customer complaints, in writing, within the monthly reporting period across all locations

Quality – Compliant with applicable DoD, MDA and local security directives policies, procedures and instructions for safeguarding classified information

Zero validated violations, in writing, within the monthly reporting period across all locations

Quality/Business Relations – Works independently with minimum corrective action required

No more than two corrective action events within the monthly reporting period across all locations. Note: A corrective action event is when an action is taken, in a corrective manner, due to lower than satisfactory performance

Schedule – Timely – Meets schedules. Completes actions within specified deadlines

No more than one late or missed scheduled event within the monthly reporting period across all locations

Table 3.1.1: Performance Objective #1 Standards

3.2 Performance Objective #2: Executive, Regional, and IT Policy Services

3.2.1 The contractor shall:

• Improve operational effectiveness and efficiency through superior delivery, and

• Improve organizationally-tiered reviews, oversight, and execution to ensure investments are in compliance with architecture at various levels, IT standards, and related policy requirements, by performing as defined in Federal and DoD regulatory guidance.

The contractor shall advise and provide assistance for local regional Enterprise execution and operations; including, but not limited to, identification of concerns and issues, corrective action recommendations, and implementation resolution oversight; as well as customer outreach efforts.

The contractor shall perform services supporting the CIO’s Office. The contractor shall perform services support the IT Policy and Planning (ICTP) office.

The contractor shall perform the activities supporting the CIO’s Office as part of the MDA/ICT organization, the IC Regional Locations, and the MDA/ICTP organization, as identified in

July 2017 18 paragraph 3.2.3, producing the Key Products/Technical Data identified in paragraph 3.2.4. This performance objective has no associated IA Workforce requirement.

3.2.2 Any and all of the Executive, Regional, or IT Policy Services tasks below may be executed. The Executive, Regional, or IT Policy Services must comply with the BMDS Security Classification Guide (SCG) and the respective element/component unique SCG and Program Protection Plans.

CCC phraseology means crossing all CIO organizations as well as current and future contracted activities, to include current contracts: JRDC, prime Northrop Grumman; MICS, prime NMR Consulting; SAP / JWICS IT Services, prime General Dynamics Mission Systems; MiDAESS Task Order IC-02 Cybersecurity Compliance and Risk Management, prime Torch; BMDS CSM/CND Bridge, prime Booz Allen Hamilton; and SAP/JWICS CSM, prime Booz Allen Hamilton.

A&E consolidated integrated recommendations, once approved by the CIO, may be executed on the JRDC, MICS, and/or SAP/JWICS IT Services contracts, with reviews and impact analysis from the BMDS CSM/CND, ITMA, CCRM and/or SAP/JWICS CSM contracts, with post installation controls validation testing by the CCRM contract.

3.2.3 The contractor shall perform the following Executive, Regional, and IT Policy Services activities in accordance with the regulatory guidance identified in paragraph 2.1:

a. Product Delivery Site. Establish, within 30 days of contract start, and maintain the UMKO and CMKO portal sites, and/or JWICS portal site, where all Executive, Regional, or IT Policy Services key products/technical documentation such as Standard Operating Procedures (SOPs), briefings, analyses, reports, and recommendation information (plans, data, and reports); as well as metrics, trip reports, weekly activity reports, and schedules are organized and posted.

b. Day-to-Day. The contractor shall assist in the technical and business operations covering all Executive, Regional, or IT Policy Services activities. Monitor day-to-day execution and operations of current and new networks and systems. Assist with developing strategies and plans, for emerging and future technology initiatives based on the A&E products. Maintain, review, and update processes and procedures.

1) Assist with and provide recommendations on developing Executive, Regional, or IT

Policy Services strategy, conducting reviews of existing technologies and systems, reviewing policies Federal, DoD, and MDA guidance, processes, and procedures for CIO related activities.

2) Review and evaluate A&E coordination and changes with current configurations, STIGs/IAVMs, and new technologies, for technical soundness, performance, and adherence to standards, plans, goals, and security considerations.

3) Prepare briefings, white papers, information papers, recommendations, governance metrics, and policy assessments.

July 2017 19

4) Engage in daily execution processes, such as classified document accountability, draft electronic tasking (referred to as E-Tasker) responses, and maintenance of policy, planning, and investment records.

5) Identify MDA directives, instructions, manuals, guidance, workflows, and processes impacts and recommended changes required to comply with Federal and DoD guidance and associated reporting.

6) Support the development, maintenance, execution, and monitoring of 2LTR Annual

Service Level Agreements (SLA) construct and actual Quarterly IT Service (Core vs Customer) Metrics Reporting by providing the related metrics.

7) Engage in customer identified concerns and present recommendations to the

Government Regional Leads.

8) Prepare and submit trip reports when at other than normal MDA office locations.

9) Assist and support ICTP, ICT, Regional IT Lead, CIO, MDA, and DoD meetings, conferences, presentations, and briefings as requested by CIO, ICT, ICTP or Regional IT Lead.

10) Prepare and deliver to ICTP a weekly activity report covering all Executive, Regional, or IT Policy Services activities.

c. Regional IT Services. The contractor IT/Network specialist shall perform the following activities for their Region.

1) Establish, within 45 days of contract start, and maintain, annually, the SOP to include as a minimum each location’s specific Regional SOPs for: Local Customer Coordination/Out Reach; Escalating local issues for resolution; Facility and Workforce moves/modifications for minimizing Enterprise impacts; New Employee Office IT Assignment and Installation; Enterprise Sustainment CCC Planned Outage/Impact Coordination, Tracking and Reporting; and CCC Unplanned Outage/Impact Notification, Escalation, and Coordination.

2) Assist with local customer IT service and project specific issues.

3) Engage and facilitate the CCC regional services coordination for both planned and unplanned Enterprise service outages/impacts, ensuring secure operations, and establish the associated escalation process.

4) Engage and facilitate the CCC regional services coordination, scheduling, monitoring, tracking, and execution of annual business IT consumption (such as agency annual conferences (MDA, OCONUS International, and Employee Awards), monthly and annual financial processing bottlenecks, Government employee timecard and annual assessment

July 2017 20 overloads, regional events (such as bring your child to work, Organization Day), and etc.)

model and needs.

5) Engage in facility workspace management and planning at each region, tracking all local and Enterprise-related proposed changes as well as verifying physical security plans; to include office consolidation and facility infrastructure planning, implementation, and/or migration.

6) Engage and facilitate the CCC regional services readiness and emergency preparedness documentation such as CCC regional Alert Roster. Establish and maintain annually the CCC regional Alert Roster and other emergency preparedness documentation.

7) Engage in customer identified concerns and present recommendations to the

Government Regional Leads.

8) Engage and support the acquisition process for unique regional requirements by participating in the MDA chartered CIO Portfolio Management and Integration Board (PMIB) defined processes: the Project Steering Committee (PSC) review and approval of the requirements, providing Procurement Initiation Documents (PID) package requirement content, and Engineering and Architecture Board (EAB) reviews of designs and implementations.

9) Engage, facilitate, and perform at least monthly quality assurance assessment on

CCC general enterprise and regional daily execution processes; such as classified document accountability; office and desktop red/black separation; IT Request completion and closeout;

PKI compliance; physical security compliance; and consolidated electronic tasking responses (referred to as E-Tasker).

10) Monitor, assess, and report monthly the trending metrics by region on: inventory levels, regional project status, open and closed IT request status, and in/out processing moves.

11) Assist with MDA CIO Office meeting orchestration: proposing agenda topics, identifying locations, working invitation list, assisting with presentations, assisting with meeting minutes, assisting with meeting execution, and actively participating in the meeting representing the regionally unique interest.

12) Perform technical analysis and provide technical positions, findings, and reports.

Perform technical quality assurance reviews of contractor work products and deliverables and provide technical positions, findings, and reports

13) Develop and maintain a detailed schedule looking three months forward (3-month plan) and one month back (actual dates executed) containing Regional timelines, technical data deliveries, executive meetings, travel, and etc.

d. Executive Services. The contractor analyst shall perform the following executive services for the CIO.

July 2017 21

1) Maintain/post the CIO IT-related Directives, Policies & Guidance Documents

Reference Materials Library on the MDA UMKO and CMKO portal sites.

2) Administer the electronic tasking (E-Tasker) CIO organization unclassified and classified mailboxes for incoming taskers, both from organizations internal and external to MDA, distribute tasking to the correct CIO organization, schedule and monitor tasking response, review tasking response for correct format, coordinate CIO review and approval of tasking response, and once approved distribute response to either internal or external MDA organization. All Cybersecurity Authorizing Official documentation processes through E-Tasker for review and signature.

3) Orchestrate the CIO staff meeting: schedule the meeting, propose the agenda, identify and secure approval of venue for events, prepare and distribute meeting notices, distribute agenda, distribute call for charts containing Internal Controls and DoD reporting metrics, assist with access control, post briefings (may include executive-level CIO information and/or decision briefings), prepare Executive read-ahead package, facilitate meeting, prepare minutes and action item tracking, post approved minutes to include decisions, track action item closure, and provide recommendation for action item closure. Note: CIO staff includes all CIO organizations both Government and Contractor members. Note: CIO Staff Meeting documentation is posted to the

UMKO.

4) Prepare CIO technical and financial briefings, whiteboards, and white papers for CIO communications during executive level meetings and briefings, internal and external to the agency.

5) Maintain currency with DoD guidance, IT technology, and IT business practices.

Provide recommendations to the CIO on potential changes based on DoD guidance, IT technology, and IT business practices

6) Draft the overall CIO weekly activity report from across the CIO organization, for CIO communications to other executives.

e. CIO Office Governance and Management Services. The contractor analyst shall perform administration, quality assurance and oversight management of CIO Office Governance and Management Services for ICT. As noted in paragraph 3.0, while the Performance Objectives stovepipe specific technical activities, the contractor’s performance in conjunction with the Government team and other CIO related contracts are to perform as an integrated team, with the MDA workforce defined as the customer.

1)…