DRAFT Solicitation HR0011-11-R-0003 Attachment 1 Statement of Work

Attachment 1 Solicitation No. HR0011-11-R-0003

April 8, 2011

STATEMENT OF WORK

CONTRACTOR SUPPORT SERVICES FOR THE

DEFENSE ADVANCED RESEARCH PROJECTS AGENCY (DARPA),

SUPPORT SERVICES OFFICE (SSO),

SECURITY AND INTELLIGENCE DIRECTORATE (SID)

TABLE OF CONTENTS

SECTION 1 DESCRIPTION OF SERVICES P.3

SECTION 2 SECURITY POSITION DESCRIPTION/REQUIREMENTS P.6

SECTION 3 DELIVERABLES P.41

APPLICABLE DOCUMENTS/FORMS P.46

ACRONYMS & ABBREVIATIONS P.50

SECTION 1 - DESCRIPTION OF SERVICES

1.0 OBJECTIVE: The objective of the Security Support Services Contract is to provide the Defense Advanced Research Projects Agency (DARPA) Support Services Office’s (SSO), Security and Intelligence Directorate (SID) with a professional capability to augment the government staff and to execute the inherently non-governmental functions central to SID’s responsibilities in preserving and enhancing National Security objectives through active and integrated security operations, processes, mechanisms and management. This support must provide multi-disciplinary security execution across the life of a program; including analytical/program protection support, flexibility and responsiveness to dynamic DARPA technology protection challenges. The government requires full-time support in a number of security disciplines. Individuals supporting these tasks may be required to perform a combination of the functions described in this Statement of Work (SOW). These security services are required for programs at all protection levels (unclassified, collaterally classified, Sensitive Compartmented Information (SCI), and Special Access Programs (SAP)).

1.1 DARPA’s mission is to maintain the technological superiority of the U.S. military and prevent technological surprise from harming our national security by sponsoring revolutionary, high payoff research. DARPA’s mission is also to create technological surprise for our adversaries. This implies one imperative – radical innovation for national security. DARPA’s business philosophy is to bring in expert, entrepreneurial program managers (PM) for the technical programs, empower them, protect them from red tape, and quickly make decisions about starting, continuing or stopping research projects. The DARPA technical staff organization is dynamic and changes as the projected requirements of the Department of Defense, the state-of-the-art of technology development, and adversarial threats to the United States evolve.

1.2 SSO’s mission is to provide a knowledgeable, lean, and adaptable staff exemplifying world-class customer service in support of the DARPA mission; supplying the tools, facilities, expertise, administrative services, and secure environment that enables the technical and administrative offices to perform their jobs more quickly, with greater ease and economy.

1.3. SID’s mission is to develop, manage and implement programs that facilitate the secure and successful accomplishment of DARPA’ s mission, while protecting DARPA technical and administrative personnel, information, property, and ensuring business continuity. SID supports this mission by planning, executing, and directing multi-disciplined security, emergency management, and international cooperation at DARPA. SID also formulates and implements security policy and procedures at DARPA and represents DARPA on security matters with external organizations.

1.4 SID’s objectives are to provide world-class service to each of our customers; to establish credible Agency policy and procedures; to be responsive to technical program needs in a timely manner; to represent DARPA’s interests in National Security Forums; and above all, to protect our people and information. SID’s challenge is to accomplish the mission and objectives while enabling the DARPA business philosophy. The SID requires a contractor that will provide a high-quality professional security staff that believes in teamwork and customer service and that will partner with SID to accomplish these objectives using initiative, innovativeness, and cost consciousness. In fulfilling this responsibility, SID requires a support services contractor experienced in developing, implementing and maintaining programs that facilitate the secure and successful accomplishment of its mission while protecting DARPA personnel, information, property, and maintaining business continuity consistent with DARPA’s Mission, Public Law, National Policy, and Department of Defense Directives and Regulations. Just as the DARPA technical offices (Figure 1) dynamically change to meet the Agency’s obligation to providing world-class technology vision and leadership, the SID organization must remain flexible to provide seamless security support to the technical offices and their industry and academia researchers and capability builders. The SID organization chart in Figure 2, on the following page, reflects the current structure to support the Agency’s needs.

1.5 Paramount to SID’s support to the DARPA vision and mission is the concept that in every security related action or document approved by the DARPA staff, the action is accomplished, or the document approved, on behalf of the DARPA Director. Therefore, the contractor will ensure that the contents and formats (including spelling and grammar) fully comply with DoD, governmental, and accepted English standards. The contractor staff in support of SID is expected to fully comply with this concept.

2.0 General and specific tasks for all positions on this contract are provided in Section 2.

2.1 Deliverables which may require the efforts of multiple positions are identified in Section 3.

2.2 Executive Orders, United State Code, Department of State, Director National Intelligence, Defense Intelligence Agency and Eos, other Agency Instructions, Directives, Memos, Guides, Forms, etc are applicable to the duties and tasks articulated in this Statement of Work and are provided on page 46. Current and updated versions shall be used in lieu of outdated copies.

2.3 Common Acronyms and Abbreviations associated with the duties and tasks are provided on page 50.

2.4 The Director, SID, from time-to-time tasks government staff with contractor support to address issues that arise which are either outside the responsibility of individual SID offices, or which encompass the responsibilities of multiple ones. These tasks whether assigned to a single individual or to a group take the form of a Special Project, Study, Assessment or Analysis, (either government only, or mixed government/contractor) and normally require extensive knowledge of security disciplines and an understanding of DARPA missions, functions, and organization and may be of a time-sensitive nature.

3.0 On the following page, Figure 1 shows the basic organization of DARPA and the relationship of the SSO and the SID to the Technical Offices (all other administrative and support offices have been left out for brevity). Figure 2 shows the basic functional organization of SID.

Figure 1. BASIC DARPA ORGANIZATION

SECTION 2 - SECURITY POSITION DESCRIPTION/REQUIREMENTS

OVERVIEW: Each position on this contract requires the ability to work independently, with little to no supervision. Flexibility and adaptability to change and innovation are imperative in supporting DARPA. The DARPA mission model is based upon a consistently changing and evolving leadership and PM base. Each position has its core functional requirements listed.

However, in addition to the position-specific requirements, all positions on this contract will be required and expected to incorporate the following base-line professional business functions in their specific job descriptions:

a) Attend meetings (either out-of-area or locally) and create meeting summaries or trip reports;

b) Prepare and submit Meeting Minutes on an as-required basis;

c) Prepare/present briefings, incorporating graphics (if appropriate) for/to SID and DARPA leaders;

d) Prepare various, numerous, security forms associated with their duties;

e) Assist in entry control and perform escort duties for visitors;

f) Answer telephones and other modes of administrative communications in the performance of duties;

g) Perform self-inspections; identify security discrepancies, and report security incidents;

h) Perform, or support, security inspections; identify security discrepancies; prepare reports;

i) Perform courier duties within the continental United States (CONUS);

j) Perform user-level security administrator and information security responsibilities, as required and in compliance with US Codes, Executive Orders, DoD, and DARPA policy in addition to their core duties;

k) Perform objective reviews on all documentation encountered during performance of duties;

l) Update security databases (e.g., SIMS, SILVERADO, CAST, JPAS, suspense tracking, personnel files, facility, etc), as required, in the performance of assigned duties;

m) In conjunction with other contract Subject Matter Experts (SME) perform QC reviews of all documentation provided to SID staff. These QC reviews will encompass technical content, spelling/grammar, and delivery format (including required reference/back-up materials) to ensure the highest professional standards are applied;

n)

Security professionals assigned to positions under the SOW are expected to perform the tasks germane to their assignments. There are detailed descriptions of the positions associated with the services required under each job description. In addition to those specific tasks each of the security professionals performing under the contract, within their area of responsibility, are expected to apply the policies, guidance, and instructions appropriate to their programs, and in concert with the stakeholders involved, to:

1) Identify their duty to protect. This includes: (1) identifying and/or assisting in the identification of information and/or assets requiring protection, (2) identifying, interpreting, and analyzing protection requirements critical to protecting the identified information and/or assets, (3) specifying laws, standards, regulations, policies, and requirements that govern the identification and protection of the information and/or assets, and (4) determining how those laws, standards, regulations, policies, and requirements need to be applied to identify information and/or assets requiring protection.

2) Review, respond, and solve security-related concerns, issues, and problems that fall within one’s area of responsibility and provide stakeholders the technical assistance and guidance they need to effectively perform their security roles and responsibilities.

3) Specify and provide direction on the laws, standards, regulations, policies, and requirements that:

a) Identify roles and responsibilities associated with the classification decision process (original and derivative). Determine security practitioner’s roles and responsibilities in the classification decision process and enact actions, under one’s own area of responsibility, that facilitate the effective execution of the classification decision process.

b) Are applicable to security clearance processes (e.g., personnel security clearance, facility security clearance), and determine how those laws, standards, regulations, policies, and requirements need to be applied in one’s area of responsibility and enact actions that result in the accurate determination of an entity’s eligibility for a security clearance.

c) Call for the application of risk assessment processes and determine how those laws, standards, regulations, policies, and requirements need to be applied in one’s area of responsibility and enact actions that result in the systematic identification, characterization, and evaluation of risks.

d) Are applicable to the application of countermeasures to manage risks to identified information and/or assets requiring protection. Identify potential countermeasures that can be applied to reduce identified vulnerabilities and enact actions that result in the systematic evaluation of costs and benefits associated with each identified countermeasure. Prioritize countermeasures to support risk management decisions, and support the implementation and/or implement specified and/or selected countermeasures to manage risks to identified information and/or assets requiring protection.

e) Are applicable to the development, implementation, and evaluation of security awareness, education, and training programs. Determine how those laws, standards, regulations, policies, and requirements need to be applied in one’s area of responsibility and enact actions that result in the execution of effective security awareness, training, and education requirements.

f) Are applicable to the detection, identification, and handling of security incidents.

Determine how those laws, standards, regulations, policies, and requirements need to be applied in one’s area of responsibility and enact actions that facilitate the effective handling of security incidents.

g) Are applicable to the need to evaluate security program effectiveness. Determine how those laws, standards, regulations, policies, and requirements need to be applied in one’s area of responsibility, to enact actions that facilitate the comprehensive and targeted evaluation of a program’s effectiveness (including the identification, characterization, and communication of lessons-learned) and identify, coordinate, and execute program modifications and improvements based on evaluation results.

h) Are applicable to the development and generation of plans for protecting information and/or assets. Determine how those laws, standards, regulations, policies, and requirements need to be applied in one’s area of responsibility and enact actions, based on the application of sound risk management planning, that result in the development, documentation, and coordination of plans for protecting information and/or assets.

4) Appropriately identify, coordinate, and/or manage resources necessary to successfully pursue security mission and/or roles and responsibilities.

1. PROGRAM MANAGEMENT TEAM:

DARPA requires an on-site management team that will have the full authority to commit the company to all operational functions in support of the contract and to represent and act for, and in the name of, the company in all contract matters relative to the execution of this contract.

PROGRAM SECURITY REPRESENTATIVES:

Program security representative (PSR) support provides life-cycle protection for research, development, test & evaluation/science & technology (RDT&E/S&T) programs at DARPA.

PSRs provide embedded support to the various DARPA Technical Offices. The PSRs utilize their omnibus security discipline expertise to provide services to program managers. Physical security expertise and the associated responsibilities are inherent in the PSR tool-kit in assuring appropriate security infrastructure and practices are incorporated at DARPA program performer locations.

2.1 The Contractor shall provide program security support with personnel referred to as PSRs to work closely with government Program Security Officers (PSO). The security scope of the programs to be worked on by the PSR will range from Unclassified through TOP SECRET and include SAP and SCI compartments. The PSR is embedded into one or more DARPA Technology Offices. The primary functions of the PSR shall be to provide security augmentation support to the PSOs and the DARPA technical office PMs and program SETA staff in determining, interpreting, and applying security requirements applicable to assigned technical office programs. PSRs are expected to be familiar with DARPA policies and procedures as well as the programs to which they are assigned. The PSR shall use initiative, innovation, and risk management techniques to apply program security requirements in such a manner that the programs can be executed in a cost-effective, schedule compliant manner, with minimum risk to information, personnel, and business continuity. The PSR shall apply their security background knowledge to aid the PSO, PM and SETAs in identifying and managing risks associated with the programs. The PSR’s duties will include, but are not limited to: working with the DARPA SID Program Security Office (SAPCO for SAPs) to establish security compartments, as required, develop security classification guides (SCG); write and coordinate Department of Defense Contract Security Classification Specification’s (DD Form 254); and, in cooperation with DARPA program performer security staffs: the selection, interpretation, and implementation of information, industrial, physical, and personnel security concepts applicable to the DARPA programs; recommend the adoption of appropriate OPSEC measures, information technology concepts/configurations, International Traffic in Arms Regulation (ITAR), and Export Administration Regulations (EAR) procedures. PSRs are expected to support multiple programs, if required. When incidents occur, conduct containment actions and develop a recovery strategy and procedures to prevent recurrence.

2.2 In order to be able to understand the challenges and effectively interface with the PMs, their SETAs, admin staff, and performer staffs, PSRs are required to have or to develop rudimentary background knowledge of the technologies and proposed applications involved in the programs for which they will provide informed security support and recommendations.

2.3 Typical duties of a PSR include, but are not limited to:

1) Using their knowledge of the various security disciplines (e.g. physical, information, personnel) determine, apply, and monitor appropriate security requirements and tasks relative to the specific technology programs to be protected; prepare and present suggestions for improvement;

2) Research and recommend/develop long and short range security strategies and tactics for new or established programs, or changes in program direction;

3) Develop DD 254's, ensure security requirements are spelled out clearly on the initial contracts and required security documentation is provided to the contractor;

4) Establish and sustain personnel access actions, to include personnel Tier reviews, document control, and other database maintenance, applicable to the specific areas (collateral, SCI, or SAP);

5) Apply a working knowledge of Executive Order 12968 and 13526;

6) In cooperation with other SID offices, assist in the investigations/inquiries of security violations and Practices Dangerous to Security (PDS) conducted in accordance with DoD 5105.21-M-1;

7) Assist in determining program access requirements/process personnel for access;

8) Indoctrinate newly assigned personnel and de-brief departing personnel;

9) Support the creation, processing, coordination, and approval of physical security and Automated Information Systems (AIS) accreditations, as well as entering such information and including individuals, programs, contracts and performers, if required, into appropriate information security management systems, i.e.,

a. DARPA ISMS;

b. JPAS;

c. CASTS;

d. SCATTERED CASTLES; and,

e. SILVERADO.

10) Provide program courier services, as required;

11) Plan, coordinate, and manage security support for test activities, including equipment/material/personnel transportation;

12) Develop, write, review, coordinate, and execute security documentation, i.e.,

a) SCGs; provide guidance and assistance for all security levels, including collateral, SAP and SCI;

b) Program Protection Plans;

c) Public Affairs / Perception Management Plans;

d) Exposure Contingency Plans;

e) System accreditation plans;

f) Test Security Plans;

g) System Security Plans;

h) Detailed trip & meeting reports;

i) Technology Transfer and Program

Transition Plans;

j) Standard Operating Procedures;

k) Memorandums of Agreement and

Understanding;

l) Transportation Plans;

m) OCONUS Deployment Plans;

n) Managed Access Plans;

o) Treaty Compliance Plans;

p) Dismantle, Disposition &

Demilitarization Plans;

q) Determine Security Architecture

13) Plan, coordinate, provide, and manage security support for meetings;

14) Actively support Agency Program Security Reviews and Self-Inspection Programs;

15) Manage security incident investigations and reporting;

16) Develop and support intelligence requests to obtain state-of-the-world, rest-of-the-world, or state-of-the-art technology/capability status;

17) Perform OPSEC analysis and provide other OPSEC support, to include identification of critical program information (CPI), collecting and analyzing threat data, developing, and coordinating program OPSEC plans;

18) Participate in program close-outs reviews at program sites;

19) Prepare plans and provide on-site security for transportation of equipment and systems for program tests;

20) Travel to, and attend/conduct, briefings and plans for system/facility security changes;

21) Coordinate AIS testing with the Designated Approval Authorities, to include certification and accreditation requirements; and,

22) Attend program reviews, i.e., preliminary design reviews (PDR), critical design reviews (CDR), and integrated product team (IPT) reviews, to ensure changes to system baselines don't negatively affect security and initiate actions to add mitigation where necessary.

23) Provide the proper protection for privacy information.

3. SECURITY ASSISTANTS:

Security Assistants perform a vital administrative security support function by providing direct access control to secure areas; ensuring consistent and efficient processing and distribution of security-related documentation; the maintenance and monitoring of calendar schedules;

monitoring suspense items; conducting document quality reviews; scheduling presentation of special taskings; accepting deliveries of classified and unclassified materials (reports, presentations, etc); and, the management and administration of the SID-related portion of the Defense Travel Service database. SID has embedded Security Assistants in key positions throughout the Directorate.

3.1 The contractor shall provide administrative support across all functional areas to assure the maintenance of records and files, the preparation and distribution of mail, correspondence, reports, and other documents, and the maintenance of a suspense date file.

These efforts include the development, review, analysis, and preparation of ad hoc reports, spreadsheets, charts, graphs, and narratives.

3.2 The contractor shall perform the following duties related to security assistance:

1) Plan, conduct, analyze, evaluate, and report security issues;

2) Generate and maintain databases that reflect receipt, storage, inventory and disposition of information; to include data entry, updates, and generation of reports;

3) Conduct audits/inventories to ensure proper control and/or accountability;

4) Assist in the inspection, inventory, logging, storage, and internal distribution of information received;

5) Maintain and document personnel security programs, to include databases for all collateral, SAP, and SCI personnel;

6) Review and analyze requests for information;

7) Assist in the preparation and execution of security directives and security guides;

8) Assist in reviewing customer security regulations and procedures and determine methods of implementation;

9) Participate in security reviews, security incident investigations and preliminary inquiries, and surveys, as required;

10) Assist with implementing the Security Education Awareness training program;

11) Develop security education bulletins, directives, security plans, procedures and controls as required;

12) Prepare and protect security files, records and other information;

13) Perform entry, exit, visit processing, and escorting;

14) Conduct end-of-day security checks and performing other security administrative functions as requested; and,

15) Conduct indoctrination and debriefings, as required.

3.3 The contractor shall perform the following duties related to general administration:

1) Serves as the principal point of contact for the Director SID, Assistant Director Operations, and Assistant Director Program Security;

2) Provide day-to-day access control management of supported facilities;

3) Maintain supported facilities and conference rooms;

4) Assist customers in completing meeting checklist forms;

5) Complete and file, in and/out processing checklists on all personnel;

6) Coordinate with other security offices, organizations, and personnel in support of mission requirements;

7) Coordination of conferences and meetings at local and other supported facilities;

8) Perform files management functions for office to which assigned;

9) Perform calendar management functions for assigned offices;

10) The contractor shall perform the following duties related to documents and media:

a) Manage and update Document Control Center (DCC) procedures, and conduct DCC training

b) Handle incoming and outgoing faxes, and document scanning for faxing

c) Prepare packages & documentation for transmission via appropriate channels.

d) Pick-up and deliver selected items to local US Postal Service (USPS)

e) Receive and account for all USPS registered and Express mail

f) Maintain document control/accountability databases

g) Maintain magnetic and optical media, and perform annual inventories and reconciliation

h) Virus check media

i) Document and perform proper disposal of documents and magnetic media

j) Perform document archiving

k) Internal distribution of all office material

l) Update magnetic media used to backup all systems

m) Conduct secure Electronic Data Transfer service (EDTS) operations

n) Perform copying and other document/media reproduction

o) Perform self-inspections, identify security discrepancies, and report security incidents

11) Assist DARPA staff in completing personnel security related documents and ensuring that personnel are notified in advance when they are due for reinvestigation, and;

12) Provide the proper protection for privacy information.

13) Plan, support, and accomplish office automation support work using multiple automated programs and software;

14) Develop and/or maintain administrative methods and procedures for an office;

15) Schedule and track the calendar for appointments, meetings and travel, to include use of the Defense Travel Service System (DTS);

16) Maintain and follow-up on suspense records for correspondence or action items;

17) Prepare a wide variety of recurring and nonrecurring correspondence, reports and other documents;

18) Apply knowledge of management principles, organizational theory, and techniques of analysis and evaluation in order to conduct studies of automated clerical work processes;

19) Establish, update, and develop inclusive administrative office procedures and methods;

20) Gather information, verify facts, and assemble background materials, reference material, and reports for executive level officials for meetings and conferences;

21) Proof reading, QC, DoD and DARPA Format compliance, task tracking and disposition;

22) Establish and manage workflow staffing process;

23) Assist with new employee processing and indoctrinations to the respective SID offices;

24) Support the coordination of executive correspondence/products to resolve issues/obtain concurrences for planned actions; receive guidance on choosing appropriate courses of policy/programmatic or administrative actions; and,

25) Make recommendations for process improvements.

4. SECURITY ASSISTANTS (SA) IN THE SPECIAL SECURITY OFFICE (SSO)

The function of the DARPA SSO is to provide a reliable and secure means to receive and disseminate Sensitive Compartmented Information (SCI) to authorized recipients. The SSO has overall security responsibility of all SCI Facilities (SCIFs) and Temporary Secure Work Areas (TSWA) within DARPA. The SSO assists DARPA Technical Offices in the development, implementation, document marking, safeguarding, procedures for use, and the exercise of classification and declassification issues for SCI involved in DARPA programs.

4.1 Contractor SA in the SSO shall perform the following functions in supporting the

DARPA SSO:

1) Maintain applicable SCI directives, regulations, manuals, and guidelines to adequately discharge SSO duties and responsibilities;

2) Maintain listings of available SCI electrical and hard copy products;

3) Validate product request requirements, and ensure dissemination to authorized users;

4) Conduct SCI security briefings, indoctrinations, and debriefings;

5) Interface with SCI telecommunications centers, Automated Data Processing (ADP) facilities, computer centers, and similar offices to ensure SCI security;

6) Working with the SID Security Education, Training, and Awareness Office, develop and provide input for, and assist in conducting, a continuing SCI security education training and awareness program to ensure that all SCI-indoctrinated individuals are kept apprised of the requirements and guidelines for protecting

SCI;

7) Ensure appropriate accreditation documentation is available for each SCIF and communications/automated information systems under DARPA’s security cognizance;

8) Produce, review, and manage emergency plans for DARPA SCIFs, ensuring that these plans are in concert with Agency emergency planning actions;

9) In coordination with SID Intelligence/Counterintelligence Office, constantly evaluate SCI risks associated with DARPA facilities and programs and recommend appropriate countermeasures to mitigate them;

10) Create SOPs for DARPA SSO operations and review and provide recommendations, as appropriate, for DARPA program-specific SOPs involving the use or transport of SCI materials;

11) In cooperation with other SID offices, assist in the investigations/inquiries of security violations and Practices Dangerous to Security (PDS) conducted in accordance with DoD 5105.21-M-1;

http://en.wikipedia.org/wiki/Classified_information_in_the_United_States#Sensitive_Compartmented_Information_.28SCI.29_and_Special_Access_Programs_.28SAP.29

5. SECURITY ASSISTANTS PERFORMING PERSONNEL SECURITY TIER II

ADJUDICATOR DUTIES

5.1 The contractor shall perform TIER II SAP Access Eligibility Determination reviews, in accordance with DoD 5220.22-M-Supp 1, JFAN 6/4, and relevant DARPA/Service MOAs, to support DARPA’s SAPs.

5.2 The following are functional duty areas for the DARPA TIER II Reviewer:

1) Develop, review, and update as required: TIER 1 and TIER II office policies and procedures;

2) Determine, or initiate the process for determining, a candidate’s access eligibility;

3) Perform TIER I and TIER II SAP access eligibility determinations;

4) Input, as appropriate, TIER I & II access eligibility determination results into relevant database(s) ;

5) Review and process requests for interim SCI eligibility;

6) Monitor and track personnel security actions until complete;

7) Respond within two (2) working days to incoming eligibility determination requests and reports;

8) Review, and remain current, on the personnel security standards appropriate to the classification level of the programs for which access is being requested;

9) Prepare request for waiver and/or exception documentation and initiate staffing for approval;

10) Coordinate access approval or denial process with appropriate access approval authority;

11) Prepare documentation, as required to notify appropriate personnel of access approval or denial and staff or DARPA approval;

12) Conduct indoctrination briefings and processing of relevant documentation (e.g., SAP indoctrination agreement, nondisclosure agreements, polygraph agreement);

13) Update program access lists or roster in appropriate database(s) following indoctrination;

14) Coordinate the DARPA Polygraph schedule with the DARPA Polygrapher; and,

15) Provide advice to the DARPA SAPCO relating to the access eligibility review process and guidelines regarding TIER III issues, including the procedures to be followed in the appeal processes.

16) Provide the proper protection for privacy information.

6. PERSONNEL SECURITY SPECIALIST

SID manages a comprehensive personnel security program. This program includes efficiently and effectively processing DARPA employees for security clearances and access to both facilities and information. The program encompasses the collection and protection of personal history data, the review of that data to ensure its completeness, and the support and coordination for initial, periodic reinvestigations, special investigations, continued eligibility reviews, and adjudications by other agencies. The DARPA Personnel Security program ensures that all personnel meet the standards mandated by DoD Regulation 5200.2 to obtain and maintain a personnel security clearance and, if appropriate, accesses to SAP and SCI programs. The contractor shall support the DARPA SID in initiating appropriate investigative and administrative actions needed to ensure that DARPA and selected contractor personnel are efficiently and effectively processed for their security clearances and appropriate compartmented accesses.

6.1 The contractor shall perform the following tasks related to Personnel Security:

1) The collection and protection of personal history and privacy data; the determination, in conjunction with other DARPA entities, of position sensitivity levels;

2) Review of an individual’s background information prior to final adjudication submission. This includes determining:

a. The suitability of personnel for clearances and processing personnel for personnel security clearances by the collection of personal history data;

b. The review of the information collected, the coordination of appropriate background investigations with appropriate agencies and the maintenance of personnel security files;

c. The review of completed case files and Personnel Security Questionnaires (PSQ’s);

3) Update appropriate personnel database(s), handle phone inquiries, and protect the dissemination of adverse information reports;

4) Compose, analyze, edit, QC , transmit, and track security requests; input data into appropriate personnel database(s);

5) Research and verify data in security databases for DARPA staff;

6) Conduct liaison with Central Adjudication Facilities, DoD, and Intelligence Community (IC) agencies to coordinate clearance issues;

7) Update account authorizations for the appropriate personnel database(s);

8) Provide personnel security guidance to PSRs and other individuals in the DARPA technical offices who have personnel security responsibilities, including DARPA performer organizations having questions relating to DARPA’s involvement in providing personnel security support for Agency efforts;

9) Assist in training new SID and DARPA personnel on procedures involving personnel security issues; and,

10) Review security documents, draft, and initiate staffing of waiver request documentation to appropriate security authorities.

7. INFORMATION ASSURANCE SPECIALIST

IA encompasses, but is not limited to, the entire spectrum of Network Administration, Certification and Accreditation, Network Defense, and Enterprise establishment, management, and oversight. The DARPA systems to be protected include systems that process and store information from the unclassified (including controlled unclassified information) up to the Top Secret level, including SCI and SAP compartments operating on IT systems with protection levels 1-5. The contractor shall review and perform the IA tasks necessary to ensure that the existing DARPA IA program meets National and DoD Information Assurance standards and continues to protect and defend DARPA information and information systems by ensuring the availability, integrity, authentication, confidentiality, and non-repudiation of the systems. The contractor shall provide for restoration of information systems by incorporating protection, detection, recognition, and reaction capabilities. The DARPA systems to be protected include systems that process and store information at the unclassified, collateral, SCI and SAP levels.

7.1 Information Assurance personnel duties shall include, but are not limited to the following:

1) Certification and Accreditation Activities in accordance with DoD Instruction 8510.01, DCID 6/3, and NISPOM Chapter 8.

2) Analysis of Threats and Vulnerabilities and Risk Mitigation and Acceptance;

3) Examination of computer and associated equipment;

4) Reviewing and recommending changes or amplification of policy, procedures, and strategy development;

5) Ensuring that system security requirements are addressed during all phases of DARPA program life cycles (concept development, Request for Information (RFI), Request for Proposal (RFP) or Broad Agency Announcement (BAA), Proposal, Selection, Award, Closeout, Transition, etc.). This includes coordinating all technical security issues outside of area of expertise or responsibility with appropriate SMCs SME;

6) Monitor, as necessary, activities of DARPA and selected performer automated IS, providing advice and assistance, as required;

7) Develop and review Automated Information System Security Plan and/or System Security Authorization Agreement (SSAA);

8) Evaluate IA products and provide written recommendations as to their usefulness and/or adoption for the DARPA IA mission;

9) Develop and implement Red Team Plans and activities, as directed;

10) Develop, implement and evaluate, as directed, DARPA information system security program policy incorporating special emphasis on integration of existing SAP network infrastructures;

11) Establish, schedule, and perform network security analysis for DARPA systems;

these activities shall be based on established certification and accreditation processes; advise DARPA SID on IT certification and accreditation issues revealed;

12) Perform IA risk assessments and provide recommendations to SID;

13) Advise DARPA PMs and their SETA staffs on security testing methodologies and processes;

14) Evaluate certification documentation and provide written recommendations for accreditation to government PMs;

15) Periodically review system security to accommodate changes to policy or technology;

16) Evaluate IT vulnerabilities to assess whether additional safeguards are prudent;

ensure that certification, as appropriate, is accomplished for each information system;

17) Develop and maintain formal, written, Information Systems Security Program Standard Operating Procedures (SOP);

18) Ensure that all appropriate SOPs are readily available to DARPA performers assigned to IA tasks;

19) Ensure that all Information System Security Officers (ISSO), network administrators, and other Automated Information Security (AIS) personnel, to include DARPA performers performing these functions, receive the necessary, and required, technical and security training to carry out their duties;

20) Ensure development and implementation of an information security education, training, and awareness program, to include attending, monitoring, and presenting local AIS security training;

21) Develop, review, endorse, and recommend action by the designated approval authority (DAA) of system certification documentation;

22) Ensure approved procedures are in place for transfer, release, or disposal of automated information system equipment or products;

23) Conduct certification tests that include verification that the features and assurances are functional and support PL1 – PL5 accreditation, as needed;

24) Maintain a repository for all system certification/accreditation documentation and modifications;

25) Coordinate AIS security inspections, tests, and reviews;

26) Prepare policies and procedures for responding to security incidents, and for investigating and reporting security violations and incidents;

27) Ensure proper protection or corrective measures have been taken when an incident or vulnerability has been discovered within a system;

28) Ensure that security testing and evaluations are completed and documented;

29) Evaluate vulnerabilities to ascertain whether additional safeguards are needed;

30) Assess changes in the system, its environment, and operational needs that could affect the accreditation;

31) Ensure that certification is accomplished on each AIS;

32) Review AIS test plans;

33) Conduct periodic testing of the security posture of the AIS;

34) Research, write, and review additions, modifications, deletions to existing AIS SSP's including configuration, equipment, software and location changes;

35) Maintain System Security Plans (SSPs); review and make recommendations to PSOs on SSPs from DARPA performers;

36) Ensure configuration management (CM) for security-relevant AIS software, hardware, and firmware is maintained and documented;

37) Ensure that system recovery processes are monitored to ensure that security features and procedures are properly restored;

38) Ensure all AIS security-related documentation is current and accessible to properly authorized individuals;

39) Perform system audits on multiple systems; work closely with system administrators and ensure current security measures are sufficient and in compliance with approved policies and processes;

40) Participate in self-inspections (at DARPA and performer locations); identify security discrepancies and report security incidents;

41) Maintain a working knowledge of DARPA IT system functions, security safeguards, and operational security measures; as well as DARPA programs leveraging IT systems as their inherent capability;

42) Provide advice to SID Information Security and PSOs/PSRs regarding the control and accountability of magnetic and optical media of all types;

43) Perform virus and malicious code scanning on all computer media entering a facility, or provide the applicable certification and training of security administrators and PSRs to be able to conduct same;

44) Perform and conduct training, as required, for conducting secure file transfers between local systems to storage devices, this includes secure down writing of data between systems of different security levels;

45) Inspect incoming equipment to ensure it is what was ordered; inspect outgoing equipment to ensure proper disposal;

46) Provide technical advice and assistance, as required, and perform technical oversight over the development and implementation of new software database systems;

47) Provide technical advice and assistance, as required, and perform technical oversight on telecommunications requirements for Collateral, SAP, and SCI support;

48) In coordination with SID Emergency Management, review and provide AIS security relevant input to DARPA Emergency/Disaster plans and procedures;

49) Participate in Configuration Control Boards; and,

50) Assist in inquiries and investigations of possible security incidents involving local

AIS.

8. IA SPECIALIST PERFORMING COMPUTER NETWORK DEFENSE (CND)

FUNCTIONS

8.1 Contractor personnel assigned to perform CND functions on this contract perform the following functions: track, collect incident information, investigate, analyze, plan/coordinate, and direct all response and recovery activities related to computer security incidents.

8.2 The contractor shall perform a myriad of CND duties, to include:

1) Detection, respond, mitigate, and report on cyber threats affecting DARPA networks;

2) Maintain an understanding of the current vulnerabilities, response, and mitigation strategies used in cyber security operations;

3) Produce reports and briefings to provide an accurate depiction of the current threat landscape and associated risks;

4) Achieve acceptable configuration through passive evaluations (compliance audits) and active evaluations (penetration tests and/or vulnerability assessments);

5) Use data collected from a variety of CND tools (including intrusion detection system alerts, firewall and network traffic logs, and host system logs) to analyze events that occur within the DARPA environment;

6) Use of customer, community, and open source reporting to develop information on CND activities;

7) Analyze correlated information sources;

8) Facilitate the customer's posture to aggressively investigate cyber activity targeting customer information and its information infrastructure.

9) Maintain proficiency in the use and production of visualization charts, link analysis diagrams, and database queries;

10) Maintain knowledge of applicable CND policies, regulations, and compliance documents specifically related to DARPA assets;

11) Perform CND vulnerability assessments within the DARPA facility;

12) Perform assessments of systems and networks within DARPA and identify where those systems/networks deviate from acceptable configurations, DARPA policy, or local policy;

13) Perform CND vulnerability assessments within the DARPA facility, perform CND risk assessments within the DARPA facility, conduct authorized penetration testing of DARPA network assets;

14) Analyze and report cyber threats and assist in deterring, identifying, monitoring, investigating and analyzing computer network intrusions;

15) Investigate and perform incident analysis to include system, network, and malicious code analysis;

16) Participate in an Incident Response Team responsible for responding to computer security events;

17) Analyze site/enclave CND policies and configurations and evaluate compliance with regulations and DARPA directives;

18) Perform incident reporting with distribution to proper DoD channels and law enforcement/intelligence communities;

19) Additional duties may include providing intrusion support to high technology investigations in the form of computer evidence seizure, computer forensic analysis, data recovery, and network assessments;

9. SECURITY EDUCATION, TRAINING, AWARENESS AND OPERATIONS

SECURITY (OPSEC) SPECIALIST

A key component of SID’s protection mission for DARPA is to administer and conduct a comprehensive Security Education, Training and Awareness Program. Security awareness is the knowledge and attitude that members of an organization possess regarding the protection of the physical and, especially, information assets of the organization. In that regard SID manages an aggressive and on-going Security, Education, Training, and Awareness program. Many of the DARPA PMs and their supporting Systems Engineering and Technical Assistance (SETA) contractors come to DARPA with little, or no, experience working in the DoD or in an environment involving classified information. The SID security education program is a graduated one, tailored to the needs of its varied audience. It encompasses basic DARPA building access procedures, handling of classified information, intelligence and terrorist threats that may be directed against DARPA or its employees, the basics of OPSEC, and procedures to be followed in the event of an emergency. For selected individuals, additional security-related education is provided to acquaint, or reinforce, knowledge related to the safeguarding of SAP, SCI, and COMSEC materials, as well as other more specialized training needs. Periodic re-training is also managed and documented.

OPSEC is a Presidentially-mandated process (via National Security Decision Directive 298) and is implemented within the DoD by DoD Directive 5205.02. It is a process that identifies critical information to determine if friendly actions can be observed by adversary intelligence systems, determines if information obtained by adversaries could be interpreted to be useful to them, and then executes selected measures that eliminate or reduce adversary exploitation of friendly critical information.

9.1 The contractor shall perform the following duties related to Security Education, Training & Awareness:

1) Develop briefings, write scripts, develop charts/graphics for use during NISPOM required training;

2) Distribute program classified briefings (indoctrinations and updates);

3) Distribute security awareness products electronically

4) Conduct training needs analysis

5) Prepare and publish annual Agency security awareness training plan, short-term goals and long-term goals; update as required;

6) Write quarterly security awareness newsletters for general population;

7) Write security awareness newsletter for security educators;

8) Develop, review, and produce security awareness products that reflect adverse security trends;

9) Write training plans for quarterly awareness training and specific training modules; update as required;

10) Support DSS Academy's security awareness products web site and security professionalism initiative;

11) Liaison with the Defense Security Service (DSS) Academy;

12) Support DSS Academy's collateral and SAP security professionalism certification program and disseminate information to DARPA SID leadership, PSOs, and PSRs.

13) Write training plans for DSS Academy's SAP curriculum, as requested;

14) Support DSS Academy as an adjunct instructor for special program training curriculum, as required;

15) Support and conduct DARPA newcomer training;

16) Provide input for the rewrite of requirements documents to include the NISPOMSUP Overprint;

17) Convene, and conduct, quarterly security awareness meetings;

18) Assist in the development and maintenance of a DARPA security education products web site;

19) Write special reports of security topics of interest for community;

20) Schedule, convene, conduct, and participate in miscellaneous meetings discussions with other service or Agency security educators (DSSA, Navy, etc.);

21) Update security awareness products to maintain accuracy;

22) Schedule personnel to attend off site training; and,

23) Disseminate policy documentation and correspondence to the community, as requested.

9.2 The contractor shall be an integral team member of the DARPA OPSEC process. The contractor will work in close cooperation with the DARPA OPSEC Manager to ensure that the Agency’s information, personnel, and programs have the appropriate OPSEC posture to counter adversary collection. The contractor, in cooperation with other elements (contractor and government) of SID and DARPA, shall perform the following duties related to OPSEC:.

1) Become thoroughly familiar with the DARPA organization, and with the programs (and the performers) that the Agency is currently pursuing, and remain current on emerging programs;

2) Working closely with Technical Office PMs, their SETA staffs,…