20150415_HS0021-15-R-0011-0001_NISS_FINAL.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to add item 41 to the NISS Reading Room w hich is the NISS Requirements Repository _v5_1_final and to update Anticipated NISS Delivery Increments section.

1. CONTRACT ID CODE PAGE OF PAGES

S 1 7

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 15-Apr-2015

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X HS0021-15-R-0011

X 9B. DATED (SEE ITEM 11)

13-Feb-2015

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

15-Apr-2015

CODE

DEFENSE SECURITY SERVICE

SUMMER WILSON 571.305.6709

RUSSELL-KNOX BUILDING

27130 TELEGRAPH ROAD

QUANTICO VA 22134-2253

HS0021 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

HS0021-15-R-0011

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

The following have been modified:

SOO CONTENT

This is a single award Indefinite Quantity Indefinite Delivery (IDIQ) type contract. Task orders shall be issued under this arrangement. Total orders under this contract shall not exceed $50,000,000 including all options periods.

(One-year base, four one-year options). The guaranteed minimum is $100,000 for the basic period only. There is no guaranteed minimum for the option periods, if exercised. Orders may only be issued by the Defense Security Service (DSS) Office of Acquisitions (AQ) contracting officers.

NATIONAL INDUSTRIAL SECURITY SYSTEM (NISS) STATEMENT OF OBJECTIVES (SOO)

Introduction As one of four Government Security Agencies (GSA) directed to implement the National Industrial Security Program (NISP) per Executive Order 12829, the Defense Security Service (DSS) provides Industrial Security Services and training to the Department of Defense (DoD) and twenty-seven other federal agencies. Administering the NISP to cleared contractors eligible to receive, handle, and protect classified information for DoD and the 27 agencies makes DSS responsible for an industrial base that includes over 13,000 cleared facilities, 40,000 classified information systems, and over 10,000 industrial security professionals.

Purpose There is an existing “gap” between DSS Agency capacity and national security requirements being predominantly driven by a summation of challenges found within three Agency operational activities:

1) Process Facility Clearances (FCL)

2) Conduct Proactive Monitoring

3) Manage Incident Response

DSS currently conducts its critical missions without an integrated enterprise information technology architecture.

The lack of an enterprise IT solution results in cumbersome, inefficient, and exceedingly manual processes that jeopardize the success of DSS missions.

Five primary factors that span across the three forenamed operational activities challenge DSS’s ability to effectively administer the NISP and account for Industry’s rapidly evolving security environment:

1. Limited ability to identify vulnerabilities and mitigate the expanding threat through consistent interaction and partnership with Industry, given resource constraints

2. Increasing reliance on proactive NISP stakeholder partnerships, which can be met with hesitation

3. Scaled directorates to meet growing mission sets, resulting in potential service delivery overlap

4. Required Department-level clarity on critical issues, such as cyber defense, fogging the Agency’s ability to determine mission effectiveness

5. Legacy technological infrastructure out-stripped by modern information security demands, and actually hampering the Agency’s ability to provide timely support to NISP stakeholders

The National Industrial Security System (NISS) is the working name for a new, automated business information capability that DSS is seeking to replace and expand upon the following legacy systems: Industrial Security Facility Database (ISFD) and the Department of Energy (DoE) hosted but DSS owned Electronic Facility Clearance System (e-FCL). The NISS Solution will be an integrated automated solution that will facilitate efficient execution of the Agency's core mission. It will use available technology to drive smoother user workflows, enhance decision-making through stronger and timelier synthesis of information, and improve transparency pertaining to the National Industrial Security Program (NISP). The NISS requirements capture the desired ISFD and e-FCL functionality, which includes workflows to enable contractor performance, provide proactive oversight, and complete reactive incident response. The DSS managed ISFD system and DoE managed e-FCL system contain DSS data which must be migrated to the NISS database for Full Operational Capability (FOC). The successful vendor may be required to incorporate additional functionality.

NISS will allow users to sift through vast volumes of information and more easily form linkages about a facility and its Key Management Personnel (KMP), effectively closing Industry’s safeguarding gaps, while allowing DSS field personnel to proactively partner with Industry on-site through Security Vulnerability Assessments (SVAs).

Presently critical resources are diverted from meaningful customer engagement and identification of high-risk threats to menial data entry without an effective NISS enterprise IT solution.

High Level Objectives for the NISS approach include the following:

a. Expedited performance against classified contracts

i. Streamlined facility clearance (FCL) processing

ii. Enhanced FOCI identification and mitigation

iii. Accelerated and improved C&A of Industry information systems

iv. Expedited production of quality information

b. Enhanced data linkages to provide full risk profile

i. Increased information sharing and transparency

ii. Automated prioritization of Industry engagement (FIL)

iii. Implemented enterprise risk analytics capability

c. Improved ability to make metrics-based decisions

i. Enhanced automated metrics capture and analysis

d. Improved vulnerability management from identification through mitigation

i. Improved vulnerability reporting through automation

ii. Streamlined vulnerability oversight

iii. Expedited vulnerability mitigation

e. Improved threat management from identification through mitigation

i. Improved threat reporting

ii. Expedited threat mitigation

f. Increased technology effectiveness and mobility

i. Create a mobile technology solution to meet mobile workforce needs

ii. Improve ability to utilize data from multiple sources, classifications, and types in a single location

iii. Improve analysis

iv. Improve discovery of unknown unknowns. Expedite data submission validation

NISS Required System Attributes

Attributes required for the NISS include the following features:

a. BPMN - The Defense Security Service (DSS) requires a product which enables the capturing of business operations through Business Process Modeling and Notation (BPMN) workflows with work prioritization.

b. Workflow Management – The contractor shall provide NISS users with the ability to manage workflow processes and ensures that out-of-the-box vender functional capabilities are available.

c. Facility Profile Creation – The contract shall provide an end product that will ensure that each facility has a profile within NISS that includes information such as the facility address, region, KMP list, corporate website, corporate legal structure, research data, facility actions, alerts, change conditions, workflow status, etc. The system shall visually display parent-child and related ownership hierarchies between facilities and companies.

d. Search/Content Management – The contractor shall provide a system that will enable site-wide searching for internal and external users on various information within the NISS. While search functionality provided as native capabilities will likely require further customization to meet Agency needs.

e. Reporting – The contractor shall provide a system that will calculate and display standard metrics related to all DSS processes conducted within the system. Additionally, the system should enable advanced ad-hoc reporting and analytics that can record and report historical transaction and usage data, and conduct real-time validation of the data. Reporting should facilitate the implementation of the risk management framework which includes identification of potential threats to detection of realized impacts, for the Industrial Security Supply Chain. The reporting should enable data-driven decision making to identify risks within the supply chain and enable executive level reporting for performance management.

f. Analytics – The contractor shall provide a system capable of transforming structured and unstructured data to help identify and develop meaningful and actionable information to inform business decisions and identify trends or risks. This analytic capability should allow for the easy interpretation of volumes of data, and provide historical, current and predictive views of internal

(DSS) and external (Industry) operations. The system should acquire, process, and correlate data that is within the system, as well as within linked sources.

g. Integration and Interoperability – The contractor shall provide a system that will enable access to data from databases internal and external to DSS to complete internal processes and validate information included in this DSS system of record. The technical solution shall conform to DoD Guidelines and DSS infrastructure. The expectation is that the delivered product will have already incorporated external system integration activities prior to DSS Pre-Production staging.

h. Storage – The contractor shall provide a system that will allow users to upload and save documents as well as unstructured data.

i. Dashboard Portal/Single User Interface – The contractor shall provide a system that will present workflow data, notifications and messages, dependent upon roles and permission level assigned to each user. The graphical user interface (GUI) must be innovative in nature.

j. Auditing – The contractor shall provide a system with the capabilities to ensure that transactional logs of various actions are recorded and saved. This includes, but is not limited to, the overall system transactions and facility profile transactions.

k. Attribute Based Access Control (ABAC) – The contractor shall provide a system that establishes rules for users’ access, roles, and permissions within the NISS, in accordance with NIST SP 800- 162.

l. Help – The contractor shall provide a system that provides access to job aides, FAQs, and other help-related documentation.

m. Mobile Capabilities – The contractor shall provide a system that converts core NISS capabilities into a mobile version for access over mobile devices.

n. Automated Notifications/Alerts/Messaging – The contractor shall provide a system that provides the ability for internal and external users to liberally manage notifications, alerts and messages.

o. Automated Cross Domain Solution (CDS) – The contractor shall provide a system that enables automated transfer of data between NIPR and SIPR without spillage. The developer must enable a bridge for NIPR information to be ingested up to SIPR, and primary unclassified NISS SIPR information to be available down to NIPR. A near real-time, bi-directional cross-domain data solution will be required to be in place at NISS initial deployment. The CDS will be included within and throughout the workflow processes.

p. NoSQL (Not Only SQL) data repository with modular systems integration to allow for multiple transactional systems to utilize, modify and validate data

q. Data Migration – The existing legacy application contains data which will continue to be used and must be migrated into the NISS. The developer must prepare existing data so that it ports into the new system without losing functional meaning and with minimal disruption of service for daily operations. Data fields for the existing and receiving systems shall be formally documented mapping schemas for review and approved by stakeholders for accuracy.

r. GUI Interfaces – The Agency requires internal and external GUI interfaces. The interfaces should automate the exchange of Industrial Facility Clearance data, between DSS internal systems and extra-Agency systems. Timely exchange of this information will allow Agency representatives to execute proactive monitoring, risk response, and assessment responsibilities.

s. Milcloud Development - The winning Proof of Concept (PoC) will be uploaded to and developed by the contractor to the DSS Milcloud environment. Milcloud will serve as the development environment for the NISS. The contractor will be expected to conduct remote development activities within the DSS provided Milcloud environment. The Agency anticipates two possible infrastructure related end states for NISS Production; a MilCloud Production instance or deployment to physical virtualized hardware located in Quantico, VA and Monterey, CA.

NISS Delivery Increments

Anticipated NISS Delivery increments include the following:

a. TASK ORDER 0001: Incorporate ISFD and E-FCL into Core NISS Foundation Capabilities – The first increment will provide DSS with core ISFD and e-FCL capabilities and establishes the foundation for accessing facility data, site navigation, and fundamental application functionality within the NISS. The NISS requirements, as stated, capture the desired ISFD and e-FCL functionality, which includes workflows to enable contractor performance, provide proactive oversight, and complete reactive incident response. The DSS managed ISFD system and DoE managed e-FCL system contain DSS data which must be migrated to the NISS database for Initial Operational Capability (IOC). The first increment will centralize all processes required for managing the initial facility security clearance (IFCL) process. The estimated duration for this increment is anticipated to be roughly 18 months since it will include all core capabilities listed as system attributes. [Requirements Development Document (RDD) Tabs 1, 12 (excluding “Mobile”), and 13]

i. ISFD currently interfaces with the Office of the Designated Approval Authority (ODAA) Business Management System (OBMS). The interface displays Industry System Security Plan counts and plans status for internal users.

The interconnectivity between OBMS and ISFD reduces the dependency of non-Information System Security Professionals to access the OBMS system. Further details are provided in the ISFD-OBMS Interface Document. As the system of record for Industrial Security Facilities Data, ISFD provides facility information for display only within OBMS.

ii. JPAS Extracts - The NISS shall provide real time Industrial Security Facility system updates to the Joint Personnel Adjudication System (JPAS) and its replacement system; Defense Information Security System (DISS).

The data transferred includes but is not limited to facility cage code, FCL, facility name and address.

iii. NCAISS – The NISS shall interface with National Industrial Security Program (NISP) Central Access and Information Security System (NCAISS). NCAISS is the Agency’s single point of entry or portal for DSS managed applications. PKI authentication through NCAISS supports both Common Access Card (CAC) and External Certificate Authority (ECA) certificates. The Agency leadership expects NCAISS interface with NISS to be operational by the completion of Full Operational Capability (FOC). The NISS contractor shall only support interface work related to the NISS application as the NCAISS application is administered under another contract.

Increment One (1) is Task Order 0001. The following increments will be future Task Orders.

b. Increment Two: Security Vulnerability and Incident Response Management – The second increment will provide DSS stakeholders with essential tools and information required to manage security violations, assess vulnerabilities and respond to incident reports. This increment also builds upon the functionalities developed in Increment-I by enhancing existing system functionality. Processes include Security Vulnerability Assessment (SVA), Suspicious Contact Report (SCR), and Security Violation (SV) processing, The estimated duration for this increment is roughly 12 months. [RDD Tabs 9, 10, 11]

i. NISS will interface with the Joint Personnel Adjudication System (JPAS) and its ultimate replacement, Defense Information Security System (DISS) for real time data transfer. Industrial Security Facility related data, including but not limited to the Commercial and Government Entity (CAGE) Code, Facility Clearance (FCL), facility name and address, and Key Management Personnel (KMP) details, will be automatically transmitted from NISS to DISS, once updated. NISS KMP personnel clearance details shall update NISS from DISS updates. The DISS is comprised of Case Adjudication Tracking System (CATS) and Joint Verification System (JVS).

ii. NCCS - NISS shall interface with and provide real-time Industrial Security Facility data updates to the NISP Contractor Classified System (NCCS). The NISS will provide Facility related data, including but not limited to the facility CAGE code, FCL, facility name and address. The NISS-NCCS interface shall be directional; with NCCS contained Contractor information sent to NISS through real-time data updates. Data transferred will include but is not limited to contract number, Government Contracting Agency (GCA), prime contractor and subcontractor information

iii. Cross Domain Solution - The NISS shall leverage the DISA Cross Domain Solution (CDS) for the near-real time transfer of data to the DSS SIPR instance to NISS and unclassified data from SIPR instance of NISS to NIPR version. The Agency expects CDS capabilities to be incorporated into in NISS Increment II delivery.

c. Increment Three: Change Condition Monitoring – The third increment will enable DSS to efficiently and effectively perform change condition monitoring making use of all core facility data availability within the NISS.

This increment allows for refinement of system functionality to be established by the task order. Processes to be incorporated into NISS include Key Management Personnel (KMP) Monitoring, NATO Control Point Inspections (CPI), Triage Outreach Program (TOP), NISP Facility Oversight, and Foreign Visit Requests (FVR). [RDD Tabs 4, 5, 6, 7, 8]

d. Increment Four: Mobile Access Enablement – The fourth increment will provide stakeholders with the ability to access NISS functionality in a mobile environment, increasing workforce productivity during facility site visits and security assessment visits. The estimated duration for this increment is roughly 9 months. [RDD Tab 12 “Mobile”]

e. Increment Five: Information System Accreditation - The fifth increment shall enable processing of Industry Stakeholder submitted information system certification and accreditation (C&A) plans through the system and associated transfer, review, and processing in support of the field operations mission to enable industry performance and secure digital classified information. The scope of this increment will be determined at a later date. The estimated duration for this increment is roughly 9 months. [RDD Tab 2]

f. Increment Six: Command Cyber Readiness Inspections (CCRI) - The sixth increment will provide the ability to electronically manage the process of scheduling, conducting, and perfuming follow-up activities related to DISA mandated CCRI inspections. The estimated duration for this increment is roughly 9 months. [RDD Tab 3]

SECTION J - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

The following have been modified:

ATTACHMENTS IN READING ROOM

NISS Reading Room Content

1) NISS Requirements Definition Document (RDD)/Requirements Repository

2) Initial Facility Clearance (iFCL) Use Case

3) NISS Capabilities Increment Mapping, HLOs slide deck

4) NISS Acquisition Friendly Business Case Exert

5) NISS Hardware and Software Specifications

6) NISS Work Breakdown Structure (WBS)

7) NISS Reporting Requirements

8) NISS 508 Software Development – GPAT Evaluation

9) NISS DoD Risk Management Framework 8510.01

10) NISS_Risk Management Controls_Draft DIACAP IA Controls

11) NISS Joint Information Environment (JIE) – DoD Interoperability Guidance

12) NISS Open Systems Language

13) NISS Software Assurance Guidance

14) NISS Sample Data

15) Virtual Image Related

16) Test Folder

17) Industry Day

18) 20150324_Q &As NISS

19) VMWARE_VCD_55_user _guide

20) MILCLOUD_Portfolio_Briefing

21) MILCLOUD_VDC_Secure_Remote_Acess_Options_v0.9

22) Virtual_ Data_ Center_vdc_terms_and_conditions_statements

23) U_IIS_7‐0_V1R7‐STIG

24) U_IIS_6‐0_V6R15‐STIG

25) 20150319_Q and A_NISS_v1

26) 20150319_Q and A_NISS

27) 20150304_NISS_Industry_Day_02232015_Consolidated

28) Hard Drive Request Instructions_Final

29) Reading Room Updates (022015) _SIPR Business Case excerpts, Updated RDD and Updated iFCL Use Case

30) NISS Business Case SIPR Excerpt

31) IFCL Use Case Document 1 pt 2 02102015

32) 4 – NISS Requirements Repository_v2pat1

33) NISS Information_12‐19‐14

34) 20141204_NISS RFI Q & A

35) NISS Industry Day Vendors for Reading Room

36) 20141120_NISS_Industry_Day_Final_v19Nov 20141024

37) Data Center EastWest‐Combined 9 Jan 2014

38) Cross Domain

39) Application Model 19 June 2014

40) ISFD‐ODAA Interface Requirements

41) 20150413_Q and A_NISS

42) NISS Requirements Repository _v5_1_final

(End of Summary of Changes)