Attachment I - PWS C4IT SC IT IA Security Management Support-Revised Final 13 Jan 11.docx

PROVIDE SUPPORT SERVICES TO THE UNITED STATES COAST GUARD (USCG) COMMAND CONTROL COMPUTER AND COMMUNICATIONS INFORMATION TECHNOLOGY (C4IT) INFORMATION ASSURANCE (IA) DIVISION.

PERFORMANCE WORK STATEMENT

1.0 GENERAL.

1.1 SCOPE.

To provide the Command Control Computer and Communications Information Technology (C4IT) Information Assurance (IA) Division with the necessary service support to assist the United States Coast Guard (USCG) C4IT in one or more of the areas of Coast Guard Computer Incident Response Team (CGCIRT), Certification and Accreditation (C&A), Secure Communications Services (SECCOMMS) and training. The contractor shall provide technical, administrative, and security management services for the area of CGCIRT to include network administration, information systems security and systems security analysis; C&A, conduct IT evaluations and assessments, and perform documentation support services for the area of C&A; provide TEMPEST Field Technical Authority (FTA) support for the area of SECCOMMS; and related IA training support in all areas. Tasks shall be performed to address the protection of all USCG systems and information they contain, which shall include the USCG IT infrastructure and connected workstations on the Non-Classified Internet Protocol Router Network (NIPRNET), Secret Internet Protocol Router Network (SIPRNET), and the Joint Worldwide Intelligence Communications System (JWICS).

1.2 BACKGROUND.

The Coast Guard C4IT Service Center Information Assurance (IA) Division is made up of three branches consisting of the following:

· Computer Incident Response Team

· Certification & Accreditation Branch

· Secure Communications Branch

The IA Division is charged with the protection of all Coast Guard systems and information they contain. The IA Division has a continuing responsibility to protect the confidentiality, integrity, and availability of the information that is used and to ensure essential Coast Guard functions are carried out. The Information Assurance program consists of providing:

· Guidance on computer security issues,

· Assistance to CG program offices and the field in researching and developing IA security plans and policies,

· Certification and Accreditation support,

· Assistance in developing IA awareness and training programs for Information System Security Officers (ISSO),

· Evaluations on IA hardware and software products, and

· A CG wide incident response program.

1.3 CONTRACTOR PERSONNEL.

The Team Lead shall be the single point of contact for the Contracting Officer (KO) and the Contracting Officer’s Technical Representative (COTR). The Team Lead’s name and that of any alternate(s) who shall act in the absence of Contractor shall be in writing to the KO as part of the Contractor’s proposal. During the absence of the Team Lead, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this task order. The Contractor shall provide notification to the KO and COTR five (5) calendar days prior to any scheduled absence of the Team Lead. The Team Lead and all designated alternate(s) shall be able to read, write, speak and understand English.

The Team Lead’s duties shall include but not limited to the following: (1) attending meetings with the COTR and KO to discuss any technical problems or issues dealing with the contract, (2) knowledgeable of of field activities that are summarized in a monthly report(s) from the ISSOs in the field, (3) submitting reports from the CGCIRT Watchstanders, (4) coordinate the submission of travel and training requests.

1.3.2 Team Lead’s Availability.

The Team Lead shall be available to the COTR via telephone during the core hours of 0700 and 1600 EST, Monday through Friday, and shall respond to a request for discussion or resolution of technical and/or administrative problems within two (2) hours of notification.

1.3.3 Qualified Personnel.

The Contractor shall provide qualified personnel to perform all requirements in this task order. All Contractor employees supporting this task order shall be citizens of the United States, shall be able to read, write, speak and understand English. All Contractor employees supporting this task order must be able to obtain and sustain a Secret Clearance throughout the duration of this task order. However, the contractor may be required to have a Secret, Top Secret (TS), and Top Secret (TS) Sensitive Compartmented Information (SCI). As a condition of privileged access to any information system, personnel performing IA functions as described in the Information Assurance Workforce Improvement Program, DoD 8570.01-M, must satisfy both preparatory and sustain DoD IA training and certification requirements (see DoD 8570.01-M, Chapters 3, 4, 5, 10 and 11). Additionally, contractor personnel with privileged access must complete a Privileged Access agreement (see DoD 8570.01-M, Appendix 4). Additional guidance regarding these requirements also be referenced in the Information Assurance Workforce Improvement Program, DoD 8570.01-M.

1.3.4 Employee Identification.

Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display the Government issued badge in plain view above the waist at all times. Contractor employees visiting Government facilities shall wear an identification badge that, at minimum, displays the Contractor name, the employee’s photo, and name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements.

1.3.5 Employee Conduct.

Contractor’s employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, flag officer courtesy, “off limits” areas, wearing of parts of military uniforms, and possession of firearms) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect a discredit on the United States, the USCG or the Department of Homeland Security (DHS).

1.3.6 Removing Employees for Misconduct or Security Reasons.

The Government may at its sole discretion, direct the Contractor to remove any Contractor employee from USCG’s and DHS’s facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required in this task order. The KO will provide the Contractor with an immediate written explanation of the request to remove the employee. Once removed, the Contractor shall immediately replace the Contractor employee with another who possesses equal or superior qualifications and experience.

1.3.7 No Violation of Security Protocol.

The Contractor shall adhere to the information systems security (ISS) policies, plans, and procedures administered by the USCG and DHS. The Contractor shall maintain the highest degree of security trust when accessing USCG’s resources, networks and, systems.

1.3.8 Conflict of Interest.

The Contractor shall not employ any person who is an employee of the United States Government if that employment would appear to cause a conflict of interest.

1.3.9 Training.

If the Government provides training to a Contractor employee, then the specific skill set learned from the training becomes a job position requirement. The Contractor is responsible for supplying and ensuring that any replacement employee has that skill set.

1.4 KEY PERSONNEL.

All Contractor employees hired under this task order are key personnel. Before replacing any individual identified as Key, the Contractor shall notify the Contracting Officer no less than fifteen (15) business days in advance, submit written justification for replacement and provide the resume of any proposed substitute(s). Any proposed substitute shall possess qualifications equal or superior to those of the Key person being replaced. The Contractor shall not replace Key Contractor personnel without written consent from the Contracting Officer. The Government may designate additional Contractor personnel as Key prior to the task order date of award.

1.5 SECURITY.

Contractor access to classified information is required under this task order. The details are specified in the attached Department of Defense Form 254 and in section 1.3.3 of this SOWPWS.

1.5.1 Security Requirements For Unclassified Information Technology Resources Clause

SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION TECHNOLOGY RESOURCES (JUN 2006)

(a) The Contractor shall be responsible for Information Technology (IT) security for all systems connected to a DHS network or operated by the Contractor for DHS, regardless of location. This clause applies to all or any part of the contract that includes information technology resources or services for which the Contractor must have physical or electronic access to sensitive information contained in DHS unclassified systems that directly support the agency's mission.

(b) The Contractor shall provide, implement, and maintain an IT Security Plan. This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract.

(1) Within 30 days after contract award, the contractor shall submit for approval its IT Security Plan, which shall be consistent with and further detail the approach contained in the offeror's proposal. The plan, as approved by the Contracting Officer, shall be incorporated into the contract as a compliance document.

(2) The Contractor's IT Security Plan shall comply with Federal laws that include, but are not limited to, the Computer Security Act of 1987 (40 U.S.C. 1441 et seq.); the Government Information Security Reform Act of 2000; and the Federal Information Security Management Act of 2002; and with Federal policies and procedures that include, but are not limited to, OMB Circular A-130.

(3) The security plan shall specifically include instructions regarding handling and protecting sensitive information at the Contractor's site (including any information stored, processed, or transmitted using the Contractor's computer systems), and the secure management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

(c) Examples of tasks that require security provisions include--

(1) Acquisition, transmission or analysis of data owned by DHS with significant replacement cost should the contractor's copy be corrupted; and

(2) Access to DHS networks or computers at a level beyond that granted the general public (e.g., such as bypassing a firewall).

(d) At the expiration of the contract, the contractor shall return all sensitive DHS information and IT resources provided to the contractor during the contract, and certify that all non-public DHS information has been purged from any contractor-owned system. Components shall conduct reviews to ensure that the security requirements in the contract are implemented and enforced.

(e) Within 6 months after contract award, the contractor shall submit written proof of IT Security accreditation to DHS for approval by the DHS Contracting Officer. Accreditation will proceed according to the criteria of the DHS Sensitive System Policy Publication, 4300A (7.2 dated April 20, 2010) or any replacement publication, which the Contracting Officer will provide upon request. This accreditation will include a final security plan, risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. This accreditation, when accepted by the Contracting Officer, shall be incorporated into the contract as a compliance document. The contractor shall comply with the approved accreditation documentation.

1.5.2 Contractor Employee Access Clause

(a) Sensitive Information, as used in this Chapter, means any information, the loss, misuse, disclosure, or unauthorized access to or modification of which could adversely affect the national or homeland security interest, or the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of title 5, Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

(b) “Information Technology Resources” include, but are not limited to, computer equipment, networking equipment, telecommunications equipment, cabling, network drives, computer drives, network software, computer software, software programs, intranet sites, and internet sites.

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting Officer's request, the Contractor's employees shall be fingerprinted, or subject to other investigations as required. All contractor employees requiring recurring access to Government facilities or access to sensitive information or IT resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

(d) The Contracting Officer may require the contractor to prohibit individuals from working on the contract if the government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to sensitive information. Therefore, the Contractor shall not disclose, orally or in writing, any sensitive information to any person unless authorized in writing by the Contracting Officer. For those contractor employees authorized access to sensitive information, the contractor shall ensure that these persons receive training concerning the protection and disclosure of sensitive information both during and after contract performance.

(f) The Contractor shall include the substance of this clause in all subcontracts at any tier where the subcontractor may have access to Government facilities, sensitive information, or resources.

(End of clause)

(g) Before receiving access to IT resources under this contract the individual must receive a security briefing, which the Contracting Officer’s Technical Representative (COTR) will arrange, and complete any nondisclosure agreement furnished by DHS.

(h) The contractor shall have access only to those areas of DHS information technology resources explicitly stated in this contract or approved by the COTR in writing as necessary for performance of the work under this contract. Any attempts by contractor personnel to gain access to any information technology resources not expressly authorized by the statement of work, other terms and conditions in this contract, or as approved in writing by the COTR, is strictly prohibited. In the event of violation of this provision, DHS will take appropriate actions with regard to the contract and the individual(s) involved.

(i) Contractor access to DHS networks from a remote location is a temporary privilege for mutual convenience while the contractor performs business for the DHS Component. It is not a right, a guarantee of access, a condition of the contract, or Government Furnished Equipment (GFE).

(j) Contractor access will be terminated for unauthorized use. The contractor agrees to hold and save DHS harmless from any unauthorized use and agrees not to request additional time or money under the contract for any delays resulting from unauthorized use or access.

(k) Non-U.S. citizens shall not be authorized to access or assist in the development, operation, management or maintenance of Department IT systems under the contract, unless a waiver has been granted by the Head of the Component or designee, with the concurrence of both the Department’s Chief Security Officer (CSO) and the Chief Information Officer (CIO) or their designees. Within DHS Headquarters, the waiver may be granted only with the approval of both the CSO and the CIO or their designees. In order for a waiver to be granted:

(1) The individual must be a legal permanent resident of the U.S. or a citizen of Ireland, Israel, the Republic of the Philippines, or any nation on the Allied Nations List maintained by the Department of State;

(2) There must be a compelling reason for using this individual as opposed to a U.S. citizen; and

(3) The waiver must be in the best interest of the Government.

(l) Contractors shall identify in their proposals the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the contracting officer.

1.5.3 "Classified information is Government information which requires protection in accordance with Executive Order 12958, National Security Information (NSI) as amended and supplemental directives. If the contractor has access to classified information at a DHS owned or leased facility, it shall comply with the security requirements of DHS and the facility.

Contractor shall comply with all government facility and security requirements while on government property, including obtaining and displaying identification badges, obtaining vehicle decals and proper vehicle operation.

The contractor shall have a facility security clearance up to FILL IN LEVEL level. All personnel supporting this procurement shall be required to obtain and maintain a FILL IN LEVEL level clearance. The Government reserves the right to approve or deny suitability of the contractor's individual employees based on security risks, unsatisfactory performance, or disruptive influence to mission accomplishment.

Requirements for Handling Sensitive and/or Proprietary Information.

The Contractor shall abide by the requirements set forth in the DD Form 254, Contract Security Classification Specification, an attachment to the contract, and the National Industrial Security Program Operating Manual (NISPOM) for protection of classified information at its cleared facility, if applicable, as directed by the Defense Security Service.

All Contractor employees handling classified information shall have a DD254 and comply with the following clauses in accordance with FAR 52.204-2 Security Requirements (Aug 1996):

FAR 52.204-2 Security Requirements (Aug 1996)

(a) This clause applies to the extent that this contract involves access to information classified "FILL IN CLASSIFICATION".

(b) The contractor shall comply with-

(1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DOD 5220.22-M); and

(2) Any revisions to that manual, notice of which has been furnished to the contractor.

(c) If, subsequent to the date of this contract, the security classification or security requirements under this contract are changed by the Government and if the changes cause an increase or decrease in security costs or otherwise affect any other term or condition of this contract, the contract shall be subject to an equitable adjustment as if the changes were directed under the Changes clause of this contract.

(d) The contractor agrees to insert terms that conform substantially to the language of this clause, including this paragraph (d) but excluding any reference to the Changes clause of this contract, in all subcontracts under this contract that involve access to classified information. "

1.6 PERIOD OF PERFORMANCE.

The period of performance for this contract is five one-year ordering periods from date of award.

1.7 PLACE OF PERFORMANCE.

The primary places of performance will be Telecommunications Information Systems CommandOM(TISCOM), Command, Control, Communications Center (C32CEN), Operations Systems Command (OSC), and Electronic Support Unit facilities located throughout the United States. Additionally, performance at other facilities and vessels (air and sea) both CONUS and OCONUS may be required. Each individual task order will specify the actual place of performance. OCUNUS work may be done in Alaska, Hawaii as well as foreign bases located in Bahrain, Japan, Singapore and the Netherlands. There may be times where IA personnel will visit deployed assets in foreign ports of call throughout the world. as the CG mission needs support from IA.

1.8 HOURS OF OPERATION.

Contractor employees shall perform all work during the hours agreed upon by the Contractor and the COTR from Monday through Friday except Federal holidays. However, there may be occasions when Contractor employees shall be required to work other than normal business hours, including weekends and holidays. The Contractor employees assigned to provide support as watchstanders shall perform all work 24x7x365, Monday through Sunday, including holidays. (see SOWPWS 67.1.3.1)

1.9 INCLEMENT WEATHER OR EMERGENCY CONDITIONS.

In the event that inclement weather or other emergency conditions forces CGCIRT’s base closure during normal operating hours, the COTR will notify the Team Lead. The Contractor shall adhere to CGCIRT's unit’s facility policies on closing or delayed opening due to inclement weather, or other reasons as directed by the Commanding Officer through the KO. This policy also applies to the Contractor employees that are providing support as ISSOs at locations specified in section 1.7 of the SOWPWS. Watchstander Contractors shall be available 24x7, 365 days irrespective of weather conditions. In the event the situation occurs, the Contractor shall coordinate with COTR and KO.

1.9.1 Emergencies and Disasters.

In the event of fire, flood, hurricane, tornado, or similar emergency or disasters, Contractor support may be required to support Continuity of Operations (COOP). COOP operations may involve travel to an alternate location for an extended period. The KO or the COTR will be contacted to notify the Contractor and request support. The Contractor shall submit documentation of work performed to the KO.

1.10 TRAVEL.

Contractor travel shall be required to support this contract. All travel required by the Government outside the local commuting area(s) will be reimbursed to the Contractor in accordance with the Federal Travel Regulations. The Contractor shall be responsible for obtaining COTR approval via electronic mail, for all reimbursable travel in advance of each travel event.

Contractor employee travel may be required, but not limited to the following primary places of performance:; TISCOM, C3CEN, OSC, and Electronic Support Unit facilities located throughout the United States. Additionally, travel to other facilities and vessels (air and sea) both CONUS and OCONUS may be required.

The Contractor shall provide trip reports to the COTR and KO via electronic mail no later than five (5) business days after the completion of the trip.

1.11 KICK-OFF MEETING.

The Project Manager shall attend a Kick-Off Meeting with the KO and the COTR no later than five (5) business days after the date of award. The purpose of the Kick-Off Meeting which will be chaired by the KO, is to discuss technical and contracting objectives of this task order and review the Contractor's project plan. The Kick-Off Meeting will be held at the Government’s facility.

1.12 PROJECT PLAN.

The Contractor shall provide a draft Project Plan for this task order at the Kick-Off Meeting for Government review and comment. The Contractor shall provide a final Project Plan to the COTR no later than five (5) business days after the Kick-Off Meeting.

1.13 PROGRESS REPORTS.

The Contractor shall provide a monthly progress report to the COTR and KO via electronic mail by the fifth (5th) of each month. This report shall include a summary of all Contractor work performed, an assessment of technical progress, schedule status, any travel conducted and any Contractor concerns or recommendations for the previous month.

1.13.1 TRIP REPORTS.

The Contractor shall provide a trip report for this task order for Government review and comment. The Contractor shall provide a final Trip Report to the COTR no later than five (5) business days after the completion of the trip.

1.14 PROGRESS MEETINGS.

The Team Lead shall be available to meet with the KO and/or COTR upon request to present deliverables, discuss task order progress, exchange information and resolve emergent technical problems and issues. These meetings shall take place at the Government's facility. The Team Lead shall record notes from the Progress Meetings and submit to the KO and the COTR via electronic mail no later than five (5) business days. This meeting shall occur no later than 10 business days after the award of this a task order and at minimum monthly thereafter.

1.15 GENERAL REPORT REQUIREMENTS.

The Contractor shall provide all written reports in electronic format with read/write capability using Microsoft Office Suite products compatible with the current USCG Standard Workstation.

1.16 PERFORMANCE REQUIREMENTS SUMMARY (PRS).

This task order includes a Performance Requirements Summary (PRS) (see SOWPWS 8.0). The PRS sets forth the expected outcomes (objectives) of the task order, the service(s) required of the Contractor to achieve the objectives, a performance standard per outcome, and an incentive plan (positive or negative) in the event the Contractor does not meet the performance standard. The PRS is not an exclusive remedy and inclusion of the PRS does not preclude the Government from using any other remedy available by law or contract terms, including reductions in payment in accordance with any clause for inspection of services.

1.17 "Security Certification/Accreditation:.

"All hardware, software, and services provided must be compliant in accordance with 140-01 Information Technology Systems Security and the DHS Sensitive Systems Handbooks 4300A for Sensitive But Unclassified (SBU) or All services, hardware, and software provided under this task order must be compliant with DHS 4300B DHS National Security System Policy and the DHS 4300B National Security System Handbook.4300B Handbook for Classified Systems".

"Security Certification/Accreditation: USCG Contractor shall provide personnel with the appropriate clearance levels to support the security certification/accreditation processes under this Agreement in accordance with DHS MD 4300A, DHS Sensitive Systems Policy and Handbook. During all SDLC phases of USCG systems, USCG personnel shall develop documentation and provide any required information for all levels of classification in support of the certification / accreditation process. In addition, all security certification / accreditation will be performed using the DHS certification/accreditation process, methodology and tools.

DHS Sensitive Systems Policy Directive 4300 A, Section 4.1.4 requires the "Separation of duties to prevent a single individual from being able to disrupt or corrupt a critical security process." The Policy requires the following: "Components shall divide and separate duties and responsibilities of critical IT system functions among different individuals to minimize the possibility that any one individual would have the necessary authority or system access to be able to engage in fraudulent or criminal activity." Security testing is but one critical systems function that needs to be performed by a provider (either government or contractor) other than the system designer / developer / operator.

This requirement is based, in part, on NIST 800-53 Rev 3, Security Control CA-2 Security Assessments - enhancement 1 which requires "The organization employs an independent assessor or assessment team to conduct an Security Test & Evaluation (ST&E) assessment of the security controls in the information system." Consequently, the vendor that provides C&A services may not perform the security controls testing".

1.18 INTELLECTUAL PROPERTY.

All Contractor developed processes and procedures and other forms of intellectual property developed under this SOWPWS shall be considered Government property.

All documentation, electronic data and information collected by the Contractor and entered into or generated in support of this task order shall be considered Government property, and shall be returned to the Government at the end of the performance period.

1.19 Accessibility Requirements (Section 508).

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology (EIT), they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public.

All EIT deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following applicable EIT accessibility standards have been identified:

1.19.1 Section 508 Applicable EIT Accessibility Standards 36 CFR 1194.21.

Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including but not limited to GOTS and COTS software. In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web based applications as described within 36 CFR 1194.22.

36 CFR 1194.22 Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous Javascript and XML (AJAX) then 1194.21 Software standards also apply to fulfill functional performance criteria.

36 CFR 1194.23 Telecommunications Products, applies to all telecommunications products including end-user interfaces such as telephones and non end-user interfaces such as switches, circuits, etc. that are procured, developed or used by the Federal Government.

36 CFR 1194.24 Video and Multimedia Products, applies to all video and multimedia products that are procured or developed under this work statement. Any video or multimedia presentation shall also comply with the software standards (1194.21) when the presentation is through the use of a Web or Software application interface having user controls available.

36 CFR 1194.25 Self Contained, Closed Products, applies to all EIT products such as printers, copiers, fax machines, kiosks, etc. that are procured or developed under this work statement.

36 CFR 1194.26 Desktop and Portable Computers, applies to all desktop and portable computers, including but not limited to laptops and personal data assistants (PDA) that are procured or developed under this work statement.

36 CFR 1194.31 Functional Performance Criteria, applies to all EIT deliverables regardless of delivery method. All EIT deliverable shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

36 CFR 1194.41 Information Documentation and Support, applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required 1194.31 Functional Performance Criteria, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and Applications at a minimum. In addition, any help or support provided in this work statement that offer telephone support, such as, but not limited to, a help desk shall have the ability to transmit and receive messages using TTY.

1.19.2 Section 508 Applicable Exceptions.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the COTR and determination will be made in accordance with DHS MD 4010.2. DHS has identified the following exceptions that may apply: 36 CFR 1194.3(b) Incidental to Contract, all EIT that is exclusively owned and used by the contractor to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any EIT deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those contractors assigned to fulfill the obligations of this work statement and for the purposes of this requirement, are not considered members of the public.

1.19.3 Section 508 Compliance Requirements 36 CFR 1194.2(b) (COTS/GOTS products).

When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a Government solicitation. Agencies cannot claim a product as a whole is not commercially available because no product in the marketplace meets all the standards. If products are commercially available that meet some but not all of the standards, the agency must procure the product that best meets the standards. When applying this standard, all procurements of EIT shall have documentation of market research that identify a list of products or services that first meet the agency business needs, and from that list of products or services, an analysis that the selected product met more of the accessibility requirements than the non-selected products as required by FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires authorization from the DHS Office of Accessible Systems and Technology (OAST) in accordance with DHS MD 4010.2.

All tasks for testing of functional and/or technical requirements must include specific testing for Section 508 compliance, and must use DHS Office of Accessible Systems and Technology approved testing methods and tools. For information about approved testing methods and tools send an email to accessibility@dhs.gov.

1.20 Enterprise Architecture Compliance.

All solutions and services shall meet DHS and USCG Enterprise Architecture policies, standards, and procedures. Specifically, the contractor shall comply with the following Homeland Security Enterprise Architecture (HLS EA) and Coast Guard Enterprise Architecture (CGEA) requirements:

· All developed solutions and requirements shall be compliant with the HLS EA and CGEA.

· All IT hardware or software shall be compliant with the HLS EA Technical Reference Model (TRM) Standards and Products Profile.

· Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the DHS Enterprise Data Management Office (EDMO) for review and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository.

· In compliance with Office of Management and Budget (OMB) mandates, all network hardware shall be IPv6 compatible without modification, upgrade, or replacement.

· All Information Technology assets being developed, procured, or acquired shall be IPv6 capable.

2.0 Final Approval.

Final approval and acceptance of documentation required herein shall be by letter of approval and acceptance of the Contracting Officer. Any letter of acknowledgment of receipt of material shall not be construed as a waiver of review, or as an acknowledgment that the material is in conformance with this work statement. Any approval given during preparation of the documentation, or approval for shipment shall not guarantee the final acceptance of the completed documentation.

3.0 GOVERNMENT TERMS & DEFINITIONS

3.1 AIS - Automated Information System

3.2 CGDN - Coast Guard Data Network

3.3 CGCIRT- Coast Guard Computer Incident Response Team

3.4 COMDTINST - Commandant Instruction

3.4 COTR -Contracting Officer’s Technical Representative

3.5 COTS - Commercial off the shelf

3.6 DHS - Department of Homeland Security

3.7 ESU -Electronic Systems Support Unit

3.8 GOTS - Government Off the Shelf

3.9 IA - Information Assurance

3.10 INFOCON - Information Operations Condition

3.11 INFOSEC - Information Security

3.12 IS - Information System

3.13 ISS - Information Systems Security

3.14 ISSA - Information Systems Security Assistant

3.15 ISSO - Information Systems Security Officer

3.16 ISSP - Information Systems Security Program

3.17 NIST - National Institute of Standards and Technology

3.18 C4IT -Command Control Computer and Communications

3.19 USCG - United States Coast Guard

4.0 GOVERNMENT FURNISHED PROPERTY.

The Government will provide the following property and information to the Contractor for work required under this task order:

4.1 The Government will provide the workspace, equipment and supplies necessary to perform the on-site services required in this task ordercontract.

4.2 Contractor shall use Government furnished property only for the performance of work under this task order, and shall be responsible for returning all Government furnished property in good working condition, subject to normal wear and tear.

4.3 Contractor may use Government furnished procedures, tools, databases from the Computer Emergency Response Team (CERT) and Computer Incident Response Team (CIRT) programs with minimal or no modifications.

5.0 CONTRACTOR FURNISHED PROPERTY.

The Contractor shall not furnish property to fulfill the requirements of this SOWPWS due to all services being provided at Government facilities.

6.0 REQUIREMENTS.

The Contractor shall provide support to assist the United States Coast Guard (USCG) C4IT in one or more of the areas of CGCIRT, C&A, Secure Communications, and IA related training to the C4IT Information Assurance (IA) Division. A Point Of Contact (POC) will be assigned to each of the areas of C&A, CGCIRT and SECCOMS.

6.1 CGCIRT

The Contractor shall provide technical, administrative, and security management services to the CGCIRT. The services shall include providing network administration, information systems security, and systems security analysis.

6.1.1 TECHNICAL

6.1.1.1 Information Systems Security

· The Contractor shall provide support as an Information System Security Assistant (ISSA) to the ISSOs at the following but not limited to the primary places of performance; TISCOM, C2CEN, OSC, and Electronic Support Unit facilities located throughout the United States. Additionally, support to other facilities and vessels (air and sea) both CONUS and OCONUS may be required.

· The Contractor shall analyze and implement the Information Operations Condition (INFOCON) levels in order to maintain the USCG’s connectivity to the Global Information Grid (GIG).

· The Contractor shall assist the USCG in the coordination and implementation of Information Assurance (IA) policies, procedures and training programs. The Contractor shall also identify and report gaps in the existing IA policy and provide recommendations.

The Contractor shall assist the Government in the review of draft IA policy compliance procedures.

· The Contractor shall utilize tools and tracking mechanisms that shall automate reporting and data collection of Information Security (INFOSEC) associated vulnerabilities. The Contractor shall submit findings and recommendations to CGCIRT.

· The Contractor shall assist CGCIRT in the ongoing improvement of procedures for detecting, reporting, and responding to security incidents that are classified and unclassified.

The Contractor shall provide support in drafting an Information Systems Security Plan (ISSP).

· The Contractor shall assist CGCIRT in obtaining information from USCG units on new vulnerability alerts and assign security risk levels as they are released.

· The Contractor employee(s) providing support as an ISSO shall coordinate and maintain the DHS’ and DOD’s vulnerability database accounts.

6.1.1.2 Network Administration

· The Contractor shall configure, install, manage, and support the Information Assurance (IA) network systems.

· The Contractor shall determine system security vulnerabilities and recommend fixes, patches, or workarounds for applications including; but not limited to, Microsoft Office, Microsoft Outlook, DOS batch files, Oracle, Access, UNIX, Red Hat Linux, Windows NT, Windows 2000, Windows XP, Windows 2003 Server as well as other windows programs and applications.

· The Contractor shall support, populate, and maintain various USCG network data in Oracle, MS Access, MS SQL and MySQL databases.

· The Contractor shall develop tool sets to support various CGCIRT functions such as; vulnerability assessments, incident analysis, remote scanning, and incident clean up.

· The Contractor shall install and debug current and future software applications in the USCG’s standard operating system environment.

6.1.1.3 Web Site Maintenance

· The Contractor shall provide web site maintenance to the CGCIRT intranet web pages. Examples of maintenance are: updating web content; fixing broken links; fixing HTML code errors, etc.

6.1.2 ADMINISTRATIVE

6.1.2.1 Computer Incident Support

· The Contractor shall assist with Information Systems Security (ISS) incidents and coordinate reporting and tracking of incidents with the CGCIRT.

· The Contractor shall document each computer incident in the Government provided database when the incident occurs.

6.1.2.2 Administrative Support

· The Contractor shall provide findings and supporting documentation to complete the security certification and security accreditation packages (SOWPWS 7PWS 6.1.2)

· The Contractor shall provide support to the USCG in planning, organizing, implementing, and executing the IA and INFOSEC programs.

· The Contractor shall coordinate with the field unit’s ISSOs to advise and facilitate resolution of all IA and INFOSEC issues.

· The Contractor shall provide support in interpreting the Department Of Defense (DOD) and Intelligence Community directives, regulations, instructions, and procedures.

· The Contractor shall review system audit records and intrusion detection data in support of ISSOs in identifying security incidents.

· The Contractor may be required to represent the USCG by participating in a multi-agency working group (USCG, DOD or DHS) to identify, address and provide recommendations for IA and INFOSEC improvements.

· The Contractor shall attend technical exchange meetings as requested by the COTR.

· The Contractor shall provide meeting support, including generating meeting summaries and providing briefing materials.

6.1.2.3 Documentation Support

The Contractor employees providing support as ISSAs to the ISSOs shall assist in the preparation and maintenance of contingency plans, disaster recovery plans and similar plans that support the Continuity of Operations (COOP).

6.1.3 SECURITY MANAGEMENT

6.1.3.1 CGCIRT Watch Support:

· The Contractor shall assist CGCIRT in the development of work schedule to ensure there is full coverage of watchstanders.

· The Contractor shall provide continuous monitoring of the firewall logs, IntruVert, and other USCG intrusion detection systems.

The Contractor shall monitor the Coast Guard Data Network (CGDN) for network intrusions and anomalies.

· The Contractor shall provide 24x7x365 operational support for CGCIRT, Monday through Sunday, including weekends and holidays. The watch will be supported by a junior level and mid level security analyst. Protection of the CGDN is the number one priority of the CGCIRT watch. No other assignment will take priority unless directed by the Chief of CGCIRT.

6.1.3.2 System Security Analysis

· The Contractor shall maintain the USCG network, respond to and resolve system intrusions and breaches.

· The Contractor shall install and maintain advance application technology that includes but is not limited to: firewall technology, secure World Wide Web application technologies, advanced authentication (e.g. PKI; bio-metrics), and Data Management Systems (DMS) to facilitate secure information exchange between CGCIRT and other CIRT/CERT organizations.

· The Contractor shall administer and maintain classified and unclassified LAN and enterprise firewall systems.

· The Contractor shall maintain virus detection, elimination, and prevention applications (e.g. Symantec).

· The Contractor shall support and troubleshoot various Government-off-the-Shelf (GOTS) and Commercial-off-the-shelf (COTS) intrusion detection systems.

· The Contractor shall provide support in administering, and maintaining Information Assurance (IA) incident documentation for dissemination to various government agencies and organizations.

· The Contractor shall perform computer security risk assessments on a variety of USCG Information Systems when requested by the COTR.

6.2 C&A

The Contractor shall provide Information Systems Security Certification and Accreditation support to USCG facilities, conduct evaluations and assessments, and perform documentation support services.

6.2.1 Information System Security.

The Contractor shall perform NIST SP 800-37, DIACAP, and NIACAP system certification and accreditation services in support of C4IT to include the following:

· The Contractor shall perform certification and re-certification of all SBU and Classified USCG Standard Workstation Image, major applications, stand-alone systems, and general support systems within the local area network (LAN) of all USCG districts up to and including the CGDN+ wide area network (WAN) for accreditation approval.

· Depending on the classification of a system the Contractor shall use either the NIST SP-800-37, DIACAP, or NIACAP as the primary guideline for conducting information system certifications. In addition, the Contractor shall use the COMDTINST5500.13B and USCG Guide to the Certification and Accreditation Process as guidance for the USCG certification methodology.

· In accordance with NIST SP 800-37, DIACAP and NIACAP, the Contractor shall use a three-phased process to establish a Certification and Accreditation Package. The three-phased process includes the following:

· Phase 1 – Pre-Assessment/Initiation: Consists of but not limited to the following; (i) preparation; (ii) reevaluate project plan and resource identification; and (iii) system security plan analysis, update and acceptance. The Contractor shall ensure that the Designated Authorizing Official and Information Systems Owner are in agreement with contents of the system security plan.

· Phase 2 – Security Certification: Consists of but not limited to the following (i) security control assessment, and (ii) security certification documentation. The Contractor shall determine the extent to which the security controls in the information system are implemented correctly, operating as intended, and producing the desire outcome with respect to meeting the security requirements of the system.

· Phase 3 – Security Accreditation: Consists of but not limited to the following (i) security accreditation decision, and (ii) security accreditation documentation. The Contractor shall assist the Government in determining if the remaining known vulnerabilities in the information system pose an acceptable level of risk to agency operations, agency assets, or individuals.

· The Contractor shall assist/conduct a Risk Assessment (RA) using NIST SP 800-53 Self Assessment Checklist.

· The Contractor shall assist/conduct annual Self Assessment using the NIST SP 800-53 for systems accredited under the NIST SP 800-37, and assist/conduct annual IA Control Review for systems accredited under the DIACAP process.

· The Contractor shall assist/conduct at any time that a CG system SBU or Classified i.e., GSS, Maj App or Standalone systems accreditation is revoked by DAA, system security posture changes, or by normal expiration of the ATO this system shall go through the…