CAC_PWS_01_Mar_16_MP_removed_comments.docx

Performance Work Statement for Common Access Card (CAC) Authentication Solution and Domain Name System (DNS) Hosting

1.0 Background:

Congress created SIGAR to provide independent and objective oversight of Afghanistan reconstruction projects and activities. Under the authority of Section 1229 of the National Defense Authorization Act for Fiscal Year 2008 (P.L. 110-181), SIGAR conducts audits and investigations to: 1) promote efficiency and effectiveness of reconstruction programs and 2) detect and prevent waste, fraud, and abuse.

1.1 Description of Services/Introduction:

SIGAR is in the process of obtaining the sigar.gov domain from dotgov.gov in order to improve digital collaboration abilities. In order to move forward with domain procurement, SIGAR seeks to obtain a FISMA compliant external DNS hosting solution. SIGAR also currently uses an Office 365 SharePoint online tenant in the Government Cloud. SIGAR has approximately 200 users actively using SharePoint libraries for document collaboration. Currently, SIGAR authenticates to Office 365 using a cloud identity with username and password; however, Government policy dictates SIGAR use a two factor authentication method such as Common Access Card (CAC) and Personal Identification Number (PIN).

The overall objective of this project is to enable SIGAR to utilize CAC authentication for SharePoint online in Office 365 and obtain the DNS hosting solution.

1.2 Objective:

Obtain a Federal Information Security Management Act (FISMA) compliant external DNS hosting solution that is both reliable and secure and further enables the provision of a CAC authentication solution within a Microsoft Azure Cloud environment. The solution shall provide a developmental aspect for increasing productivity and implementing new functionality within the cloud environment. The Contractor shall Assist SIGAR in facilitating procurement of dotgov.gov by providing all necessary information for registration such as primary and secondary server(s) host name and IP as well as DS/DNS data as well as provide a CAC authentication solution within a Microsoft Azure Cloud environment that is in line with Government best practices and policies. The CAC solution will enable SIGAR to utilize authentication for SharePoint online in Office 365 and be used to further SIGAR’s mission to detect and prevent waste, fraud, and abuse.

1.3 Scope:

The CAC Solution requires the following:

· Azure Infrastructure Services: Configuration of infrastructure as a service (IaaS) components to host the infrastructure for the solution.

· Active Directory: Deployment of a single application specific, Active Directory to host the user accounts and infrastructure services. Configuration of CAC authentication for Active Directory Users.

· Remote User Management: Deployment of a Remote Desktop Services environment for managing users and groups in the solution. Provide guidance on the application of user management tools for remote administration environment. Provide VPN access to remote connected users to the Remote User management environment.

· Active Directory (AD) Federation Services (FS): Design a host load-balancing AD FS federation service to authenticate users. Enable certificate-based multi-factor authentication for CAC authentication support. Integrate AD FS with Office 365.

· AD Connect: Deploy AD connect within Azure IaaS to synchronize agency user identity into Office 365.

· CAC Authentication: Provide CAC authentication to office 365 resources through AD FS. Provide operation guidelines for user administration, on how to enable CAC authentication throughout the agency.

· Cyber Security Review: Develop cyber resources to understand cyber security requirements. Present cyber security recommendations. Support remediation of cyber requirements and assist in authoring a Cyber Security Threat Management Plan.

The DNS External Hosting Solution requires the following:

· Facilitate the domain procurement process with dotgov.gov by providing all necessary information for registration such as primary and secondary server(s) host name and IP as well as DS/DNS data.

· Establish an off-site virtualized managed external DNS hosting environment that is FISMA compliant with out-of-the-box support for DNSSEC and IPv6.

· Ensure the managed solution has centralized DNS administrative tools or a single point of contact for DNS configuration.

· Provide configuration support as necessary for reliable and secure DNS. The contractor shall be required to install, house, and maintain the hosting environment to ensure high levels of reliability and security. The contractor is to provide status updates on a weekly basis until the sigar.gov domain is registered and effectively served from the host.

· Ensure host reliability and performance with service for approximately 200 dedicated users. The DNS shall be “live” 98% of the time, and notification shall be provided to the Technical POC of any downtime, whether scheduled or unscheduled.

· Ensure host is physically secured within climate controlled facilities with sufficient physical security such as servers locks and secure card access to protect against equipment tampering. Ensure host is cyber secured with load balancing, redundancy, and hardening where the service is protected against DNS-based cyber-attacks such as DDOS, and cache poisoning. Security measures not specifically mentioned will follow industry best practices and standards, as well as federal regulations and guidance.

· Ensure that the hosting hardware is fully housed and supported independent of SIGAR facilities. SIGAR reserves the right to inspect hosting facilities to ensure proper security measures are in place.

1.5 Period of Performance:

The period of performance shall be a one-year base period and four one-year option periods. The following provides a notional timeline and will be updated accordingly at time of award:

1.6 General Information:

1.6.1 Quality Control:

The Government shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The Government shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective service.

1.6.2 Quality Assurance:

The Government shall evaluate the contractor’s performance under this contract is in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure the contractor has performed in accordance with the performance standards. It defines how the performance standards shall be applied, the frequency of the surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays:

The contractor shall recognize all Federal Holidays.

1.6.4 Hours of Operations:

Work accomplished under this task order shall be conducted during SIGAR’s normal business hours: Monday-Friday, 9:00 am to 5:00 pm. Under extraordinary circumstances work may be required beyond these normal business hours.

The Contractor shall be expected to respond to phone or email correspondence from SIGAR within 24 hours; the initial response shall provide notice of their availability to work on SIGAR issues and identify any constraints that may limit their availability. Should the contractor be requested to report to SIGAR Headquarters, a minimum of one week’s notice shall be provided. SIGAR may grant extensions to these requirements depending on the circumstances; it is the Contractor’s responsibility to formally request review and waiver if necessary.

1.6.5 Place of Performance:

The work to be performed under this contract will be performed at the Contractors Business location and/or at SIGAR Headquarters, in Crystal City, VA.

1.6.6 Security Requirements:

The Contractor shall forward a Visit Authorization in the Joint Personnel Adjudication System (JPAS) JPAS. The Authorization will be processed to the SMO or CAGE code W6QWAA6 with established visit dates before the beginning of each contracting/task order period of performance and as new contract employees are assigned to the contract.

All contract personnel assigned on-site at SIGAR location shall require access to the (Army) IMCEN computer network as part of normal business operations. All persons accessing the network are required to have a minimum of a NACI investigation and a signed controlled unclassified attestation on file. Due to the sensitive nature of information available and operational requirements for a Secret Clearance shall be required.

******************All Personnel requiring access to SCI information must be U.S. citizens, have been granted a final DCID 6/4 security clearance by the U.S. Government, and have been indoctrinated for the applicable compartments of SCI access prior to being given any access to such information released or generated under this contract and at all task order levels.

All personnel requiring a Top Secret clearance under this contract must undergo a favorably adjudicated Single Scope Background Investigation (SSBI) as a minimum investigation, and a signed classified non-disclosure agreement (SF312). The SSBI or PR will be maintained current within 5-years and requests for Top Secret Periodic Reviews (SBPRs) will be initiated 90 days prior to the 5-year anniversary date of the previous SSBI or SBPR.************************** The security aspect of this contractual effort is under the authority of the National Industrial Security Program and, as such the Defense Security Service.

1.6.7 Anti-Terrorism Training:

AT Level I Training: This provision/contract text is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within five calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer. AT level I awareness training is available at the following website: CAC Holders - https://Jkodirect.jten.mil and Non-CAC Holders - http://jko.jten.mil/courses/atl1/launch.html.

AT Awareness Training for contractor Personnel Traveling Overseas: This standard language text requires US based contractor employees and associated sub-contractor employees to make available and to receive Government provided area of responsibility (AOR) specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact.

1.6.7.1 OPSEC Training:

For Contracts that Require OPSEC Training: Per AR 530-1, Operations Security, new contractor employees must complete Level I OPSEC training within 30 calendar days of their reporting for duty. All contractor employees must complete annual OPSEC awareness training. http://cdsetrain.dtic.mil/opsec/index.htm

1.6.7.2 Information Systems:

Contractor Employees Who Require Access to Government Information Systems: All contractor employees with access to a Government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the IS and then annually thereafter.

For Information assurance (IA)/information technology (IT) training: All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoD 8570.01, DoD 8570.01-M and AR 25-2 within six months of employment.

1.6.7.3 Data Handling:

Performance of this contract may require the contractor to access data and information considered “sensitive” to the Government or of such a nature that its dissemination or use, other than in performance of this contract, would be adverse to the interests of the Government or others. The contractor shall not divulge or release data or information developed or obtained in performance of this contract, except to authorize Government personnel or upon written approval of the Contracting Officer.

The contractor shall not use, disclose, or reproduce sensitive data, other than as required in the performance of this contract. The limitations above do not apply to data or information that has been made public by the Government. Further, these limitations do not preclude the use of any data acquired independently by the contractor without such limitations or prohibit an agreement at no cost to the Government between the contractor and the data owner that provides for greater rights to the contractor.

All products produced by the contractor during the course of this contract and associated work papers are to be considered the property of the Government.

1.6.7.4 Physical Security:

The contractor shall be responsible for safeguarding all Government equipment, information and property for contractor use.

1.6.7.5 Lock Combination/Personnel Identification:

The contractor shall be responsible for safeguarding all lock combinations and personal identification cards issued to the contractor. Upon departure of SIGAR the contractor shall turn in all keys and identification cards.

1.6.8 Post Award Conference/Periodic Progress Meetings:

The Contracting Officer, Contracting Officer Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor’s performance. At these meetings the contracting officer will apprise the contractor of how the Government views the contractor’s performance and the contractor will apprise the Government of any problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. The contractor agrees to attend any post award conferences convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation (FAR) Subpart 42.5. The contractor should prepare for recurring weekly progress meetings with SIGAR staff. These meetings shall be at no additional cost to the Government and are based on SIGAR’s request for such meetings.

1.6.9 Key Personnel:

The minimum requirements of all contractor personnel associated with this contract are as follows:

· Status as Microsoft Blue Badge Employee

· Help Desk personnel must be US Citizens (clearance not required, but must be US citizens)

1.6.10 Payment for Unauthorized Work:

No payments will be made for any unauthorized supplies and/or services or for any unauthorized changes to the work specified herein. This includes any services performed by the contractor or its personnel without prior authorization by the Contracting Officer. Only a duly appointed Contracting Officer is authorized to change the specifications, terms, and conditions under this effort.

1.6.11 Dissemination of Information/Publishing:

There shall be no dissemination or publication of information, except within and between the contractor and any subcontractors or specified who have a need to know, of information developed under this order or contained in the reports to be furnished pursuant to this order without prior written approval of the Contracting Officer. SIGAR approval for publication shall require provisions which protect the intellectual property rights of both SIGAR and the contractor.

1.6.12 Non-Disclosure /Non-Use Agreement:

The contractor shall ensure that the Non-Disclosure Statement is signed by all staff assigned to or performing on this Task order before performing any work, including all subcontractors and consultants. The Non-Disclosure / Non-Use statement will be cosigned by a corporate official (contractor Task Manager or higher). The contractor shall also ensure that all staff understand and adhere to the terms of the non-disclosure statement, protecting the procurement sensitive information of the Government and the proprietary information of other contractors. Assignment of contractor employees who have not executed this statement or failure to adhere to this statement shall constitute default on the part of the contractor.

1.6.13 Data Rights

The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.6.14 Records Management

The contractor shall ensure that copies of all records, documents, data, drafts, working papers, records of interviews, or other items related to the creation of the lessons learned report are maintained on SIGAR’s internal network, per the relevant LLP file structure for each research project. These records should be updated on a continual basis, at minimum bi-weekly and whenever requested by SIGAR.

1.6.15 Government Furnished Property, Equipment, and Services

SIGAR will provide office space (cubicle), a desktop or laptop computer for access to shared drives and other files and documents needed, and will supply necessary materials to complete designated tasks.

1.7 Deliverables

All deliverables shall be provided in electronic format, as an e-mail attachment, to the Technical Point of Contact and the Contracting Officer’s Representative (COR).

At a minimum, monthly summary reports & status updates shall be submitted to the Technical Point of Contact. Progress reports will be required when SIGAR uses the contractor for work performed.

Summary reports shall be delivered no later than the 5th business day of every month and Status updates will be provided upon request from SIGAR– to include:

· A list of deliverables in this contract and the activities completed in the previous month and activities planned for the following month relevant to each of these deliverables

· Any personnel changes (Contractor accountability reports); and

· Any additional information or documentation requested by SIGAR.

· On-Demand Reports – if specific issues come to impede the performance of the contract, SIGAR reserves the right to request reports on specific issues and challenges. Requested contents of these reports will vary on a case by case basis and will be detailed by SIGAR in an official request to the contractor.

2.0 Performance Objectives

The contractor’s performance for all deliverables will be measured against the performance objectives identified in the Service Delivery Summary below, as well as any additional Performance Standards listed under individual PWS subsections:

Feedback

Both Positive and negative performance will be documented in the Contractor Performance Assessment Reporting System (CPARS), as appropriate, and will be taken into consideration for follow-on work

Both Positive and negative performance will be documented in the Contractor Performance Assessment Reporting System (CPARS), as appropriate, and will be taken into consideration for follow-on work

Both Positive and negative performance will be documented in the Contractor Performance Assessment Reporting System (CPARS), as appropriate, and will be taken into consideration for follow-on work

Definitions Contractor: A supplier or vendor having a contract to provide specific supplies or services to the Government. The term used in this contract refers to the prime.

Contracting Officer: A person who has the authority to enter into, administer, and terminate contracts, and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

Contracting Officer’s Representative (COR): An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the contractor as long as direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

Defective Service: A service output does not meet the standards of performance associated with the Performance Work Statement.

Deliverable: Anything that can be physically delivered but may include non-physical things such as meeting minutes.

Key Personnel: contractor personnel are evaluated in a source selection process and may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons are listed in the proposal. Resumes shall be submitted with the proposals.

Physical Security: Actions that prevent the loss or damage of Government Property.

Quality Assurance: The Government procedures to verify services being performed by the contractor are performed according to acceptable standards.

Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

Quality Control: All necessary measures taken by the contractor to assure the quality of an end product or service shall meet contract requirements.

Work Day: The number of hours per day the Contractor provides services in accordance with the contract.

Work Week: Is defined as Monday through Friday, unless specified otherwise.

image1.png