INR_TIO - INSPIRE BPA DRAFT SOW 20240827 - FINAL RFI.pdf

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

United States Department of State

Bureau of Intelligence and Research (INR)

Blanket Purchase Agreement:

Intelligence Network Support, Personnel, Infrastructure and

Requisitions Engine (INSPIRE) 2.0

Statement of Work (SOW)

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

CONTENTS

1. INTRODUCTION

1.1. AUTHORITIES

1.2. CONFLICT OF INTEREST

1.3. BACKGROUND

1.4. DESCRIPTION OF SERVICES

1.5. ORDERING PERIOD

1.6. PRICING

1.7. STRATEGIC MODERNIZATION EFFORTS

1.8. CURRENT OPERATING AND MAINTENANCE ENVIRONMENT

2. SCOPE

2.1. PROJECT OBJECTIVES

2.2. PERFORMANCE OBJECTIVES

3. BPA REQUIREMENTS

3.1. TASK ONE – ACQUISITION AND PROCUREMENT ADMINISTRATION

(POP 01/27/2025 TO 01/26/2035)

3.1.1. PLANNING AND OVERSIGHT REPORTING

3.1.2. PROGRAMS, PROJECTS AND INITIATIVES

3.2. TASK TWO - OPERATIONS AND MAINTENANCE OF INR INFORMATION SYSTEMS

(POP 01/27/2025 TO 01/26/2035)

3.2.1. IT PROGRAM MANAGEMENT

3.2.2. CALL ORDER MANAGEMENT

3.2.3. SERVICE DESK/USER ASSISTANCE

3.2.4. NETWORK AND INFRASTRUCTURE ENGINEERING, OPERATIONS AND MAINTENANCE

3.2.5. VOICE AND VIDEO ENGINEERING AND OPERATIONS

3.2.6. SECURITY SUPPORT

3.2.7. EXPERIENCE AND SERVICE LEVEL AGREEMENTS (SLA) AND IT SERVICE DESK CUSTOMER

SERVICE GUIDE

3.2.8. PROCESS AND CONTINUOUS IMPROVEMENT FEES

3.2.9. TECHNICAL MANAGEMENT AND ADVANCED TECHNICAL STUDIES

3.2.10. PURCHASES OF HARDWARE AND SOFTWARE

3.3. TASK THREE – APPLICATION DEVELOPMENT, INTEGRATION AND OPERATIONS SUPPORT

(POP 09/29/2028 TO 01/26/2035)

3.3.1. ROBUST, RELIABLE, EFFICIENT SYSTEMS

3.3.2. USER CENTRIC DESIGN

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

3.3.3. CUSTOMER COMMUNICATIONS

3.3.4. MULTI-DOMAIN APPLICATION

3.3.5. USER EXPERIENCE (UX)

3.3.6. INNOVATION INCENTIVE FEES

1.1. TASK FOUR – CYBERSECURITY SERVICES

(POP 09/29/2026 TO 01/26/2035)

1.1.1. PERFORM ROUTINE NETWORK SCANS

1.1.2. CONFIGURATION MANAGEMENT

1.1.3. SUPPORT GOVERNMENT-WIDE CYBER PRIORITIES

1.2. TASK FIVE - TRANSITION

1.2.1. TRANSITION-IN

1.2.2. TRANSITION-OUT

2. PERFORMANCE DETAILS

2.1. LABOR CATEGORIES AND PERSONNEL QUALIFICATIONS FOR THIS BPA

2.1.1. STAFFING REQUIREMENTS

2.2. CONTRACT DELIVERABLES .................................................................. ERROR! BOOKMARK NOT DEFINED.

2.3. PERIOD OF PERFORMANCE

2.4. PLACE OF PERFORMANCE

3. APPLICABLE DOCUMENTS

4. CONSTRAINTS

4.1. CLEARANCE REQUIREMENTS

5. ROLES AND RESPONSIBILITIES

5.1. GOVERNMENT PERSONNEL

5.1.1. CONTRACTING OFFICER (CO)

5.1.2. CONTRACTING OFFICER REPRESENTATIVE (COR)

5.1.3. PRODUCT OWNER (PO)

5.1.4. GOVERNMENT TECHNICAL MONITORS (GTM)

5.2. CONTRACTOR PERSONNEL

6. BPA CALL ORDER MANAGEMENT

7. GENERAL INFORMATION

7.1. GOVERNMENT FURNISHED PROPERTY, EQUIPMENT (GFP/GFE) AND FACILITIES

7.2. QUALITY CONTROL THROUGH QUALITY ASSURANCE

7.3. IDENTIFICATION OF CONTRACTOR EMPLOYEES

7.4. REIMBURSABLE EXPENSES (INCIDENTAL TRAVEL OR INCIDENTAL HARDWARE/SOFTWARE

PURCHASES)

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

7.5. NON-PERSONAL SERVICES STATEMENT

8. APPENDICIES

8.1. APPENDIX 10.1: GENERAL INFORMATION

8.1.1. HARDWARE

8.1.2. SOFTWARE

8.1.3. HELP DESK TICKETS

8.2. APPENDIX 10.2: DELIVERABLES

8.3. APPENDIX 10.3: PERFORMANCE REQUIREMENTS SUMMARY (PRS)

8.4. APPENDIX 10.4: QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

8.4.1. PURPOSE

8.4.2. GOVERNMENT ROLES AND RESPONSIBILITIES

8.4.3. CONTRACTOR REPRESENTATIVES

8.4.4. METHODS OF SURVEILLANCE

8.4.5. PERFORMANCE ISSUES FINDINGS AND FORMAL REPORT

8.5. APPENDIX 10.5: ACRONYMS AND DEFINITIONS

1. INTRODUCTION

This BPA provides the Department of State (DoS) Bureau of Intelligence and Research (INR), as well as other Department intelligence stakeholders, with a streamlined, efficient ability to acquire a range of information technology (IT) services to provide reliable, effective, and secure IT network capabilities and resources in support of the Bureau’s mission.

INR is responsible for providing independent analysis of events to DoS policymakers and the broader

Intelligence Community (IC). INR ensures intelligence activities support foreign policy and national security purposes and serves as the focal point at DoS for ensuring policy review of sensitive counterintelligence and law enforcement activities around the world. Additionally, the department directs the DoS program of intelligence analysis and research, liaises with the IC, and represents the

DoS on committees and in interagency intelligence groups. INR serves a broad customer base with diverse intelligence requirements in increasingly complex, interconnected, and rapidly changing global environment. INR is comprised of roughly 20 offices reporting to three Deputy Assistant Secretaries

(DAS) responsible for four lines of business: Analysis and Production (AP); Intelligence, Policy, and

Coordination (IPC); Executive Directorate; and Operations.

INR serves several audiences, and users of these systems may include policymakers, intelligence personnel, military officers, congressional staff, foreign Government, or the public. INR fulfills many roles including providing full source intelligence analysis, coordinating between diplomatic policymakers and the intelligence community, and providing boundary and sovereignty analysis.

INR’s technologies must continuously evolve to meet the requirements of the INR analysts and the IC.

Evolvement includes the development and operation of technology needed to improve product quality, modernization of processes, ensuring product reliability, and facilitating the rapid dissemination of

INR products.

The Technology and Innovation Office (TIO) designs, deploys, protects, and supports information technology that allows INR’s staff to maximize their productivity and effectiveness in executing the

Bureau’s core mission. TIO is led by the DoS Chief Information Officer (CIO) and is organized across three divisions: Infrastructure and Operations (I&O), Security and Cybersecurity (CS), and

Acquisition, Budget and Plans (ABP). TIO operates the Department’s JWICS network presence (i.e.

INRISS), as well as systems across both the unclassified internet, unclassified intranet (i.e. OpenNet), SIPR (i.e. ClassNet), and cloud systems on multiple classification levels.

1.1. AUTHORITIES

This Multi Award Blanket Purchase Agreement (BPA) is established pursuant to the terms of the Information Technology Professional Services under Special Item Number (SIN)

54151S and Highly Adaptive Cybersecurity Services SIN 54151 are available on the GSA

Multiple Award Schedule (MAS). The terms and conditions of the GSA Schedule shall govern except in situations when specific Department of State and Bureau of Intelligence and Research guidelines are outlined in the BPA or resultant order.

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

1.2. CONFLICT OF INTEREST

This effort may result in an actual or potential conflict of interest, or may provide contractors with the potential to attain an unfair competitive advantage based on access to source selection sensitive information gained by performance of required acquisition support services. Contractors shall comply with requirements of the FAR Part 9.5 and the Organizational Conflict of Interest clause included in the BPA.

An organizational conflict of interest is similar to a personal conflict of interest in terms of its harmful effects on the integrity of the acquisition process. The difference is that, with an organizational conflict of interest, no person stands to directly benefit from the conflict of interest. Rather, the organization — whether it’s a government organization or a company — stands to benefit. An organizational conflict of interest may result when factors create an actual or potential conflict of interest on an instant contract, or when the nature of the work to be performed on the instant contract creates an actual or potential conflict of interest on a future acquisition. In the latter case, some restrictions on future activities of the contractor may be required.

1.3. BACKGROUND

The Intelligence and Research Information Support System (INRISS) is operational for Top Secret

Sensitive Compartmented Information (TS/SCI) processing and is operational 24 hours a day, 7 days a week, 365 days a year. The system is continuously evolving to meet the requirements of the INR staff and the IC, including a current strategic effort to migrate to a cloud-based network. This evolution of

INRISS includes the development and implementation of technology needed to improve output quality, modernize processes, ensure output reliability, and facilitate the rapid dissemination of INR products.

There is a subsystem of INRISS which allows for the electronic delivery of finished intelligence to clients located in approved Sensitive Compartmented Information Facilities (SCIFs), including facilities outside the INR space, for use by cleared and approved TS/SCI individuals in their respective

Bureaus. e-Intel also allows for the communication with other Intelligence Community (IC) counterparts though IC-Email, web sites, blogs, and Community of Interest (COI) sites. INRISS and e-Intel consists of commercial off the shelf (COTS), Government off the shelf (GOTS), and specifically designed software to integrate layered products in support of INR staff requirements. In addition to TS/SCI systems, INR maintains a presence on ClassNet and OpenNet, the Department’s

SIPR/NIPR equivalents.

1.4. DESCRIPTION OF SERVICES

IT Professional Services include: Network Services; Data/records management; Testing; Systems analysis, integration and design; Programming, conversion and implementation support; Professional services and labor categories for database planning and design.

The contractor shall provide network systems business process and support services related primarily to the operation and maintenance, help desk support, user training, reports development, and minor upgrades and enhancements of existing systems. Also included are special projects or initiatives that

DRAFT Pre-Decisional SBU//Contracting and Acquisitions include work associated with supporting the development and implementation of new systems and integration/interfaces to new or existing systems whether optional or mandatory. These special projects may include supporting the migration, implementation and systems maintenance for non-INR organizations as part of any shared services type program that INR may pursue.

1.5. ORDERING PERIOD

The ordering period for the BPA will be for one base year and nine (9) option years. The Period of

Performance for each order will be specified in each individual BPA order.

BPA Orders will be firm-fixed price (FFP), time and materials (T&M), labor hour (LH), or a hybrid depending on the requirement.

1.6. PRICING

The Contracting Officer permits contractors to offer price reductions from price lists in accordance with commercial practices. INR is seeking price reductions from GSA published price lists under this

BPA and all orders.

Pricing under this BPA may be reviewed no less than annually to ensure compliance with the paragraph above. BPA pricing may be refreshed to accommodate a downward trend in market prices.

The BPA holder can voluntarily reduce its rates at any time during the BPA by giving advanced written notice to the CO or when responding to a specific Request for Quote. As future labor rates are established in the Awardees’ GSA Schedule, should the GSA Schedule rates be lower than these proposed BPA rates, the BPA will be modified to incorporate the lower GSA Schedule rates and associated discounts.

1.7. STRATEGIC MODERNIZATION EFFORTS

In 2019, INR began its broad modernization initiative, including a digital transformation and migration to a cloud-based network. To succeed in its digital transformation, INR has identified the need to modernize or sunset legacy interfaces and systems and develop modern custom tools and infrastructure that are better suited for customer needs. Success in this effort requires solutions which integrate seamlessly with other IC systems, IT program management to prevent disruption in mission capabilities, and an intimate knowledge of user requirements. TIO is often called upon to be champions for innovations and best practices both in technologies and changing business processes.

In 2020, TIO developed and launched INR’s new flagship intelligence dissemination platform, Tempo on INRISS/JWICS, followed by the Secret version of the site on ClassNet/SIPR in early 2021 and the sensitive but unclassified (SBU) version on OpenNet in July 2023. The development of this custom site marked a generational leap in technological offerings from TIO and is the touchstone for future development initiatives.

INR is prioritizing the utilization of cloud technologies to advance its capabilities and offerings that meet Bureau stakeholder requirements. This includes adoption of virtualization/containerization, infrastructure as code, and zero trust infrastructure to enable strategic capabilities such as rapid system

DRAFT Pre-Decisional SBU//Contracting and Acquisitions development and instantiation, high availability, strong contingency plans, and security controls.

These include utilization of Amazon Web Services (AWS) and Microsoft Azure Cloud capabilities.

1.8. CURRENT OPERATING AND MAINTENANCE ENVIRONMENT

INR operates on multiple classification domains; including internet, OpenNet/NIPR intranet, ClassNet/SIPR, and INRISS/JWICS; and has global operations which depend on INR’s IT Support

Services 24 hours a day, 7 days a week, and 365 days a year. Currently, OpenNet and ClassNet are managed by Department of State Bureau of Diplomatic Technology (DT). INRISS currently consists of a variety of platforms supporting a mostly zero client infrastructure utilizing VMWare for desktop delivery, and traditional/blade servers with local and Storage Attached Networks (SAN). The INRISS infrastructure is a multi-tenant, multi-domain architecture comprised mostly of Cisco equipment, and leverages a Next Generation Firewall to meet unique security requirements. Type 1 encryption devices are also used and must be maintained and configured. Backups of all systems are mandatory and must be tested and stored off site.

INRISS leverages operating systems, capabilities, and applications including VMware solutions, several databases, Microsoft Exchange, Windows (and its various server roles), and web sites. The

INRISS security systems include both COTS and GOTS tools; some COTS tools include XACTA, Nessus, RedSeal, and other industry compliance scanning tools.

The current operational environment includes but is not limited to Microsoft Servers, SQL Databases, Cisco ISE, Palo Alto Firewalls, Type-1 (KG) Crypto Devices, Public Key Infrastructure (PKI)

Issuance, profile administration through Dynamic Enterprise Manager (DEM), Teradici Zero Clients, Voice over Internet Protocol (VoIP) and video endpoints and associated servers, Standalone Windows

10 Workstations, virtual desktop infrastructure (VDI) utilizing VMWare vCenter and Horizon View, enterprise administration through Active Directory, and license and software administration.

In-scope service areas for the INR operational environment include, but are not limited to:

a) Artificial intelligence applications

b) Antivirus

c) Applications

d) Backup and restoration of data

e) Cloud architecture and engineering

i) AWS/C2S

ii) Azure

f) ComSec administration

g) Cross-Domain Solutions (CDS)

h) Data analytics

i) Database administration

i) SQL

ii) Oracle

j) Domain enterprise support

k) Geospatial application support

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

i) ARC GIS

ii) Google Earth

iii) Adobe Creative Cloud

iv) ESRI

v) MaPublisher

l) Information Security

i) Information security governance (e.g., Assessment and Authorization (A&A), Incident management, compliance management, vulnerability management, etc.)

ii) Security testing and assessments

iii) Network Security Architecture

(1) Zero Trust Network design, implementation, and management (Identity & Access

Management, Endpoint Security, Data Security, Firewall, Intrusion Detection and

Prevention Systems, Access Controls, etc.)

(2) Cloud security architecture design and maintenance

iv) Security Design and Engineering

(1) Cloud security design, implementation, and assessment

(2) Zero Trust Network security architecture, implementation, and maintenance

(3) Layer 1 Security Design and Implementation (e.g., physical access controls, environmental controls, power and cable management, tamper-evident seals, etc.)

(4) Layer 2 Security Design and Implementation (e.g., 802.1X authentication, Spanning

Tree Protocol protection, port Security, MAC address filtering, VLAN segmentation, etc.)

(5) Layer 3 Security Design and Implementation (e.g., access control lists, Virtual Private

Networks (VPN), IPSec, NAT, etc.)

(6) Implementation network scanning/monitoring tools or technology controls in support of the cybersecurity program

v) Security System Administration (e.g., designing and deploying security systems, configuring networks and systems to align with organizational security policies, monitoring security systems, managing user access and privileges, maintaining, and updating security systems and network hardware\software to mitigate vulnerabilities against emerging threats, etc.)

vi) Security Operations (e.g., security monitoring, incident response, security automation and orchestration, security analytics, compliance\governance, firewall administration, intrusion detection and prevention systems administration etc.)

vii) Insider Threat (e.g., policies, procedures, and technologies to mitigate the risk of insider threats, user activity monitoring and other technical controls, etc.)

viii) Communication Security (e.g., secure handling, storage, and distribution of cryptographic materials, periodic inventories and inspections, maintaining accurate records of cryptographic materials, reporting compromise, etc.)

ix) Application security (e.g., Application hardening, etc.)

x) Software development security

xi) Disaster recovery and business continuity

xii) Mobile security

xiii) Asset security

m) Inventory management and tracking of both hardware and software

n) IT service management platforms (e.g., ServiceNow)

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

o) Messaging (e.g., Exchange Email, Jabber, Teams...)

p) Network/Infrastructure

q) Secure host baseline maintenance (e.g., Operating system hardening, update hardware disposal, End of Support software, and patch management)

r) Peripherals

i) Printers

ii) Scanners

iii) Monitors

iv) Keyboard/Mouse

s) Public Key Infrastructure (PKI)

t) Servers

u) User Profile Services

v) Video Tele-Conferencing (VTC) and Voice Over IP (VOIP)

w) Virtual Desktop Infrastructure (VDI)

x) Website administration and troubleshooting

y) Workstations

i) Standalone desktop

ii) Zero Client hardware

2. SCOPE

Call orders issued under this BPA will define specific requirements for providing the full range of IT core support services necessary to effectively support the DoS INR mission with secure, reliable, and efficient IT capabilities and services. Core support services shall include BPA management, individual call order management, service desk/user support, IT network and infrastructure operations and maintenance support, IT security support consistent with DoS and IC security requirements, advanced technical studies, support purchasing hardware/software when needed, and transition/integration support for new IT capabilities introduced onto INR networks. Call orders may also be issued to provide corresponding services in support of additional DoS bureaus and other federal bureaus, which provide additional, similar, or derivative instances of INR TIO IT support that will be implemented and require support within other DoS domains.

When ordered, the Contractor will develop, operate, secure, and maintain numerous systems across multiple classification domains (primarily focused on TS/SCI systems), including both on-premises and cloud systems both as the system owner or as a tenant subsystem within other organization operated information systems.

2.1. PROJECT OBJECTIVES

The objective of this BPA is to obtain the full range of IT support services required for INR IT networks to ensure reliable, effective, secure, and uninterrupted IT capabilities needed to support the dynamic INR mission.

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

2.2. PERFORMANCE OBJECTIVES

Specific performance objectives detailed in Section 4 below will be included in subsequent Call Orders issued under this BPA. Representative call order performance objectives for each of the specific requirements detailed in Section 4 below are delineated in Appendix 10.3, “Performance Requirements

Summary,” of this SOW.

3. BPA REQUIREMENTS

Call orders issued under this BPA may reflect any variety of combinations of the BPA requirements defined in this section. These requirements will entail all classification levels, as specifically defined individually and collectively within the respective BPA call orders.

The Contractor shall deliver IT capabilities and services to support the dynamic INR mission, as measured by Call Order level Performance Requirements and Service Level Agreements (see

Appendix 10.3 Performance Requirements Summary (PRS) for representative performance requirements). Such capabilities and services shall be delivered to satisfy the performance standards defined herein, and consistent with industry best practices, as well as the DoS and IC security standards. In addition, performance shall conform to the applicable background and governance documents identified in Section 5, Applicable Documents.

3.1. TASK ONE – ACQUISITION AND PROCUREMENT ADMINISTRATION

(POP 01/27/2025 TO 01/26/2035)

3.1.1. PLANNING AND OVERSIGHT REPORTING

Includes lifecycle acquisition management support for the procurement of goods and services in support of the Technology and Innovation Office and performance-based management support for

Contracting Officer Representatives (CORs). The Contractor shall provide all personnel and supervision necessary to provide efficient and cost- effective acquisition management support services to achieve the Office business outcomes. It should be noted that this support is limited in scope to only acquisition related functions which are the responsibility of the Technology and Innovation Office.

The Contractor shall prepare and deliver, as necessary – acquisition and procurement planning, oversight, and execution/status reports as defined by the, DOSAM, DOSAR and any other established program/project management processes in place at DoS.

Below are examples of acquisition and procurement artifacts:

● Mission Needs Statement

● Integrated Master Schedule

● Cost Projection Estimates

● Alternatives Analysis (AA)

● Analysis of Alternatives (AoA)

● Operational Requirements Documents

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

● Project Management Plan (PMP)

● Risk Management Plan (RMP)

● Quality Assurance Plan

● Operational Analysis (OA)Security Test & Evaluation Plan

3.1.2. PROGRAMS, PROJECTS AND INITIATIVES

Perform Program Management support for emerging procurement Initiatives, to include:

• Develop and maintain project plans and integrated master schedules to track and manage procurements

• Develop and coordinate planning activity and documents to support project reporting and approvals including business cases and those associated with acquisition management

• Support Change Control and Integration Boards including reports preparation and communication with key participants and acquisitions timelines, activities, milestones, dependencies, risks and issues

• Develop and manage project methodology, integration, and quality for procurement and acquisition activities

• Collaborate with stakeholders to assist in defining and documenting requirements to inform procurement and acquisition decisions in the following areas:

- Configuration Management

- Operations & Maintenance

- Issue Management

- Risk Management

- Knowledge transfer

- Project status reporting

• Support the COR in monitoring and reporting contractor performance metrics and provide recommendations to address performance challenges

• Develop and prepare resource and cost estimates for new initiatives, procurements and acquisitions.

• Perform systems analysis, design, configuration, testing and all associated documentation including that which is needed for investment, acquisition, and program management reviews

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

3.2. TASK TWO - OPERATIONS AND MAINTENANCE OF INR INFORMATION

SYSTEMS

(POP 01/27/2025 TO 01/26/2035)

3.2.1. IT PROGRAM MANAGEMENT

TIO operates the Department’s JWICS network presence (i.e. INRISS), as well as systems across both the unclassified internet, unclassified intranet (i.e. OpenNet), SIPR (i.e. ClassNet), and cloud systems on multiple classification levels.

● Operate and maintain information networks on multiple classification domains; including internet, OpenNet/NIPR intranet, ClassNet/SIPR, and INRISS/JWICS; and has global operations which depend on INR’s IT Support Services 24 hours a day, 7 days a week, and 365 days a year

● The personnel supporting this effort must have appropriate security clearances, education, certifications, experience, and skills commensurate with the work scope and operational tempo

● Plan, implement, monitor, and continuously improve an IT Service Desk/User Assistance function to ensure interruptions in individual or collective users’ availability of systems or data

● Plan, develop, implement, operate, maintain, and monitor a network operations and maintenance program to provide robust, reliable, and efficient IT networks access and availability across all security levels

● Manage Information security aspects of the INR networks, including, but not limited to, protecting information from unauthorized access, use, disclosure, disruption, modification, or destruction, regardless of the form the information takes (i.e., electronic, paper, or physical), and provide support to INR’s comprehensive cybersecurity program

● Perform tasks related to the maintenance, modernization, and improvement of INR Systems to include the network, servers, desktops, and web services

In accordance with specific call orders, when and if issued, the Contractor shall develop and implement a flexible Staffing Plan and Project Management Plan (PMP) to recognize, anticipate, and align with the fluctuations and shifting priorities related to the support requirements for each awarded call order. The Staffing Plan shall include the Contractor’s strategic considerations for: workforce recruitment, training, retainment, an organizational chart, identified roles and responsibilities, labor mix and hour breakdown, and key personnel resumes. The Staffing Plan shall consider and plan for an effective balance of on and off premises support, leveraging cloud environments to the extent practical. The Staffing Plan shall consider and proactively manage the staff across all levels of security from Unclassified through and including TS/SCI.

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

There is a requirement to operate a service desk on multiple classification domains; including internet, OpenNet/NIPR intranet, ClassNet/SIPR, and INRISS/JWICS; and has global operations which depend on INR’s IT Support Services 24 hours a day, 7 days a week, and 365 days a year.

The Contractor Program Manager (CPM) shall collaborate closely with the COR and GTM(s) to ensure performance under this BPA is fully integrated and efficiently delivered consistent with the defined work scope of the awarded call orders. These responsibilities include staffing selection and assignment, overseeing the integration of staff into assigned projects, cost control, schedule management to ensure on time delivery, and implementing consistent quality assurance across all call orders.

3.2.2. CALL ORDER MANAGEMENT

The Contractor shall carefully plan for and properly integrate the resources (e.g., contractual requirements, budget, and personnel) necessary to fulfill the performance objectives identified in this

SOW and subsequent call orders. The personnel supporting this effort must have appropriate security clearances, education, certifications, experience, and skills commensurate with the work scope and operational tempo. For this effort, DoD Directive 8570 training, certification, and workforce management requirements shall serve as a minimal certification baseline. The Contractor shall properly integrate the full range of support activities included in this SOW and subsequent call orders, as well as strive to minimize duplications of effort amongst contractual lines while ensuring timely/quality performance and deliveries. Within this responsibility, the Contractor shall develop and implement a quality control and management oversight plan to effectively manage the staff and the performance per the standards established herein. Performance measures for this requirement are defined in the Appendix 10.3 “Performance Requirements Summary” (PRS) and include timeliness of staff on-boarding, timeliness of deliverables, and consistency in meeting all performance measures within this call order.

3.2.3. SERVICE DESK/USER ASSISTANCE

The Contractor shall plan, implement, monitor, and continuously improve an IT Service Desk/User

Assistance function to ensure interruptions in individual or collective users’ availability of systems or data are resolved in accordance with call order Experience Level Agreements (XLA) and IT Service

Desk Customer Service Guides. The Service Desk will provide on-site end user support for all information technology service requests. Example services are outlined, but not limited to, the list provided in the Current Operating and Maintenance Environment section of this document (Section

1.3).

Performance measures for this requirement are defined in the Appendix 10.3 PRS and include on-call crisis response coverage, first contact resolution rates, and user service restoration times.

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

3.2.4. NETWORK AND INFRASTRUCTURE ENGINEERING, OPERATIONS AND

MAINTENANCE

The Contractor shall plan, develop, implement, operate, maintain, and monitor a network operations and maintenance program to provide robust, reliable, and efficient IT networks access and availability across all security levels.

• Robust refers to the capacity of the network to maintain functionality and connectivity. This includes, but is not limited to, planning, preparing for, and maintaining network performance during periods of system failures, cyber-attacks, natural disasters, or other disruptive events

• Reliability refers to the length of time IT infrastructure operates without disruption. This includes, but is not limited to, minimizing the mean time between failures as well as the failure rate

• Efficiency refers to network performance relative to the number of users as well as the capabilities of network hardware and software.

This objective includes the full scope of IT systems administration, application delivery, and content/configuration management.

Performance measures for this requirement are defined in the Appendix 10.3 PRS below and are based on the quality, relevance and innovation of Contractor recommendations, and the timeliness of deliveries of technical study results.

3.2.5. VOICE AND VIDEO ENGINEERING AND OPERATIONS

Performance measures for this requirement are defined in the Appendix 10.3 PRS below and are based on the quality, relevance and innovation of Contractor recommendations, and the timeliness of deliveries of technical study results.

3.2.6. SECURITY SUPPORT

In support of the INR Chief Information Systems Security Officer (CISO), the Contractor shall be responsible for managing Information security aspects of the INR networks, including, but not limited to, protecting information from unauthorized access, use, disclosure, disruption, modification, or destruction, regardless of the form the information takes (i.e., electronic, paper, or physical), and providing support to INR’s comprehensive cybersecurity program.

Information security is concerned with maintaining the confidentiality, integrity, and availability of

INR’s information.

• Confidentiality refers to ensuring that only authorized individuals have access to the information. This includes, but is not limited to, access controls, encryption, and secure storage to prevent unauthorized access and disclosure of information.

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

• Integrity refers to maintaining accuracy, completeness, and trustworthiness of INR’s information. This includes, but is not limited to, data validation, backup and recovery, and change management processes to ensure that INR’s information is not accidentally or maliciously modified or deleted.

• Availability refers to ensuring that INR’s information is accessible to authorized individuals when needed. This includes, but is not limited to, measures such as redundancy, fault tolerance, and disaster recovery planning to ensure that INR’s information is not lost or unavailable due to system failures, natural disasters, or other disruptive events. Specific requirements, if any, will be detailed at the call order level.

Support to INR’s cybersecurity program includes support to Information Security, Operational Risk

Management, Network Security, Application Security, Communications Security, Security Operations

Center, Compliance, and Training and awareness. Specific requirements, if any, will be detailed at the call order level.

Performance measures for this requirement are defined in the Appendix 10.3 PRS and include on-time delivery in accordance with project plans, timely response to security notices, alerts and directives issued by the Department or IC.

3.2.7. EXPERIENCE AND SERVICE LEVEL AGREEMENTS (SLA) AND IT

SERVICE DESK CUSTOMER SERVICE GUIDE

The Contractor shall develop, deliver, and maintain Experience and Service Level Agreements (SLA) and an IT Service Desk Customer Service Guide as necessary to support the requirements of this SOW and the Appendix 10.3 PRS as prescribed in call orders issued under this BPA.

3.2.8. PROCESS AND CONTINUOUS IMPROVEMENT FEES

Based on the scope of this TO, the contractor shall agree to continuous improvement of certain Service

Level Requirements (SLRs) and/or outcomes. This improvement and timing shall be defined by the

GTMs. Contractors will be assessed on the processes they implement, their conformance to processes, their contribution to required frameworks, and to continuously improve these processes. They will also be assessed on innovative approaches and solutions that change the services and results in additional

Business and/or IT value. The PM and the COR will determine implementation and conformance and apply incentives for performance as applicable.

3.2.9. TECHNICAL MANAGEMENT AND ADVANCED TECHNICAL STUDIES

The Contractor shall provide innovative solutions in support of INR’s systems. As INR continues to implement its cloud migration strategy, this process plays an important role in the technical aspects of designing, testing, operating, and improving IT services, as well as in developing the skills required to operate the IT infrastructure.

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

At the request of the COR/GTM, the Contractor shall provide INR support for performing tasks related to the maintenance, modernization, and improvement of INR Systems to include the network, servers, desktops, and web services.

Requirements for specific Technical Management and Advanced Technical Studies will be defined at the call order level. Potential studies may include but are not limited to the following:

● Perform technical analysis of proposed network or system upgrades, and new capabilities to assess INR Systems integration and transition risks

● Provide advice in the selection of emerging hardware and software technologies

● Provide assistance with the planning, installation, set-up, and operation of emerging technologies

● Provide assistance with identifying surplus equipment and tracking inventory

● Assist with research, development, and implementation of ad-hoc tasks and special projects

● Provide documentation as needed for continuity, standard operating procedures, policy, and ad-hoc tasks/projects

● Provide security enhancements and recommendations commensurate with security level/risk

Performance measures for this requirement are defined in the Appendix 10.3 PRS below and are based on the quality, relevance, and innovation of Contractor recommendations, and the timeliness of deliveries of technical study results.

3.2.10. PURCHASES OF HARDWARE AND SOFTWARE

The contractor shall analyze and provide written recommendations and supporting justifications for hardware upgrades and replacements. If approved by the Government contracting officer (or designee such as an assigned GTM or COR), the Contractor shall implement the replacement actions consistent with the following constraints:

● Procure hardware, software, and systems required to accomplish the tasks specifically defined in the contract to maintain current or modernize operations (i.e., bench stock items or mission critical items that are in-service, have failed or are failing, and specialized equipment necessary to support proof of concept activities)

● Enable a critical function. The enablement of a critical function is an item that supports provision of service to the existing infrastructure or poses a critical risk to Agency mission such as enhanced security, storage capacity (i.e., disk space), etc.

● Support time sensitive mission requirements.

3.3. TASK THREE – APPLICATION DEVELOPMENT, INTEGRATION AND

OPERATIONS SUPPORT

(POP 09/29/2028 TO 01/26/2035)

The objective is to obtain highly specialized technical contractor support services to assist the CIO in executing and accomplishing their application development objectives. Key Mission Objectives are below:

● Perform application and service compliance and performance monitoring (e.g., FedRAMP, DHS Directive 4300A, NIST Guidance, Federal Information Security Management Act of 2002

(FISMA), Privacy, Section 508 of the Rehabilitation Act of 1973, as amended, 36 CFR Part

● Perform application delivery and systems assurance including configuration management.

● Plan, develop and manage enterprise application development and delivery.

● Provide an integrated approach to enterprise application capabilities (e.g., user interface, application logic, workflows, access to data and security, etc.).

● Provide Architecture and Planning Support.

● Provide Development and Implementation Support.

● Provide Strategic Communications Support.

● Provide User Experience/Customer Experience research, design, and consulting support.

● Implement and manage technology platforms with numerous customers/tenants based on infrastructure, software, and cloud services.

This task includes the full range of activities and support for planning, development, implementation, operation, monitoring and enhancement of INR’s enterprise application portfolio. This support includes all mission applications currently integrated into the INR Enterprise and mission applications to be integrated over the life of this task.

INR operates system components in support of intelligence operations across all classification levels and the contractor’s innovation and support to INR shall be critical to national security and foreign policy. Specific activities the contractor shall be required to perform are emergent and evolving over time but can reasonably be expected to include those activities listed below.

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

3.3.1. ROBUST, RELIABLE, EFFICIENT SYSTEMS

The contractor must ensure systems are designed and maintained to provide robust, reliable, efficient, and secure system functionality and availability across all security levels. This objective includes the full scope of IT systems administration, application delivery, and content and configuration management. Essential system upgrades, security patches, and modifications, as well as any other planned systems maintenance shall be planned and coordinated with the COR and GTMs to establish the most appropriate time to schedule actions to minimize disruption of services and mission impact.

3.3.2. USER CENTRIC DESIGN

The contractor shall provide User Centric Design services utilizing both commercial products such as

Microsoft SharePoint & Nintex, and will be responsible for creating bespoke custom applications utilizing C#, .NET, MS SQL, ElasticSearch, and other similar technologies.

The contractor shall work closely with other contractors allocated to support these applications to minimize duplication, ensure consistent secure function of these applications, recommend new innovative ideas, and anticipate risks.

3.3.3. CUSTOMER COMMUNICATIONS

The Contractor shall establish and maintain a proactive and retroactive communications program. The purpose of this program is to ensure customers of the Contractor that operate services are promptly informed of systems changes and upgrades, and of system maintenance or interruptions. This includes coordinating with operators of other interconnected systems, intelligence community enterprise data standards governance bodies, other Department IT stakeholders, external government agencies, and other INR service consumers to identify requirements, impacts of planned and unplanned changes, and troubleshooting incidents.

3.3.4. MULTI-DOMAIN APPLICATION

INR operates on multiple classification domains; including internet, OpenNet intranet, ClassNet/SIPR, and INRISS/JWICS; and has operations, which depend on the INR Development Enterprise

Applications managed solutions 24 hours a day, 7 days a week, and 365 days a year. Normal hours for this call order are based on a 40-hour work week engagement with core hours as determined by the

COR, plus on-call support as needed to ensure sufficient operational support. The contractor shall support this operating environment per mission requirements.

3.3.5. USER EXPERIENCE (UX)

The intent of this effort is to modernize existing User Interfaces (UI), aligning it with the programs overall User Experience (UX) effort, and harmonizing solution aesthetics for transparent system integration. The contractor shall identify process inefficiencies, bottlenecks and effectively restructure the user experience leveraging modernization and UX tools. Furthermore, the contractor will

DRAFT Pre-Decisional SBU//Contracting and Acquisitions communicate with business process owners to explain design approach, UX benefit and expected improvements helping users getting their job done easily and more intuitively.

3.3.6. INNOVATION INCENTIVE FEES

To manage the contractor’s services by monitoring and measuring performance on critical requirements, this Call Order (CO) may designate performance metrics and Service Level

Requirements (SLRs) that measure the outcome(s) expected for this task. These SLRs will be reported by the contractor and evaluated by the PM and CO level COR to determine compliance and/or to apply incentives for performance as applicable. CO performance may also be measured by deliverables or other outcomes defined in the CO and agreed to by the contractor. Measurements for this task may include (not limited to) achievement of Minimally Viable Product (MVP) and User Acceptance

Testing dates as required by the Integrated Master Schedule (IMS).

3.4 TASK FOUR – CYBERSECURITY SERVICES

(POP 09/29/2027 TO 01/26/2035)

Building on results and findings of previous Cyber Hygiene Assessment efforts, the development of a

Cybersecurity Resilience Plan is part of TIO’s continued efforts to implement a holistic approach to a cyber hygiene management program and to engage with and validate industry compliance at an attainable and sustainable level between DoS and our Intelligence Community partners. TIO requires the following:

● Direct support in creating strategies, processes, procedures, capabilities, and tools to develop, implement, and mature the Office’s Cyber Security Program.

● Unified deliberate and crisis action planning, while integrating the execution of cyber defense plans.

● Integration of capabilities in concert with Intelligence Community Partners to ensure execution of cyber defense operations across prevention, detection, and response missions.

● Test high-priority IT systems.

● Quickly order and implement licenses and subscription-based services from technically-evaluated vendors.

● Stop adversaries before they impact networks.

● Rapidly address potential vulnerabilities.

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

3.4.1. PERFORM ROUTINE NETWORK SCANS

The contractor shall ensure that INR system of systems components are accessible for routine scanning. Furthermore, the contractor shall define vulnerability and scanning procedures to ensure credentialed scans of INR systems are regularly performed on all network endpoints.

3.4.2. CONFIGURATION MANAGEMENT

The contractor shall maintain comprehensive configuration management policies and procedures for

INR system of systems IAW NIST 800-53 and 5 FAM 651-658.

3.4.3. SUPPORT GOVERNMENT-WIDE CYBER PRIORITIES

The contractor shall provide proactive and reactive cybersecurity services and supports government-wide priorities like Application Security Testing (AST) and Zero Trust Architecture.

AST, is testing, analyzing, and reporting the security level of an application as it moves from early development stages through deployment and maintenance. An effective AST program incorporates products, services, and solutions that continuously assess and address application vulnerabilities through the entire software development life cycle. An AST program should:

● Reduce the number of vulnerabilities in released applications.

● Mitigate the potential impact of the exploitation of undetected or unevaluated vulnerabilities.

● Identify and address the root causes of vulnerabilities to prevent future recurrences.

● Provide greater insight into the Department’s application security posture.

Zero trust is an approach to cybersecurity that goes beyond “trust but verify” and treats all networks and traffic as potential threats.

A Zero Trust Architecture (ZTA) helps agencies build zero trust principles into industrial and enterprise infrastructure and workflows.

There is no single technology, product, or service that can achieve the goals of implementing a ZTA. A truly effective ZTA incorporates technologies that:

● Authenticate, monitor, and validate user identities and trustworthiness.

● Automate security monitoring and connect tools across information systems.

● Analyze user behavior and other data to observe real-time events and proactively orient network defenses.

● Identify, monitor, and manage devices and other endpoints on a network.

https://www.gsa.gov/node/156884 https://www.gsa.gov/node/149831

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

● Control and manage access to and data flows within networks.

● Secure and accredit applications within a technology stack.

● Support IPv4 and IPv6.

3.5. TASK FIVE - TRANSITION

3.5.1. TRANSITION-IN

The Contractor shall plan for and execute a transition-in strategy to provide for the on-boarding of appropriately qualified staff with the required security clearances and certificates, needed to support a smooth and seamless transition from the incumbent support team to “full performance” within 90 calendar days of call order award. Transition-in includes all staffing activities, as well as the necessary knowledge capture and transfer to ensure “work-in-progress” is smoothly transitioned, and mission support is not interrupted. Performance measures for the first 60 calendar days will be recorded and reported for monitoring purposes but will not be used as performance indicators until the completion of the third month of performance. The exception to this suspension of performance measures will be measures associated with this transition-in requirement. The performance measure for this requirement is defined in the PRS below and focuses on the on-boarding of support staff per the transition-in plan included in the Contractor proposal. The initial plan for Transition-in will be included in the BPA RFP response and will be updated and implemented during the initial performance period of newly awarded call orders.

3.5.2. TRANSITION-OUT

The Contractor shall plan for and support the smooth and seamless transition-out at the end of the performance period. The Contractor shall develop and deliver a transition-out plan defining their knowledge transfer plan with specific emphasis on transiting work-in-progress. The Transition-Out plan shall include a detailed inventory of all assigned GFE to facilitate the prompt disposition of assigned GFE at the end of performance. The Contractor shall coordinate with the incoming workforce

(government or contractor) as necessary to enable a seamless transition with minimum interruption of mission support. Prior to the start of the Transition-Out period, the Contractor shall provide the COR with an itemized list of estimated costs required to facilitate the transition out. The Contractor shall remain accountable for performance consistent with the PRS below until the end of the contract period of performance. The primary deliverable addressing performance of this optional requirement, if exercised, is located in Appendix 10.4 “Transition Out Plan.”

https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf

DRAFT Pre-Decisional SBU//Contracting and Acquisitions

4. PERFORMANCE DETAILS

4.1. LABOR CATEGORIES AND PERSONNEL QUALIFICATIONS FOR THIS BPA

4.1.1. STAFFING REQUIREMENTS

The performance of this contract will require a unique balancing of key personnel and skillsets to accomplish the requirements for the government. Individual call orders will specify minimum technical qualifications for required personnel.