E1 M0026425R0013 Amendment 0001.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this Amendment is to:

1) Provide completed Question and Answ er document RFP Attachment 1;

2) Revise FAR 52.212-1;

3) Revise PWS;

4) Revise RFP Attachment 2 Staff ing Matrix;

5) Revise RFP Attachment 3a Past Performance Questionnaire;

6) Revise RFP Attachment 4 Price Workbook;

7)Revise RFP PWS Attachment 1 Help Desk Matrix; and

8) Provide Industry Day Q&A Document, Draft RFP Q&A Document, and extend the due date and time of this solicitation from 10AM EST 30

September 2025 to 10AM EST 2 October 2025.

NOTE: All changes to the solicitation have been highlighted in yellow , w ith removed text stricken through and turned red, unless otherw ise stated in the respective document.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 42

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 18-Sep-2025

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X M0026425R0013

X 9B. DATED (SEE ITEM 11)

27-Aug-2025

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

12-Sep-2025

CODE

MCINCR - RCO

2010 HENDERSON RD CAPT BRADLEY A. HOOVER

QUANTICO VA 22124

M00264 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

M0026425R0013

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

SOLICITATION/CONTRACT FORM

The required response date/time has changed from 30-Sep-2025 10:00 AM to 02-Oct-2025 10:00 AM.

The following have been modified:

FAR 52.212-1 ADDENDUM

52.212-1 INSTRUCTIONS TO OFFERORS – COMMERCIAL PRODUCTS AND COMMERCIAL

SERVICES ADDENDUM

Tailored in accordance with FAR 12.302(a)

This is a Federal Acquisition Regulation (FAR) Part 12, Acquisition of Commercial Items, procurement utilizing the procedures in FAR Part 15, Contracting by Negotiation procedures. This request for proposals (RFP) will result in the award of a single award Indefinite-Delivery/Indefinite-Quantity (ID/IQ) contract against which it is planned to award Firm Fixed-Price (FFP) and Cost Reimbursement task orders in accordance with FAR Subpart 16.5 -

Indefinite Delivery Contracts. This IDIQ shall incorporate an overall ceiling value for the IDIQ. CLIN 0001will be issued on a Firm Fixed Price basis only and SLINs 0002AA and 0002AB will be issued on a Cost reimbursement basis only.

The Government intends to make an award from initial proposals; therefore, offerors should provide their most competitive and complete proposal assuming there will not be a future opportunity to revise its proposal. However, after receipt of proposals the Government may, with or without notice, conduct discussions with and, if desired, seek proposal revisions from as many or as few offerors as it, in its discretion, deems appropriate. Volume page limitations noted below may change based on proposal revisions received in response to discussions.

An offeror’s proposal must be determined to be acceptable or better to be eligible for award. The offeror must demonstrate an understanding of and an ability to meet the requirements set forth in the solicitation. All claimed capabilities to meet the requirements shall be realistic and are subject to verification by the Government. The offeror shall provide sufficient detail to substantiate the validity of all statements. General statements that the offeror can or will comply with the requirements, that standard procedures will be used, that well known techniques will be used, or paraphrasing the solicitation’s requirements in whole or part will NOT constitute compliance.

Non-conformance with these instructions may result in rejection of the proposal, an unfavorable proposal evaluation, or the proposal being deemed ineligible for award.

The Government reserves the right to incorporate all or part of the successful offeror’s proposal into the resultant contract.

(b) Submission of offers.

1. QUESTIONS

Offerors may submit questions requesting clarification of solicitation requirements. All questions must be received no later than 08 September 2025 at 10:00AM Eastern Time (ET). All questions shall be submitted on the attached

Question and Answer form (RFP Attachment 1) in its original file format and not converted to Word, Adobe

Acrobat (.pdf), or other file format. The form is to be submitted electronically to: cynthia.guthridge@usmc.mil, and bradley.hoover@usmc.mil.

2. OFFERS

Electronic (email) offers only will be accepted; paper copies are not required nor desired. Offers must be received by the date and time stated in Standard Form (SF) 1499 Block 8. Offers are to be submitted to:

cynthia.guthridge@usmc.mil, and bradley.hoover@usmc.mil. Email subject line shall read “M00264-25-R-0013

Submission [Vendor name] Source Selection Sensitive”.

Due to the firewall at Marine Corps Base Quantico, please be advised it is the offeror’s responsibility to ensure all electronic submissions are received by the Marine Corps Installations National Capital Region- Regional Contract

Office (MCINCR-RCO) in the timeframe given above, and not exceeding the file limit size of 25MB per electronic submission. Delivery delays that cause a question to be unanswered or an offer to be late are not the responsibility of

MCINCR-RCO. Offerors are advised to contact all above named individuals if receipt of questions or the offer is not acknowledged within an hour of it being transmitted or within an hour of the submission closing date and time.

3. OFFER FORMAT

To maximize efficiency for proposal evaluation, the entire offer submission must meet the following format requirements:

a. Each page must include the solicitation number and the offeror’s business name (excluding any RFP attachment’s included in the venders’ proposal).

b. Each page of the offer shall include the following footer: “CUI:/SSEL/CONREG/PROPIN”.

c. Pages shall be numbered consecutively within each volume. As an example, page 7 of Volume II is numbered II-

7. All pages will be numbered.

d. Minimum 10-point font, Times New Roman font for all text material, graphics, figures, exhibits, screen shots, drawings, and etc.

e. Each page if printed: fits on 8.5 x 11inch paper, at a minimum is single-spaced, has a minimum 1 inch margin on all sides.

f. Spreadsheet files shall include all formulas. All rows, columns, cells, and worksheets shall be visible; no password protected fields. Decimal places are limited to two (2) places.

g. Page limitations specified for each volume shall not be exceeded. All material in excess of the specified page limits will neither be read nor evaluated. Cover pages, table of contents, appendices, references, plans, etc., as well as graphs, charts, attachments and diagrams are included in the page count, unless otherwise noted. Partial pages count as a full page.

h. No hyperlinks are permitted.

i. Microsoft Office 2016 compatible files or Adobe pdf files are required.

j. RFP Attachment 2 and RFP Attachment 4 are submitted in Excel as an attachment to the proposal.

4. OFFER CONTENT

The offer shall be presented in four separate volumes:

Volume I: Administrative and Compliance

Volume II: Technical

Volume III: Past Performance

Volume IV: Price

Offerors are advised to ensure their proposal is accurate and complete. Each offeror shall assume the Government has no prior knowledge of its capabilities and experience. Each proposal shall stand on its own. It shall not be dependent or reliant on information not submitted. Brochuremanship is NOT desired, rather clarity, completeness, and conciseness are essential. Offerors are cautioned they are responsible for ensuring the information they desire to mailto:cynthia.guthridge@usmc.mil mailto:bradley.hoover@usmc.mil mailto:cynthia.guthridge@usmc.mil mailto:bradley.hoover@usmc.mil have evaluated for a particular volume is contained in that specific volume. The Government will consider information not found in the designated volume as being omitted from the offeror’s proposal.

4.1 Volume I Administrative and Compliance Documentation (No page limitation)

4.1.1 Offer Letter

• The solicitation number.

• Company information (name, address, telephone, CAGE, UEI, TIN).

• “Remit to” address, if different than above provided address.

• Authorized personnel who, in the event of questions, can provide answers regarding the offer and act on behalf of the company.

• Statement acknowledging all solicitation amendments (as applicable).

• Statement of agreement or statement specifying the extent of agreement with all terms and conditions, and provisions included in the RFP. Offerors are to clearly detail any exceptions taken and the rationale for the exceptions taken. Please note that exceptions taken to the RFP may render the offer unacceptable to the Government.

• Identify all proposed sub-contractors, to include teaming and joint ventures, by company name and

CAGE.

• Self-certify compliance with FAR 52.219-14 ‘Limitation on Subcontracting’.

• Demonstration of responsibility as required in FAR 9.104-1.

• Length of proposal validity (Proposal validation shall be for no less than 210 days.)

• SF 1449 page 1 with signature and date (pdf submission only).

• Total evaluated price.

4.1.2 Solicitation Representations and Certifications

Completed copy of all FAR and Defense Federal Acquisition Regulation Supplement (DFARS) solicitation representations and certifications are required for the prime. If the (prime) offeror completed all the solicitation’s required FAR and DFARS representations and certifications in the System for Award

Management (SAM), please include a statement stating the representations and certifications required in the solicitation are in SAM and are current and correct; including a copy of them all within Volume I is not necessary. Any required FAR and DFARS representations and certifications that are not available in SAM shall be submitted in Volume I.

4.1.3 Organizational Conflict of Interest (OCI)

Offeror shall provide an affirmative statement that no actual or potential OCIs exist, or a detailed plan which mitigates existing or anticipated OCIs. If a plan is submitted, it shall address all actual or potential conflicts of interest in adequate detail for the contracting officer to determine whether an OCI exists or has been mitigated. The offeror shall describe how the OCI Mitigation Plan was developed and the company's approach to avoiding, mitigating, or neutralizing any identified OCI risks. The prime contractor must validate that no OCIs exist between the prime and proposed subcontractors. The prime is responsible for managing and validating the OCI status of its subcontractors.

4.1.4 Verification of Eligibility of Small Business Joint Ventures

A small business joint venture offeror must submit, with its offer, the representation required at FAR

52.212-3 ‘Offeror Representations and Certifications-Commercial Products and Commercial Services’ at paragraph (c), and FAR 52.219-1, Small Business Program Representations’ paragraph (c) in accordance with 52.204-8(d) and 52.212-3(b) for the following categories:

(A) Small business;

(B) Service-disabled veteran-owned small business;

(C) Women-owned small business (WOSB) under the WOSB Program;

(D) Economically disadvantaged women-owned small business under the WOSB Program; or

(E) Historically underutilized business zone small business.

4.1.5 DD Form 254

The offeror shall provide a completed DD254, Contract Security Classification Specification (PWS

Attachment 3) filled out for both prime contractor and all proposed subcontractors. The offeror shall demonstrate its ability to meet the security requirements of the solicitation and in accordance with the DD

Form 254.

Offeror will be responsible for ensuring that its subcontractor(s) meet(s) security policies and regulations in accordance with the DD Form 254 and applicable security policies and regulations. The proposal must provide sufficient information for the Government to validate the proposed information. The offeror’s proposal shall provide specific information that indicates any Facility Security Clearance (FCL) and

Foreign Ownership, Control, or Influence (FOCI) issues and/or concerns by the offeror, as indicated in the

National Industry Security Program Operating Manual (NISPOM), that have not been properly negated. If no FOCI issues and concerns exist, the offeror shall state so in the proposal. FCL and FOCI information shall include at least the following:

• Company Name

• Address and Zip Code

• Commercial and Government Entity (CAGE) Code

• Facility Security Clearance Level

• Safeguarding Level

4.1.6 Personnel Security Requirements

The offeror must self-certify that all proposed personnel will meet the PWS security requirements prior to full contract performance.

4.1.7 All Other Provisions and Clauses

All other provisions and clauses not pertaining to 4.1.2 herein requiring contractor acknowledgment/completion must be addressed.

4.2 Volume II Technical: Factor 1 (page limitation: 60 total pages. ALL pages count, with exception of RFP

Attachment 2. All material beyond page 60 will neither be read nor evaluated. RFP Attachment 2 shall remain as an Excel document and submitted as an attachment.)

This volume shall not contain pricing data or pricing information whatsoever.

The technical volume shall focus on the offeror’s ability to achieve successful contract performance and specifically include the following:

4.2.1 Technical Approach Description

A detailed description of the proposed technical approach for PKI Task Requirements PWS Section 4 Tasks

4.2 through 4.7, and Training Support (PWS Section 5). The proposal must demonstrate an understanding of and an ability to meet the PWS requirements. The proposal must sufficiently describe the company’s capability to provide the required services, how it will address vacancies, particularly at the LRA locations, and how it will comply with the requirements throughout the performance period. The description shall identify which task and/or subtasks will be performed by the prime and which will be performed by a

(named) subcontractor.

4.2.2 Staffing Matrix

Offerors must provide a staffing matrix, utilizing RFP Attachment 2, which details the minimum proposed qualifications of all proposed personnel, what PWS task(s) each will perform, and how the proposed positions and associated qualifications will contribute to performance that meets or exceeds the PWS requirements. The offeror shall describe what constitutes a full time equivalent and state the proposed productive work hours. The proposal shall describe how the approach to integrating the various background, education, and experience of its proposed personnel ensures the offeror will meet or exceed the PWS technical requirements. Submission of resumes, “resume like” information, and the name of individuals is strictly prohibited.

The offeror shall identify and map its company position name to the occupation code and position description per the Department of Labor (DoL) Occupational Outlook Handbook

(https://www.bls.gov/ooh/) for each of the positions proposed for this effort.

RFP Attachment 2’s format shall not be altered, nor should additional tabs be added to the spreadsheet.

The awardee’s staffing matrix will become the minimum standard in the resultant contract.

4.2.3 Mission Essential Contractor Services Plan

In accordance with DFARS 252.237-7024(b), a detailed description of how the contractor will continue to perform the essential contractor services in PWS Attachment 2 during periods of crisis.

4.2.4 Phased Transition-In Approach

A detailed description of the proposed approach to provide a phased transition-in commencing 1 April 2026 which is 30 days before the end of the current contract.

4.3 Volume III Past Performance: Factor 2 (page limitation: 20 total pages. All material beyond page 20 will neither be read nor evaluated. Page limitation excludes the below mentioned PDFs of each referenced past performance, any necessary Past Performance Questionnaires, CPARS, and any necessary signed commitments as described below.)

The offeror shall demonstrate relevant and recent past performance or affirmatively state that it possesses no relevant and recent past performance. Relevant past performance is defined as the level of similarity in scope, magnitude, and complexity as compared to what the effort requires. Recent is defined as a contract performed within the past five years from solicitation date.

When submitting a subcontractor past performance, a commitment signed by the offeror and subcontractor certifying that if a contract is awarded resulting from the proposal, the parties commit to joint performance as proposed shall be included. If the signed commitment is not fully executed by both parties and provided with the

Past Performance volume, subcontractor references will not be evaluated or considered. Affiliate companies, sister companies, teaming arrangements and joint venture’s past performance in addition to their own (if applicable) may also be included and will be considered provided that sufficient documentation is included in the proposal. The prime contractor must demonstrate that the affiliate will perform significant and critical aspects of the contract if awarded. Documentation includes a copy of the signed arrangement such as documented affiliation, a copy of the teaming agreement, a copy of the joint venture agreement, etc. (copies of teaming arrangements, joint venture agreement and/or commitments by subcontractors can be provided as an Appendix in the Past Performance Volume and are excluded from the page count).

4.3.1 Past performance submission

To demonstrate its past performance, the offeror shall identify up to three of its most relevant and recent contract efforts. The offeror must be the prime on at least one of the three efforts. If the prime provides its https://www.bls.gov/ooh/ experience as a subcontractor for part of the three most relevant contracts or efforts, the subcontractor experience will be given weight relative to the scope, magnitude, and complexity of the aspects of the work under the solicitation that as a subcontractor it performed. Past performance of proposed subcontractor(s) or teaming partner(s) identified in Volume I and Volume II may be included.

All offerors must provide a PDF version of each referenced past performance effort that includes: 1) the signed cover page of the referenced contract award, 2) the referenced contract’s priced line items (and sub-line items if any) and, 3) the referenced contract’s Performance Work Statement/Statement of

Work/Statement of Objectives, as applicable. This information is not included in the page limitations.

All offerors must provide its past performance utilizing RFP Attachment 3. The attachment shall not be altered, meaning margins shall not be adjusted, no additional tables shall be added, tables shall not be removed, and the required instructions and information within each table shall not be edited. Completion of the form shall be 10pt, Times New Roman font.

In the event a CPARS record is not available for a referenced past performance contract, RFP Attachment

3a ‘Past Performance Questionnaire’ (PPQ) must be utilized. The offeror will complete PPQ’s Section I and

II and then provide the PPQ to the named contact (assessor) for completion. The assessor will complete

PPQ’s Section III through Section XI, and upon completion provide the PPQ directly to the contracting office as instructed in the PPQ.

4.4 Volume IV Price: Factor 3 (page limitation, excluding the pricing template: 10 pages. All material beyond page 10 will neither be read nor considered. The Excel Price Workbook shall be submitted as an attachment.)

The offeror shall provide sufficient price information to allow the contracting officer to determine reasonableness of the proposed price. The price proposal shall include a narrative describing any assumptions, an explanation for any year-to-year price fluctuations used in the unit prices, an explanation for the proposed travel handling rate, and any other information deemed necessary to support the basis of the offeror’s price.

Due to the commercial and competitive nature of this procurement, the Government is not requesting submission of certified cost or pricing data under this solicitation in accordance with FAR 15.4. The offeror shall not submit certified cost or pricing data substantiating the cost elements being proposed. If adequate competition is not obtained or should a situation develop that the Government will require the submission of additional data other than certified cost or pricing data, the offeror should be prepared to submit the data within five business days after being requested by the Government. Should one of the business days fall on a Federal holiday, the next business day will be counted in succession.

4.4.1 Price submission

The offeror’s price is submitted by completing the attached price workbook (RFP Attachment 4) in MS

Excel format (.xlsx) with formulas intact (NOT a read-only spreadsheet) (No macros). The offeror shall ensure a total evaluated price is included in its proposal adhering to the price workbook provided (RFP

Attachment 4). The offeror shall propose unit prices and handling rates (as applicable) for each pricing element in the Price Matrix worksheet within the price workbook (RFP Attachment 4). Data contained in the price workbook shall be consistent with the data contained in the Technical Volume, meaning, the price supports the level of resources proposed and required to fulfill the solicitation’s requirements. The price workbook shall remain in its initial form, meaning no additional worksheets/tabs with additional information shall be added. Price workbook formulas shall remain as structured. If a pre-established formula error is noted, make any necessary corrections but notify the contracting office immediately.

Handling Rates: Since unit prices are not set on the contract for Travel and Other Travel Related Expenses

Sub-Contract Line Items (SLINs), the fixed handling rate shall consist of expenses other than the cost for travel (direct cost). This handling rate shall be based on a percentage the contractor will charge for processing and acquiring Travel (SLIN 0002AA) and Other Travel Related Expenses (SLIN 0002AB).

The handling rate encompasses handling and indirect expenses the contractor may account for when processing transactions. No additional indirect rates are applicable since there is a negotiated fixed price handling rate in the contract. This rate is a fixed rate to be applied on a per dollars basis. The rate will be incorporated in the contract and used in all subsequent task orders. The offeror shall account for the handling rate in their Total Evaluated Price amount. Fee is strictly prohibited.

4.4.2 Price Workbook

The price workbook contains three (3) sheets: Basis of Estimate; Price Matrix; and, Total Evaluated Price

Matrix.

4.4.2.1 Basis of Estimate: This sheet is similar to the Technical Volume’s Staffing Matrix but requires offeror input of annual hours, fully burdened labor rates, and total annual labor costs for each ordering period.

4.4.2.2 Price Matrix: This sheet requires offeror input of line-item pricing on a per month basis and on a per event or each basis, as applicable, for each ordering period. Offeror input is also required for its handling rate percentage for travel and other travel related expenses.

4.4.2.3 Total Evaluated Price Matrix: This sheet cumulates the information entered by the offeror on the Price Matrix sheet and produces the total evaluated price utilized in the Government’s evaluation. Contractor input on this sheet is not required.

(e) Multiple offers.

Offerors shall not submit multiple offers representing alternative terms and conditions for satisfying the requirements of this solicitation.

(f) Late submissions, modifications, revisions, or withdrawals of offers. (2)(i): Late and incomplete proposals will be not evaluated and will be deemed ineligible for consideration of award.

LIST OF ATTACHMENTS

RFP Attachments PWS Attachments

1. Question and Answer Document 1. Help Desk Matrix

2. Staffing Matrix 2. MECS Plan

3. Past Performance 3. DD 254

3a. Past Performance Questionnaire 4. GFP Attachment

4. Price Workbook

The following will become part of the contract at time of award:

RFP Attachment 2: Staffing Matrix

RFP Attachment 4: Price Workbook

PWS Attachment 1: Help Desk Matrix

PWS Attachment 2: MECS Plan

PWS Attachment 3: DD 254

PWS Attachment 4: GFP Attachment

End 52.212-1 Addendum

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT

Marine Corps Public Key Infrastructure (PKI) Support Services

United States Marine Corps

1. SCOPE

This Performance Work Statement (PWS) describes the technical support services required of the Marine Corps

Public Key Infrastructure and provides descriptions of Public Key Infrastructure (PKI) technical requirements definition, operations, and sustainment support for authorized systems and personnel located at United States Marine

Corps (USMC) installations worldwide.

Required support includes sustainment of the USMC portion of the established Department of Defense (DoD)

Information Network (DoDIN): Non-classified Internet Protocol Router Network (NIPRNET) Public Key

Infrastructure (PKI), National Security Systems (NSS) Secret Internet Protocol Router Network (SIPRNET) PKI, and Defense Information Systems Agency (DISA) Gray PKI.

2. BACKGROUND

The mission of the Marine Corps PKI Program is to provide the resources, manpower, and equipment (hardware and software) dedicated to the management (i.e.: generation, production, distribution, control, accounting, and destruction) of keys and certificates used by public key-based security services to include Non-classified Internet

Protocol Router Network (NIPRNet) and SIPRNet both garrison and deployed. The PKI program operates the

USMC Certificate Validation Infrastructure (CVI) and USMC organizational Certificate Authorities (CA) necessary to ensure that only authorized users and server-based applications can operate on the Marine Corps Enterprise

Network (MCEN). These services are required for user access to all information system components on the MCEN including network accounts, applications, and web sites. PKI must be operable in garrison and tactical/deployed environments. Marine Corps PKI is operationally attached to the Marine Corps Cyber Operations Group (MCCOG) aboard Marine Corps Base Quantico, Virginia and sponsored by Headquarters Marine Corps Deputy Commandant, Information (HQMC DC I) as a USMC Representative to DoD PKI.

3. GENERAL INFORMATION

Marine Corps PKI requires support for operations, management, and sustainment of the Marine Corps Component to

DoD and NSS PKI, USMC Only-Locally-Trusted PKI, and related programs. Extensive knowledge of DoD/NSS

PKI is required (see PWS Section 19: DoDI 8520.02; DoD PKI Registration Authority/Local Registration

Authority Certificate Practice Statement; and, NSS PKI DoD Registration Authority Practice Statement). Contractor support shall include PKI registration support for authorized systems and personnel located at USMC installations worldwide. The contractor shall sustain the USMC portion of the established DoD PKI to include USMC Only-

Locally-Trusted (OLT) PKI and USMC internal Certificate Validation Infrastructure.

3.1 Objective

The objective of this PWS is to achieve effective, reliable, and secure PKI capability across the Marine Corps

Information Environment (MCIE).

Achieving the objective requires the following:

• Staff augmentation is maintained with the required qualifications, skill sets, and certifications such that services are effectively delivered.

• Contractor personnel must have expert knowledge in both the technical aspects of PKI and how PKI is employed within the Department of Defense and National Security System Networks.

• All contractor personnel are fully compliant with DoD Cyber Security Work Force certification standards.

Personnel shall continuously maintain annual DoD training requirements.

• Projects and tasks are delivered on time and within cost controls.

3.2 Synopsis of general Marine Corps PKI Program Operational Support:

• Post-deployment applications software PKI support

• Certificate generation and issuance in support of Zero Trust

• Operate and maintain Marine Corps Only Locally Trusted (OLT) PKIs on the Marine Corps portion of the

DoDIN

• Operate and maintain Marine Corps Commercial Solutions for Classified PKIs

• DoD/NSS/Gray Certificate Validation support

• DISA DoD/NSS/Gray Registration Authority operations

• Integration Support for fielded systems

• Field technical support

3.3 Place of Performance

The contractor shall provide support for the Marine Corps PKI Program at the following locations:

• MCB Quantico, Virginia – Primary Site (All tasks except LRA)

• Camp Foster, Okinawa, Japan – Local Registration Authority (LRA) task only

• Camp Pendleton, California – Secondary site (for network operations redundancy purposes), LRA task only

• Camp Lejeune, North Carolina - LRA task only

• Commandant of the Marine Corps, HQ USMC, Washington, DC - LRA task only

Contractor situational telework may be authorized when in the best interest of, and approved by, the Government in advance. Only tasks that do not require SIPRnet Access or use of Registration Authority Workstations will be considered.

3.4 Hours of Operation

The Government’s normal workday is Monday – Friday 0600 – 1800 local time. These hours denote when the designated Government facility is normally open for business and does not specify a required contractor work schedule. Contractor personnel may be required to work on weekends, may be required to work a 10 -12-hour work day, and may be recalled (at hours other than a normal work day) for high critical incidents. Although the frequency of these types of work hours is minimal, the contractor shall coordinate and maintain an adequate work force for the uninterrupted performance of all tasks defined within this PWS. Adjustments to contractor work schedules shall not constitute overtime.

3.5 Personnel Qualifications

All contractor personnel working this effort must meet the minimum qualifications listed at PWS Section 18 upon contract award. Personnel who do not meet or maintain the minimum qualifications throughout the duration of the contract are considered unqualified and will not have access to facilities and systems.

3.6 Available Workstation Space

Government on-site workspaces are limited by location and task as follows:

Location PWS Task Available On-Site

Workspaces

MCCOG – Quantico, VA Program Management (4.1) 1

Registration Authority Operations (4.2) 6 (includes 1 Lead)

PKI Network Operations (4.4) 8 (includes 1 Lead)

Implementation and Planning (4.5) 3

PKI Cyber Security (4.6) 1 Lead

Knowledge Management (0) 1

I MEF – Camp Pendleton, CA Local Registration Authority (4.3) 1

II MEF – Camp Lejeune, NC Local Registration Authority (4.3) 1

III MEF – Camp Foster

Okinawa, Japan Local Registration Authority (4.3)

HQMC – Pentagon, Arlington, VA

Local Registration Authority (4.3)

3.7 Compliance with Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7001

The contractor shall ensure that personnel accessing information systems have the proper and current IA certification to perform IA functions in accordance with DFARS 252.239-7001. All personnel performing tasks under this contract shall be United States citizens. No foreign nationals shall be provided access to any Items any way associated with the effort under this contract regardless of the security classification of such Items.

4. PKI TASK REQUIREMENTS

The tasks identified below, when integrated and supported with the contractor’s direct DoD/NSS PKI experience shall achieve the PWS objective. These tasks enable the Marine Corps PKI to fulfill its role within the DoD’s operational hierarchy, quickly adapting to near-term changes and continuously evolving to meet long-range technology trends.

The Contactor shall provide PKI support services under the following major tasks and its subtasks.

4.1 Program Management

The contractor shall identify a Program Manager (PM) who shall provide management, technical oversight, direction and guidance, administration, quality assurance, and leadership for all contractor personnel effort in the execution of this contract. The PM shall schedule meetings and provide deliverables. The PM shall serve as the

Government’s primary point-of-contact, maintaining regular communication with Marine Corps PKI and keeping

Marine Corps PKI apprised of all contract issues and status.

The contractor shall apply and maintain proven and successful program management practices throughout the life of this contract.

4.1.1 Kick-off Meeting

The contractor shall attend a Kick-off Meeting at a location determined by the Government no later than five (5) business days after contract award. The meeting will provide an introduction between key contractor personnel and relevant Government personnel who will be involved with the effort. The purpose of the Kick-off Meeting is to achieve a clear and mutual understanding of all contract requirements and identify and resolve potential problems.

During the Kick-off Meeting, the contractor shall be prepared to discuss its management approach, staffing, and any plans submitted in response to the solicitation that will be implemented under this contract. Other topics of discussion may include contract deliverables, sub-contracting plan compliance (as applicable), government furnished equipment, travel procedures, and other topics as warranted. The contractor shall deliver Meeting Minutes in accordance with PWS Section 0.

4.1.2 In-Progress Review (IPR)

The contractor shall host, by the 15th of each month, a monthly IPR with the Government’s Technical Point of

Contact (TPOC), COR, contracting officer, and other vital Government stakeholders. The purpose of this meeting is to ensure all stakeholders are informed of the previous month’s activity, provide opportunities to identify other activities and establish priorities, and coordinate resolution of identified problems or opportunities. The contractor shall provide an agenda no later than one day prior to the meeting and written minutes of the meeting, including attendance, issues discussed, decisions made, and action items assigned within three business days after the meeting in accordance with PWS Section 0. (The first IPR will be jointly determined by the Government and the contractor.)

Minimum IPR content shall include the following:

a. Activities during reporting period, i.e. previous month, by task (include on-going activities, new activities, activities completed; progress to date on all above-mentioned activities). Start each section with a brief description of the task.

b. Problems and corrective actions taken. Also include issues or concerns and proposed resolutions to address them.

c. Contract status, which will include task leads information and staffing update/changes (vacant, transition in/out, gains, losses).

d. Security clearance status or issues.

e. Government actions required.

f. Financial Status of non-firm fixed price line items up to the previous month and projected cost for the current month.

g. Any recommendation or issues regarding the contract.

4.1.3 Project Management Plan (PMP)

The contractor shall document all support requirements in a PMP. The PMP provides the Government insight into the contractor’s process and methods of ensuring PWS objectives are satisfactorily achieved throughout the life of the contract. The PMP is subject to changes pending Government comments and recommendations. (See PWS

Section 0)

The PMP is an evolutionary document that shall be updated as required. The contractor shall work from the latest

Government-reviewed version of the PMP.

Minimum PMP content shall include:

a. Proposed management approach to ensure successful execution of all tasks, to include its staffing matrix.

b. SOPs for all tasks.

c. Milestones, tasks, and subtasks.

d. Provide for an overall Work Breakdown Structure (WBS) and associated responsibilities and partnerships between or among Government organizations.

4.1.4 Transition-Out Plan

The transition-out period, if required, shall commence 60 days prior to the end of the contract. The Transition-Out

Plan is due 90 days before the end of the contract to allow for the exchange of Government comments and questions and contractor revisions as necessary prior to submission of the final plan. The final plan is due 60 days before the end of the contract. The contractor shall maintain full personnel staffing up to the contract end date. The Plan shall facilitate a seamless transition from the current contractor to the incoming contractor and identify how it will transfer the following:

a. Project management processes

b. Points of contact

c. Location of technical and project management documentation

d. Status of ongoing technical initiatives

e. Transition of Key Personnel, if applicable

f. Schedules and milestones

g. Actions required of the Government

h. Submit a “turnover binder” for each functional area which shall include, but is not limited to, passwords, permissions, SOPs, documentation, etc.

The current contractor shall establish and maintain effective communication with the incoming contractor and

Government personnel for the period of the transition via weekly status meetings.

The contractor shall also complete or perform transfer of all tangible and intangible (intellectual) property and licenses prior to the end of the contract.

4.1.5 Quarterly Meeting

The contractor shall plan and conduct a quarterly contract status meeting. The primary purpose of these meetings is to review contract performance status and address contract-related issues. These meetings are expected to last no longer than one (1) hour. At a minimum, the meeting will include appropriate contractor representative(s), the contracting officer, the COR, and Government technical personnel, as appropriate; however, the contracting officer may choose to include other Government attendees. The meeting will be held virtually, via a phone conference call, or at a location determined by the contracting officer.

Each meeting will cover the following topics, as appropriate:

a. Contract Performance Status (interim draft CPARS rating)

b. Status of contract deliverables/tasks (updates since last meeting)

c. Performance issues encountered or expected (e.g., potential delays)

d. Required Government actions (e.g., delivery of Government Furnished Information and/or Property)

e. Compliance with staffing (See Sections 11 and 12)

f. Discussion on contractor performance against QASP metrics

g. CLIN-related issues.

h. Address new or in process modifications, requests for out-of-scope work, requests for equitable adjustment, claims, or disputes

i. Clause compliance (e.g., FAR 52.245-1, Government Furnished Property; FAR 52.219-9, Small

Business Subcontracting Plan)

j. Invoice submission and payment status

k. Continuous improvement ideas for current contract and/or future contract

4.2 Registration Authority (RA) Operations

The contractor shall provide PKI RA support for the implementation, maintenance and upkeep of the

DoD/NSS/Marine Corps PKI to include, as an example the below broad elements. The contractor shall assign a RA

Operations single point of contact who will provide technical oversight and guidance specific to the PKI RA

Operations contractor support staff and will be the Government’s touch point for all PKI RA Operations management tasks.

• Creation and removal of Local Registration Authorities (LRAs)

• Issuance and revocation of Role Based, Code Signing, End user, administrator and server certificates

Alternate token issuance

• NIPR/SIPR key recovery

• SIPRNet Token and Common Access Card (CAC) PIN resets

• Manage the production and issuance of USMC Alternate Tokens using the NIPRNet Enterprise

Alternate Token System (NEATs)

• Manage the production and issuance of the DoD/NSS SIPRNet tokens using the Token Management

System (TMS)

• Will provide USMC LRA audit support as required. A valid passport is required.

4.2.1 PKI RA Ops Enterprise Help Desk

The PKI RA section is a fast-paced work environment and serves as the only PKI Enterprise help desk in the USMC providing professional and courteous support to customers located throughout the world to include tactical environments. Help Desk support provides Level I support and will route complex support requirements to Network

Ops (PWS 4.4.6) as necessary. The contractor shall use DoD/NSS PKI RA skills to enhance the network security through the utilization of PKI while working with internal MCCOG divisions, external USMC organizations, various other DoD organizations, and a myriad of Government and civilian organizations.

Tasks include:

4.2.1.1 Certificate Issuance/Revocation

4.2.1.2 PKI Help Desk Support Level 1 (required incident handling matrix at Attachment 1)

4.2.1.3 PIN Reset Support

4.2.1.4 Purebred/Mobile Device PKI certificate support

4.2.1.5 PKI Key Recovery

4.2.1.6 New/Emerging technologies testing support

4.2.1.7 Serve as RAs and Key Recovery Agents

4.2.1.8 Maintain support for creation and removal of LRAs.

4.2.1.9 Issue end user certificates.

4.2.1.10 Coordinate installation of DoD certificates on to Mobile devices.

4.2.1.11 Execute certificate revocation within 12 hours of notification.

4.2.1.12 Download, format, and install PKI certificates.

4.2.1.13 Resolve customer issues related to PKI certificate use and system configuration.

4.2.1.14 Serve as the Liaison between the MCCOG and the field LRA staff for the resolution of issues elevated to the MCCOG call center.

4.2.1.15 Submit and update Remedy tickets in accordance with established metrics. (Attachment 1)

4.2.1.16 Execute certificate disposition for USMC casualties.

4.2.1.17 Assist in the execution of LRA, Trusted Agent and end user PKI training.

4.2.1.18 Manage the production and issuance of DoD SIPR Tokens using a TMS and peripherals provided by the

Government.

4.2.1.19 Manage the production and issuance of USMC Alternate PKI Tokens using NEATs.

4.2.1.20 Maintain and sustain the central repository of PKI records specified by the Government, to include records required to establish the validity of a signature and the proper operation of the PKI as specified in the DoD

PKI Certificate Policy.

4.2.1.21 Perform ah-hoc metric collection and reporting (deliverable 0009) on selected activities directed by the

Government. Shall maintain a daily log of user assistance calls, SIPR token and Alternate token certificate issuance, revocations, and server certificate issuance on Government-provided SharePoint site.

4.2.1.22 Shall maintain a daily physical logbook consisting of all RA certificate activities as specified in the DoD

RA LRA Certificate Practice Statements (CPS)/NSS RPS.

4.2.1.23 Maintain and update required PKI certificate issuance, revocation, and key recovery actions in appropriate existing or future SharePoint lists/Databases.

4.2.1.24 Provide data as required by the Government for future SharePoint lists/databases for issuance activities from new DoD capabilities.

4.2.1.25 Direct calls from customers of the DoD and Marine Corps PKI to appropriate MCCOG sections.

4.2.1.26 Provide both internal and external Marine Corps PKI customers with knowledgeable, problem-solving resolutions, in the shortest time possible to minimize any customer downtime or work stoppage.

4.2.1.27 Assist Program of Record (POR) application owners with integration of current Marine Corps PKI enabling technologies.

4.2.1.28 Provide general administrative support tasks to the execution of PKI logistics activities such as controlled distribution of SIPR Tokens, ALT Tokens, and PKI peripherals.

4.2.1.29 Provide input for operational metrics and analysis to improve the enterprise PKI related customer experience and reduce Help Desk calls.

4.2.1.30 Provide desktop and network support.

4.2.1.31 Perform operational testing of beta tokens, new certificate types and Token Management Testing along with operational capability testing of all new versions of PKI certificate and systems.

4.2.2 PKI RA Training and Outreach

Contractor personnel expertise under the RA task will be utilized from time to time to assist in developing and presenting PKI training along with participating in outreach activities in support of Marine Corps PKI initiatives for garrison and tactical networks. Training shall be in conformance to IA policy.

4.2.2.1 Assist in developing PKI Training Plans.

4.2.2.2 Assist in developing and maintaining PKI Outreach Materials to support PKI training and customer awareness as related to constant changing of PKI environment.

4.2.2.3 Assist in developing and providing PKI Briefs for conferences or working group meetings regarding PKI projects, plans, and initiatives as directed.

4.2.2.4 Assist in developing and providing targeted computer/hands-on training specific to LRA, TA, System

Administrators, and end-users within USMC.

4.2.2.5 Assist in developing and providing PKI Instructor Materials such as course outlines, background material, and training aids in support of targeted training.

4.2.2.6 Assist in developing and providing PKI student course materials such as workbooks, handouts, completion certificates, and course critique forms for onsite hands-on training.

4.2.2.7 Train PKI LRAs in accordance with the USMC, DISA, and National Security Agency IA policy and procedures via formal classroom courses, and hands-on workshops as required.

4.2.2.8 Coordinate dates of training and classroom facilities for local (Quantico area) training requirements

4.2.2.9 Provide PKI end-user training on certificate utilization within the Desktop environment, at the LRA level.

4.2.3 Local Registration Authority (LRA) Audit

The contractor shall provide LRA Audit support as directed by the Government for the development, updating and execution of comprehensive audit procedures and reports for all LRA field operations.

4.2.3.1 Develop, modify, and execute comprehensive audit procedures for all LRA field operations

4.2.3.2 Conduct and ensure performance of field LRA operations audits are in accordance with the most current

DoD RA/LRA CPS, NSS RPS, CNSS Certificate Policy (CP) the USMC Training User’s Guide, and USMC

RA guidance

4.2.3.3 Maintain all procedures, reports, and Automated Message Handling System (AMHS) messages to ensure the USMC RA maintains a prepared state for the successful completion of the LRA audits directed by the

DoD CPS and NSS RPS

4.2.3.4 Draft and submit LRA Audit reports within 10 business days of audit completion for signature and delivery to audited Command (deliverable 0006)

4.2.3.5 Recommend improvements to procedures and processes related to the audits to PKI Leadership (deliverable

0006)

Existing Registration Authority personnel performing under the RA Operations task shall conduct the audits. Audits typically take one week to complete and occur a minimum of once every two years, although out-of-cycle audits may be directed by the Government as necessary. Audits are required at the following locations:

• Camp Lejeune, NC

• Camp Pendleton, CA

• Okinawa, Japan

• HQMC, Arlington, VA

4.3 Local Registration Authorities

The contractor shall provide LRA support at each Marine Expeditionary Force (MEF) location listed below and

HQMC to assist in Communications General Staff (G6) PKI missions. The contractor LRA shall assist in all PKI implementations, server builds and installs in conjunction with the Local G6’s.

• Provide LRA support to ensure the PKI Server Certificates are requested, approved,…