Attachment_2___DO_PWS_for_Evaluation_of_DOs_-final_29_Aug_2014.docx

Carahsoft ID 421

2. PROJECT DESCRIPTION

ATTACHMENT 2

1. PERFORMANCE WORK STATEMENT FOR HP CODE REVIEW SOFTWARE TRAINING AND ON-SITE PROFESSIONAL SERVICES FOR DELIVERY ORDER 1 EVALUATION

1. Objectives and Scope The purpose of the Code Review capability is to support the United States Marine Corps (USMC), Space and Naval Warfare Systems Command (SPAWAR), and Information Systems and Infrastructure (IS&I), Product Manager (PdM) Total Force Information Technology Systems (TFITS) Information Assurance (IA) programs by increasing the existing cybersecurity capabilities in order to comply with Federal, Department of Defense (DoD), and USMC Application Security Policies, Directives, and Guidelines i.e. the Application Security and Development Security Technical Implementation Guide (STIG), Headquarters United States Marine Corps (HQMC),Command, Control, Communications and Computers (C4) memorandum dated 20 November 2012. The contractor shall provide the software licenses, Computer Based Training (CBT), maintenance, classroom-based training, and Subject Matter Expertise (SME) to work with USMC/SPAWAR/IS&I/PDM TFITS designated point of contact(s). The contractor shall assist USMC/SPAWAR/IS&I/PDM TFITS SMEs and developers with the setup and implementation of the static and dynamic code review and Runtime Web Application Protection capability and processes.

For IS&I, the code review capability will be hosted at the IA/Cyber Range. The IA/Cyber Range is a Comprehensive National Cybersecurity Initiative (CNCI) sponsored, Office of Secretary of Defense (OSD) directed, and Defense Information Systems Agency (DISA) governed project. The IA/Cyber Range is chartered to provide the DoD Cyber/IA Community with a realistic replica of the production networks to support testing, training, and exercising of the Cyber/IA Workforce.

Delivery and/or task orders issued by activities other than IS&I, may require performance outside of the Washington, DC area.

2. Requirements

2.1. Scope Definition

The contractor shall provide support to implement and train Hewlett Packard (HP) Fortify, WebInspect and Runtime software in a USMC Nonsecure Internet Protocol (IP) Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet) and TS/Sensitive Compartmented Information (TS/SCI) environment.

Support shall consist one or more of the following, and will be order specific:

The contractor shall install and configure of HP product suite with Government personnel.

The contractor shall develop software security scanning standard operating procedures with Government personnel.

The contractor shall install, configure and integrate HP Fortify Static Code Analyzer (SCA) into targeted application build/development environments with Government personnel.

The contractor shall use Static and Dynamic Code Analysis (DCA) to produce scans of USMC/SPAWAR/IS&I/PdM TFITS applications with Government personnel.

The contractor shall install, configure and integrate HP Runtime onto targeted servers with Government personnel.

The contractor shall perform triage and analysis of USMC/SPAWAR/IS&I/PdM TFITS scan results with Government personnel.

The contractor shall provide advice and guidance on how to remediate security vulnerabilities.

The contractor shall implement secure development techniques with Government personnel.

The contractor shall provide metrics and develop reports in HP Fortify Software Security Center with Government personnel.

The contractor shall administer and troubleshoot the HP product suite with Government personnel.

The contractor shall provide all training and services in English.

The contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the HP Code Review Software, Training and On-Site Professional Services via a secure data collection site. Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities;

(4) S, Utilities ONLY;

(5) V, Freight and Shipping ONLY.

The contractor is required to completely fill in all required data fields using the following web address https://doncmra.nmci.navy.mil.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://doncmra.nmci.navy.mil.

4. Facilities, Other Direct Charges (ODCs), and Travel Requirements Travel expenses for work performed in the DC, and Virginia area will not be allowed. Laptops, cellular equipment/services, and other items of convenience are not reimbursable as ODCs. All travel outside the Washington DC and Virginia area will be placed on a Firm Fixed Price NTE CLIN and reimbursed after reviewing receipts of the contractor’s actual expenses to ensure the claimed travel expenses are fair and reasonable. Costs for transportation, lodging, meals and incidental expenses incurred by the contractor are allowable subject to the limitations contained in the Federal Travel Regulations and/or Joint Travel Regulations.

All Government printing requirements MUST be done by or through the local Document Automation and Production Service (DAPS, now called DLA Document Services) http://www.daps.dla.mil/dapsonline.html.

A majority of the work will be conducted in the Northern Virginia area. Anticipate that 2 weeks will be spent in Albany, GA and 1 week will be spent in Kansas City, MO.

5. Security Contractors assigned to this contract will be required to obtain and maintain access to Top Secret/Sensitive Compartmented Information (TS/SCI). The majority of the work will be conducted at the Joint IA/Cyber Range located at the Quantico Corporate Center, 925 Corporate Drive, Stafford VA 22554 with other work locations as outlined in section 4 of this PWS. Individuals will be indoctrinated in order to perform their daily work inside the aforementioned Sensitive Compartmented Information Facility (SCIF). SCI involvement entails unescorted access into SCI spaces, and access to SCI materials and/or systems. The Marine Corps Systems Command (MARCORSYSCOM) Site Security Officer (SSO) provides SCI contract support (Joint Personnel Adjudication System (JPAS) SCI Security Management Office (SMO) Ownership) for required contractor employees. The contractors requiring access to SCI will require Director of Central Intelligence Directive (DCID) 6/4 eligibility determination made by the Department of the Navy Central Adjudication Facility (DODCAF).

A finalized DD254 will be incorporated into the contract.

6. Performance Requirements SUMMARY (PRS)

PERFORMANCE REQUIREMENTS SUMMARY (PRS)

(What do you want to accomplish as the end result of this contract?)

Required Service (What task must be accomplished to give you the desired result?)

Performance Standard (What should the standards for completeness, reliability, accuracy, timeliness, quality and/or cost be?)

Acceptable Quality Level (AQL) (How much error will you accept?)

Monitoring Method (How will you determine that success has been achieved?)

1. PERFORMANCE WORK STATEMENT FOR HP CODE REVIEW SOFTWARE TRAINING AND ON-SITE PROFESSIONAL SERVICES FOR DELIVERY ORDER 2 EVALUATION

1. Objectives and Scope The purpose of the Code Review capability is to support the United States Marine Corps (USMC), Space and Naval Warfare Systems Command (SPAWAR), and Information Systems and Infrastructure (IS&I), Product Manager (PdM) Total Force Information Technology Systems (TFITS) Information Assurance (IA) programs by increasing the existing cybersecurity capabilities in order to comply with Federal, Department of Defense (DoD), and USMC Application Security Policies, Directives, and Guidelines i.e. the Application Security and Development Security Technical Implementation Guide (STIG), Headquarters United States Marine Corps (HQMC),Command, Control, Communications and Computers (C4) memorandum dated 20 November 2012. The contractor shall provide the software licenses, Computer Based Training (CBT), maintenance, classroom-based training, and Subject Matter Expertise (SME) to work with USMC/SPAWAR/IS&I/PDM TFITS designated point of contact(s). The contractor shall assist USMC/SPAWAR/IS&I/PDM TFITS SMEs and developers with the setup and implementation of the static and dynamic code review and Runtime Web Application Protection capability and processes.

For IS&I, the code review capability will be hosted at the IA/Cyber Range. The IA/Cyber Range is a Comprehensive National Cybersecurity Initiative (CNCI) sponsored, Office of Secretary of Defense (OSD) directed, and Defense Information Systems Agency (DISA) governed project. The IA/Cyber Range is chartered to provide the DoD Cyber/IA Community with a realistic replica of the production networks to support testing, training, and exercising of the Cyber/IA Workforce.

Delivery and/or task orders issued by activities other than IS&I, may require performance outside of the Washington, DC area.

2. Requirements

2.1. Scope Definition

The contractor shall provide support to implement and train HP Fortify, WebInspect and Runtime software in a USMC Nonsecure Internet Protocol (IP) Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet) and TS/Sensitive Compartmented Information (TS/SCI) environment.

Support shall consist one or more of the following, and will be order specific:

The contractor shall install and configure of HP product suite with Government personnel.

The contractor shall develop software security scanning standard operating procedures with Government personnel.

The contractor shall install, configure and integrate HP Fortify Static Code Analyzer (SCA) into targeted application build/development environments with Government personnel.

The contractor shall use Static and Dynamic Code Analysis to produce scans of USMC/SPAWAR/IS&I/PdM TFITS applications with Government personnel.

The contractor shall install, configure and integrate HP Runtime onto targeted servers with Government personnel.

The contractor shall perform triage and analysis of USMC/SPAWAR/IS&I/PdM TFITS scan results with Government personnel.

The contractor shall provide advice and guidance on how to remediate security vulnerabilities.

The contractor shall implement secure development techniques with Government personnel.

The contractor shall provide metrics and develop reports in HP Fortify Software Security Center with Government personnel.

The contractor shall administer and troubleshoot the HP product suite with Government personnel.

The contractor shall provide all training and services in English.

The contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the HP Code Review Software, Training and On-Site Professional Services via a secure data collection site. Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities;

(4) S, Utilities ONLY;

(5) V, Freight and Shipping ONLY.

The contractor is required to completely fill in all required data fields using the following web address https://doncmra.nmci.navy.mil.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://doncmra.nmci.navy.mil.

4. Facilities, Other Direct Charges (ODCs), and Travel Requirements Travel expenses for work performed in the DC, and Virginia area will not be allowed. Laptops, cellular equipment/services, and other items of convenience are not reimbursable as ODCs. All travel outside the Washington DC and Virginia area will be placed on a Firm Fixed Price NTE CLIN and reimbursed after reviewing receipts of the contractor’s actual expenses to ensure the claimed travel expenses are fair and reasonable. Costs for transportation, lodging, meals and incidental expenses incurred by the contractor are allowable subject to the limitations contained in the Federal Travel Regulations and/or Joint Travel Regulations.

All Government printing requirements MUST be done by or through the local Document Automation and Production Service (DAPS, now called DLA Document Services) http://www.daps.dla.mil/dapsonline.html.

A month of support will be in each of the following areas: SPAWAR Atlantic, Charleston, SC; Space and Naval Warfare Systems Center Pacific, San Diego, CA and Marine Corps Base Camp Lejeune, NC. One week of WebInspect Quickstart will be conducted in Marine Corps Support Facility New Orleans, LA.

5. Security Contractors assigned to this contract will be required to obtain and maintain access to Top Secret/Sensitive Compartmented Information (TS/SCI). The majority of the work will be conducted at the Joint IA/Cyber Range located at the Quantico Corporate Center, 975 Corporate Center Drive, Stafford VA 22554 with other work locations as outlined in section 4 of this PWS. Individuals will be indoctrinated in order to perform their daily work inside the aforementioned Sensitive Compartmented Information Facility (SCIF). SCI involvement entails unescorted access into SCI spaces, and access to SCI materials and/or systems. The Marine Corps Systems Command (MARCORSYSCOM) Site Security Officer (SSO) provides SCI contract support (Joint Personnel Adjudication System (JPAS) SCI Security Management Office (SMO) Ownership) for required contractor employees. The contractors requiring access to SCI will require Director of Central Intelligence Directive (DCID) 6/4 eligibility determination made by the Department of the Navy Central Adjudication Facility (DODCAF).

6. Performance Requirements Survey (PRS)

PERFORMANCE REQUIREMENTS SURVEY (PRS)

(What do you want to accomplish as the end result of this contract?)

Required Service (What task must be accomplished to give you the desired result?)

Performance Standard (What should the standards for completeness, reliability, accuracy, timeliness, quality and/or cost be?)

Acceptable Quality Level (AQL) (How much error will you accept?)

Monitoring Method (How will you determine that success has been achieved?)

1. PERFORMANCE WORK STATEMENT FOR HP CODE REVIEW SOFTWARE TRAINING AND ON-SITE PROFESSIONAL SERVICES FOR DELIVERY ORDER 3 EVALUATION

1. Objectives and Scope The purpose of the Code Review capability is to support the United States Marine Corps (USMC), Space and Naval Warfare Systems Command (SPAWAR), and Information Systems and Infrastructure (IS&I), Product Manager (PdM) Total Force Information Technology Systems (TFITS) Information Assurance (IA) programs by increasing the existing cybersecurity capabilities in order to comply with Federal, Department of Defense (DoD), and USMC Application Security Policies, Directives, and Guidelines i.e. the Application Security and Development Security Technical Implementation Guide (STIG), Headquarters United States Marine Corps (HQMC),Command, Control, Communications and Computers (C4) memorandum dated 20 November 2012. The contractor shall provide the software licenses, Computer Based Training (CBT), maintenance, classroom-based training, and Subject Matter Expertise (SME) to work with USMC/SPAWAR/IS&I/PDM TFITS designated point of contact(s). The contractor shall assist USMC/SPAWAR/IS&I/PDM TFITS SMEs and developers with the setup and implementation of the static and dynamic code review and Runtime Web Application Protection capability and processes.

For IS&I, the code review capability will be hosted at the IA/Cyber Range. The IA/Cyber Range is a Comprehensive National Cybersecurity Initiative (CNCI) sponsored, Office of Secretary of Defense (OSD) directed, and Defense Information Systems Agency (DISA) governed project. The IA/Cyber Range is chartered to provide the DoD Cyber/IA Community with a realistic replica of the production networks to support testing, training, and exercising of the Cyber/IA Workforce.

Delivery and/or task orders issued by activities other than IS&I, may require performance outside of the Washington, DC area.

2. Requirements

2.1. Scope Definition

The contractor shall provide support to implement and train HP Fortify, WebInspect and Runtime software in a USMC Nonsecure Internet Protocol (IP) Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet) and TS/Sensitive Compartmented Information (TS/SCI) environment.

Support shall consist one or more of the following, and will be order specific:

The contractor shall install and configure of HP product suite with Government personnel.

The contractor shall develop software security scanning standard operating procedures with Government personnel.

The contractor shall install, configure and integrate HP Fortify Static Code Analyzer (SCA) into targeted application build/development environments with Government personnel.

The contractor shall use Static and Dynamic Code Analysis to produce scans of USMC/SPAWAR/IS&I/PdM TFITS applications with Government personnel.

The contractor shall install, configure and integrate HP Runtime onto targeted servers with Government personnel.

The contractor shall perform triage and analysis of USMC/SPAWAR/IS&I/PdM TFITS scan results with Government personnel.

The contractor shall provide advice and guidance on how to remediate security vulnerabilities.

The contractor shall implement secure development techniques with Government personnel.

The contractor shall provide metrics and develop reports in HP Fortify Software Security Center with Government personnel.

The contractor shall administer and troubleshoot the HP product suite with Government personnel.

The contractor shall provide all training and services in English.

The contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the HP Code Review Software, Training and On-Site Professional Services via a secure data collection site. Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities;

(4) S, Utilities ONLY;

(5) V, Freight and Shipping ONLY.

The contractor is required to completely fill in all required data fields using the following web address https://doncmra.nmci.navy.mil.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://doncmra.nmci.navy.mil.

4. Facilities, Other Direct Charges (ODCs), and Travel Requirements Travel expenses for work performed in the DC, and Virginia area will not be allowed. Laptops, cellular equipment/services, and other items of convenience are not reimbursable as ODCs. All travel outside the Washington DC and Virginia area will be placed on a Firm Fixed Price NTE CLIN and reimbursed after reviewing receipts of the contractor’s actual expenses to ensure the claimed travel expenses are fair and reasonable. Costs for transportation, lodging, meals and incidental expenses incurred by the contractor are allowable subject to the limitations contained in the Federal Travel Regulations and/or Joint Travel Regulations.

All Government printing requirements MUST be done by or through the local Document Automation and Production Service (DAPS, now called DLA Document Services) http://www.daps.dla.mil/dapsonline.html.

The SCA Quickstart wll be held in Marine Corps Base Camp Smedley D. Butler, Okinawa, Japan. WI Quickstart Basic will be held in Marine Corps Base Hawaii.

5. Security Contractors assigned to this contract will be required to obtain and maintain access to Top Secret/Sensitive Compartmented Information (TS/SCI). The majority of the work will be conducted at the Joint IA/Cyber Range located at the Quantico Corporate Center, 975 Corporate Center Drive, Stafford VA 22554 with other work locations as outlined in section 4 of this PWS. Individuals will be indoctrinated in order to perform their daily work inside the aforementioned Sensitive Compartmented Information Facility (SCIF). SCI involvement entails unescorted access into SCI spaces, and access to SCI materials and/or systems. The Marine Corps Systems Command (MARCORSYSCOM) Site Security Officer (SSO) provides SCI contract support (Joint Personnel Adjudication System (JPAS) SCI Security Management Office (SMO) Ownership) for required contractor employees. The contractors requiring access to SCI will require Director of Central Intelligence Directive (DCID) 6/4 eligibility determination made by the Department of the Navy Central Adjudication Facility (DODCAF).

6. Performance Requirements Survey (PRS)

PERFORMANCE REQUIREMENTS SURVEY (PRS)

(What do you want to accomplish as the end result of this contract?)

Required Service (What task must be accomplished to give you the desired result?)

Performance Standard (What should the standards for completeness, reliability, accuracy, timeliness, quality and/or cost be?)

Acceptable Quality Level (AQL) (How much error will you accept?)

Monitoring Method (How will you determine that success has been achieved?)

image1.png image3.png