Draft_NACCR_PWS_25_Aug16.pdf

For Official Use Only

Source Selection Sensitive See FAR 2.101 and 3.104

DRAFT Performance Work Statement (PWS)

For

Network Access Control, Compliance and Remediation (NACCR)

NOTE: This is a DRAFT Performance Work Statement (PWS) and not an official PWS. The purpose of this DRAFT PWS is to initiate market research under Federal Acquisition Regulation

(FAR) Part 10. The information herein only initiates communication with industry in order to assess market potential. No official solicitation document exists at this time. This DRAFT PWS does not create any Government obligation to procure these items or to issue an official solicitation. In addition, the Government has no obligation to pay for information responsive to this DRAFT PWS and will not accept any responses as offers. The information provided in this

DRAFT PWS is subject to change and is not binding on the Government.

1. Background: Commander, Marine Forces Cyber (COMMARFORCYBER) issued an

Urgent Universal Needs Statement (U-UNS) for an enhanced Network Access Control

(NAC) solution.

The United States Marine Corps (USMC) employs “port based security” today as an initial mitigation step to preclude unauthorized assets from connecting to the network, however the port based security capability does not meet the criteria set forth in the applicable Defense

Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) and Security Requirement Guides (SRGs). Additionally, the port based security approach was not adopted consistently as an enterprise solution, nor does it use 802.1x authentication.

2. Scope: The scope of this PWS establishes and defines the requirements for a turn-key

NACCR solution including appliance, installation, system integration, system training, system warranty and support services on the Marine Corps Enterprise Network (MCEN) for unclassified (MCEN-N) and classified (MCEN-S). The Government requires technical expertise to document, configure, and train users, during and immediately following site installations. The NACCR solution shall support each Marine Corps Air-Ground Task Force

(MAGTF) Information Technology Service Center (MITSC), Enterprise Information

Technology Center (EITC) and the Marine Corps Network Operations and Security Center

(MCNOSC) as defined in Table 1. Figure 1 provides an overview of the locations within each MITSC region. The scope of this effort includes follow-on annual lifecycle sustainment support to ensure the solution remains operational and is fully supported by manufacturer warranty (hardware) and software assurance support (software).

This effort includes building a prototype and performing a pilot fielding of the NACCR solution. The prototype will be tested in the Enterprise Engineering Verification Environment

(EEVE) lab and will allow the Government to verify that the system can perform as intended and will not cause unintentional consequences to the network prior to placing it on the live network during the National Capital Region (NCR) pilot.

The pilot will allow the Government to thoroughly evaluate all components of the solution prior to the enterprise roll-out. During the pilot, relevant enterprise tools will be integrated and evaluated to determine if the enterprise requirement must be revised.

The pilot will continue until the evaluation of the enterprise tools allows generation and refinement of a concept of employment (CoE) and applicable policies.

Table 1: Regional Locations

Region Regional Management Location

MITSC NCR MCB Quantico, VA

MITSC HQMC Arlington, VA

MITSC East MCB Camp Lejeune, NC

MITSC West MCB Camp Pendleton, CA

MITSC Mid-Pac Kaneohe Bay, HI

MITSC West-Pac Okinawa, Japan

MITSC EUR Panzer Kaserne, Böblingen, Germany

MITSC Res New Orleans, LA

EITC Kansas City, MO

System architecture may require other locations

Figure 1: USMC Regional Overview

3. Objectives:

3.1. Program Management: The Contractor shall conduct and participate in scheduled virtual and on-site meetings, conference calls, present briefings, and provide progress overviews as indicated below.

3.1.1. Post Award Conference (PAC): The contractor shall host a multi-day PAC, in the National Capital Region at a Government specified location, within 30 calendar days after award. The contractor shall provide a PAC agenda (CDRL

A001), a presentation brief (CDRL A002), and the documentation identified below two days prior to the PAC. A hard copy binder of the PAC deliverables shall be provided for each Government participant identified in the CDRL. At the

PAC, the contractor will present and prepare to discuss the following:

- Paragraph-by-paragraph review of the awarded PWS and technical solution.

- Draft Project Plan (CDRL A006).

- Contractor roles and responsibilities.

- Preliminary system-level engineering document package (CDRL A011).

- Detailed product performance specifications for provided equipment. This includes metrics for sizing, interfacing thresholds, processing and storage capacity, and how they relate to the managed network and interfacing systems.

- Interface requirements for integrated systems. For example, if an agent is needed on Government equipment, the details on that agent, access, etc.

shall be defined.

- Preliminary allocation of identified system requirements to hardware, human and software systems/subsystems.

The Government will conduct a paragraph-by-paragraph review of the PWS in conjunction with the contractor’s technical solution as it relates to system requirements and provide comments and recommendations. The Government will provide GFI, identify the contractor staging/storage area, establish POC lists, and provide protocols and rules of conduct. Following the PAC, the contractor shall make the recommended changes to the documents presented during the meeting.

The contractor shall commence work upon approval by the COR of the Project

Plan and preliminary system-level engineering document package. The PAC shall be documented by electronic meeting minutes (CDRL A003), which shall be submitted to the Government for approval not later than (NLT) five working days after the meeting.

CDRL:

A001 PAC Agenda

A002 PAC Briefing Slides

A003 PAC Meeting Minutes

3.1.2. Weekly Meetings: The contractor shall conduct weekly meetings to provide and discuss status updates, findings, milestones, significant actions, issues or concerns, overall project status, and the discrepancy list. A one-time submission of a meeting agenda (CDRL A004) shall be submitted for Government approval

NLT two calendar days prior to the first weekly meeting. The approved agenda shall be followed for all weekly meetings. Meeting participants will be identified at the PAC and included in the meeting minutes. The contractor shall establish an action item log, track updates, and discuss during each weekly meeting.

Additionally, a library showing critical items and work progress shall be established and maintained throughout the life of the project. The contractor shall post contract documents to a Government secure website NLT than one working day prior to the first weekly meeting.

The contractor shall provide weekly meeting minutes (CDRL A005), which will identify:

a. Date of the reporting period.

b. All attendees.

c. Outstanding issues and current status of items in the action item log.

d. Activity on the action item log, which shall track at a minimum:

(1) Individual actions.

(2) Dates of actions.

(3) Person(s) assigned the action.

(4) Assigned tasks.

(5) Unique item number.

(6) Resolution and resolution date.

(7) Estimated completion date.

(8) Meeting at which this action item was generated.

e. A summary of major accomplishments for the reporting period, including major milestones achieved, critical path items completed, and products delivered.

f. Project schedule.

g. Description of work performed during the reporting period (to include major milestones/activities and critical path items) and anticipated work for the next reporting period.

h. Any risks to include any issues related to scheduling, cost, and technical or administrative problems, and the steps being taken to mitigate them.

i. Any safety and quality assurance related issues and current status.

The primary means of conducting scheduled weekly meetings will be voice teleconference, video teleconference or collaborative website, as available. The contractor’s Key Personnel shall participate in person, at a minimum, in one weekly meeting, per quarter, and provide an expanded update, as required. The

Government and the contractor will take advantage of installation site visits to conduct in person weekly meetings, where feasible. The contractor shall post weekly meeting minutes to the Government secure website within four working days after each meeting.

CDRL:

A004 Weekly Meeting Agenda

A005 Weekly Meeting Minutes/Action Log

3.1.3. Project Plan: The contractor shall provide a Project Plan for the implementation of the NACCR Project. The plan is to fully implement the NACCR capability in accordance with the tasks contained in this PWS within 24 months of contract award date. The Project Plan shall:

a) Function as a monthly Plan of Action and Milestones (POA&M) that includes project phases for each installation location. Changes to the

POA&M that effect performance will be approved by the Government prior to changes being enacted.

1. Detail work tasks and be reflective of activities and submittals including: technical reviews, planning, design documentation, site documentation, site readiness, product/solution acceptance, site acceptance, installation, configuration, testing, training, asset tagging, and closeout documentation submittals at a minimum.

2. Identify the project timeline and associated milestones. Track the progress and critical milestones of the program, including the tasks needed to complete the project.

3. Indicate the order in which the contractor proposes to perform the work and the dates on which the contractor contemplates starting and completing tasks (including acquiring materials, equipment, and utility service connections).

4. Reflect the updated project progress as percent complete values for each task and project phase.

5. Include information in the form of a progress chart and indicate task dependencies.

6. Highlight positive or negative impacts; provide details on the process to deal with unforeseen site conditions; and predict schedule slips.

b) Address a management approach and highlight actions that will be taken to mitigate risk to cost, schedule, and performance.

1. Describe the Risk Management approach and how the contractor will present project risks to the Government.

2. Identify the contractor’s approach to managing Quality Control for the project. Identify corporate policies and how the project team will follow quality control processes to delivery products.

c) Describe the contractor’s approach to Resource Management. The approach to Resource Management shall include program and reporting structure, organizational charts, and delivery team management. Changes in

Resource Management that have impact on performance should be highlighted in Project Plan updates.

d) Describe the contractor’s approach to Configuration Management (CM).

Identify how the contractor’s approach shall integrate with the Government

CM process. Detail the methods of CM prior to design approval and after the Government approves the contractor design at the NIR.

e) Provide recommendations to optimize implementation based on industry best practices and lessons learned

f) Be finalized at the time of initial submittal and be re-baselined only upon

Government approval.

g) Identify and provide details on the collection and analysis of system metrics to support implementation of required capabilities

h) Provide data, studies, and reports necessary or useful to demonstrate full compliance with Federal, State, and Local environmental laws, including any known potential compliance issues associated with the system manufacturing, testing, operations, or disposal.

i) Provide Environment, Safety, and Occupational Health (ESOH) information relating to the system. Identify any ESOH risks or issues that impact project success.

j) Provide details about the lifecycle maintenance planning for end-of-life devices and applications.

CDRL:

A006 Project Plan

3.2. Design: The contractor shall provision a completely functional turn-key solution with the required programming, interfaces, hardware, software, ancillary equipment, parts, databases, and material for all identified capabilities and requirements. If the contractor identifies a necessary change to the Government infrastructure, the contractor shall notify the COR and the on-site Government representative to make the required changes.

The contractor shall replace and correct any hardware, software, applications, data, material, and services omitted and/or installed in error associated with the NACCR implementation without additional cost or delay to the Government. The contractor also shall Engineer, Furnish, Install, Secure, and Test (EFIST) and make operational any ancillary equipment required to support this effort (such as cables, firmware, interfaces, wiring blocks, applications, and racking) to provide a complete solution.

3.2.1. Technical Reviews: The contractor shall be required to participate, in person, in scheduled, formal, Government technical reviews, including the following:

Non-Developmental Item (NDI) Integration Review (NIR): This review is conducted to ensure the system design is suitable for full enterprise implementation, demonstration, and test and can meet stated performance requirements within cost (budget) and schedule. The assessment establishes the initial product baseline and verifies the design satisfies functional requirement.

The contractor shall participate in the NACCR NIR by providing documentation and briefing the design (CDRL A007).

CDRL:

A007 NIR Contractor Design Briefing Presentation

Test Readiness Review (TRR): This review validates that the system under review is ready to proceed into formal test as identified in Section 3.3.2. The contractor shall participate in the TRR. The TRR will occur prior to System

Qualification Test. The TRR assesses test objectives, test methods and procedures, scope of tests, and safety and confirms that required test resources have been properly identified, made available, and coordinated to support planned tests. This review will also address the Cyber requirements and the ability of the systems to begin the accreditation process as described in Section 3.3.4. The contractor shall present their initial test results and readiness to proceed into

Government testing (CDRL A008). The TRR shall be coordinated with the

Government for an acceptable time period to perform the testing.

Additional TRR events will be held for each location prior to the Site Acceptance

Event as identified in Section 3.3.3. The contractor shall brief site readiness to test for Site Acceptance (CDRL B009).

CDRL:

A008 NACCR TRR for SQT Briefing Presentation

B009 Site Specific TRR Briefing Presentation

System Verification Review (SVR): This review validates that the system as tested has met the user requirements. The successful completion of this review signifies that the system is ready for full deployment and that the capabilities as defined are sufficient to complete the enterprise rollout. The contractor shall participate in the SVR and develop briefing materials (A010) on design changes and test results.

CDRL:

A010 SVR Briefing Presentation

3.2.2. System-Level Engineering Document Package: The contractor shall develop a system-level document package and conduct a preliminary document review as part of the PAC to allow the Government to validate the drawing formats, details captured, quality, and accuracy of the information. The Government will review and comment on each of the engineering documents and provide feedback on the document package in the time between the PAC and the final design review at the

NIR. The Systems Engineering Technical Review (SETR) handbook ensures the required technical rigor is applied to the project and outlines each Technical

Review process, the entrance and exit criteria for these reviews and the expectations for acceptable system level documentation. The development of these deliverables for the applicable technical reviews are identified in CDRL

A011

After completion of the preliminary document review and Government acceptance, the contractor shall construct the final system-level engineering document package incorporating comments and changes delineated by the

Government. The contractor shall deliver the final system-level engineering document package to the Government for review NLT five working days prior to the NIR kick-off. The final system-level engineering document package will be accepted when Government comments are adjudicated and the Government approves all drawings and technical documents.

CDRL:

A011 Final System-level Engineering Document Package

3.2.3. Location-Specific Engineering Document Package: The contractor shall develop a location-specific engineering document package and conduct a preliminary document review to allow the Government to validate the drawing formats, details captured, quality, and accuracy of the information. The contractor shall deliver the preliminary location-specific engineering document package to the Government NLT ten working days after each Facility Assessment. The

Government will have a period of ten working days to review and comment on each of the engineering document packages.

The contractor shall deliver the final location-specific engineering document package to the Government NLT 20 working days prior to each Site Acceptance

Test event. The contractor shall redline the location-specific engineering document package and then incorporate the changes into a final, “as-built” drawing package after the completion of the Government Physical Configuration

Audit (PCA). The contractor shall deliver the “as-built” location-specific engineering document package to the Government NLT five working days after each PCA. The development of these deliverables for the applicable technical reviews are identified in CDRL B012.

CDRL:

B012 Location-Specific Engineering Document Package

3.2.4. Implementation Plans: The contractor shall develop an Implementation Plan for the execution of the initial phases of the Government rollout. The contractor shall detail their processes for the implementation of NACCR into the EEVE lab as a prototype evaluation for the development of the design and documentation of the enterprise solution. At the completion of the NIR, the contractor shall begin deployment of the pilot in the NCR to include the management infrastructure.

The contractor shall document the time required to perform key activities and deliver required design and test documentation. The Implementation Plans shall include contractor details on methods and procedures for the deployment, installation and transition of NACCR at each site in accordance with CDRL

B013.

CDRL:

B013 Implementation Plan

3.2.5. Network Access Control System Requirements: The contractor shall install

NAC systems. NAC system availability, as pertains to the contractor’s area of responsibility, shall be assessed on all contractor installed equipment and cabling.

The NAC systems shall meet the capabilities in the NACCR SSS to be fully operational. The contractor shall integrate the NAC appliance with network timing source for time synchronization and integrate on-site interfaces for receipt and delivery of compliance and remediation activities/tasks.

3.2.6. Facility Assessment: Per task order, the contractor shall conduct a Facility

Assessment for each specific installation. The purpose of the Facility Assessment is to provide the contractor with an opportunity to begin development of the location-specific engineering design package. The Facility Assessment will be arranged and coordinated between the COR, the contractor, and the site point of contact. The contractor shall provide a Facility Assessment Report (CDRL B014) that accurately describes the existing conditions, identifies potential problem areas to include the Government’s readiness to proceed, and practicality of existing system reuse. The Facility Assessment Report shall be submitted no later than

(NLT) seven working days after Facility Assessment has been concluded. The

Facility Assessment Report shall include a section that identifies facilities improvements required for implementation of the NAC solution. Existing drawings, diagrams, and other Government Furnished Information (GFI) will be available for review through the site point of contact during the Facility

Assessment.

CDRL:

B014 Facility Assessment Report

3.3. Testing and Cybersecurity: The contractor shall perform testing and Cybersecurity of the delivered system to validate that the Government specifications have been met.

3.3.1. Product Acceptance Test: The contractor shall conduct a Product

Acceptance Test (PAT) in the EEVE lab after the completion of Self-

Assessment and remediation of vulnerabilities as required. The contractor shall perform PAT to verify system functional integration through the planning, conducting, and documenting of this test. The contractor shall take separate systems and subsystems identified in the NACCR SSS and create the necessary interfaces between them to build a cohesive NAC system as identified in the performance objectives of the approved test plan. The interaction among the systems and subsystems is the focus during this test. All available interfaces shall be integrated and tested to verify intended functionality in this test phase.

The contractor shall use simulated, functionally equivalent interfaces to represent interfaces external to the provided solution for Product Acceptance.

The contractor shall document their approach to demonstrate that all simulated interfaces are adequate in the test plan. The contractor shall conduct PAT at the

EEVE facility. The Government will provide the contractor access to the test facility during the PAT period. The contractor shall provide personnel to administer the system under test. The contractor shall provide personnel to conduct and document PAT results. The Product Acceptance shall simulate operational testing to demonstrate and validate system configuration and proposed operational capabilities.

The role of the Government during Product Acceptance is to validate the results of Product Acceptance and provide Government oversight regarding the planning, conduct, and documentation of Product Acceptance. Unless specified in a templated DEVDOC, contractor format is acceptable for CDRLs A015, A016, and A017.

CDRL:

A015 PAT Plan

A016 PAT Procedures/Scenarios

A017 PAT Report

3.3.2. System Qualification Test (SQT): The contractor shall participate in the

Government evaluation of the solution at the completion of the Independent

Verification and Validation (IV&V). After an acceptable TRR outcome, the

Government will validate that the NACCR solution meets the performance specifications identified in the NACCR SSS and this PWS. The contractor shall provide initial test plans, procedures and scenarios. The contractor shall support

Government execution of the SQT.

CDRL:

A018 SQT Plan

A019 SQT Procedures/Scenarios

3.3.3. Site Acceptance Test: The Site Acceptance Test (SAT) is a per installation test, to include base personnel, performing scenarios that validate the required operational capabilities. Operational testing on the actual system will lead to the required certifications to authorize the system operations and connections to the base IP network. The contractor shall create site specific test plans, procedures and reports for each SAT. The contractor shall present preliminary test results as part of each site-specific TRR prior to the beginning of the test event. The SAT shall include:

a. Specification Validation: The data gathered from this process shall be validated against the NACCR SSS.

b. Cybersecurity: The system shall be scanned to verify the Cyber compliance of the system. If vulnerabilities were found during prior test events, the mitigation steps shall be verified at the installation prior and/or during SAT to ensure that the system meets Cybersecurity standards.

At the completion of the SAT, the system will begin a 30-calendar day burn-in.

The 30-day burn-in will allow the contractor to perform any remediation activities or correct deficiencies identified by the Government. At the completion of the 30-day burn-in, if the deficiencies have been remediated, the

Government will formally accept the system as delivered by the contractor and the warranty will begin.

CDRL:

B020 SAT Plan

B021 SAT Procedures/Scenarios

B022 SAT Report

3.3.4. Cybersecurity: Marine Corps Order (MCO) 5239.2B establishes an information systems lifecycle management approach to protect critical Marine

Corps information. The contractor shall execute to the requirements within this order and in accordance with the latest releases or revisions of the cybersecurity policies located in Appendix A. NACCR will attain and maintain an Authority-

To-Operate (ATO) as required by DoDI 8510.01 Risk Management Framework

(RMF) for DoD Information Technology, 24 May 2016. The contractor shall have knowledge of, support, and perform all activities necessary for system

Assessment and Authorization (A&A) as directed by the RMF for DoD IT and

MARCORSYSCOM Systems Engineering, Interoperability, Architectures and

Technologies (SIAT) RMF Process Guide Version 1.0, 25 May 2016. The current A&A strategy includes attaining an IATT prior to Pilot Phase start date and ATO prior to Pilot Phase end date. Unless specified in the CDRL, contractor format is acceptable.

The contractor shall:

1) Attain and maintain the NACCR IATT and ATO to include create, review and update A&A documentation required for the system as defined by RMF policy and MCSC RMF process guide;

2) Use the current Government cybersecurity support tool, Marine Corps

Certification and Support Tool (MCCAST) V2, to create, submit, maintain, and review A&A documentation and workflow;

3) Harden and configure NACCR in accordance with Defense Information

Systems Agency (DISA) Security and Technical Implementation Guides (STIG) to include automated and manual settings. Applicable STIGs (GFI) will be based on the vendor provided material solution to this solicitation;

4) Identify and provide technical guidance on remediation and mitigation of all open findings from DISA STIGs. The contractor shall incorporate open STIG findings into the Government-provided Plan of Action and Milestones

(POA&M) format. STIG open findings are defined as: CAT I, CAT II, and

CAT III. All CAT I, II, and III open findings shall be remediated, configured, or mitigated. If any open STIG finding adversely affects system functionality, then a Government acceptable mitigation (i.e., current processes or measures that reduce vulnerability exposure) shall be provided in the POA&M with recommended completion dates;

5) Conduct weekly credentialed scans using the current DoD-approved vulnerability scanning tool (Assured Compliance Assessment Solution

(ACAS));

6) Conduct ACAS scans using the DISA Field Security Operations (FSO) scan policy (GFI) and latest ACAS plugin definitions available on the DoD Patch

Repository (GFI);

7) Conduct all ACAS scans with proper credentials;

8) Identify and provide technical guidance on remediation and mitigation of all open findings from ACAS scans. The contractor shall incorporate open ACAS findings in the Government-provided POA&M format. ACAS open finding are defined as Critical/High Severity = CAT I, Medium Severity = CAT II, and

Low Severity = CAT III. All CAT I, II, and III open findings shall be remediated, configured, or mitigated. If any open ACAS finding adversely affects system functionality, then a Government acceptable mitigation (i.e., current processes or measures that reduce vulnerability exposure) shall be provided in the POA&M with recommended completion dates;

9) Plan, facilitate, and participate in all annual cybersecurity requirements to include Annual Security Reviews, Annual Security Control testing, and Annual

Contingency Plan testing in compliance with the Federal Information Security

Management Act (FISMA);

10) Create, review, and update all NACCR cybersecurity-related documentation.

Provide documentation to properly authorized individuals;

11) Analyze, test and apply all Information Assurance Vulnerability Alerts

(IAVAs), Information Assurance Vulnerability Bulletins (IAVBs), security updates and patches to software and operating systems;

12) Implement a system for the assessment, remediation, tracking, and reporting of system vulnerabilities per Information Assurance Vulnerability Management

(IAVM) Program and Operational Directives (OPDIRs);

13) Implement cybersecurity best practices in accordance with National Institute of

Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 4 to maintain and improve the security posture of NACCR to include software quality code reviews and penetration tests;

14) Conduct cybersecurity risk analysis to include identification and mitigation of cyber security risks to NACCR system;

15) Implement system software that is registered in the Department of the Navy

Application and Database Management System (DADMS) and approved for

Marine Corps use;

16) Analyze and implement NACCR Ports, Protocols, and Services (PPS) according to DoDI 8551.01 Ports, Protocols, and Services Management (PPSM);

17) Plan and evaluate NACCR to the National Information Assurance Partnership

(NIAP) Protection Profile: Enterprise Security Management – Access Control standard;

18) Complete annual Cybersecurity Awareness training and provide certificates to the Government ISSM;

19) Provide on-site technical support for the full duration of scheduled Self-

Assessment and Independent Verification and Validation (IV&V) events. The contractor shall develop test plans, review system security documentation, perform vulnerability and Secure Content Automated Protocol (SCAP) scans, review vulnerability and SCAP scan results, analyze and configure STIG settings, review STIG compliance results, evaluate test results, prepare and review POA&Ms, and remediate/mitigate findings;

20) Provide on-site technical support for the full duration of scheduled Command

Cyber Readiness Inspection (CCRI) events. The contractor shall develop test plans, review system security documentation, perform vulnerability and SCAP scans, review vulnerability and SCAP scan results, analyze and configure STIG settings, review STIG compliance results, evaluate test results, prepare and review POA&Ms, and remediate/mitigate findings.

CDRL:

A023 RMF Categorization Memorandum for the Record (MFR)

A024 Hardware/software baseline artifact

A025 Ports, Protocols, and Services (PPS) artifact

A026 Network Diagram with A&A boundary

A027 Information Security Continuous Monitoring (ISCM) Strategy

A028 Cybersecurity Strategy

A029 Service Level Agreements or Memorandum of Agreements

A030 Information Assurance Vulnerability Management (IAVM) Plan

A031 IAVA/OPDIR Status Report

A032 Annual Security Review Test Plan

A033 Annual Security Review Report

A034 Annual Contingency Exercise Test Plan

A035 Annual Contingency Exercise Report

A036 Annual Security Control Test Plan

A037 Annual Security Control Test Report

A038 Self-Assessment Test Plan

A039 Self-Assessment Test Report

B040 ACAS Scan Report

B041 Vulnerability Scan files (.nessus files)

B042 STIG checklists

B043 SCAP files (XXCDF xml files)

B044 POA&M

A045 Risk Assessment Report

3.4. Installation Services & Support: The contractor shall satisfy all applicable

Department of Defense (DoD) and commercial standards, Appendix A, for installation, commissioning, physical security and Cyber Security of the delivered system.

Contractor personnel who perform on-site implementation and integration shall be

DODI 8140 IASAE Level II certified. The contractor shall perform system configuration, marking, delivery, warranty and support as described below. The contractor shall provide system warranty, software upgrades and support services for one year for each delivered system beginning after site acceptance. The contractor provided solution shall be executed IAW the local seismic zone requirements.

The contractor shall use and retain personnel who are fully trained and certified to perform the specified activities during development, testing, installation and warranty period of the procured systems. The contractor shall maintain sufficient access to manufacturer’s recommended spare parts during the performance period of the contract.

3.4.1. Site Implementation: The contractor shall EFIST and make operational a fully functional, turn-key, NAC system and an administration terminal. This implementation shall include programming, installation, applications, data transfer/migration and entry, hardware, software, ancillary equipment, parts, training, and material for all identified services and requirements. The system shall be capable of performing those functions and operating standards identified in Appendix A. The contractor shall replace and correct equipment, software, applications, data, material, and services omitted and/or installed in error without additional cost or delay to the Government. The contractor shall EFIST and make operational any ancillary equipment, software, and services required to support this effort. Table 1 identifies potential locations for the system to be installed.

3.4.2. Warranty Support: The contractor shall provide as a guarantee that their product will continue to operate at its advertised level of performance. The contractor shall provide Warranty and Maintenance support. The contractor shall facilitate replacement with new OEM parts at the time of failure. The contractor shall repair or replace the item at the contractor's expense provided the failure was a manufacturer’s defect. The contractor shall begin the warranty period upon

Government acceptance of each site. The contractor shall provide details of their warranty agreement (CDRL A046) to the Government to include, at a minimum:

1) Specific terms of agreement

2) Lowest replaceable unit

3) Self-repair options

4) Upgrade procedures

5) Equipment recall procedures

6) Preferred shipping method

CDRL:

A046 Warranty Instructions

3.4.3. Monthly Maintenance Report (MMR): The contractor shall provide a MMR to the Government COR. The report shall cover the entire preceding month activities and shall be delivered on the fifth day of every month. This report contains all helpdesk activity related to services in support of NACCR equipment and if no calls are received, the contractor shall generate a negative report indicating no activity to report for that period. Reports shall include any unresolved issues from preceding months until the reported issue has been resolved.

CDRL:

A047 Monthly Maintenance Report

3.4.4. Unique Item Identifier (UII) Requirement: The contractor shall affix a

Unique Item Identification (UII) label to each item, including all affixed cards, as identified in DFARS Clause 252.211-7003 regardless of the unit cost. The

Contractor shall provide an UII report, identifying UII parent and child relationships if appropriate. If an end-item fails, the contractor shall re-serialize the replacement end-item to match that of the failed item. The contractor shall transfer warranty to the new (replacement) item.

CDRL:

B048 UII Report

3.4.5. Packaging, Handling and Shipping: The contractor shall perform packaging, handling and shipping in accordance with MIL-STD-129.

3.4.6. Disposal: The contractor shall identify as part of the design (CDRLs A011, B012), system drives that store classified data. Disposal and destruction of classified hard drives, electronic media, processing equipment components, and the like will be accomplished in accordance with CNSSI 4004.1, and applicable security controls.

3.4.7. Counterfeit Parts Program and Diminishing Manufacturing Sources and

Material Shortages: The contractor shall ensure that no counterfeit parts (i.e.

gray market) are provided as replacement parts, or as part of the equipment delivered under this contract IAW DODI 4140.67 and FAR 252.246-7007.

3.5. Training: The contractor shall provide formal training for all new systems provided under this PWS. All training shall be conducted during the installation phase, and prior to system cutover for each location. The contractor shall prepare and provide a draft

Training Plan to include course descriptions, syllabuses, and training schedules for all locations 45 calendar days from contract award date. The contractor shall provide a final

Training Plan NLT 30 calendar days prior to the planned commencement of training at each location. The contractor shall provide manufacturer certified courses tailored for operation and maintenance for the USMC NACCR solution. The contractor shall provide each student a Certificate of Completion after successful completion of the course(s). The contractor shall provide Training Manuals which include data and documents to effectively guide the personnel through the Operator Training Course and the Systems Administration Training Course. The contractor shall provide training materials meeting the following requirements:

a. Be provided with for reproduction, modification, and repurposing in electronic format.

b. Describe and detail the functional operation of the system within the

MCEN.

c. Detail specific instructions for administering and operating the systems within the MCEN to include interfaces with the systems identified in the

NACCR System/Subsystem Specification (SSS) and the endpoint asset.

d. Provide sufficient written and audio visual instruction including text, graphs, charts, troubleshooting checklist, and images to effectively guide the trainees through the installation, configuration, setup, operation and maintenance of the NACCR solution.

e. Contain scenarios as deemed appropriate by the contractor and approved by the Government.

CDRL:

B049 Training Plan

3.5.1. Operator Training: The contractor shall provide Operator Training course materials and perform training which shall include:

a. Material, equipment, and hardware information specific to the

MCEN NACCR solution.

b. Functional operation of the system including all operating modes.

c. Operator commands.

d. Database entry where applicable.

e. Reports generation.

f. Event monitoring.

g. Diagnostics and basic troubleshooting.

h. Operator preventive maintenance procedures.

i. User/operator and maintenance guides, how-tos and checklists.

j. Conducting hands-on training for target audiences in the use and operation of the NACCR solution.

3.5.2. System Administrator Training: The contractor shall provide System

Administrator course materials and perform training which shall:

a. Include instruction on the specific hardware and software configurations of the system within the MCEN and MITSC architecture, environments and interfaces.

b. Include specific instructions for administering and operating the system within the MCEN.

c. Provide each student the ability to start the system, operate the system, configure the system, recover the system after a failure, and describe the specific hardware and software architectures and operation of the system.

d. Include user/operator and maintenance guides, how-tos and checklists on the administration of the NACCR solution.

e. Conduct hand-on training for target audiences in the use and administration of the NACCR solution.

3.5.3. Training Documentation: The contractor shall provide NACCR

Technical Manuals for all new systems delivered.

The contractor shall provide all necessary materials, documentation, manuals, and training aids at the commencement of training. Training material shall be provided to each training attendee in hard copy and electronic formats. See

Table 2 for estimated student quantities for each location.

Table 2 – Estimated Student Quantities

Location

Estimated

Number of

Students

MITSC NCR 30-40

MITSC West 8-10

MITSC East 8-10

MITSC Mid-Pac 8-10

MITSC Wes-Pac 8-10

MITSC HQMC 8-10

MITSC Reserves 8-10

MITSC Europe 8-10

Technical Manuals shall:

a. Provide step-by-step instruction for NACCR deployment, configuration, integration, monitoring, troubleshooting, operation, management and updating of systems and subsystems.

b. Include enterprise and regional NACCR workflow(s), sketches and interfaces.

c. Detail instructions for NACCR installation at each region.

d. Detail troubleshooting activities with technical instructions

e. Provide Preventive and Corrective maintenance procedures.

f. Help Desk Support and procedures.

g. Detailed System Architecture

h. Warranty Instructions

CDRL:

B050 NACCR Technical Manual(s)

B051 Operator Training Materials

B052 Administrator Training Materials

3.5.4. Manpower, Personnel and Training (MPT): The contractor shall provide NACCR solution MPT impacts for all new systems provided under this

PWS. MPT Impact analysis shall include:

a. NACCR Manpower and Personnel impacts and changes in force mix across the Enterprise.

b. NACCR Job Task Analysis.

c. NACCR Workload Analysis.

CDRL:

A053 Manpower and Personnel Impact Analysis

A054 Job Task Analysis

A055 Workload Analysis

3.6. Post-Implementation Lifecycle Sustainment and Support: The contractor shall provide sustainment and support services to maintain NACCR on the MCEN-N and

MCEN-S. The contractor shall use industry best practices and NACCR product knowledge to perform troubleshooting activities, documentation updates, configuration management of policy updates, preventive and corrective maintenance, and assisting in problem resolution. The contractor shall perform vulnerability scans, remediation and mitigation activities to maintain the ATO. Contractor personnel who have privileged access on the MCEN shall be DODI 8140 IAT Level II certified. The contractor shall provide a Post-Implementation Lifecycle Support Plan (CDRL A056) to address, at a minimum:

1. Logistics support.

2. Government change requests.

3. Manage system configuration.

4. Maintain cybersecurity posture.

5. Manage interfaces.

6. Perform system administration.

7. Recommended continuous process improvements.

8. Resolve preventive and corrective maintenance actions.

CDRL:

A056 Post-Implementation Lifecycle Support Plan

4. Constraints

4.1. Government Furnished Equipment (GFE): The Government anticipates providing at each site rack space for hardware included in the NACCR solution. Virtual appliances shall not be installed on existing GFE.

4.2. Government Furnished Information (GFI): The Government anticipates having to provide information to aid the contractor in executing the contract. The GFI will be identified in FAR 52.245-1.

4.3. Government Furnished Materials: No Government Furnished Material will be provided under this PWS. The contractor shall furnish its own computer equipment, administrative supplies, and office supplies, required for the performance of the tasking within this PWS. The Government will not reimburse the contractor for cell phone charges under this PWS. The Government will not provide network services for contractor computer equipment.

4.4. Access to Government Facilities: The Government will provide access to the required facilities during normal working hours, scheduled with each TSO, Monday through

Friday. The Government will provide workspace for the contractor to perform on-site duties. The contractor must seek prior approval of the COR and site point of contact for access to facilities during non-standard Government hours. Limited access facility badges may be provided if off-hours access is required, the COR and site point of contact will determine if contractors require this level of access. Hours may be further reduced during the working day before and the day after Government holidays.

4.5. Travel and Other Direct Costs (ODCs): There will be no reimbursement for Travel or

ODCs for contractor personnel. It is the contractor’s responsibility to include all costs in the firm-fixed pricing schedule.

4.6. Security

4.6.1. Security Clearance: This contract will require the contractor to have a Secret

Facility Clearance and will require contractors to obtain and maintain classified access eligibility. The contractor shall have a valid Secret Facility Clearance prior to classified performance. The prime contractor and all sub-contractors

(through the prime contractor) shall adhere to all aspects of DoD Directive

5220.22-M. All personnel identified to perform on this contract shall maintain compliance with Department of Defense, Department of the Navy, and Marine

Corps Information and Personnel Security Policy to include completed background investigations (as required) prior to classified performance. This contract shall include a DoD Contract Security Classification Specification (DD

Form 254) as an attachment. The contractor shall notify the Government (written notice) within twenty-four hours of any contractor personnel added or removed from the contract that have been granted classified access, issued a Common

Access Card and/or MCSC Building access.

4.6.2. Common Access Card: The COR will identify and approve those contractor employees performing on this contract that require Common Access Cards

(CACs) in order to perform their job function. In accordance with Headquarters, United States Marine Corps issued guidance relative to Homeland Security

Presidential Directive – 12 (HSPD-12), all personnel must meet eligibility criteria to be issued a CAC. In order to meet the eligibility criteria, contractor employees requiring a CAC, must obtain and maintain a favorably adjudicated Personnel

Security Investigation (PSI.) Prior to authorizing a CAC, the employee’s JPAS record must indicate a completed and favorably adjudicated PSI or (at a minimum) that a PSI has been submitted and accepted (opened.) The minimum acceptable investigation is a National Agency Check with Written Inquiries

(NACI.) If a contractor employee’s open investigation closes and is not favorably adjudicated, the CAC must be immediately retrieved and revoked.

Facility Security Officers (FSOs) are responsible for notifying the MCSC Security

Director if any contractor performing on this contract receives an unfavorable adjudication after being issued a CAC. The FSO must also notify the MCSC

Security Director of any adverse/derogatory information associated with the 13

Adjudicative Guidelines/Factors concerning any contractor issued a CAC, regardless of whether a JPAS Incident Report is submitted.

Each CAC is issued with a “ctr.usmc.mil” e-mail account that the individual contractor is responsible to keep active by logging in on a regular basis (at least twice a month), sending an e-mail and clearing any unneeded e-mails.

Contractors are prohibited from “auto-forwarding” their .mil e-mail account to their .com e-mail account. If the ctr.usmc.mil e-mail account is not kept active, the G-6 will deactivate the account and CAC will lose its functionality.

CACs will only be issued to those contractors supporting this contract that have been authorized by the COR. The COR will only authorize CACs for those contractors that meet current HSPD-12 criteria and have a definitive requirement.

If a contractor loses their eligibility for a CAC due to an adverse adjudicative decision, they have also lost their eligibility to perform on MCSC contracts.

CACs are not issued for convenience.

4.6.3. SIPRNet Token: The COR will identify and approve those contractor employees performing on this contract that require SIPRNet tokens in order to perform their job function. SIPRNet tokens will be issued IAW DODI 8520.02.

5 ADMINISTRATIVE AUTHORITY

5.1 Contracting Officer: Only the Contracting Officer has the authority to authorize deviations from the terms and conditions of this contract, including deviations from the specifications and requirements stated herein. In the event the contractor does deviate, without the issuance of a duly executed contract modification, such deviation shall be at the risk of, and any costs related thereto shall be borne by the contractor.

5.2 Contracting Officer’s Representative: The Contracting Officer’s Representative

(COR) is limited to providing day-to-day program specific clarification to the contractor's

Task Leader and does not have the authority to take any action, either directly or indirectly, that would change the pricing, quality, place-of-performance, delivery schedule, or any other terms and conditions or scope of the resulting contract. If the contractor perceives that any Government employee is requesting an effort outside the existing scope of this contract, the contractor shall promptly notify the Contracting Officer in writing before proceeding. No action shall be taken by the contractor under such direction until the Contracting Officer has issued a contractual change or otherwise resolved the issue.

Attachments:

Dev400_template

Dev401_template

Dev403_template

Dev405_template

Dev406_template

Dev409_template

Dev410_template

DEVDOC_101 PowerPoint Brief

QASP_PRS

System Engineering Technical Review (SETR) Handbook

Contracts Data Requirements List (CDRLS)

Systems-Sub-systems-Specifications (SSS)

Requirements Traceability Matrix (RTM)

Appendix A: APPLICABLE DOCUMENTS AND STANDARDS

Joint Interoperability Test Command Approved Products List: The Approved Products List

(APL) is the only list of DoD approved equipment to be fielded in DoD networks. DoD components are required to fulfill their system needs by purchasing only APL listed products, providing one of the listed products meets their needs. This means the APL shall be consulted prior to purchasing the provided NAC system or product. If no listed product meets the organization’s needs, they may sponsor a product for testing that does meet their needs. Joint

Interoperability Test Command (JITC) testing ensures interoperability between NAC appliances and specific network switches. All contractor proposed NAC hardware and software shall be listed on the APL prior to system acceptance.