M67854-16-R-4001.pdf

SEE ADDENDUM

(No Collect Calls)

M67854-16-R-4001 20-Sep-2016

b. TELEPHONE NUMBER 8. OFFER DUE DATE/LOCAL TIME

10:00 AM 11 Oct 2016

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

M678549. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED ORX

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

MCSC CONTRACTING OFFICES

CODE CT

2200 LESTER STREET

QUANTICO VA 22134-6050

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE 16. ADMINISTERED BY

SEE SCHEDULE

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$27,500,000

NAICS:

541519

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF111

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES MAX

QUANTITY

UNIT UNIT PRICE MAX AMOUNT

0001 1 Lot

PAC/ Initial Design

FFP

Contractor shall provide supplies and services in accordance with PWS 3.1.1.

Ordering Period:

Date of award - 2 Months

FOB: Destination

MAX

NET AMT

UNIT UNIT PRICE MAX AMOUNT

0002 1 Lot

NIR/System Final Design

FFP

Contractor shall provide supplies and services in accordance with PWS 3.1.3.

3.1.4., 3.2., 3.2.1, 3.2.2., 3.3.4.

Ordering Period: Date of award- 12 months

UNIT UNIT PRICE MAX AMOUNT

0003 48 Months

Program Management

FFP

Contractor shall provide supplies and services in accordance with PWS 3.1., 3.1.2., 3.1.

Ordering Period: Date of Award- 36 Months

UNIT UNIT PRICE MAX AMOUNT

0004 1 Lot

Facility Assessment: MITSC NCR & MCNOSC

FFP

Contractor shall provide supplies and services in accordance with PWS 3.2.6.

(This CLIN includes all travel costs)

UNIT UNIT PRICE MAX AMOUNT

0005 1 Lot

Facility Assessment: MITSC HQMC

FFP

UNIT UNIT PRICE MAX AMOUNT

0006 1 Lot

Facility Assessment: MITSC East

FFP

Ordering Period:Date of Award- 36 Months

UNIT UNIT PRICE MAX AMOUNT

0007 1 Lot

Facility Assessment: MITSC West

FFP

UNIT UNIT PRICE MAX AMOUNT

0008 1 Lot

Facility Assessment: MITSC Mid-Pac

FFP

UNIT UNIT PRICE MAX AMOUNT

0009 1 Lot

Facility Assessment: MITSC West-Pac

FFP

UNIT UNIT PRICE MAX AMOUNT

0010 1 Lot

Facility Assessment: MITSC EUR

FFP

UNIT UNIT PRICE MAX AMOUNT

0011 1 Lot

Facility Assessment: MITSC Res

FFP

UNIT UNIT PRICE MAX AMOUNT

0012 1 Lot

Installation/Testing/Operator Training

Installation/Testing/Operator Training: MITSC NCR & MCNOSC

Contractor shall provide supplies and services in accordance with PWS 3.2.5, 3.3.1., 3.3.2., 3.3.3., 3.4.1, 3.5., 3.5.1., 3.5.3., 3.5.4.

UNIT UNIT PRICE MAX AMOUNT

0013 1 Lot

Installation/Testing/Operator Training

Installation/Testing/Operator Training: MITSC HQMC

UNIT UNIT PRICE MAX AMOUNT

0014 1 Lot

Installation/Testing/Operator Training

Installation/Testing/Operator Training: MITSC East

UNIT UNIT PRICE MAX AMOUNT

0015 1 Lot

Installation/Testing/Operator Training

Installation/Testing/Operator Training: MITSC West

UNIT UNIT PRICE MAX AMOUNT

0016 1 Lot

Installation/Testing/Operator Training

Installation/Testing/Operator Training: MITSC Mid-Pac

UNIT UNIT PRICE MAX AMOUNT

0017 1 Lot

Installation/Testing/Operator Training

Installation/Testing/Operator Training: MITSC West-Pac

UNIT UNIT PRICE MAX AMOUNT

0018 1 Lot

Installation/Testing/Operator Training

Installation/Testing/Operator Training: MITSC EUR

UNIT UNIT PRICE MAX AMOUNT

0019 1 Lot

Installation/Testing/Operator Training

Installation/Testing/Operator Training: MITSC Res

UNIT UNIT PRICE MAX AMOUNT

0020 1 Lot

System Administration Training

System Administration Training: MITSC NCR & MCNOSC

Contractor shall provide supplies and services in accordance with PWS 3.5., 3.5.2., 3.5.3.

UNIT UNIT PRICE MAX AMOUNT

0021 1 Lot

System Administration Training

System Administration Training: MCI West

Contractor shall provide supplies and services in accordance with PWS 3.5., 3.5.2., 3.5.3.

UNIT UNIT PRICE MAX AMOUNT

0022 1 Lot

Design: MITSC NCR & MCNOSC

FFP

The Contractor shall provide all supplies and services in accordance with PWS

3.2.3., 3.2.4.

UNIT UNIT PRICE MAX AMOUNT

0023 1 Lot

Design: MITSC HQMC

FFP

UNIT UNIT PRICE MAX AMOUNT

0024 1 Lot

Design: MITSC East

FFP

UNIT UNIT PRICE MAX AMOUNT

0025 1 Lot

Design: MITSC West

FFP

UNIT UNIT PRICE MAX AMOUNT

0026 1 Lot

Design: MITSC Mid-Pac

FFP

UNIT UNIT PRICE MAX AMOUNT

0027 1 Lot

Design: MITSC West-Pac

FFP

UNIT UNIT PRICE MAX AMOUNT

0028 1 Lot

Design: MITSC EUR

FFP

UNIT UNIT PRICE MAX AMOUNT

0029 1 Lot

Design: MITSC Res

FFP

SThe Contractor shall provide all supplies and services in accordance with PWS

UNIT UNIT PRICE MAX AMOUNT

0030 UNDEFINED Lot

NAC hardware and initial warranty

FFP

3.2.5

UNIT UNIT PRICE MAX AMOUNT

0031 96 Months

Warranty and Maintenance

FFP

3.4.2., 3.4.3.

Ordering Period: 13 Months - 24 Months

UNIT UNIT PRICE MAX AMOUNT

0032 96 Months

Warranty and Maintenance

FFP

3.4.2., 3.4.3.

Ordering Period:

25 Months - 36 Months

UNIT UNIT PRICE MAX AMOUNT

0033 UNDEFINED Lot

Contract Data Requirements List

The contractor shall provide contract deliverables as specified IAW the PWS.

CDRLs are NSP. See Performance Work Statement, Appendix C, Contract Data

Requirements List

CDRLs beginning with A are System-level deliverables. CDRLs beginning with a B are Site-specific and shall be included in each site package.

UNIT UNIT PRICE MAX AMOUNT

0034 12 Months

Lifecycle Sustainment and Support

FFP

3.6, 3.3.4 .

Ordering Period: Date of Award- 12 Months

UNIT UNIT PRICE MAX AMOUNT

0035 12 Months

Lifecycle Sustainment and Support

FFP

Ordering Period: 13 Months - 24 Months

UNIT UNIT PRICE MAX AMOUNT

0036 24 Months

Lifecycle Sustainment and Support

FFP

Ordering Period: 25 - 36 Months

Performance Work Statement (PWS)

For

Network Access Control, Compliance and Remediation (NACCR)

1. Background: Commander, Marine Forces Cyber (COMMARFORCYBER) issued an Urgent Universal Needs

Statement (U-UNS) for an enhanced Network Access Control (NAC) solution.

The United States Marine Corps (USMC) employs “port based security” today as an initial mitigation step to preclude unauthorized assets from connecting to the network, however the port based security capability does not meet the criteria set forth in the applicable Defense Information Systems Agency (DISA) Security Technical

Implementation Guides (STIGs) and Security Requirement Guides (SRGs). Additionally, the port based security approach was not adopted consistently as an enterprise solution, nor does it use 802.1x authentication.

2. Scope: The scope of this PWS establishes and defines the requirements for a turn-key NACCR solution including appliance, installation, system integration, system training, system warranty and support services on the Marine Corps Enterprise Network (MCEN) for unclassified (MCEN-N) and classified (MCEN-S). The

Government requires technical expertise to document, configure, and train users, during and immediately following site installations. The NACCR solution shall support each Marine Corps Air-Ground Task Force

(MAGTF) Information Technology Service Center (MITSC) and the Marine Corps Network Operations and

Security Center (MCNOSC) as defined in Table 1. The scope of this effort includes follow-on annual lifecycle sustainment support to ensure the solution remains operational and is fully supported by manufacturer warranty

(hardware) and software assurance support (software).

This effort includes integrating a preliminary prototype model to the specified interface points and performing a pilot fielding of the NACCR solution. The prototype will be tested in a Government lab environment and will allow the Government to verify that the system can perform as intended and will not cause unintentional consequences to the network prior to placing it on the live network during the National Capital Region (NCR) pilot.

During the prototype, relevant enterprise tools will be integrated. The pilot will then allow the Government to thoroughly evaluate effectiveness of all components of the solution prior to the enterprise roll-out. The pilot instance will be evaluated to determine if the enterprise requirement must be revised.

The pilot will continue until the evaluation of the enterprise tools allows generation and refinement of system specifications, concept of employment and applicable policies.

Table 1: Regional Locations/Seat Counts

Region Regional Location MCEN-N MCEN-S

MITSC NCR &

MCNOSC

MCB Quantico, VA

9375 601

MITSC HQMC Arlington, VA 2772 959

MITSC East MCB Camp Lejeune, NC 26,434 1722

MITSC West MCB Camp Pendleton, CA 26548 1444

MITSC Mid-Pac Kaneohe Bay, HI 3977 448

MITSC West-Pac Okinawa, Japan 15207 979

MITSC EUR Panzer Kaserne, Böblingen, Germany 351 276

MITSC Res New Orleans, LA 7415 345

3. Objectives:

3.1. Program Management: The Contractor shall conduct and participate in scheduled virtual and on-site meetings, conference calls, present briefings, and provide progress overviews as indicated below.

3.1.1. Post Award Conference (PAC): The contractor shall host a multi-day PAC (no more than 5 days), in the National Capital Region at a Government specified location, within 30 calendar days after award. The contractor shall deliver a PAC agenda (CDRL A001), a presentation brief

(CDRL A002), and the documentation identified below two days prior to the PAC. A hard copy binder of the PAC deliverables shall be provided for each Government participant identified in the

CDRL. At the PAC, the contractor shall present, deliver, and be prepared to discuss the following:

- Paragraph-by-paragraph review of the awarded PWS and technical solution.

- Draft Project Plan (CDRL A006).

- Contractor roles and responsibilities.

- Preliminary system-level engineering document package (CDRL A011, A012, A013, A014, A015, A016, A017, A018, A019, A020, A029). The contractor shall complete and deliver these documents in accordance with the Writer’s Guide and Dev templates with their proposed architecture for the solution and present it at the PAC. A draft Dev 400 document is being provided as an attachment to this PWS to assist contractor’s development of proposal. The contractor shall complete and deliver applicable sections of the Dev 400 with their proposed solution architecture.

- Detailed product performance specifications for provided equipment. This includes metrics for sizing, interfacing thresholds, processing and storage capacity, and how they relate to the managed network and interfacing systems.

- Interface requirements for integrated systems. For example, if an agent is needed on

Government equipment, the details on that agent, access, etc. shall be defined.

- Preliminary allocation of identified system requirements to hardware, human and software systems/subsystems.

The Government will conduct a paragraph-by-paragraph review of the PWS in conjunction with the contractor’s technical solution as it relates to system requirements and provide comments and recommendations. The Government will provide GFI, identify the contractor staging/storage area, establish POC lists, and provide protocols and rules of conduct. Following the PAC, the contractor shall make the recommended changes to the documents presented during the meeting.

The contractor shall commence work upon approval by the COR of the draft Project Plan and preliminary system-level engineering document package. The PAC shall be documented by electronic meeting minutes (CDRL A003).

CDRL:

A001 PAC Agenda

A002 PAC Briefing Slides

A003 PAC Meeting Minutes

3.1.2. Weekly Meetings: The contractor shall conduct weekly meetings to provide and discuss status updates, findings, milestones, significant actions, issues or concerns, overall project status, and the discrepancy list. A meeting agenda (CDRL A004) shall be submitted for Government approval.

The approved agenda shall be followed for all subsequent weekly meetings. The contractor shall establish an action item log, track updates, and discuss during each weekly meeting. Additionally, a library showing critical items and work progress shall be established and maintained by the

Government throughout the life of the project. The contractor shall deliver contract deliverables to this Government secure website.

The contractor shall deliver weekly meeting minutes (CDRL A005). The primary means of conducting scheduled weekly meetings will be voice teleconference, video teleconference or collaborative website, as available. The contractor’s personnel shall participate in person, in a minimum of one weekly meeting per quarter, and provide an expanded update, as required. The

Government and the contractor will take advantage of installation site visits to conduct in person weekly meetings, where feasible.

CDRL:

A004 Weekly Meeting Agenda

A005 Weekly Meeting Minutes/Action Log

3.1.3. Project Plan: The contractor shall deliver a Project Plan for the implementation of the NACCR

Project. The plan is to fully implement the NACCR capability in accordance with the tasks contained in this PWS within 24 months of contract award date. The Project Plan shall:

a) Function as a monthly Plan of Action and Milestones (POA&M) that includes project phases for each installation location. Changes to the POA&M that effect performance will be approved by the Government prior to changes being enacted.

1. Detail work tasks and be reflective of activities and submittals including: technical reviews, planning, design documentation, site documentation, site readiness, product/solution acceptance, site acceptance, installation, configuration, testing, training, asset tagging, and closeout documentation submittals at a minimum.

2. Identify the project timeline and associated milestones. Track the progress and critical milestones of the program, including the tasks needed to complete the project.

3. Indicate the order in which the contractor proposes to perform the work and the dates on which the contractor contemplates starting and completing tasks (including acquiring materials, equipment, and utility service connections).

4. Reflect the updated project progress as percent complete values for each task and project phase.

5. Include information in the form of a progress chart and indicate task dependencies.

6. Highlight positive or negative impacts; provide details on the process to deal with unforeseen site conditions; and predict schedule slips.

b) Address a management approach and highlight actions that will be taken to mitigate risk to cost, schedule, and performance.

1. Describe the Risk Management approach and how the contractor will present project risks to the Government.

2. Identify the contractor’s approach to managing Quality Control for the project.

Identify corporate policies and how the project team will follow quality control processes to delivery products.

c) Describe the contractor’s approach to Resource Management. The approach to Resource

Management shall include program and reporting structure, organizational charts, and delivery team management. Changes in Resource Management that have impact on performance should be highlighted in Project Plan updates.

d) Describe the contractor’s approach to Configuration Management (CM). Identify how the contractor’s approach shall integrate with the Government CM process. Detail the methods of CM prior to design approval and after the Government approves the contractor design at the NIR.

e) Provide recommendations to optimize implementation based on industry best practices and lessons learned

f) Identify and provide details on the collection and analysis of system metrics to support implementation of required capabilities

g) Provide data, studies, and reports necessary or useful to demonstrate full compliance with

Federal, State, and Local environmental laws, including any known potential compliance issues associated with the system manufacturing, testing, operations, or disposal.

h) Provide Environment, Safety, and Occupational Health (ESOH) information relating to the system. Identify any ESOH risks or issues that impact project success.

i) Provide details about the lifecycle maintenance planning for end-of-life devices and applications.

CDRL: A006 Project Plan

3.1.4. Government Lab proto-type model: The prototype will be tested in a Government lab environment and will allow the Government to verify that the system can perform as intended and will not cause unintentional consequences to the network prior to placing it on the live network during the National Capital Region (NCR) pilot. The contractor shall integrate a preliminary prototype NAC model in accordance with the SubSystem Specifications (attached to PWS) to the specified enterprise tools interface points for the NACCR solution.

3.2. Design: The contractor shall provision a completely functional turn-key solution with the required programming, interfaces, hardware, software, ancillary equipment, parts, databases, and material for all identified capabilities and requirements. The contractor shall replace and correct any hardware, software, applications, data, material, and services omitted and/or installed in error associated with the NACCR implementation without additional cost or delay to the Government. The contractor also shall Engineer, Furnish, Install, Secure, and Test (EFIST) and make operational any ancillary equipment required to support this effort (such as cables, firmware, interfaces, wiring blocks, applications, and racking) to provide a complete solution.

3.2.1. Technical Reviews: The contractor shall be required to participate, virtually and in person, scheduled, formal and informal, Government technical reviews, including the following:

Enterprise Engineering Verification Environment (EEVE) Peer Review (EPR): This technical assessment between engineering peers at MCSC and MCNOSC is conducted to ensure the system design is fully documented and technically sound. The technical assessment provides

Government engineering concurrence of the design prior to entering any formal Technical Review

(TR) which is chaired by the Technical Authority. The contractor shall participate in the EPR providing contractor engineering and test documentation (CDRLs A011, A012, A013, A014, A015, A016, A017, A018, A019, A020, A029, A032, A033, A035, and A036) and participating in weekly reviews when documentation is provided as described in the aforementioned CDRLs. The

EPRs after PAC will act as the initial Government review and provide recommended changes, if required. Additional EPRs will be held when required prior to any formal TR. Final approval and acceptance of the engineering and test documentation will be at the TR defined in the aforementioned CDRLs.

Non-Developmental Item (NDI) Integration Review (NIR): This review is conducted to ensure the system design is suitable for full enterprise implementation, demonstration, and test and can meet stated performance requirements within cost (budget) and schedule. The development of the

System-level Design Package deliverables will be iterative and the due dates staggered to allow the Government and contractor time to review and revise the design and documentation as necessary. The Government plans to hold this event approximately 60 working days after the contract award. The assessment establishes the initial product baseline and verifies the design satisfies the functional requirements. The contractor shall participate in the NACCR NIR by delivering documentation and briefing the design (CDRL A007). Briefing format will be provided as GFI after contract award.

CDRL:

A007 NIR Contractor Design Briefing Presentation

Test Readiness Review (TRR): This review validates that the system under review is ready to proceed into formal test as identified in Section 3.3.2. The contractor shall participate in the TRR.

The TRR will occur prior to System Qualification Test. The TRR assesses test objectives, test methods and procedures, scope of tests, safety and confirms that required test resources have been properly identified, made available, and coordinated to support planned tests. This review will also address the Cyber requirements and the ability of the systems to begin the accreditation process as described in Section 3.3.4. The contractor shall deliver their initial test results and readiness to proceed into Government testing (CDRL A008). The TRR shall be coordinated with the Government for an acceptable time period to perform the testing.

Additional TRR events will be held for each location prior to the Site Acceptance Event as identified in Section 3.3.3. The contractor shall brief site readiness and initial test results of the

NACCR solution prior to the Site Acceptance Test (CDRL B009).

CDRL:

A008 NACCR TRR for SQT Briefing Presentation

B009 Site Specific TRR Briefing Presentation

System Verification Review (SVR): This review validates that the system as tested has met the user requirements. The successful completion of this review signifies that the system is ready for full deployment and that the capabilities as defined are sufficient to complete the enterprise rollout. The contractor shall participate in the SVR and develop and deliver briefing materials

(A010) on design changes and test results. Format for brief will be provided as GFI.

CDRL:

A010 SVR Briefing Presentation

3.2.2. System-Level Engineering Document Package: The contractor shall develop and deliver a system-level document package and conduct a preliminary document review as part of the PAC to allow the Government to validate the drawing formats, details captured, quality, and accuracy of the information. The Government will review and comment on each of the engineering documents and provide feedback on the document package in the time between the PAC and the final design review at the NIR. The Systems Engineering Technical Review (SETR) handbook guidelines will be followed to ensure the required technical rigor is applied to the project; the Handbook outlines each Technical Review process, the entrance and exit criteria for these reviews and the expectations for acceptable system level documentation. The following is a list of the products that are part of the System-Level Engineering Document Package:

a) DEV400 is a solution architecture

b) DEV 401 is a detailed technical design, this may require multiple instances to complete the design

c) DEV403 is a detailed configuration, this may require multiple files to complete the design

d) DEV405 is a bill of materials/solution components

e) DEV406 is an operating guidelines document, this may require multiple files to complete the design

The development of these deliverables will be iterative and the due dates for delivery will be staggered to allow the Government and contractor time to review and revise the design and documentation as necessary. The contents of the deliverables are identified in CDRLs A011, A012, A013, A014, A015, A016, A017, A018, A019, and A020.

CDRL:

A011 System Architecture, NIPR, DEV400

A012 Detailed Technical Design, NIPR, DEV 401

A013 Detailed Configuration, NIPR, DEV403

A014 Bill of Materials, NIPR, DEV405

A015 Operating Guidelines, NIPR, DEV406

A016 System Architecture, SIPR, DEV400

A017 Detailed Technical Design, SIPR, DEV 401

A018 Detailed Configuration, SIPR, DEV403

A019 Bill of Materials, SIPR, DEV405

A020 Operating Guidelines, SIPR, DEV406

3.2.3. Location-Specific Engineering Document Package: The contractor shall develop a location-specific engineering document package and conduct a preliminary document review to allow the

Government to validate the drawing formats, details captured, quality, and accuracy of the information.

a) DEV 401 is a detailed technical design, this may require multiple files to complete the design

b) DEV403 is a detailed configuration, this may require multiple files to complete the design

c) DEV405 is a bill of materials

d) DEV406 is an operating guidelines document, this may require multiple files to complete the design

The development of these deliverables will be iterative and the due dates staggered to allow the

Government and contractor time to review and revise the design and documentation as necessary.

The details for the development of these deliverables for each location are identified in CDRLs

B021, B022, B023, B024, B025, B026, B027, and B028.

CDRL:

B021 Detailed Technical Design, NIPR, DEV401

B022 Detailed Configuration, NIPR, DEV403

B023 Bill of Materials, NIPR, DEV405

B024 Operating Guidelines, NIPR, DEV406

B025 Detailed Technical Design, SIPR, DEV401

B026 Detailed Configuration, SIPR, DEV403

B027 Bill of Materials, SIPR, DEV405

B028 Operating Guidelines, SIPR, DEV406

3.2.4. Implementation Plans: The contractor shall develop an Implementation Plan for the execution of the each phase of the Government rollout to include the enterprise design phase. The contractor shall detail their processes for the implementation of NACCR into the Government lab environment as a prototype evaluation for the development of the design and documentation of the enterprise solution. At the completion of the NIR, the contractor shall begin deployment of the pilot in the NCR to include the management infrastructure. The contractor shall document the time required to perform key activities and deliver required design and test documentation. The

Implementation Plans shall include contractor details on methods and procedures for the deployment, installation and transition of NACCR for the enterprise design and at each site in accordance with CDRLs A029 and B030.

CDRL:

A029 Implementation Plan, DEV410

B030 Implementation Plan, DEV410

3.2.5. Network Access Control System Requirements: The contractor shall deliver and install NAC solutions to meet the Government initial and enterprise requirements. The NAC systems shall meet the capabilities in the NACCR SSS to be fully operational. The contractor shall integrate the

NAC appliance with network timing source for time synchronization and integrate on-site interfaces for receipt and delivery of compliance and remediation activities/tasks.

3.2.6. Facility Assessment: The contractor shall conduct a Facility Assessment for each specific installation. The purpose of the Facility Assessment is to provide the contractor with an opportunity to begin development of the location-specific engineering design package. The

Facility Assessment will be arranged and coordinated between the COR, the contractor, and the site point of contact. The contractor shall deliver a Facility Assessment Report (CDRL B031) that accurately describes the existing conditions, identifies potential problem areas to include the

Government’s readiness to proceed. The Facility Assessment Report shall include a section that identifies facilities improvements required for implementation of the NAC solution. Existing drawings, diagrams, and other Government Furnished Information (GFI) will be available for review through the site point of contact during the Facility Assessment.

CDRL:

B031 Facility Assessment Report

3.3. Testing and Cybersecurity: The contractor shall perform testing and Cybersecurity of the delivered system to validate that the Government specifications have been met.

3.3.1.Product Acceptance Test: The contractor shall conduct a Product Acceptance Test (PAT) in the Government lab environment. The PAT shall begin after the completion of Self-Assessment and remediation of vulnerabilities. The contractor shall perform PAT to verify system functional integration through the planning, conducting, and documenting of this test. The contractor shall take separate systems and subsystems identified in the NACCR SSS and create the necessary interfaces between them to build a cohesive NAC system as identified in the performance objectives of the approved test plan. The interaction among the systems and subsystems is the focus during this test. All available interfaces shall be integrated and tested to verify intended functionality in this test phase. The contractor shall use simulated, functionally equivalent interfaces to represent interfaces external to the provided solution for Product Acceptance. The contractor shall document their approach to demonstrate that all simulated interfaces are adequate in the test plan (CDRL A032). The Government will provide the contractor access to the test facility during the PAT period. The contractor shall provide personnel to administer the system under test. The contractor shall provide personnel to conduct and document PAT results.

The Product Acceptance shall simulate operational testing to demonstrate and validate system configuration and proposed operational capabilities (CDRL A033).

The role of the Government during Product Acceptance is to validate the results of Product

Acceptance and provide Government oversight regarding the planning, conduct, and documentation of Product Acceptance (CDRL A034).

CDRL:

A032 PAT Plan, DEV409

A033 PAT Procedures/Scenarios, TST509

A034 PAT Report

3.3.2.System Qualification Test (SQT): The SQT will be performed on the operational network, the

SQT will demonstrate to the Government that system requirements have been met. The SQT covers the system requirements in the specification and associated interface control documents.

The SQT will commence after the successful completion of a TRR. The contractor shall assist the Government evaluation of the solution at the completion of the Independent Verification and

Validation (IV&V) by interpreting how test results and operational events meet each stated requirement in the SubSystem Specification (SSS) and the Requirements Traceability Matrix

(RTM) After an acceptable TRR outcome, the Government will validate that the NACCR solution meets the performance specifications identified in the NACCR SSS and this PWS. The contractor shall provide initial test plans (CDRL A035), procedures and scenarios (CDRL

A036).

CDRL:

A035 SQT Plan

A036 SQT Procedures/Scenarios

3.3.3.Site Acceptance Test: The Site Acceptance Test (SAT) is a per installation test, to include base personnel, performing scenarios that validate the required operational capabilities. Operational testing on the actual system will lead to the required certifications to authorize the system operations and connections to the base IP network. The contractor shall create site specific test plans, procedures and reports for each SAT. The contractor shall present preliminary test results as part of each site-specific TRR prior to the beginning of the test event. The SAT shall include:

a. Specification Validation: The data gathered from this process shall be validated against the NACCR SSS.

b. Cybersecurity: The system shall be scanned to verify the Cyber compliance of the system. If vulnerabilities were found during prior test events, the mitigation steps shall be verified at the installation prior and/or during SAT to ensure that the system meets

Cybersecurity standards.

At the completion of the SAT, the system will begin a 30-calendar day burn-in. The 30-day burn-in will allow the contractor to perform any remediation activities or correct deficiencies identified by the Government. At the completion of the 30-day burn-in, if the deficiencies have been remediated, the Government will formally accept the system as delivered by the contractor and the warranty will begin after the PCA.

CDRL:

B037 SAT Plan

B038 SAT Procedures/Scenarios

B039 SAT Report

3.3.4.Cybersecurity: Marine Corps Order (MCO) 5239.2B establishes an information systems lifecycle management approach to protect critical Marine Corps information. The contractor shall execute to the MCO requirements within this order and in accordance with the latest releases or revisions of the cybersecurity policies located in Appendix A. NACCR will attain and maintain an Authority-To-Operate (ATO) as required by DoDI 8510.01 Risk Management

Framework (RMF) for DoD Information Technology, 24 May 2016. The contractor shall have knowledge of and perform all activities necessary for system Assessment and Authorization

(A&A) as directed by the RMF for DoD IT and MARCORSYSCOM Systems Engineering, Interoperability, Architectures and Technologies (SIAT) RMF Process Guide Version 1.0, 25

May 2016. The current A&A strategy includes attaining an IATT prior to Pilot Phase start date and ATO prior to Pilot Phase end date. Unless specified in the CDRL, contractor format is acceptable.

The contractor shall:

1) Attain and maintain the NACCR IATT and ATO to include create, review and update A&A documentation required for the system as defined by RMF policy and MCSC RMF process guide (CDRL A040, A041, A042, A043, A044, A045, A046, A047, A048, A055, A056, B057, B058, B059, B060, B061, A062);

2) Use the current Government cybersecurity support tool, Marine Corps Certification and Support

Tool (MCCAST) V2, to create, deliver, maintain, and review A&A documentation and workflow;

3) Harden and configure NACCR in accordance with Defense Information Systems Agency

(DISA) Security and Technical Implementation Guides (STIG) to include automated and manual settings. Applicable STIGs (GFI) will be based on the vendor provided material solution to this solicitation (CDRL B059, B060);

4) Identify and provide technical subject matter expertise on remediation and mitigation of all open findings from DISA STIGs. The contractor shall incorporate open STIG findings into the

Government-provided Plan of Action and Milestones (POA&M) format. STIG open findings are defined as: CAT I, CAT II, and CAT III. All CAT I, II, and III open findings shall be remediated, configured, or mitigated. If any open STIG finding adversely affects system functionality, then a Government acceptable mitigation (i.e., current processes or measures that reduce vulnerability exposure) shall be provided in the POA&M with recommended completion dates (CDRL B061);

5) Conduct weekly credentialed scans using the current DoD-approved vulnerability scanning tool

(Assured Compliance Assessment Solution (ACAS)) (CDRL B057, B058);

6) Conduct ACAS scans using the DISA Field Security Operations (FSO) scan policy (GFI) and latest ACAS plugin definitions available on the DoD Patch Repository (GFI) (CDRL B057, B058);

7) Conduct all ACAS scans with proper credentials (CDRL B057, B058);

8) Identify and provide technical subject matter expertise on remediation and mitigation of all open findings from ACAS scans. The contractor shall incorporate open ACAS findings in the

Government-provided POA&M format. ACAS open finding are defined as Critical/High

Severity = CAT I, Medium Severity = CAT II, and Low Severity = CAT III. All CAT I, II, and

III open findings shall be remediated, configured, or mitigated. If any open ACAS finding adversely affects system functionality, then a Government acceptable mitigation (i.e., current processes or measures that reduce vulnerability exposure) shall be provided in the POA&M with recommended completion dates (CDRL B061);

9) Plan, facilitate, and provide technical subject matter expertise for in all annual cybersecurity requirements to include Annual Security Reviews, Annual Security Control testing, and Annual

Contingency Plan testing in compliance with the Federal Information Security Management Act

(FISMA) (CDRL A049, A050, A051, A052, A053, A054);

10) Create, review, and update all NACCR cybersecurity-related documentation. Provide documentation to properly authorized individuals (CDRL A040, A041, A042, A043, A044, A045, A046, A047, A048, A049, A050, A051, A052, A053, A054, A055, A056, B057, B058, B059, B060, B061, A062);

11) Analyze, test and apply all Information Assurance Vulnerability Alerts (IAVAs), Information

Assurance Vulnerability Bulletins (IAVBs), security updates and patches to software and operating systems (CDRL A047, A048);

12) Implement a system for the assessment, remediation, tracking, and reporting of system vulnerabilities per Information Assurance Vulnerability Management (IAVM) Program and

Operational Directives (OPDIRs) (CDRL A048);

13) Implement cybersecurity best practices in accordance with National Institute of Standards and

Technology (NIST) Special Publication (SP) 800-53 Revision 4 to maintain and improve the security posture of NACCR to include software quality code reviews and penetration tests

(CDRL A044);

14) Conduct cybersecurity risk analysis to include identification and mitigation of cyber security risks to NACCR system (CDRL A062);

15) Implement system software that is registered in the Department of the Navy Application and

Database Management System (DADMS) and approved for Marine Corps use (CDRL A041);

16) Analyze and implement NACCR Ports, Protocols, and Services (PPS) according to DoDI

8551.01 Ports, Protocols, and Services Management (PPSM) (CDRL A042);

17) Plan and evaluate NACCR to the National Information Assurance Partnership (NIAP)

Protection Profile: Enterprise Security Management – Access Control standard;

18) Complete annual Cybersecurity Awareness training and provide certificates to the Government

ISSM;

19) Provide on-site technical subject matter expertise for the full duration of scheduled Self-

Assessment and Independent Verification and Validation (IV&V) events. The contractor shall develop test plans, review system security documentation, perform vulnerability and Secure

Content Automated Protocol (SCAP) scans, review vulnerability and SCAP scan results, analyze and configure STIG settings, review STIG compliance results, evaluate test results, prepare and review POA&Ms, and remediate/mitigate findings (CDRL A055, A056, B057, B058, B059, B060, B061, A062);

20) Provide on-site technical subject matter expertise for the full duration of scheduled Command

Cyber Readiness Inspection (CCRI) events. The contractor shall develop test plans, review system security documentation, perform vulnerability and SCAP scans, review vulnerability and

SCAP scan results, analyze and configure STIG settings, review STIG compliance results, evaluate test results, prepare and review POA&Ms, and remediate/mitigate findings (CDRL

A049, A051, A053, A055, B057, B058, B059, B060, B061).

CDRL:

A040 RMF Categorization Memorandum for the Record (MFR)

A041 Hardware/software baseline artifact

A042 Ports, Protocols, and Services (PPS) artifact

A043 Network Diagram with A&A boundary

A044 Information Security Continuous Monitoring (ISCM) Strategy

A045 Cybersecurity Strategy

A046 Service Level Agreements or Memorandum of Agreements

A047 Information Assurance Vulnerability Management (IAVM) Plan

A048 IAVA/OPDIR Status Report

A049 Annual Security Review Test Plan

A050 Annual Security Review Report

A051 Annual Contingency Exercise Test Plan

A052 Annual Contingency Exercise Report

A053 Annual Security Control Test Plan

A054 Annual Security Control Test Report

A055 Self-Assessment Test Plan

A056 Self-Assessment Test Report

B057 ACAS Scan Report

B058 Vulnerability Scan files (.nessus files)

B059 STIG checklists

B060 SCAP files (XXCDF xml files)

B061 POA&M

A062 Risk Assessment Report

3.4. Installation Services & Support: The contractor shall satisfy all applicable Department of Defense

(DoD) and commercial standards, Appendix A, for installation, commissioning, physical security and

Cyber Security of the delivered system. Contractor personnel who perform on-site implementation and integration shall be DODI 8140 IASAE Level II certified. The contractor shall perform system configuration, marking, delivery, warranty and support as described below. The contractor shall provide system warranty, software upgrades and support services for one year for each delivered system beginning after site acceptance. The contractor provided solution shall be executed IAW the local seismic zone requirements, where applicable.

The contractor shall use and retain personnel who are fully trained and certified to perform the specified activities during development, testing, installation and warranty period of the procured systems. The contractor shall maintain sufficient access to manufacturer’s recommended spare parts during the performance period of the contract.

3.4.1. Site Implementation: The contractor shall EFIST and make operational a fully functional, turn-key, NAC system and an administration terminal. This implementation shall include programming, installation, applications, data transfer/migration and entry, hardware, software, ancillary equipment, parts, training, and material for all identified services and requirements. The system shall be capable of performing those functions and operating standards identified in

Appendix A. The contractor shall replace and correct equipment, software, applications, data, material, and services omitted and/or installed in error without additional cost or delay to the

Government. The contractor shall EFIST and make operational any ancillary equipment, software, and services required to support this effort. Table 1 identifies potential locations for the system to be installed.

3.4.2. Warranty Support: The contractor shall provide as a guarantee that their product will continue to operate at its advertised level of performance. The contractor shall provide Warranty and

Maintenance support. The contractor shall facilitate replacement with new OEM parts at the time of failure. The contractor shall repair or replace the item at the contractor's expense provided the failure was a manufacturer’s defect. The contractor shall begin the warranty period upon

Government acceptance of each site. The contractor shall provide details of their warranty agreement (CDRL A063) to the Government to include, at a minimum:

1) Specific terms of agreement

2) Lowest replaceable unit

3) Self-repair options

4) Upgrade procedures

5) Equipment recall procedures

6) Preferred shipping method

CDRL:

A063 Warranty Instructions

3.4.3. Monthly Maintenance Report (MMR): The contractor shall deliver a MMR to the Government

COR. The report shall cover the entire preceding month activities and shall be delivered on the fifth day of every month. This report contains all helpdesk activity related to services in support of NACCR equipment and if no calls are received, the contractor shall generate a negative report indicating no activity to report for that period. Reports shall include any unresolved issues from preceding months until the reported issue has been resolved.

CDRL:

A064 Monthly Maintenance Report

3.4.4. Unique Item Identifier (UII) Requirement: The contractor shall affix a Unique Item

Identification (UII) label to each item, including all affixed cards, as identified in DFARS Clause

252.211-7003 regardless of the unit cost. The Contractor shall deliver an UII report, identifying

UII parent and child relationships if appropriate. If an end-item fails, the contractor shall re-serialize the replacement end-item to match that of the failed item. The contractor shall transfer warranty to the new (replacement) item.

CDRL:

B065 UII Report

3.4.5. Packaging, Handling and Shipping: The contractor shall perform packaging, handling and shipping in accordance with MIL-STD-129.

3.4.6. Disposal: The contractor shall identify as part of the design (CDRLs A019, and B027) system drives that store classified data. Disposal and destruction of classified hard drives, electronic media, processing equipment components, and the like will be accomplished in accordance with

CNSSI 4004.1, and applicable security controls.

3.4.7. Counterfeit Parts Program and Diminishing Manufacturing Sources and Material

Shortages: The contractor shall ensure that no counterfeit parts (i.e., gray market) are provided as replacement parts, or as part of the equipment delivered under this contract IAW DODI 4140.67 and DFARS 252.246-7007.

3.5. Training: The contractor shall provide formal training for all new systems provided under this PWS. All training shall be conducted during the installation phase, and prior to system cutover for each location.

The contractor shall prepare and provide a draft Training Plan (CDRL B066) to include course descriptions, syllabuses, and training schedules for all locations. The contractor shall provide manufacturer certified courses tailored for operation and maintenance for the USMC NACCR solution.

The contractor shall provide each student a Certificate of Completion after successful completion of the course(s). The contractor shall deliver Training Manuals which include data and documents to effectively guide the personnel through the Operator Training Course and the Systems Administration Training

Course. The contractor shall deliver training materials meeting the following requirements:

a. Describe and detail the functional operation of the system within the MCEN.

b. Detail specific instructions for administering and operating the systems within the MCEN to include interfaces with the systems identified in the NACCR System/Subsystem

Specification (SSS) and the endpoint asset.

c. Provide sufficient written and audio visual instruction including text, graphs, charts, troubleshooting checklist, and images to effectively guide the trainees through the installation, configuration, setup, operation and maintenance of the NACCR solution.

d. Contain training scenarios as deemed appropriate by the contractor and approved by the

Government.

CDRL:

B066 Training Plan

3.5.1.Operator Training: The contractor shall provide Operator Training course materials and perform training which shall include:

a. Material, equipment, and hardware information specific to the MCEN NACCR solution.

b. Functional operation of the system including all operating modes.

c. Operator commands.

d. Database entry where applicable.

e. Reports generation.

f. Event monitoring.

g. Diagnostics and basic troubleshooting.

h. Operator preventive maintenance procedures.

i. User/operator and maintenance guides, how-tos and checklists.

j. Conducting hands-on training for target audiences in the use and operation of the NACCR solution.

3.5.2.System Administrator Training: The contractor shall provide System Administrator course materials and perform training which shall:

a. Include instruction on the specific hardware and software configurations of the system within the MCEN and MITSC architecture, environments and interfaces.

b. Include specific instructions for administering and operating the system within the MCEN.

c. Provide each student the ability to start the system, operate the system, configure the system, recover the system after a failure, and describe the specific hardware and software architectures and operation of the system.

d. Include user/operator and maintenance guides, how-tos and checklists on the administration of the NACCR solution.

e. Conduct hand-on training for target audiences in the use and administration of the NACCR solution.

3.5.3.Training Documentation: The contractor shall deliver NACCR Technical Manuals (CDRL

B067) for all new systems delivered.

The contractor shall deliver all necessary materials, documentation, manuals, and training aids at the commencement of training. Training material (CDRLs B068, B069) shall be provided to each training attendee in hard copy and electronic formats. See Table 2 for estimated student quantities for each location.

Table 2 – Estimated Student Quantities

Location

Estimated

Number of

Students

MITSC NCR/MCNOSC 30-40

MITSC West 8-10

MITSC East 8-10

MITSC Mid-Pac 8-10

MITSC Wes-Pac 8-10

MITSC HQMC 8-10

MITSC Reserves 8-10

MITSC Europe 8-10

Technical Manuals shall:

a. Provide step-by-step instruction for NACCR deployment, configuration, integration, monitoring, troubleshooting, operation, management and updating of systems and subsystems.

b. Include enterprise and regional NACCR workflow(s), sketches and interfaces.

c. Detail instructions for NACCR installation at each region.

d. Detail…