NACCR_Amendment_0001_(MOD_DOC)_10-6_NRJ_RELEASED.pdf

M67854-16-R-4001

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this modif ication is to change the proposal due date, update the PWS and CDRLs, and to include questions and answ ers.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 46

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 06-Oct-2016

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X M67854-16-R-4001

X 9B. DATED (SEE ITEM 11)

20-Sep-2016

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer X is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

06-Oct-2016

CODE

MARINE CORPS SYSTEMS COMMAND - CT MC3

ATTN: NORENE JONES

2200 LESTER STREET

QUANTICO VA 22134-6050

M67854 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

SOLICITATION/CONTRACT FORM

The required response date/time has changed from 11-Oct-2016 10:00 AM to 20-Oct-2016 10:00 AM.

The following have been modified:

ATTACHMENTS

1. System/Subsystems Specification (SSS)

2. Requirements Traceability Matrix (RTM)

3. DEVDOC_Writers Guide (PDF)

4. DEVDOC_101 PowerPointBrief

5. Dev400_draft

6. Dev400_template

7. Dev401_template

8. Dev403_template

9. Dev405_template

10. Dev406_template

11. Dev409_template

12. TST509_template

13. Dev410_template

14. QASP_PRS

15. MARCORSYSCOM Systems Engineering, Interoperability, Architectures and Technologies

(SIAT) RMF Process Guide Version 1.0, 25 May 2016

Exhibits:

See Performance Work Statement, Appendix C, Contract Data Requirements List

PERFORMANCE WORK STATEMENT

Performance Work Statement (PWS) For

Network Access Control, Compliance and Remediation (NACCR)

1. Background: Commander, Marine Forces Cyber (COMMARFORCYBER) issued an Urgent Universal Needs Statement (U-UNS) for an enhanced Network Access Control (NAC) solution.

The United States Marine Corps (USMC) employs “port based security” today as an initial mitigation step to preclude unauthorized assets from connecting to the network, however the port based security capability does not meet the criteria set forth in the applicable Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) and Security Requirement Guides (SRGs). Additionally, the port based security approach was not adopted consistently as an enterprise solution, nor does it use 802.1x authentication.

2. Scope: The scope of this PWS establishes and defines the requirements for a turn-key NACCR solution including appliance, installation, system integration, system training, system warranty and support services on the Marine Corps Enterprise Network (MCEN) for unclassified (MCEN-N) and classified (MCEN-S). The Government requires technical expertise to document, configure, and train users, during and immediately following site installations. The NACCR solution shall support each Marine Corps Air-Ground Task Force (MAGTF) Information Technology Service Center (MITSC) and the Marine Corps Network Operations and Security Center (MCNOSC) as defined in Table 1. The scope of this effort includes follow-on annual lifecycle sustainment support to ensure the solution remains operational and is fully supported by manufacturer warranty (hardware) and software assurance support (software).

This effort includes integrating a preliminary prototype model to the specified interface points and performing a pilot fielding of the NACCR solution. The prototype will be tested in a Government lab environment and will allow the Government to verify that the system can perform as intended and will not cause unintentional consequences to the network prior to placing it on the live network during the National Capital Region (NCR) pilot.

During the prototype, relevant enterprise tools will be integrated. The pilot will then allow the Government to thoroughly evaluate effectiveness of all components of the solution prior to the enterprise roll-out. The pilot instance will be evaluated to determine if the enterprise requirement must be revised. Enterprise implementation will not commence until successful completion of the pilot.

The pilot will continue until the evaluation of the enterprise tools allows generation and refinement of system specifications, concept of employment and applicable policies.

Table 1: Regional Locations/Seat Counts Region Regional Location MCEN-N MCEN-S

MITSC NCR &

MCNOSC MCB Quantico, VA 9375 601

MITSC HQMC Arlington, VA 2772 959 MITSC East MCB Camp Lejeune, NC 26,434 1722 MITSC West MCB Camp Pendleton, CA 26548 1444 MITSC Mid-Pac Kaneohe Bay, HI 3977 448 MITSC West-Pac Okinawa, Japan 15207 979 MITSC EUR Panzer Kaserne, Böblingen, Germany 351 276 MITSC Res New Orleans, LA 7415 345

3. Objectives:

3.1. Program Management: The Contractor shall conduct and participate in scheduled virtual and on-site meetings, conference calls, present briefings, and provide progress overviews as indicated below.

3.1.1. Post Award Conference (PAC): The contractor shall host a multi-day PAC (no more than 5 days), in the National Capital Region at a Government specified location, within 30 calendar days after award. The contractor shall deliver a PAC agenda (CDRL A001), a presentation brief (CDRL A002), and the documentation identified below two days prior to the PAC. A hard copy binder of the PAC deliverables shall be provided for each Government participant identified in the CDRL. At the PAC, the contractor shall present, deliver, and be prepared to discuss the following:

- Paragraph-by-paragraph review of the awarded PWS and technical solution.

- Draft Project Plan (CDRL A006).

- Contractor roles and responsibilities.

- Preliminary system-level engineering document package (CDRL A011, A012, A013, A014, A015, A016, A017, A018, A019, A020, A029). The contractor shall complete and deliver these documents in accordance with the Writer’s Guide and Dev templates with their proposed architecture for the solution and present it at the PAC. A draft Dev 400 document is being provided as an attachment to this PWS to assist contractor’s development of proposal. The contractor shall complete and deliver applicable sections of the Dev 400 with their proposed solution architecture.

- Detailed product performance specifications for provided equipment. This includes metrics for sizing, interfacing thresholds, processing and storage capacity, and how they relate to the managed network and interfacing systems.

- Interface requirements for integrated systems. For example, if an agent is needed on Government equipment, the details on that agent, access, etc. shall be defined.

- Preliminary allocation of identified system requirements to hardware, human and software systems/subsystems.

The Government will conduct a paragraph-by-paragraph review of the PWS in conjunction with the contractor’s technical solution as it relates to system requirements and provide comments and recommendations. The Government will provide GFI, identify the contractor staging/storage area, establish POC lists, and provide protocols and rules of conduct. Following the PAC, the contractor shall make the recommended changes to the documents presented during the meeting.

The contractor shall commence work upon approval by the COR of the draft Project Plan and preliminary system-level engineering document package. The PAC shall be documented by electronic meeting minutes (CDRL A003).

CDRL:

A001 PAC Agenda A002 PAC Briefing Slides A003 PAC Meeting Minutes

3.1.2. Weekly Meetings: The contractor shall conduct weekly meetings to provide and discuss status updates, findings, milestones, significant actions, issues or concerns, overall project status, and the discrepancy list. A meeting agenda (CDRL A004) shall be submitted for Government approval.

The approved agenda shall be followed for all subsequent weekly meetings. The contractor shall establish an action item log, track updates, and discuss during each weekly meeting. Additionally, a library showing critical items and work progress shall be established and maintained by the Government throughout the life of the project. The contractor shall deliver contract deliverables to this Government secure website.

The contractor shall deliver weekly meeting minutes (CDRL A005). The primary means of conducting scheduled weekly meetings will be voice teleconference, video teleconference or collaborative website, as available. The contractor’s personnel shall participate in person,at a minimum one weekly meeting per quarter, and provide an expanded update, as required. The Government and the contractor will take advantage of installation site visits to conduct in person weekly meetings, where feasible. Weekly meetings will be held in the Quantico, VA area when meetings do not coincide with an installation site visit.

CDRL:

A004 Weekly Meeting Agenda A005 Weekly Meeting Minutes/Action Log

3.1.3. Project Plan: The contractor shall deliver a Project Plan for the implementation of the NACCR Project. The plan is to fully implement the NACCR capability in accordance with the tasks contained in this PWS within 24 months of contract award date. The Project Plan shall:

a) Function as a monthly Plan of Action and Milestones (POA&M) that includes project phases for each installation location. Changes to the POA&M that effect performance will be approved by the Government prior to changes being enacted.

1. Detail work tasks and be reflective of activities and submittals including: technical reviews, planning, design documentation, site documentation, site readiness, product/solution acceptance, site acceptance, installation, configuration, testing, training, asset tagging, and closeout documentation submittals at a minimum.

2. Identify the project timeline and associated milestones. Track the progress and critical milestones of the program, including the tasks needed to complete the project.

3. Indicate the order in which the contractor proposes to perform the work and the dates on which the contractor contemplates starting and completing tasks (including acquiring materials, equipment, and utility service connections).

4. Reflect the updated project progress as percent complete values for each task and project phase.

5. Include information in the form of a progress chart and indicate task dependencies.

6. Highlight positive or negative impacts; provide details on the process to deal with unforeseen site conditions; and predict schedule slips.

b) Address a management approach and highlight actions that will be taken to mitigate risk to cost, schedule, and performance.

1. Describe the Risk Management approach and how the contractor will present project risks to the Government.

2. Identify the contractor’s approach to managing Quality Control for the project.

Identify corporate policies and how the project team will follow quality control processes to delivery products.

c) Describe the contractor’s approach to Resource Management. The approach to Resource Management shall include program and reporting structure, organizational charts, and delivery team management. Changes in Resource Management that have impact on performance should be highlighted in Project Plan updates.

d) Describe the contractor’s approach to Configuration Management (CM). Identify how the contractor’s approach shall integrate with the Government CM process. Detail the methods of CM prior to design approval and after the Government approves the contractor design at the NIR.

e) Provide recommendations to optimize implementation based on industry best practices and lessons learned

f) Identify and provide details on the collection and analysis of system metrics to support implementation of required capabilities

g) Provide data, studies, and reports necessary or useful to demonstrate full compliance with Federal, State, and Local environmental laws, including any known potential compliance issues associated with the system manufacturing, testing, operations, or disposal.

h) Provide Environment, Safety, and Occupational Health (ESOH) information relating to the system. Identify any ESOH risks or issues that impact project success.

i) Provide details about the lifecycle maintenance planning for end-of-life devices and applications.

CDRL: A006 Project Plan

3.1.4. Government Lab proto-type model: The prototype will be tested in a Government lab environment and will allow the Government to verify that the system can perform as intended and will not cause unintentional consequences to the network prior to placing it on the live network during the National Capital Region (NCR) pilot. The contractor shall integrate a preliminary prototype NAC model in accordance with the SubSystem Specifications (attached to PWS) to the specified enterprise tools interface points for the NACCR solution.

3.2. Design: The contractor shall provision a completely functional turn-key solution with the required programming, interfaces, hardware, software, ancillary equipment, parts, databases, and material for all identified capabilities and requirements. The contractor shall replace and correct any hardware, software, applications, data, material, and services not in compliance with the approved NACCR implementation plan without additional cost or delay to the Government. The contractor also shall Engineer, Furnish, Install, Secure, and Test (EFIST) and make operational any ancillary equipment required to support this effort (such as cables, firmware, interfaces, wiring blocks, applications, and racking) to provide a complete solution.

3.2.1. Technical Reviews: The contractor shall be required to participate, virtually and in person, scheduled, formal and informal, Government technical reviews, including the following:

Enterprise Engineering Verification Environment (EEVE) Peer Review (EPR): This technical assessment between engineering peers at MCSC and MCNOSC is conducted to ensure the system design is fully documented and technically sound. The technical assessment provides Government engineering concurrence of the design prior to entering any formal Technical Review (TR) which is chaired by the Technical Authority. The contractor shall participate in the EPR providing contractor engineering and test documentation (CDRLs A011, A012, A013, A014, A015, A016, A017, A018, A019, A020, A029, A032, A033, A035, and A036) and participating in weekly reviews when documentation is provided as described in the aforementioned CDRLs. The EPRs after PAC will act as the initial Government review and provide recommended changes, if required. Additional EPRs will be held when required prior to any formal TR. Final approval and acceptance of the engineering and test documentation will be at the TR defined in the aforementioned CDRLs.

Non-Developmental Item (NDI) Integration Review (NIR): This review is conducted to ensure the system design is suitable for full enterprise implementation, demonstration, and test and can meet stated performance requirements within cost (budget) and schedule. The development of the System-level Design Package deliverables will be iterative and the due dates staggered to allow the Government and contractor time to review and revise the design and documentation as necessary. The Government plans to hold this event approximately 60 working days after the contract award. The assessment establishes the initial product baseline and verifies the design satisfies the functional requirements. The contractor shall participate in the NACCR NIR by delivering documentation and briefing the design (CDRL A007). Briefing format will be provided as GFI after contract award.

CDRL:

A007 NIR Contractor Design Briefing Presentation

Test Readiness Review (TRR): This review validates that the system under review is ready to proceed into formal test as identified in Section 0. The contractor shall participate in the TRR.

The TRR will occur prior to System Qualification Test. The TRR assesses test objectives, test methods and procedures, scope of tests, safety and confirms that required test resources have been properly identified, made available, and coordinated to support planned tests. This review will also address the Cyber requirements and the ability of the systems to begin the accreditation process as described in Section 0. The contractor shall deliver their initial test results and readiness to proceed into Government testing (CDRL A008). The TRR shall be coordinated with the Government for an acceptable time period to perform the testing.

Additional TRR events will be held for each location prior to the Site Acceptance Event as identified in Section 0. The contractor shall brief site readiness and initial test results of the NACCR solution prior to the Site Acceptance Test (CDRL B009).

CDRL:

A008 NACCR TRR for SQT Briefing Presentation B009 Site Specific TRR Briefing Presentation

System Verification Review (SVR): This review validates that the system as tested has met the user requirements. The successful completion of this review signifies that the system is ready for full deployment and that the capabilities as defined are sufficient to complete the enterprise rollout. The contractor shall participate in the SVR and develop and deliver briefing materials (A010) on design changes and test results. Format for brief will be provided as GFI.

CDRL:

A010 SVR Briefing Presentation

3.2.2. System-Level Engineering Document Package: The contractor shall develop and deliver a system-level document package and conduct a preliminary document review as part of the PAC to allow the Government to validate the drawing formats, details captured, quality, and accuracy of the information. The Government will review and comment on each of the engineering documents and provide feedback on the document package in the time between the PAC and the final design review at the NIR. The Systems Engineering Technical Review (SETR) handbook guidelines will be followed to ensure the required technical rigor is applied to the project; the Handbook outlines each Technical Review process, the entrance and exit criteria for these reviews and the expectations for acceptable system level documentation. The following is a list of the products that are part of the System-Level Engineering Document Package:

a) DEV400 is a solution architecture

b) DEV 401 is a detailed technical design, this may require multiple instances to complete the design

c) DEV403 is a detailed configuration, this may require multiple files to complete the design

d) DEV405 is a bill of materials/solution components

e) DEV406 is an operating guidelines document, this may require multiple files to complete the design

The development of these deliverables will be iterative and the due dates for delivery will be staggered to allow the Government and contractor time to review and revise the design and documentation as necessary. The contents of the deliverables are identified in CDRLs A011, A012, A013, A014, A015, A016, A017, A018, A019, and A020.

CDRL:

A011 System Architecture, NIPR, DEV400 A012 Detailed Technical Design, NIPR, DEV 401

A013 Detailed Configuration, NIPR, DEV403 A014 Bill of Materials, NIPR, DEV405 A015 Operating Guidelines, NIPR, DEV406 A016 System Architecture, SIPR, DEV400 A017 Detailed Technical Design, SIPR, DEV 401 A018 Detailed Configuration, SIPR, DEV403 A019 Bill of Materials, SIPR, DEV405 A020 Operating Guidelines, SIPR, DEV406

3.2.3. Location-Specific Engineering Document Package: The contractor shall develop a location-specific engineering document package and conduct a preliminary document review to allow the Government to validate the drawing formats, details captured, quality, and accuracy of the information.

a) DEV 401 is a detailed technical design, this may require multiple files to complete the design

b) DEV403 is a detailed configuration, this may require multiple files to complete the design

c) DEV405 is a bill of materials

d) DEV406 is an operating guidelines document, this may require multiple files to complete the design

The development of these deliverables will be iterative and the due dates staggered to allow the Government and contractor time to review and revise the design and documentation as necessary.

The details for the development of these deliverables for each location are identified in CDRLs B021, B022, B023, B024, B025, B026, B027, and B028.

CDRL:

B021 Detailed Technical Design, NIPR, DEV401 B022 Detailed Configuration, NIPR, DEV403 B023 Bill of Materials, NIPR, DEV405 B024 Operating Guidelines, NIPR, DEV406 B025 Detailed Technical Design, SIPR, DEV401 B026 Detailed Configuration, SIPR, DEV403 B027 Bill of Materials, SIPR, DEV405 B028 Operating Guidelines, SIPR, DEV406

3.2.4. Implementation Plans: The contractor shall develop an Implementation Plan for the execution of the each phase of the Government rollout to include the enterprise design phase. The contractor shall detail their processes for the implementation of NACCR into the Government lab environment as a prototype evaluation for the development of the design and documentation of the enterprise solution. At the completion of the NIR, the contractor shall begin deployment of the pilot in the NCR to include the management infrastructure. The contractor shall document the time required to perform key activities and deliver required design and test documentation. The Implementation Plans shall include contractor details on methods and procedures for the deployment, installation and transition of NACCR for the enterprise design and at each site in accordance with CDRLs A029 and B030.

CDRL:

A029 Implementation Plan, DEV410 B030 Implementation Plan, DEV410

3.2.5. Network Access Control System Requirements: The contractor shall deliver and install NAC solutions to meet the Government initial and enterprise requirements. The NAC systems shall meet the capabilities in the NACCR SSS to be fully operational. The contractor shall integrate the

NAC appliance with network timing source for time synchronization and integrate on-site interfaces for receipt and delivery of compliance and remediation activities/tasks.

3.2.6. Facility Assessment: The contractor shall conduct a Facility Assessment for each specific installation. The purpose of the Facility Assessment is to provide the contractor with an opportunity to begin development of the location-specific engineering design package. The Facility Assessment will be arranged and coordinated between the COR, the contractor, and the site point of contact. The contractor shall deliver a Facility Assessment Report (CDRL B031) that accurately describes the existing conditions, identifies potential problem areas to include the Government’s readiness to proceed. The Facility Assessment Report shall include a section that identifies facilities improvements required for implementation of the NAC solution. Existing drawings, diagrams, and other Government Furnished Information (GFI) will be available for review through the site point of contact during the Facility Assessment.

CDRL:

B031 Facility Assessment Report

3.3. Testing and Cybersecurity: The contractor shall perform testing and Cybersecurity of the delivered system to validate that the Government specifications have been met.

3.3.1 Product Acceptance Test: The contractor shall conduct a Product Acceptance Test (PAT) in the Government lab environment. The PAT shall begin after the completion of Self-Assessment and remediation of vulnerabilities. The contractor shall perform PAT to verify system functional integration through the planning, conducting, and documenting of this test. The contractor shall take separate systems and subsystems identified in the NACCR SSS and create the necessary interfaces between them to build a cohesive NAC system as identified in the performance objectives of the approved test plan. The interaction among the systems and subsystems is the focus during this test. All available interfaces shall be integrated and tested to verify intended functionality in this test phase. The contractor shall use simulated, functionally equivalent interfaces to represent interfaces external to the provided solution for Product Acceptance. The contractor shall document their approach to demonstrate that all simulated interfaces are adequate in the test plan (CDRL A032). The Government will provide the contractor access to the test facility during the PAT period. The contractor shall provide personnel to administer the system under test. The contractor shall provide personnel to conduct and document PAT results.

The Product Acceptance shall simulate operational testing to demonstrate and validate system configuration and proposed operational capabilities (CDRL A033).

The role of the Government during Product Acceptance is to validate the results of Product Acceptance and provide Government oversight regarding the planning, conduct, and documentation of Product Acceptance (CDRL A034).

CDRL:

A032 PAT Plan, DEV409 A033 PAT Procedures/Scenarios, TST509 A034 PAT Report

3.3.2. System Qualification Test (SQT): The SQT will be performed on the operational network, the SQT will demonstrate to the Government that system requirements have been met. The SQT covers the system requirements in the specification and associated interface control documents.

The SQT will commence after the successful completion of a TRR. The contractor shall assist the Government evaluation of the solution at the completion of the Independent Verification and Validation (IV&V) by interpreting how test results and operational events meet each stated requirement in the SubSystem Specification (SSS) and the Requirements Traceability Matrix (RTM) After an acceptable TRR outcome, the Government will validate that the NACCR solution meets the performance specifications identified in the NACCR SSS and this PWS. The contractor shall provide initial test plans (CDRL A035), procedures and scenarios (CDRL A036).

CDRL:

A035 SQT Plan A036 SQT Procedures/Scenarios

3.3.3 Site Acceptance Test: The Site Acceptance Test (SAT) is a per installation test, to include base personnel, performing scenarios that validate the required operational capabilities. Operational testing on the actual system will lead to the required certifications to authorize the system operations and connections to the base IP network. The contractor shall create site specific test plans, procedures and reports for each SAT. The contractor shall present preliminary test results as part of each site-specific TRR prior to the beginning of the test event. The SAT shall include:

a. Specification Validation: The data gathered from this process shall be validated against the NACCR SSS.

b. Cybersecurity: The system shall be scanned to verify the Cyber compliance of the system. If vulnerabilities were found during prior test events, the mitigation steps shall be verified at the installation prior and/or during SAT to ensure that the system meets Cybersecurity standards.

At the completion of the SAT, the system will begin a 30-calendar day burn-in. The 30-day burn-in will allow the contractor to perform any remediation activities or correct deficiencies identified by the Government. At the completion of the 30-day burn-in, if the deficiencies have been remediated, the Government will formally accept the system as delivered by the contractor and the warranty will begin after the PCA.

CDRL:

B037 SAT Plan B038 SAT Procedures/Scenarios B039 SAT Report

3.3.4 Cybersecurity: Marine Corps Order (MCO) 5239.2B establishes an information systems lifecycle management approach to protect critical Marine Corps information. The contractor shall execute to the MCO requirements within this order and in accordance with the latest releases or revisions of the cybersecurity policies located in Appendix A. NACCR will attain and maintain an Authority-To-Operate (ATO) as required by DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology, 24 May 2016. The contractor shall have knowledge of and perform all activities necessary for system Assessment and Authorization (A&A) as directed by the RMF for DoD IT and MARCORSYSCOM Systems Engineering, Interoperability, Architectures and Technologies (SIAT) RMF Process Guide Version 1.0, 25 May 2016. The current A&A strategy includes attaining an IATT prior to Pilot Phase start date and ATO prior to Pilot Phase end date. Unless specified in the CDRL, contractor format is acceptable.

The contractor shall:

1) Attain and maintain the NACCR IATT and ATO to include create, review and update A&A documentation required for the system as defined by RMF policy and MCSC RMF process guide. (e.g., IAVM Management, OPDIR reporting, Change Management, RMF controls (implememted, inherited and hybrid)). The Service Level Agreements and Memorandums of Agreements shall document roles, responsibilites, and coordination required for management, operations, and sustainment to ensure the confidentaility, integrity, and availability of the NACCR system. (CDRL A040, A041, A042, A043, A044, A045, A046, A047, A048, A055, A056, B057, B058, B059, B060, B061, A062);

2) Use the current Government cybersecurity support tool, Marine Corps Certification and Support Tool (MCCAST) V2, to create, deliver, maintain, and review A&A documentation and workflow;

3) Harden and configure NACCR in accordance with Defense Information Systems Agency (DISA) Security and Technical Implementation Guides (STIG) to include automated and manual settings. Applicable STIGs (GFI) will be based on the vendor provided material solution to this solicitation (CDRL B059, B060);

4) Identify and provide technical subject matter expertise on remediation and mitigation of all open findings from DISA STIGs. The contractor shall incorporate open STIG findings into the Government-provided Plan of Action and Milestones (POA&M) format. STIG open findings are defined as: CAT I, CAT II, and CAT III. All CAT I, II, and III open findings shall be remediated, configured, or mitigated. If any open STIG finding adversely affects system functionality, then a Government acceptable mitigation (i.e., current processes or measures that reduce vulnerability exposure) shall be provided in the POA&M with recommended completion dates (CDRL B061);

5) Conduct weekly credentialed scans using the current DoD-approved vulnerability scanning tool (Assured Compliance Assessment Solution (ACAS)) (CDRL B057, B058);

6) Conduct ACAS scans using the DISA Field Security Operations (FSO) scan policy (GFI) and latest ACAS plugin definitions available on the DoD Patch Repository (GFI) (CDRL B057, B058);

7) Conduct all ACAS scans with proper credentials (CDRL B057, B058);

8) Identify and provide technical subject matter expertise on remediation and mitigation of all open findings from ACAS scans. The contractor shall incorporate open ACAS findings in the Government-provided POA&M format. ACAS open finding are defined as Critical/High Severity = CAT I, Medium Severity = CAT II, and Low Severity = CAT III. All CAT I, II, and III open findings shall be remediated, configured, or mitigated. If any open ACAS finding adversely affects system functionality, then a Government acceptable mitigation (i.e., current processes or measures that reduce vulnerability exposure) shall be provided in the POA&M with recommended completion dates (CDRL B061);

9) Plan, facilitate, and provide technical subject matter expertise for in all annual cybersecurity requirements to include Annual Security Reviews, Annual Security Control testing, and Annual Contingency Plan testing in compliance with the Federal Information Security Management Act

(FISMA) (CDRL A049, A050, A051, A052, A053, A054);

10) Create, review, and update all NACCR cybersecurity-related documentation. Provide documentation to properly authorized individuals (CDRL A040, A041, A042, A043, A044, A045, A046, A047, A048, A049, A050, A051, A052, A053, A054, A055, A056, B057, B058, B059, B060, B061, A062);

11) Analyze, test and apply all Information Assurance Vulnerability Alerts (IAVAs), Information Assurance Vulnerability Bulletins (IAVBs), security updates and patches to software and operating systems (CDRL A047, A048);

12) Implement a system for the assessment, remediation, tracking, and reporting of system vulnerabilities per Information Assurance Vulnerability Management (IAVM) Program and Operational Directives (OPDIRs) (CDRL A048);

13) Implement cybersecurity best practices in accordance with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 4 to maintain and improve the security posture of NACCR to include software quality code reviews and penetration tests (Peneration testing will be overt and cooperative (internal) not adversial Red Team testing (external). Intent is to identify weaknesses, validate expliotability of any weaknesses and to inform and better understand risk prior to system authorization to operate (ATO). The system will be subjected periodically to external validation including potential Red Team penetration testing.)(CDRL A044);

14) Conduct cybersecurity risk analysis to include identification and mitigation of cyber security risks to NACCR system (CDRL A062);

15) Implement system software that is registered in the Department of the Navy Application and Database Management System (DADMS) and approved for Marine Corps use (CDRL A041);

16) Analyze and implement NACCR Ports, Protocols, and Services (PPS) according to DoDI

8551.01 Ports, Protocols, and Services Management (PPSM) (CDRL A042);

17) Plan and evaluate NACCR to the National Information Assurance Partnership (NIAP) Protection Profile: Enterprise Security Management – Access Control standard;

18) Complete annual Cybersecurity Awareness training and provide certificates to the Government

ISSM;

19) Provide on-site technical subject matter expertise for the full duration of scheduled Self- Assessment and Independent Verification and Validation (IV&V) events. The contractor shall develop test plans, review system security documentation, perform vulnerability and Secure Content Automated Protocol (SCAP) scans, review vulnerability and SCAP scan results, analyze and configure STIG settings, review STIG compliance results, evaluate test results, prepare and review POA&Ms, and remediate/mitigate findings (CDRL A055, A056, B057, B058, B059, B060, B061, A062);

20) Provide on-site technical subject matter expertise for the full duration of scheduled Command Cyber Readiness Inspection (CCRI) events. The contractor shall develop test plans, review system security documentation, perform vulnerability and SCAP scans, review vulnerability and SCAP scan results, analyze and configure STIG settings, review STIG compliance results, evaluate test results, prepare and review POA&Ms, and remediate/mitigate findings (CDRL A049, A051, A053, A055, B057, B058, B059, B060, B061).

CDRL:

A040 RMF Categorization Memorandum for the Record (MFR) A041 Hardware/software baseline artifact A042 Ports, Protocols, and Services (PPS) artifact A043 Network Diagram with A&A boundary A044 Information Security Continuous Monitoring (ISCM) Strategy A045 Cybersecurity Strategy A046 Service Level Agreements or Memorandum of Agreements A047 Information Assurance Vulnerability Management (IAVM) Plan A048 IAVA/OPDIR Status Report A049 Annual Security Review Test Plan A050 Annual Security Review Report A051 Annual Contingency Exercise Test Plan A052 Annual Contingency Exercise Report A053 Annual Security Control Test Plan A054 Annual Security Control Test Report A055 Self-Assessment Test Plan A056 Self-Assessment Test Report B057 ACAS Scan Report B058 Vulnerability Scan files (.nessus files) B059 STIG checklists B060 SCAP files (XXCDF xml files)

B061 POA&M

A062 Risk Assessment Report

3.4. Installation Services & Support: The contractor shall satisfy all applicable Department of Defense (DoD) and commercial standards, Appendix A, for installation, commissioning, physical security and Cyber Security of the delivered system. Contractor personnel who perform on-site implementation and integration shall be DODI 8140 IASAE Level II certified. The contractor shall perform system configuration, marking, delivery, warranty and support as described below. The contractor shall provide system warranty, software upgrades and support services for one year for each delivered system beginning after site acceptance. The contractor provided solution shall be executed IAW the local seismic zone requirements, where applicable.

The contractor shall use and retain personnel who are fully trained and certified to perform the specified activities during development, testing, installation and warranty period of the procured systems. The contractor shall maintain sufficient access to manufacturer’s recommended spare parts during the performance period of the contract.

3.4.1. Site Implementation: The contractor shall EFIST and make operational a fully functional, turn-key, NAC system and an administration terminal. This implementation shall include programming, installation, applications, data transfer/migration and entry, hardware, software, ancillary equipment, parts, training, and material for all identified services and requirements. The system shall be capable of performing those functions and operating standards identified in Appendix A. The contractor shall replace and correct equipment, software, applications, data, material, and services omitted and/or incorreclt installed in error without additional cost or delay to the Government. The contractor shall EFIST and make operational any ancillary equipment, software, and services required to support this effort. Table 1 identifies potential locations for the system to be installed.

3.4.2. Warranty Support: The contractor shall provide as a guarantee that their product will continue to operate at its advertised level of performance. The contractor shall provide Warranty and Maintenance support. The contractor shall facilitate replacement with new OEM parts at the time of failure. The contractor shall repair or replace the item at the contractor's expense provided the failure was a manufacturer’s defect. The contractor shall begin the warranty period upon Government acceptance of each site. The contractor shall provide details of their warranty agreement (CDRL A063) to the Government to include, at a minimum:

1) Specific terms of agreement

2) Lowest replaceable unit

3) Self-repair options

4) Upgrade procedures

5) Equipment recall procedures

6) Preferred shipping method

CDRL:

A063 Warranty Instructions

3.4.3. Monthly Maintenance Report (MMR): The contractor shall deliver a MMR to the Government COR. The report shall cover the entire preceding month activities and shall be delivered on the fifth day of every month. This report contains all helpdesk activity related to services in support of NACCR equipment and if no calls are received, the contractor shall generate a negative report indicating no activity to report for that period. Reports shall include any unresolved issues from preceding months until the reported issue has been resolved.

CDRL:

A064 Monthly Maintenance Report

3.4.4. Unique Item Identifier (UII) Requirement: The contractor shall affix a Unique Item Identification (UII) label to each item, including all affixed cards, as identified in DFARS Clause 252.211-7003 regardless of the unit cost. The Contractor shall deliver an UII report, identifying UII parent and child relationships if appropriate. If an end-item fails, the contractor shall re-serialize the replacement end-item to match that of the failed item. The contractor shall transfer warranty to the new (replacement) item.

CDRL:

B065 UII Report

3.4.5. Packaging, Handling and Shipping: The contractor shall perform packaging, handling and shipping in accordance with MIL-STD-129.

3.4.6. Disposal: The contractor shall identify as part of the design (CDRLs A019, and B027) system drives that store classified data. Disposal and destruction of classified hard drives, electronic media, processing equipment components, and the like will be accomplished in accordance with CNSSI 4004.1, and applicable security controls.

3.4.7. Counterfeit Parts Program and Diminishing Manufacturing Sources and Material Shortages: The contractor shall ensure that no counterfeit parts (i.e., gray market) are provided as replacement parts, or as part of the equipment delivered under this contract IAW DODI 4140.67 and DFARS 252.246-7007.

3.5. Training: The contractor shall provide formal training for all new systems provided under this PWS. All training shall be conducted during the installation phase, and prior to system cutover for each location.

The contractor shall prepare and provide a draft Training Plan (CDRL B066) to include course descriptions, syllabuses, and training schedules for all locations. The contractor shall provide manufacturer certified courses tailored for operation and maintenance for the USMC NACCR solution.

The contractor shall provide each student a Certificate of Completion after successful completion of the course(s). The contractor shall deliver Training Manuals which include data and documents to effectively guide the personnel through the Operator Training Course and the Systems Administration Training Course. The contractor shall deliver training materials meeting the following requirements:

a. Describe and detail the functional operation of the system within the MCEN.

b. Detail specific instructions for administering and operating the systems within the MCEN to include interfaces with the systems identified in the NACCR System/Subsystem Specification (SSS) and the endpoint asset.

c. Provide sufficient written and audio visual instruction including text, graphs, charts, troubleshooting checklist, and images to effectively guide the trainees through the installation, configuration, setup, operation and maintenance of the NACCR solution.

d. Contain training scenarios as deemed appropriate by the contractor and approved by the Government.

CDRL:

B066 Training Plan

3.5.1 Operator Training: The contractor shall provide Operator Training course materials and perform training which shall include:

a. Material, equipment, and hardware information specific to the MCEN NACCR solution.

b. Functional operation of the system including all operating modes.

c. Operator commands.

d. Database entry where applicable.

e. Reports generation.

f. Event monitoring.

g. Diagnostics and basic troubleshooting.

h. Operator preventive maintenance procedures.

i. User/operator and maintenance guides, how-tos and checklists.

j. Conducting hands-on training for target audiences in the use and operation of the NACCR solution.

3.5.2 System Administrator Training: The contractor shall provide System Administrator course materials and perform training which shall:

a. Include instruction on the specific hardware and software configurations of the system within the MCEN and MITSC architecture, environments and interfaces.

b. Include specific instructions for administering and operating the system within the MCEN.

c. Provide each student the ability to start the system, operate the system, configure the system, recover the system after a failure, and describe the specific hardware and software architectures and operation of the system.

d. Include user/operator and maintenance guides, how-tos and checklists on the administration of the NACCR solution.

e. Conduct hand-on training for target audiences in the use and administration of the NACCR solution.

3.5.3 Training Documentation: The contractor shall deliver NACCR Technical Manuals (CDRL B067) for all new systems delivered.

The contractor shall deliver all necessary materials, documentation, manuals, and training aids at the commencement of training. Training material (CDRLs B068, B069) shall be provided to each training attendee in hard copy and electronic formats. See Table 2 for estimated student quantities for each location.

Table 2 – Estimated Student Quantities

Location Estimated Number of Students

MITSC NCR/MCNOSC 30-40

MITSC West 8-10 MITSC East 8-10 MITSC Mid-Pac 8-10 MITSC Wes-Pac 8-10

MITSC HQMC 8-10

MITSC Reserves 8-10 MITSC Europe 8-10

Technical Manuals shall:

a. Provide step-by-step instruction for NACCR deployment, configuration, integration, monitoring, troubleshooting, operation, management and updating of systems and subsystems.

b. Include enterprise and regional NACCR workflow(s), sketches and interfaces.

c. Detail instructions for NACCR installation at each region.

d. Detail troubleshooting activities with technical instructions

e. Provide Preventive and Corrective maintenance procedures.

f. Help Desk Support and procedures.

g. Detailed System Architecture

h. Warranty Instructions

CDRL:

B067 NACCR Technical Manual(s) B068 Operator Training Materials B069 Administrator Training Materials

3.5.4 Manpower, Personnel and Training (MPT): The contractor shall deliver NACCR solution MPT impacts for all new systems provided under this PWS. MPT Impact analysis shall include:

a. NACCR Manpower and Personnel impacts and changes in force mix across the Enterprise (CDRL A070).

b. NACCR Job Task Analysis (CDRL A071).

c. NACCR Workload Analysis (CDRL A072).

CDRL:

A070 Manpower and Personnel Impact Analysis A071 Job Task Analysis A072 Workload Analysis

3.6. Lifecycle Sustainment and Support: The contractor shall provide sustainment and support services to maintain NACCR on the MCEN-N and MCEN-S. This support shall include on-site personnel located at a government facility in Quantico, VA, however, there may be twice a year travel for one week to Camp Pendleton, CA. The contractor shall use industry best practices and NACCR product knowledge to perform troubleshooting activities, documentation updates, configuration management of policy updates, preventive and corrective maintenance, and assisting in problem resolution. The contractor shall perform vulnerability scans, remediation and mitigation activities to maintain the ATO. Contractor personnel who have privileged access on the MCEN shall be DODI 8140 IAT Level II certified. The contractor shall deliver a Post-Implementation Lifecycle Support Plan (CDRL A073) to address, at a minimum:

1. Logistics support.

2. Government change requests.

3. Manage system configuration.

4. Maintain cybersecurity posture.

5. Manage interfaces.

6. Perform system administration.

7. Recommended continuous process improvements.

8. Resolutions of preventive and corrective maintenance actions.

CDRL:

A073 Post-Implementation Lifecycle Support Plan

4. Constraints

4.1. Government Furnished Equipment (GFE): The Government anticipates providing at each site rack space for hardware included in the NACCR solution. Virtual appliances shall not be installed on existing

GFE.

4.2. Government Furnished Information (GFI): The Government anticipates having to provide information to aid the contractor in executing the contract.

4.3. Government Furnished Materials: No Government Furnished Material will be provided under this PWS. The contractor shall furnish its own computer equipment, administrative supplies, and office supplies, required for the performance of the tasking within this PWS. Contractor furnished laptops joining the MCEN must have Windows 7 – 64 bit Enterprise licenses with Office 2010 (minimum). These assets are required to be reimaged/renamed in accordance with MCEN standards. XADMIN and BIOS passwords will be changed and not shared. Assets will be configured to receive updates, patches and Group Policy settings from the MCEN (including transition to Win-10).