M67854-20-I-4905_CERS-CLS Draft PWS.pdf

MARINE CORPS SYSTEMS COMMAND

PORTFOLIO MANAGER

SUPPORTING ESTABLISHMENT SYSTEMS

NETWORKS & INFRASTRUCTURE

EMERGENCY RESPONSE SYSTEMS

PERFORMANCE WORK STATEMENT (PWS)

UNITED STATES MARINE CORPS MARINE CORPS SYSTEMS COMMAND

NETWORK AND INFRASTRUCTURE, EMERGENCY RESPONSE SYSTEMS

CONSOLIDATED EMERGENCY RESPONSE SYSTEM

CONTRACTOR LOGISTICS SUPPORT

VERSION 2.0

04 FEBRUARY 2020

CERS CLS PWS

04 FEB 2020

ii

Table of Contents

1. Introduction

1.1 Background

1.2 Scope

1.2.1 Places of performance

1.2.2 Exception to Places of Performance

2. CERS Sustainment Requirements

2.1 Subsystems

2.1.1 E911 Customer Premises Equipment

2.1.2 Computer Aided Dispatch

2.1.3 Fire Station Alerting

2.1.4 GIS/Mapping

2.1.5 Logging and Recording

2.1.6 PowerPhone (EMD)

2.1.7 Records Management System

2.1.8 Time Synchronization

2.1.9 Uninterrupted Power Supply System – Workstation and Server

2.1.10 Workstation Area

2.2 Other Interfaces

2.2.1 Enterprise Land Mobile Radio (E-LMR)

2.2.2 PSNet

2.2.3 Base Telephone Infrastructure

2.3 System Administration

2.3.1 Active Directory

2.3.2 SQL Server Administration

2.3.3 Microsoft Windows Desktop Administration

iii

2.3.4 Microsoft Windows Server Administration

2.3.5 Virtual Machine Hypervisor (vSphere ESXi)

2.4 Remote Access

2.4.1 Remote Maintenance and Administration

2.4.2 Access Support

2.4.3 Additional Remote Access Locations

2.5 Systems Integration Lab Activities

3. Performance Objectives and Standards

3.1 Program Management

3.2 Project Planning

3.3 Weekly Meetings and Status Reports

3.4 Quality Control

3.5 Systems Engineering Management Plan

3.6 Configuration Management Plan

3.7 Post Award Conference

4. Cybersecurity

4.1 System Assurance

4.2 Assessment & Authorization (A&A)

4.3 Secure System Design

4.4 Secure Maintenance and Administration

4.5 Host-Based Security System (HBSS)

4.6 Assured Compliance Assessment Solution (ACAS)

5. Engineering

5.1 In-Service Engineering

5.2 Test and Evaluation

5.3 Logistics

6. System Integration Lab Relocation

7. Maintenance

7.1 Warranty

7.2 Deficiency Reporting

iv

7.3 Diminishing Manufacturing Sources and Materiel Storages (DMSMS) Planning

7.4 Help Desk

7.5 Item Unique Identification (IUID)

8. Government Furnished Materials

8.1 Government Furnished Information (GFI) (as required, upon request)

8.2 Government Furnished Equipment

9 Special Considerations

9.1 Site Visit(s)

9.2 Security Requirements

9.3 COMMON ACCESS CARD (CAC) REQUIREMENT

9.4 Marine Corps Enterprise Network (MCEN) Computer Access

9.5 MCEN Official E-mail usage

9.6 Security Inspections

9.7 Physical Security

9.8 Photography Recording Control

9.9 Prohibited Items

9.10 Escorting Policy

9.11 Non-Personal Services

9.12 Business Relations

9.13 Contract Administration and Management

9.13.1 Labor Hours Reporting

9.13.2 Contract Management

9.13.3 Contract Administration

9.13.4 Subcontract Management

9.13.5 Personnel Administration

9.13.6 Other Direct Charges (ODCs), and Travel Requirements

v

Appendices

Definitions...................................................................................................... A-1

Acronyms ........................................................................................................ B-1

1. Introduction 1

This Performance Work Statement (PWS) for Contractor Logistics Support (CLS) identifies the 2 maintenance and sustainment tasks (i.e. design, engineering, program management, 3 preparation, replacement, installation, configuration, optimization, system certification support, 4 testing, documentation and training) required for the United States Marine Corps (USMC) 5

Consolidated Emergency Response System (CERS). 6

1.1 Background 7

Marine Corps Systems Command (MCSC), Product Manager, Emergency 8

Response Systems (PMM 170.3) was tasked with deploying CERS aboard 9 installations worldwide to bring installation emergency response systems into 10 compliance with the Secretary of Defense (SecDef) Memorandum (January 2010) 11 in reference to the Fort Hood Task Force recommendations and Secretary of the 12

Navy Policy on Emergency Calls. CERS provides Enhanced 911 (E911) 13 capabilities along with the Computer Aided Dispatch (CAD) of emergency 14 personnel and First Responders to USMC installations around the world. CERS 15 coordinates installation-organic First Responder emergency and day-to-day 16 operations. First Responders encompasses Firefighters, Law Enforcement (LE) 17 and security personnel, Emergency Medical Technicians, and Explosive 18

Ordnance Disposal personnel who provide the initial, immediate response to an 19 all-hazards incident. 20

CERS was deployed as a turnkey solution in a two-phased approach. The first 21 phase, CERS 1.0 Enhanced 911 (E911), fielded components to support E911 22 functionality (e.g., Local Area Network (LAN), furniture, E911 Customer 23

Premises Equipment (CPE)). The second phase of CERS, commonly referred to 24 as Dispatch Alarm Recording (DAR), included a turnkey Commercial Off-The-25

Shelf (COTS) Computer Aided Dispatch (CAD), integrated Geospatial mapping, 26

Fire Station Alerting (FSA), Records Management System (RMS) interface (both 27

Law Enforcement (LE) and Fire and Emergency Services (F&ES)), and 28 associated CPE. Both phases included system installation, integration and 29 implementation; system warranty and support; and system operator training. 30

These phases as completed make up the current CERS iteration. 31

1.2 Scope 32

This PWS identifies the required USMC CERS maintenance and sustainment 33 tasks (i.e. design, engineering, program management, preparation, replacement, 34 installation, configuration, optimization, system certification support, testing, 35 documentation and training). This PWS covers the contractor’s system level 36 logistical support for CERS. The contractor is responsible to provide continued 37 maintenance and sustainment for the currently installed systems, related E911 38 systems, and Systems Integration Lab (SIL), as defined in Attachment X. This 39

PWS establishes and defines the requirements for maintenance and sustainment 40 of current CERS Hardware (HW) and Software (SW) as well as the interfaces 41 required. Maintenance and sustainment include scheduled and preventive 42 maintenance of hardware, sustained operations and maintenance planning, IT 43 system administration and domain management, software patching and updating, 44

Security Technical Implementation Guide(s) (STIG) compliance, and 45 cybersecurity vulnerability assessments and scans. 46

1.2.1 Places of performance: 47

a) Huntsville, Alabama (AL) (SIL) 48

b) Charleston, South Carolina (SC) (SIL) 49

c) Marine Corps Logistics Base (MCLB) Albany, Georgia (GA) 50

d) MCLB Barstow, California (CA) 51

e) Marine Corps Recruit Depot (MCRD) Parris Island, SC 52

f) Marine Corps Air Station (MCAS) Beaufort, SC 53

g) MCAS Cherry Point, North Carolina (NC) 54

h) MCAS Miramar, CA 55

i) MCAS Yuma, Arizona (AZ) 56

j) MCAS Iwakuni, Japan 57

k) Marine Corps Base (MCB) Camp Butler, Okinawa, Japan 58

l) MCB Camp Pendleton, CA 59

m) MCB Camp Lejeune, NC 60

n) MCB Quantico, Virginia (VA) 61

o) Marine Corps Air Ground Combat Center (MCAGCC) Twenty-nine 62

Palms, CA 63

1.2.2 Exception to Places of Performance 64

During the first year of the CLS effort there are three locations which do 65 not require full coverage due to a separate contracting action. 1) MCAS 66

Yuma, AZ is fully under warranty for the base year and will require 67 support under this effort in option year two; 2) MCAS Iwakuni, Japan will 68 require E911 support, but the CAD will be under a separate warranty in 69 the base year. Iwakuni will require full support of the E911 and CAD 70 under this effort in option year two; and, 3) MCB Camp Lejeune will 71 require E911 support, but the CAD will be under a separate warranty in 72 the base year. Camp Lejeune will require full support of the E911 and 73

CAD under this effort in option year two. 74

2. CERS Sustainment Requirements 75

The contractor shall maintain the integrated CERS components without degrading service, 76 performance, or function of previously installed or existing systems. The contractor shall 77 support the existing systems through sustainment and organizational maintenance practices. 78

The contractor shall provide sustainment and maintenance to achieve the required 79 operational availability of 99.7% annually, as defined in the USMC Capability Production 80

Document (CPD) for CERS, 21 February 2012. 81

The contractor shall maintain integrated CERS components with existing Administration and 82

Maintenance (A&M) workstation hardware. Access to the facility shall be coordinated ahead 83 of time to allow the contractor to plan accordingly for access, space requirements, personnel 84 for testing and training on the test articles. 85

The contractor shall support the operations and maintenance practices that address the 86 following: (a) regularly scheduled maintenance events including planned software updates; 87 and, (b) a sustained operations and maintenance practice functions that encompass continual 88 review of established operations and maintenance practices to ensure the most cost-effective 89 maintenance is performed on in-service support systems. 90

Under the warranty and part of the sustainment effort, the contractor shall provide an annual 91 preventive maintenance functional assessment and alignment on CERS or fixed network 92 equipment to ensure the equipment meets original manufacturer’s specifications. 93

2.1 Subsystems 94

Table 2-1 outlines those subsystems relevant to CERS and this PWS. Successful 95 sustainment of CERS and CLS execution is dependent upon its effective 96 integration and interface capabilities of these subsystems, in addition to 97

Enterprise Land Mobile Radio (E-LMR), Public Safety Network (PSNet), and 98

Base Telecommunications Infrastructure (BTI). 99

Table 2-1 101 CERS Subsystems

E911 CPE

CAD

FSA

Geographic Information System (GIS)

Logging and Recording

PowerPhoneTM (EMD)

RMS

Time Sync Subsystem

Uninterruptable Power Supply (UPS)

Workspace and System Furniture

2.1.1 E911 Customer Premises Equipment 103

The contractor shall sustain full functionality of the E911 CPE to the capacity to 104 which it was installed. The contractor shall ensure the E911 CPE continues to 105 perform to the standards and requirements set forth in the System Design 106

Specification (SDS) (GFI A00x). The contractor shall maintain E911 CPE 107 interfaces and associated applications such as CAD, Dispatch Local Area 108

Network (LAN), dispatch radio, and BTI. The contractor shall ensure the E911 109

CPE software is current in regards to security postures and patching, as 110 applicable. The contractor shall maintain a partnership with the E-LMR vendor 111 to ensure that the radio arbitration interface remains operational. 112

2.1.2 Computer Aided Dispatch 113

The contractor shall sustain full functionality of the CAD to the capacity to which 114 it was installed to include NetViewer. The CAD shall support LE, Fire, and EMS. 115

The contractor shall ensure the CAD maintains seamless transfer of calls for 116 service, Automatic Location Identification (ANI)/Automatic Location 117

Identification (ALI) ANI/ALI, and related information from the E911 CPE. The 118 contractor shall maintain CAD interfaces and associated applications such as 119

Dispatch Local Area Network (LAN), FSA, Automatic Vehicle Location (AVL)/ 120

Position Location Information (PLI) AVL/PLI, RMS (LE and F&ES), Geospatial 121

Data, data mining, and integrated Emergency Medical Dispatch (EMD). The 122 contractor shall ensure the CAD software is current in regards to security postures 123 and patching, as applicable. The contractor shall ensure the CAD continues to 124 meet system requirements as set forth in the SDS. 125

2.1.3 Fire Station Alerting 126

FSA is initiated from any emergency dispatch position. The contractor shall 127 ensure the FSA system meets applicable system requirements set forth in the 128

SDS. The contractor shall maintain the FSA interface to CAD and PSNet. Table 129

2-2 identifies the quantity of fire stations at each installation. 130

Table 2-2 131

Installation Number of Fire

Stations MCB Butler / Camp Fuji 7

MCB Camp Lejeune / MCAS New River

MCB Quantico / Marine Corps Air Facility

MCAS Yuma 2

MCAS Cherry Point 3

MCAS Beaufort 2

MCRD Parris Island 1

Camp Pendleton (MCB / MCAS) 8

MCAGCC Twenty Nine Palms 2

MCLB Albany 2

MCAS Iwakuni 2

MCAS Miramar 2

MCLB Barstow 2

2.1.4 GIS/Mapping 133

The CAD system is installed with integrated geographic information system. The 134

CAD GIS data shall be annually updated following an established map update 135 process to ensure the most current installation map possible using GFI data. The 136

Contractor shall provide the Government documentation on the procedure for 137 incorporating future GIS data layer updates into the CAD system so that it can be 138 factored into the enterprise configuration management process. The contractor 139 shall use native ESRI file formats to the maximum extent possible. 140

2.1.5 Logging and Recording 141

The contractor shall sustain and maintain the existing logging and recording 142 hardware to meet the existing system requirements set forth in the SDS. 143

2.1.6 PowerPhone (EMD) 144

The contractor shall maintain PowerPhone protocols. Installations with CAD 145 integrated PowerPhone protocols shall be updated with relevant software 146 upgrades within one week of new protocol release. Security patches shall be made 147 available within 48 hours. Installations with physical PowerPhone card protocols 148 shall be provided with relevant updated card updates within two weeks of release. 149

2.1.7 Records Management System 150

The contractor shall maintain the existing interface to the F&ES RMS that is 151 capable of sending CAD data directly to the F&ES RMS system via an 152 established Secure File Transport Protocol proxy server. 153

2.1.8 Time Synchronization 154

The contractor shall maintain CERS with existing time synchronization services. 155

The contractor shall synchronize CERS components and subsystems to Global 156

Positioning System (GPS) time synchronization sources deployed under CERS 157

E911. 158

2.1.9 Uninterrupted Power Supply System – Workstation and Server 159

The contractor shall maintain the existing CERS uninterrupted power supply 160

(UPS) at a minimum of 80% capacity. Installation specific UPS are listed in the 161

CERS baseline. (Appendix X) 162

2.1.10 Workstation Area 163

The contractor shall maintain CERS desktop equipment, including cabling, 164 power, display monitors, and ancillary devices to maintain a dispatch workstation 165 that complies with American National Standards Institute/Human Factors and 166

Ergonomics Society (ANSI/HFES) 100-2007. 167

2.2 Other Interfaces 168

2.2.1 Enterprise Land Mobile Radio (E-LMR) 169

The contractor shall maintain the existing interface and capability between CERS 170 and E-LMR. The current E-LMR system varies based by base and is either a 171

Motorola or Harris product. The standard interfaces include the ability to accept 172 radio AVL/PLI capabilities, where they exist, and radio arbitration between CPE 173 and dispatch radio. E-LMR components are identified in Appendix X. 174

2.2.2 PSNet 175

Commander Navy Installations Command (CNIC) PSNet is the secure network 176 provided for transport of data within the CERS system. The contractor shall 177 ensure all CERS components and interfaces are maintained to continue utilization 178 of this network. 179

2.2.3 Base Telephone Infrastructure 180

The contractor shall maintain a working relationship and knowledge of the 181 installation telephony system to understand how changes to that system affects 182

CERS. 183

2.3 System Administration 184

The contractor shall provide domain management, host-based security system 185

(HBSS), Assured Compliance Assessment Solution (ACAS), and sustainment 186 services such as unlocking accounts, domain policy maintenance, backups, health 187 checks, defragmentation, scans, antivirus checks, adding and deleting accounts, 188 domain Information Assurance Vulnerability Management (IAVM), operate, 189 monitor and record the ACAS, and HBSS current state on a weekly basis. The 190 contractor shall monitor results, and mitigation actions shall be logged and 191 recorded. The contractor shall create reboot procedures and coordinate with each 192

Installation. The contractor shall push Microsoft software updates and create an 193 update plan for other software. The contractor shall provide routine and ad-hoc 194 network and performance reports as technical reports for the below sections 195

(B00X). 196

2.3.1 Active Directory 197

The contractor shall provide Active Directory Domain Services Administration. 198

This includes routine daily, weekly, and monthly tasks required to keep the Active 199

Directory Domain Services functional. The contractor shall provide unscheduled 200 tasks, in support of Active Directory Administration, as required. 201

2.3.2 SQL Server Administration 202

The contractor shall provide daily, weekly, and monthly routine tasks in support 203 of SQL Server. The contractor shall provide unscheduled tasks, in support of SQL 204

Server, as required. 205

2.3.3 Microsoft Windows Desktop Administration 206

The contractor shall provide daily, weekly, and monthly routine tasks in support 207 of Microsoft Windows Desktop Administration. The contractor shall provide 208 unscheduled tasks, in support of Microsoft Windows Desktop Administration, as 209 required. 210

2.3.4 Microsoft Windows Server Administration 211

The contractor shall provide daily, weekly, and monthly routine tasks in support 212 of Microsoft Windows Server Administration. The contractor shall provide 213 unscheduled tasks, in support of Microsoft Windows Server Administration, as 214 required. 215

2.3.5 Virtual Machine Hypervisor (vSphere ESXi) 216

The contractor shall provide daily, weekly, and monthly routine tasks in support 217 of VM Hypervisor System Administration. The contractor shall provide 218 unscheduled tasks, in support of VM Hypervisor System Administration, as 219 required. 220

2.4 Remote Access 221

2.4.1 Remote Maintenance and Administration 222

In the event that the contractor’s physical place of business provides remote 223 support to the system, prior approval for remote access shall be granted by the 224

Government and IAW DoD remote access for privileged and user functions as 225 well as USMC/USN remote access policy. In addition, the contractor shall ensure 226 secure access devices including (but not limited to) door keys, locks, key cards, 227 security cameras, audible and visual alarms, and system classification/device 228 labels are in place and in use at the remote location. Contractor supplied version 229 or security patches, fixes, and maintenance to the system shall be applied only 230 after tested in a production environment. The contractor shall provide notification 231 to the Government prior to applying any patches, fixes, or maintenance to the 232 system to coordinate deployment. 233

2.4.2 Access Support 234

The contractor shall provide approved hardware to support DAR system remote 235 access. This hardware shall meet all cyber security standards that have been 236 previously met with DAR system components and shall be within the current 237 hardware and software baseline configurations identified in the current Authority 238 to Operate (ATO) plan. This hardware shall be Government-owned and 239

Contractor-operated. All GFP shall be subject to cyber security and physical 240 inspections by the Government, with a minimum 24-hour notice, to ensure 241 adherence to the Commander, Navy Installations Command (CNIC) PSNet 242 remote access service level agreement (SLA) through MCSC PMM 170.3. CNIC 243 shall be granted permissions to layer 2 switching devices supporting this solution 244 in order to support cyber security scans, intrusion prevention and detection. This 245 remote access support shall include all integrated CERS capabilities including. 246

2.4.3 Additional Remote Access Locations 247

The contractor will provide remote system support from any existing CERS 248 location until such time an additional remote access site is approved by the 249

Government. 250

2.5 Systems Integration Lab Activities 251

The contractor shall maintain the SIL during the length of this period of 252 performance. The SIL shall replicate the CERS product baseline and support the 253 integration requirements as identified by MCSC, SDS, and Requirements 254

Traceability Matrix (RTM). The SIL shall be used as the engineering facility to 255 develop, test and evaluate CERS capabilities as well as perform interoperability 256 testing with other systems such as Enterprise Land Mobile Radio (E-LMR) and 257

Base Network Infrastructure. The SIL shall be used to demonstrate functional 258 integration of CERS to related systems such as radio dispatch consoles and 259 radio/phone voice arbitration, AVL/PLI, and Human System Integration (HSI). 260

The SIL shall be used to demonstrate through design, build, secure, and test the 261 ability of CERS system level design to maintain the required operational 262 availability of 99.7% annually. CERS hardware, software, and configuration 263 changes shall be tested at the SIL prior to deploying to the enterprise. The SIL 264 shall support the operations and maintenance practices that address the following: 265

(a) regularly scheduled maintenance events including planned software updates, 266 and (b) a sustained operations and maintenance practice functions that encompass 267 continual review of established operations and maintenance practices to ensure 268 the most cost-effective maintenance is performed on in-service support systems. 269

The contractor shall deliver an as-built engineering document package 270

(Deliverable B00x) for the SIL. This engineering package shall include all 271 components of CERS. This engineering package shall be maintained using 272 configuration management processes as defined by the contractor and the 273

Government. The contractor shall provide quarterly GFE reports on the status of 274 the SIL equipment and any other GFE that is contained in the SIL (Deliverable 275

B00x). 276

3. Performance Objectives and Standards 277

The following paragraphs list all required non-personal services tasks. The contractor shall 278 provide necessary resources with knowledge and experience as cited in the Personnel 279

Qualifications text to support the listed tasks. Contractors shall perform requirements in 280 accordance with Federal Acquisition Regulation (FAR) and/or Defense Federal Acquisition 281

Regulation Supplement (DFARS) which does not include performance of inherently 282 governmental functions. The contractor shall complete all required tasks while controlling and 283 tracking performance and goals in terms of costs, schedules, and resources. 284

3.1 Program Management 285

The contractor shall provide programmatic support with program planning, 286 status, reporting, and provide program control, as well as identify, manage, and 287 provide mitigation strategies for program and project level risk. The contractor 288 shall develop and maintain regular reporting tools (e.g., dashboards, status 289 updates). The contractor shall provide program management support directly to 290 the Government with program planning, acquisition strategy, cost analysis, 291 scheduling, status reporting and other various project management activities for 292 newly assigned work efforts. The contractor shall be responsible for developing 293 program documentation and facilitating reviews. The contractor shall identify, 294 document, and communicate changes to project critical paths to include 295 identifying and articulating schedule risks, and propose risk mitigations to the 296

Risk Management Board. The contractor shall conduct reviews at Government 297 and contractor facilities. 298

Contractor personnel shall prepare agendas and conference presentation 299 materials, and provide minutes and reports following each review. The contractor 300 shall participate in a post award conference within two weeks of contract award. 301

Contractor personnel, when requested, shall prepare agendas and conference 302 presentation materials, and provide minutes and reports following each review. 303

The contractor shall deliver and maintain a Master Schedule as an accurate 304 schedule of program events. The schedule shall include all significant events, and 305 shall depict major tasks and events from start to completion of the PWS. This 306 schedule shall be maintained via Microsoft Project Software. (Deliverable B00x) 307

3.2 Program Planning 308

The contractor shall maintain a Program Plan that meets the Government’s 309 requirement for insight into the contractor’s methods of procedure used 310 throughout the performance period of the PWS. The contractor shall provide and 311 brief the Program Plan at the Post Award Conference (PAC). The Program Plan 312 shall be updated when changes to structure or performance occur and submitted 313 monthly, at a minimum, to the Government for review. Program Plan updates 314 shall be provided during the weekly meetings. 315

The Program Plan shall: 316

a) Describe the contractor’s approach to Resource Management. The approach 317 to Resource Management should include program and reporting structure, 318 organizational charts, and delivery team management. Changes in Resource 319

Management that have impact on performance should be highlighted in 320

Program Plan updates. 321

b) Track the progress and critical repair/replace activities including the tasks 322 needed to complete the project. 323

c) Address a management approach and highlight actions that will be taken to 324 mitigate risk to cost, schedule, and performance. 325

d) Address Diminishing Manufacturing Sources and Material Shortages 326

(DMSMS) and any mitigation plan to be employed. 327

e) Highlight positive or negative impacts of repair/replace activities; provide 328 details on the process to deal with unforeseen site conditions; and predict 329 schedule slips. 330

f) Detail work tasks and be reflective of activities and submittals including: 331 technical reviews, planning, Product Acceptance, asset tagging, closeout 332 documentation, and “as-built” submittals at a minimum. 333

g) Provide any and all necessary information, data, studies, and reports 334 necessary or useful to demonstrate full compliance with Federal, State, and 335

Local environmental laws, including any known potential compliance issues 336 associated with the manufacturing, testing, operations, or disposal. 337

3.3 Weekly Meetings and Status Reports 338

The contractor shall participate in weekly meetings with Government personnel 339 either by teleconference or video teleconference to ensure the adherence to the 340

Project Plan. At a minimum, the contractor shall participate in the weekly meeting 341 in-person on a quarterly basis at a predefined Government location. During the 342 weekly meetings the contractor shall provide status updates, findings, milestones, 343 significant actions, issues and concerns, and discrepancies. The contractor shall 344 submit a Weekly Meeting Agenda (Deliverable B00x) NLT two working days 345 prior to the first weekly meeting. The Government will approve the agenda and 346 the contractor shall use the Government approved agenda for all weekly meetings. 347

The contractor shall establish a Weekly Meeting Action Log (Deliverable B00x) 348 that tracks individual assigned actions including persons assigned, dates, course 349 of actions (COA), and reference to the meeting at which the action was assigned. 350

The contractor shall make the action log available NLT one working day prior to 351 the weekly meeting. The contractor shall establish a library showing drawings or 352 photographs of critical items and work progress. 353

The contractor shall maintain this library throughout the project. The contractor 354 shall make the library available NLT one working day prior to the initial weekly 355 meeting. The contractor shall provide weekly meeting minutes (Deliverable 356

B00x). The contractor shall make the weekly meeting minutes available within 357 five working days after each meeting. The contractor shall transfer weekly 358 meeting minutes, action logs, and the photo library to the Government upon final 359 acceptance of the project. The contractor shall provide a secure method, such as 360 a secure File Transfer Protocol (FTP) site, for the purpose of delivering related 361 documentation. 362

3.4 Quality Control 363

The contractor shall maintain an effective quality control program to ensure 364 services are performed in accordance with this PWS, using the (GFI A00x), Final 365

Quality Control Plan (QCP). All discrepancies shall be reported to the 366

Contracting Officer’s Representative (COR) and the local Technical Support 367

Officer (TSO) within one calendar day to ensure immediate resolution. 368

3.5 Systems Engineering Management Plan 369

The contractor shall develop and maintain a Systems Engineering Management 370

Plan (SEMP) detailing processes that aligns with the Government Systems 371

Engineering Plan (SEP) that will be used to maintain all existing systems within 372

45 calendar days following issues of SEP as (GFI A00x). 373

Contractor shall utilize (GFI A00x), Final Safety Assessment Report (SAR), to 374 identify safety features of the hardware, software, and system design and to 375 identify procedural, hardware, and software related hazards that may be present, 376 including specific procedural controls and precautions that shall be followed, and 377 any residual safety risks. 378

3.6 Configuration Management Plan 379

The contractor shall maintain a Configuration Management (CM) process for the 380 control of all Configuration Items to include software, hardware and 381 documentation. The principles contained in MIL-HDBK-61A and the established 382

CM Plan will be used for guidance. 383

The contractor shall provide form, fit, function, and interface documentation 384 necessary for configuration status accounting of configuration items identified by 385 the Government. 386

The contractor shall support the Government in maintaining and managing the 387 established allocated, product, and functional baselines. These processes shall be 388 defined in the Configuration Management Plan (GFI A00x). Changes to 389 established baselines shall only be made after written approval, from the 390

Government, of Engineering Change Proposals (ECP’s), Request for Deviation 391

(RFD), or Request for Waiver (RFW). The contractor shall implement 392 configuration control methods and procedures, which maintains the integrity and 393 traceability of an established baseline. Sufficient supporting data to evaluate the 394 proposed change shall be submitted with ECP’s and RFD’s. The contractor’s 395 configuration control process shall be available for review. 396

3.7 Post Award Conference 397

The contractor shall conduct a PAC, in the National Capital Region at a 398

Government-approved location, within 30 calendar days after contract award. 399

NLT two (2) calendar days prior to the PAC, the contractor shall electronically 400 send to all participants the meeting information to include the agenda 401

(Deliverable B00x) and presentation slides (Deliverable B00x) (in Microsoft 402

Office format), and the Program Plan (in Microsoft Project and Adobe Portable 403

Document Format (PDF) file). 404

The Government will conduct a paragraph-by-paragraph review of the PWS in 405 conjunction with the contractor’s technical solution as it relates to system 406 requirements and provide comments and recommendations. The Government will 407 provide GFI, establish Point of Contact (POC) lists, and provide protocols and 408 rules of conduct. 409

Following the PAC, the contractor shall make the recommended changes to the 410 documents presented during the meeting. The PAC shall be documented by 411 electronic meeting minutes (Deliverable B00x), which shall be submitted to the 412

Government for approval NLT five (5) working days after the meeting. The PAC 413 meeting minutes shall include at a minimum, attendees, activities conducted 414 against the agenda, decisions/major clarifications made, action items, responsible 415 party and due dates. 416

4. Cybersecurity 417

The contractor shall comply with applicable DoD, Navy, USMC regulations, and Cybersecurity 418

Maturity Model Certification (CMMC) which is being developed by DoD. The contract will 419 satisfy the Cybersecurity Assessment and Authorization (A&A) requirements in accordance with 420

(IAW) the Department of Defense Instruction (DoDI) 8510.01, Defense Information Assurance 421

Risk Management Framework (DIARMF) utilizing (GFI A00x), Mobile Code/Open-Source 422

Disclosure, (GFI A00x), Open-Source/Public Domain Software Disclosure, (GFI A00x), IA 423

Trouble Ticket Procedures. (GFI A00x), Information Vulnerability and Management Plan. The 424 contractor shall develop and provide any necessary system documentation and assessments 425 required to maintain the CERS 2.0 Authority to Operate (ATO), including yearly reviews. The 426 contractor shall provide artifacts using the SIL system sufficient to meet cyber security 427 requirements for ATO /Authority to Connect (ATC). This shall include information in support 428 of Government input into the Marine Corps Certification and Accreditation Support Tool 429

(MCCAST). 430

4.1 System Assurance 431

The contractor shall ensure that the system, network, and any component 432 complies with applicable Government-wide laws, rules, and regulations for Cyber 433

Security to include applicable DoD, Navy, and USMC regulations, directives, and 434 instructions associated with Cyber Security. The Government will be responsible 435 for submitting paperwork to the appropriate Government Cyber Security 436 organizations. The contractor shall work with the Government representative to 437 provide required documentation, testing results, and compliance reports and 438 follow through until Government certification is received for each installation. 439

The contractor shall be responsible for correcting any deficiencies which prevent 440

CERS from being certified, including continuous monitoring and patching of the 441 system baseline. 442

Additionally, the contractor shall remove, or otherwise disable, any unnecessary 443 or unused software, ports, protocols and services, firmware or hardware from the 444 integrated CERS systems. The contractor shall also remove all default system, 445 database, or application passwords and accounts, sample scripts, data, and files 446 and programs not necessary for the operation of the system from the integrated 447

CERS. The contractor shall ensure that the system shall not contain any 448 components designed to permit access by non-authorized personnel into the 449 system or to damage/erase system information. 450

4.2 Assessment & Authorization (A&A) 451

The contractor shall maintain the cyber security posture for both the CERS 452 equipment at the SIL and for fielded systems. This includes conducting a 30 day 453 scan and patch cycle which shall consist of vulnerability scans using the Assured 454

Compliance Assessment Solution (ACAS), the current DoD approved tool, and 455 mitigating findings as required. The contractor shall monitor and ensure all new 456

IAVM patches and Security Technical Implementation Guide(s) (STIGs) are 457 reviewed and applied. The contractor shall fix, patch, or mitigate all Critical, 458

High or Moderate findings. The contractor shall provide raw (Nessus) files and 459 reports from the Assured Compliance Assessment Solution (ACAS) Security 460

Center application. The contractor shall provide both raw and executive 461 summary reports of the scans for each system and component at each installation 462 location. The contractor shall ensure that any new STIG checklists are compared 463 to the current system baseline and updated if necessary. The contractor shall fix, 464 patch, or mitigate all Critical, High or Moderate findings prior to Government 465 acceptance at each installation. The Government will make available USMC 466 specific scanning tools and the Plan of Action and Milestone (POA&M) template. 467

The contractor shall provide a Host Information Configuration File to allow input 468 of system data into MCCAST. The contractor shall support the collection of 469 evidence in completing Certification and Accreditation (C&A) and connection 470 decisions and assist the process of requesting this decision. The contractor shall 471 assist the Government in obtaining an ATC from the appropriate Connection 472

Approval Office. 473

The contractor shall provide to the Government the data necessary to support the 474

Risk Management Framework (RMF) Assessment and Authorization (A&A) 475 process and will need to acquire a Common Access Card (CAC) to access most 476 of the sites necessary to support the A&A process. This will include a description 477 of the system, services and artifacts necessary to demonstrate compliance with 478 management, technical, and operational security controls. 479

4.3 Secure System Design 480

The contractor shall ensure system components have the ability to effectively 481 detect, report, respond, log, and audit security incidents and threats against the 482 environment, systems, and applications. Undocumented changes to the CM 483 baseline shall be considered as security incidents. 484

When implementing any component of the system, the contractor shall ensure the 485 system is compliant with the Confidentiality, Integrity, Availability, and Non-486

Repudiation requirements described in the applicable STIG or other DoD 487

Guidelines (e.g., DoD Chief Information Officer memorandum dated 8 488

September 2011, Implementation of Basic Input/Output System Protection 489

Guidelines). The contractor shall provide a STIG Compliance Report for each 490 applicable STIG. 491

The contractor shall remove or otherwise disable any unnecessary or unused 492 software, Ports, Protocols, and Services (PPS), firmware or hardware. The 493 contractor shall remove default system, database, or application passwords and 494 accounts, sample scripts, data, and files and programs not necessary for the 495 operation of the system. 496

The contractor shall ensure the system is capable of Public Key Infrastructure 497

(PKI) enablement or two-factor authentication. Two-factor authentication must 498 be deployed for systems / applications not Public Key (PK) capable. CAC and 499 two-factor authentication shall be tested and employed during this period of 500 performance. 501

The contractor shall minimize the use of group accounts, justify any group 502 account, or trace group account access to ensure audit accountability to individual 503 action. The contractor shall ensure the system can limit the number of multiple 504 log-on sessions. 505

All components that use encryption shall comply with the latest DoD and USMC 506 guidance. Network interfaces connected to either a managed Wide Area Network 507

(WAN) or protected via a Virtual Private Network (VPN) through the public 508

Internet shall be encrypted and protected in accordance with DoD and USMC 509 guidance. Servers and workstations shall have virus protection software installed 510 and properly functioning and shall interoperate with the managed Host-Based 511

Security System (HBSS). 512

Precautions shall be provided by the contractor to protect the sensitive 513 information in the Government’s system. The contractor shall ensure user 514 screens, views, or output are appropriately marked. 515

4.4 Secure Maintenance and Administration 516

In the event that the contractor’s physical place of business provides remote 517 support to the system, prior approval for remote access shall be granted by the 518

Government and in accordance with DoD remote access for privileged and user 519 functions as well as United States Marine Corp (USMC) /United States Navy 520

(USN) remote access policy. In addition, the contractor shall ensure secure access 521 devices including (but not limited to) door keys, locks, key cards, security 522 cameras, audible and visual alarms, and system classification/device labels are in 523 place and in use at the remote location. Contractor supplied version or security 524 patches, fixes, and maintenance to the system shall be applied only after tested in 525 a production environment. The contractor shall provide notification to the 526

Government prior to applying any patches, fixes, or maintenance to the system to 527 coordinate deployment. 528

4.5 Host-Based Security System (HBSS) 529

The contractor shall manage in accordance with current DoD and Defense 530

Information Systems Agency (DISA) policies and procedures a host-based 531 security system (HBSS) for CERS servers and dedicated workstations that use 532 the Windows or Linux operating systems. This design shall encompass all USMC 533 installations, remote locations and the CERS SIL. The contractor shall maintain 534 all HBSS hardware and software in accordance with the applicable DISA STIGs 535 and use only the software, upgrades and patches that are currently available from 536

DISA. 537

The contractor shall operate, monitor and record the SIL HBSS current state on a 538 weekly basis. All monitoring results and mitigation actions shall be logged, 539 recorded locally on the HBSS servers and made available (on removable optical 540 media) upon Government request. All personnel performing any HBSS functions 541 shall: (a) certified as Information Assurance Technical (IAT)-II or IAT-III in 542 accordance with DoD 8570.01 and (b) have completed the minimum DISA 543 requirements for HBSS administrator training established by 544 http://www.disa.mil/Cybersecurity/Network-Defense/HBSS/Training. 545

After tests are completed of the applicable patches, the fix shall be placed on the 546 ePolicy Orchestrator (ePO) server for access at each installation. 547

4.6 Assured Compliance Assessment Solution (ACAS) 548

The contractor shall manage, in accordance with current DoD and DISA policies 549 and procedures, an assured compliance assessment solution (ACAS) vulnerability 550 scanning suite to conduct vulnerability scanning for all CERS devices. All ACAS 551 hardware and software shall be in accordance with the applicable DISA STIGs. 552

Only the software, upgrades and patches that are currently available from DISA 553 shall be used. 554

Maintenance of the security authorization to operate will be through continuous 555 monitoring of security controls of the contractors system and its environment of 556 operation to determine if the security controls in the information system continue 557 to be effective over time in light of changes that occur in the system and 558 environment. Through continuous monitoring, security controls and supporting 559 deliverables are updated and submitted to ERS Information System Security 560

Manager (ISSM) on a monthly basis and/or as required. The submitted 561 deliverables shall provide a current understanding of the security state and risk 562 posture of the information systems. These will allow ERS ISSM and 563 cybersecurity team to make credible risk-based decisions regarding the continued 564 operations of the information systems and initiate appropriate responses as 565 needed when changes occur. 566

Deliverable

Number

Deliverable Name

B00x ACAS Scan Report

B00x Host Information Configuration File

B00x Summarized ACAS Security Vulnerability Scan Report

B00x Cyber Security POA&M

B00x DISA STIG or Other Security Configuration Guideline Compliance

Report

B00x System Backup and Trusted Recovery Procedures

B00x Hardware/Software/Firmware and Encryption Compliance Report

B00x Personnel Information Assurance Workforce (IAWF) Certification

Matrix

5. Engineering 570

5.1 In-Service Engineering 571

Contractor shall support and execute an Enterprise IT Service Engineering (EISE) 572 program for all CERS systems. EISE is a subset of In-Service Engineering (ISE) 573 that includes system release upgrades, technical refreshes, and recurring 574 certification that the systems perform as designed. This includes IA accreditation 575 and the training and qualification of the resources that operate and maintain the 576 systems. EISE includes the re-test and re-evaluation of the fielded system(s) to 577 include upgrades and improvements, as well as the periodic verification of 578 compatibility with other identified interfaces. Contractor shall establish and 579 maintain ISE practices throughout the period of performance. The contractor shall 580 provide, when requested, written communications in the form of technical reports 581 minimally including the following: point papers, information papers, briefs, 582 plans, and strategy. (Deliverable B00x). The contractor shall provide trip reports, 583 within ten working days of travel, (Deliverable B00x) for any installation visits 584 including in-briefs, out-briefs, and field engineering information. 585

5.2 Test and Evaluation 586

The contractor shall perform system testing for CERS using the SIL. This testing 587 shall include proposed changes to the CERS configuration baseline to include 588 hardware and software, firmware, documented configuration, and Cybersecurity 589 patches as identified by DISA as security vulnerabilities. Cybersecurity patches 590 include operating system and antivirus definitions. The contractor shall document 591 test configuration, test procedures, test results and test trouble reports. If trouble 592 reports are generated, mitigation steps shall be identified to resolve the issue. 593

The contractor shall perform ACAS scans on CERS once changes have been 594 tested and provide the raw and summary reports to the Government. The 595 contractor shall resolve, mitigate or identify mitigation procedures for all 596 identified findings. Once testing has been completed and the updates are 597 approved via the configuration management process, the documentation 598 associated with the changes shall be updated in accordance with Section 2 – CERS 599

Sustainment Requirements. Updates shall be made available to the installations 600 with instructions for employment of the change. Upon completion of testing the 601 contractor will provide an updated risk assessment. 602

5.3 Logistics 603

The contractor shall have the capability to provide logistics support required by 604 this PWS and in accordance with the Defense Federal Acquisition Regulation 605

Supplement (DFARS). The contractor shall maintain Logistics KPPs of AO and 606

AM via extended warranty, spares, break/fix, or replace during the Period of 607

Performance. The contractor shall calculate Logistics KPP of AM using the 608 equation below. 609

6. System Integration Lab Relocation 611

The contractor shall initiate the System Integration Lab (SIL) relocation from its current facility, 612 at Huntsville, AL, to Charleston, SC. The contractor shall be responsible for the 613 decommissioning of the current SIL to include the backup, proper shutdown, and proper packing 614 of all electronic equipment, ancillary equipment, racks, and cabling to ensure the equipment is 615 not damaged. The contractor shall be responsible for the transport of said equipment to the new 616

SIL facility in Charleston, SC within 30 calendar days of award. The contractor shall unpack, 617 mark, set-up, and commission/provision/restore, and turn-up all equipment to a functional state 618 within 15 calendar days of arrival at new facility. The contractor shall ensure all scans and 619 patching are current. The contractor shall provide an operational test plan (Deliverable B00x)) 620 and conduct the operational test to ensure the functionality at the new facility. The Government 621 shall provide floor space, power, and leased circuit access at the SIL on a continuous 24/7/365 622 basis in support of a PSNet wide area connection. The contractor shall provide an A-built design 623 package (Deliverable B00x) for this remote access suite within 60 calendar days of system 624 optimization. 625

7. Maintenance 626

7.1 Warranty 627

The contractor shall provide a pass-through warranty for all repair/replace 628 hardware/software, materials, and workmanship. The contractor shall provide a 629

24 hours per day, seven days per week and 365 days a year toll-free hotline which 630 shall be manned with technical consultants who are able to troubleshoot issues 631 that may occur within CERS. The contractor shall provide a process for 632 dispatching qualified field repair personnel who can perform the physical repair 633 of any deficient CERS subsystem. This process must ensure CERS installation 634 personnel are notified of actions as they occur during the existence of the issue. 635

The contractor shall follow (GFI A00x), Warranty Procedures Guide which 636 includes points of contact, phone numbers and addresses for repair and return; 637 procedures for obtaining emergency replacement parts and specific procedures 638 for obtaining these services if different from normal repair actions. 639

The contractor shall establish and maintain a warranty record system that 640 identifies and documents all items to be warranted under the contract. Each item 641 warranted shall be identified by model or part number and date of acceptance by 642 the Government. All warranty claims and transactions shall be documented 643

(Deliverable B00x) and made available for Government review during scheduled 644 meetings and/or reviews. The contractor shall provide an address for returning 645 defective items if different from repair and return. It is expected that this 646 information will be valid during the warranty and for lifecycle support after the 647 warranty has expired. If the information should change, after the warranty 648 expires, the contractor shall provide updates for continued lifecycle support. 649

The warranty shall include the capability to provide 24x7 remote system 650 monitoring and diagnostics services…