PWS.docx

Section C - Descriptions and Specifications

PERFORMANCE WORK STATEMENT

Performance Work Statement (PWS) Marine Corps Recruiting Command (MCRC) Network Support Services (NSS)

1.0 Background

The Marine Corps Recruiting Command (MCRC) is a major organization in the United States Marine Corps (USMC). It is responsible to the Commandant of the Marine Corps for the procurement of qualified individuals, in sufficient numbers, to meet the established officer and enlisted personnel strength levels of the Marine Corps. MCRC Headquarters (HQ) is located at the James Wesley Marsh Building aboard Marine Corps Base (MCB) Quantico, Virginia. The MCRC has identified a continuing requirement for a vendor to support, maintain, enhance, and defend the Recruiting Command Enterprise Network (RCEN). The objective is to support the command in carrying out the information technology technical, engineering, operations, maintenance, and management functions that support recruiting operations.

The MCRC is comprised of approximately 6,000 network users located in approximately 1,600 facilities CONUS and Outside the Continental United States (OCONUS). Each Marine Recruiter is provided with a government laptop, a smartphone, a connection to the Recruiting Command Enterprise Network (RCEN) and Internet, access to the Marine Corps Recruiting Information Support System (MCRISS: MCRC’s Command and Control (C2) System) and is supported by a dedicated helpdesk. The RCEN and its associated information systems underpin the successful command and control of recruiters, recruiting organizations, supporting personnel, and their commanders. Recruiting operations reasonably approximate a commercial sales effort. The supporting information technology (IT) resources more closely mimic commercial business practices than traditional Marine Corps tactical and operational networks, while still being compliant with Department of Defense (DoD), Department of the Navy (DoN), and USMC information assurance requirements.

The following are current MCRC user locations:

· MCRC Headquarters: Marine Corps Base (MCB) Quantico, VA

· Region Headquarters: Parris Island, SC; San Diego, CA

· District Headquarters: Locations in NY, SC, TX, IL, CA

· Recruiter School: San Diego, CA

· Recruiting Stations (RS): 48 locations

· Recruiting Substations (RSS): 592 locations

· Officer Selection Stations (OSS): 72 locations

· Permanent Contact Stations (PCS): 828 locations

· Prior Service Recruiting (PSR): 75 locations

· Military Entrance Processing Stations (MEPS): 67 locations

The RCEN is comprised of three primary infrastructure components:

1. A Defense Information Systems Agency (DISA) brokered wide area network (WAN) with 56 primary nodes (MCRC HQ, District HQs, RS HQs, and Recruiters’ School) and 65 secondary nodes (Military Entrance Processing Station (MEPS))

2. The DISA brokered commercial circuits providing Internet connectivity (transport) to the >1,500 Very Small Site Design (VSSD) locations in cities and hometowns across America

3. The local area networks (LANs) supporting VSSD sites (VSSD sites are the 2-6 person offices where most recruiters conduct day-to-day business).

MCRC relies upon core services (across the RCEN) such as:

· Directory Services

· Email Services

· Domain Naming System

· Mobile Device Management

· Unified Communications

· Cybersecurity and Compliance

· Storage and Backup Services

· Support for MCRISS infrastructure (See Appendix A for the full list of hardware and software currently supported)

Many of the RCEN’s core services are provisioned and maintained by support efforts in the scope of this contract. In some cases, aspects of core services are facilitated through collaboration with Marine Corps Cyberspace Operations Group (MCCOG) and/or in association with the Marine Corps’ Office 365 (O365), and Azure GovCloud. The MCCOG serves as the Cybersecurity Service Provider (CSSP) IAW a recently renewed March 2025, memorandum of agreement between MARFORCYBER and MCRC.

The RCEN is centrally managed by the MCRC HQ aboard Marine Corps Base Quantico, VA. MCRC’s network governance is guided by DoD and Information Technology Infrastructure Library (ITIL) standards. This includes the requirement for industry best practices such as extensive network documentation, asset management, and change management. In accordance with DoD requirements, contractors must meet certain qualifications in order to be permitted to access or manage the RCEN. The historical qualifications are outlined in Appendix B.

The MCRC has a requirement for a vendor to provide program management and technical services to support, maintain, enhance, and defend the Recruiting Command Enterprise Network (RCEN). This support will cover Program Management, an Enterprise Service Desk, Integrated Network Support, Cybersecurity, Enterprise Directory and Messaging, Data Center Optimization, Enterprise Architecture, Continuity of Operations (COOP), and Cloud Migration.

MCRC uses the Marine Corps Recruiting Information Support System (MCRISS) as the command and control (C2) system underpinning the planning, execution, and historical analysis of the recruiting mission. MCRC uses MCRISS to apportion resources, assign, track and manage the attainment of contracting and shipping missions, as well as recruiter and recruiting organization performance. MCRISS is developed and supported by the Marine Corps Systems Command (MARCORSYSCOM) under the oversight and support of the Department of the Navy’s Program Executive Office (PEO) Manpower, Logistics, and Business (MLB), and the Manpower Information Technology Systems Modernization (MITSM) Portfolio. The software is hosted on virtual machines and physical infrastructure that is managed by the contractor supporting this NSS requirement. In accordance with a memorandum of agreement (MOA) between MCRC and the MITSM portfolio, MCRC is responsible for the provisioning and maintenance of the infrastructure supporting MCRISS Legacy (23-year-old on premise application), as well as collaborating and supporting the transition from MCRISS Legacy (a modern Cloud and Platform based application) to MCRISS Next. The Network Support vendor selected to perform the work in this PWS is an essential element of the sustainment of MCRISS Legacy and the forecast transition to Next. MCRISS is currently hosted inside the Marsh Center. During the period of performance associated with this PWS, MCRC anticipates MCRISS Next to be deployed in, and thereafter hosted in the Appian IL4 GovCloud, behind the Marine Corps Cyber Operations Group (MCCOG) Secure Cloud Computing Architecture (SCCA) and principally defended by the MCCOG as the Cyber Security Service Provider (CSSP). While the MITSM portfolio has a contracted support vendor responsible for the development, deployment, and sustainment of the MCRISS Legacy and Next applications, there are from time to time, collaborative engagements where the vendor awarded this contract shall contribute to discussions, planning, and engineering necessary to ensure continuity of MCRISS operations.

Some of the tasks associated with supporting Legacy MCRISS include the following:

· Coordinate with the MCRISS Program Office to solicit requirements for supporting infrastructure needs related to MCRISS

· Execute periodic software releases and deployments to user workstations

· Support MCRISS application server changes and modifications

· Troubleshoot issues relating to MCRISS authentication and databases

· Support load balancing and Single Sign On infrastructure for the MCRISS application

· Execute firewall changes and modifications to allow MCRISS to communicate securely with needed entities

· Configure and monitor MCRISS servers

· Provide Tier-1 support for MCRISS to address approximately 8,000 service tickets annually, including account creations, data entry, and permissions assignment. For support reference:

- Tier 1 (Basic Support) – This is the first point of contact for users, handling basic inquiries and resolving common problems. Tier 1 support typically focuses on quick resolution, such as documented solutions, account management and software installation.

- Tier 2 (Intermediate Support) – When Tier 1 cannot resolve an issue, it is escalated to Tier 2, which handles more complex problems and requires deeper technical knowledge. Tier 2 may diagnose and fix software/hardware issues or troubleshoot network problems.

- Tier 3 (Advance Support) – Tier 3 is the highest level of support, involving experts who handle the most complex and critical problems. This tier may involve system analysis, vendor contact as well as enterprise-wide issues.

2.0 Purpose

MCRC released this PWS to outline the support and quality of service necessary to meet the technical, operational, administrative, and security requirements for the RCEN, associated end points, applications, and peripheral devices.

3.0 Scope

This PWS represents a continuation and expansion of services currently being provided under the existing RCEN Network Support Contract #M00263-21-F-1023, administered by the Regional Contracting Office (RCO) Parris Island, SC. Day to day operations are centrally managed out of MCBQ, VA. NSS covered under this contract will extend to over 6,000 users across >1,500 Contiguous United States (CONUS) and Outside CONUS (OCONUS) sites. NSS shall include the support of networks, connectivity, Information Technology (IT) assets, websites, applications, and peripherals distributed across the enterprise as described in Appendix A. The primary objective of this contract is to provide available, reliable, and secure IT capabilities for the RCEN in order to enable MCRC operations. The contractor shall perform hardware and software upgrades, including the replacement of outdated equipment, installation of new systems, and optimization of network infrastructure. Upgrades shall align with DoD and USMC standards, including compliance with applicable Security Technical Implementation Guides (STIGs). The contractor shall also be required to ensure compliance, situational awareness, speed of response in the event of an incident, and to support the Marine Forces Cyberspace Command’s (MARFORCYBER) operate and defend mission across the MCRC portion of the Marine Corps Information Enterprise Environment (MICEE). The contractor shall also assist in improving operational efficiency, leveraging DoD approved Cloud computing resources, as well as DoD, DoN, and USMC capabilities where appropriate over the period of performance and any/all subsequent option periods.

4.0 Requirements

The Contractor shall provide the following advisory, managerial, and technical NSS in accordance with the most recent versions of all directives, instructions, orders, and other issuances stated in or cross referenced within the contract.

In accordance with DFARS 252.237-7023, Sections 4.1 through 4.7 described herein are deemed Essential Contractor Services.

4.1 Contract, Program, and Project Management

The Contractor shall provide all service support required to analyze, recommend, manage, execute, and report on fulfillment of requirements outlined in this PWS. This involves managing ongoing projects and operations related to this PWS as well as ensuring that all tasks mentioned in this PWS are met.

In addition, MCRC’s IT portfolio and inventory includes devices and applications distributed across more than 1,500 sites and used by more than 6,000 individuals. Managing the allocation and tracking the status of these assets across the enterprise requires substantial situational awareness, ongoing accountability, and automated support. The current inventory is maintained in centralized repositories using the Asset Management module in BMC Remedy, the Global Combat Support System-Marine Corps (GCSS), and the Defense Property Accountability System (DPAS). The contractor shall coordinate with the MCRC G-4 logistics team in order to validate inventory and execute logistical requirements. The contractor will be provided with a variety of methods to perform inventories, including the access required to perform physical inventories or network discovery tools (e.g. ForeScout, Axonius, System Center Configuration Manager (SCCM), etc.). Recent additions to the asset management toolset include the hardware and software asset management capabilities and dashboards provided by the Axonius data aggregation capabilities deployed on the RCEN. MCRC would like to see continued employment of Marine Corps approved tools to support inventory management, compliance, situational awareness, and speed of response.

4.1.1 The Contractor shall implement and execute a comprehensive management methodology that ensures consistent service delivery, enterprise-wide planning, task execution, and reporting in accordance with the requirements outlined in this PWS.

4.1.2 The Contractor shall develop (in coordination with appropriate Government personnel), manage, and report on Project Plans and Schedules that specify work to be completed with clear milestones and deliverables, as well as the resources (personnel or other) assigned. This should be delivered to the COR with each Monthly Status Report (see 4.1.5 below).

4.1.3 The Contractor shall develop, execute, and maintain a Staffing Plan (IAW paragraph 9.0 Contract Personnel Administration) that identifies the roles, responsibilities, and credentials of each person supporting the contract. The Staffing Plan shall be updated from the version submitted with the proposal, if necessary, and submitted to MCRC at the end of the transition period to demonstrate staff competency and completeness, and must be available upon request by the government thereafter, and include:

· Clearance level appropriate to assigned roles and responsibilities (See paragraph 8 Security and Certification Requirements)

· DoDD 8140.01 credentials appropriate to assigned roles and responsibilities

· Organizational structure, any teaming arrangements, labor categories, and hours to accomplish the tasks outlined in the PWS

· Comprehensive staffing matrix with labor mix and hours including the qualifications, capabilities, and task alignment for each labor category

4.1.4 The Contractor will deliver a Weekly Status Report (WSR). The WSR shall include a summary of work completed, anticipated tasks for the current week, milestones for the next 90 days, and any obstacles or roadblocks. Metrics such as ticket resolution rates, network uptime, and cybersecurity compliance shall be included.

4.1.5 The Contractor shall deliver a Monthly Status Report (MSR) by the 5th of each month that provides the current status of:

· Staffing levels and operational readiness

· Project Plans and Schedules

· Accomplishments (quantified) in terms of quality, schedule, management, business relations, and regulatory compliance. Should include benefit and value added.

· Deliverables submitted

· A list of milestones anticipated in the next 180 days

· Contract and project risks and recommendations

· Metrics such as ticket resolution rates, network uptime, and cybersecurity compliance

· Other contract-related information, as requested by the government

4.1.6 The Contractor shall support designated project and status meetings by sending out invites with agendas, taking attendance, generating minutes, and distributing minutes including summary of tasks, due dates, and individual responsibilities to designated stakeholders. Project meetings occur weekly with assigned stakeholders and status meetings with MCRC leadership will be once a month within the first 10 days of the month to allow analysis and resolution of any outstanding questions or concerns related to the MSR. Meetings attendance may be in person at MCRC HQs or virtually. The Contractor shall ensure attendance and active participation in all contract related meetings, to include, but not limited to:

· Operations Morning Stand up meetings (twice weekly)

· CIO Weekly Update Meeting

· MCRC CAB Weekly Meeting

· MCRC G6 Weekly Operation Meeting

· MCCOG Weekly Cyber Meeting

· MARFORCYBER Weekly Meeting

· Microsoft Weekly Sync Meetings

· AITS Bi-weekly Meetings

· Azure Mission Owner Weekly Meeting

· MCEN Highlights Weekly Meeting

· Teams Direct Routing Weekly Meeting

· MCRC INS Weekly Meeting

· WAN Provisioning Weekly Meeting

· MCRISS related Meetings

4.1.7 The Contractor shall identify, manage, and report risks to the COR related to the overall contract performance and the contracted services supported by the vendor to include, but not limited to, network outages, service interruptions, vulnerabilities, cyber- intelligence, cyber-attacks, cybersecurity compliance, staffing, project schedules, and the submission of internal (MCRC) or external (e.g. MARFORCYBER, DCI, MARCORSYSCOM, etc.) requests for information and/or deliverables.

4.1.8 Each quarter, the Contractor shall identify, analyze, and recommend improvements to current and future operations related to the efforts covered by this contract and report the results to MCRC on a quarterly basis using that subsequent month’s MSR.

4.1.9 The Contractor shall support and fulfill government requests for market research on potential enhancements to MCRC IT operations to include, but not limited to hardware and software procurement, maintenance contracts and warranties, and upgrades and technical refresh. All market research shall be performed in accordance with FAR Part 10 and DFARS Part 210.

4.1.10 The Contractor shall track hardware, network devices, telecommunications equipment, and software assets, versions, licenses and warranties, reporting the status and any discrepancies with any of these resources on a monthly basis. The Contractor shall respond to asset-related data calls within one business day with accurate data requested by the Government.

4.1.11 The Contractor shall identify, organize, and document software and hardware configuration changes in the designated repository.

4.1.12 The Contractor shall identify redundancies or shortfalls in licensing, warranty, or spares and report any such findings to MCRC in the next MSR in order to mitigate any shortfalls in reporting requirements and prevent the expiration of licenses, warranties, certificates, or similar agreements.

4.1.13 The Contractor shall ensure that any items that are accounted for in multiple systems (e.g. GCSS and DPAS) are identified and tracked. The various accountability systems need to be reconciled against each other to ensure accuracy and consistency of the data on a monthly basis.

4.1.14 In an effort to assist MCRC with capacity planning and management, the contractor shall perform Circuit Management encompassing the provisioning/decommissioning oversight, reconciliation, and maintenance of all MCRC circuits, ensuring network performance and reliability. This includes identifying duplicate or unnecessary circuits and take action to decommission those circuits.

4.1.15 In accordance with paragraph 6, Travel, the Contractor shall coordinate travel and properly report activities and costs to MCRC stakeholders to facilitate assistance with technical refreshes, mobile device upgrades, software updates, networking equipment, cyber tools, mobile hotspots, storage solutions, and AV support for conferences, and other such initiatives or events. Stakeholders include MCRC leadership, Contracting Officer Representative (COR), and designated project team members. Meeting minutes shall be distributed to all stakeholders within two business days of the meeting.

4.1.16 The Contractor shall provide comprehensive documentation support to ensure the development, review, revision, publication, and organization of policies, directives, Standard Operating Procedures (SOPs), technical manuals, training materials, reports, and other essential documents. This support shall encompass the creation of clear, concise, and accurate documentation that aligns with organizational standards, regulatory requirements, and cybersecurity compliance mandates. The Contractor shall ensure that all documentation is appropriately formatted, accessible, and maintained in a centralized repository to support ongoing network operations, portfolio management, audit readiness, and preparations for inspections. Limited graphic design support shall also be provided to ensure that visual elements are professionally designed, consistent with branding guidelines, and effectively communicate technical information. See paragraph 5 to further clarify the scope of this task.

Section 4.1 Deliverables:

· Project Plans with Schedules (See Section 4.1.2)

· Staffing Plan (See Section 4.1.3)

· Weekly Status Report (WSR) (See Section 4.1.4)

· Monthly Status Report (MSR) (See Section 4.1.5)

· Market Research Reports (See Section 4.1.9)

· Asset Management Discrepancy Report (See Sections 4.1.10 through 4.1.13)

· A centralized repository to support ongoing network operations, portfolio management, audit readiness, and preparations for inspections. (MCRC will provide the repository, the contractor is responsible for content curation.)

4.2 MCRC Enterprise Service Desk (ESD)

The MCRC ESD is the primary customer service support arm for the MCRC G-6, and in many ways is the face of MCRC to the nationwide recruiting force. The MCRC ESD operates on-site at the MCRC HQs in Quantico, VA and provides the recruiting force with local and remote Tier-1 IT event handling Monday-Friday, 0600-2200 ET with on-call support at all other times. The ESD receives trouble calls via Remedy tickets, phone calls, emails, chat messages, and walk-ins. The ESD also provides Tier-1 support for managing user accounts and mobile devices. They provide Tier-1 support for the MCRISS Legacy system and are anticipated to do the same for MCRISS Next. MCRC uses two instances of BMC Remedy to centrally manage RCEN events, incidents, and trouble tickets. The primary Remedy system in use is the Marine Corps Enterprise instance of Remedy, which is owned and managed by MCCOG and is used by many units in the Marine Corps. MCRC ESD uses the modules in this Remedy instance to manage various help desk functions typically associated with common IT service requests. In addition, the ESD also uses a separate MCRC-owned instance of BMC Remedy. This second Remedy instance is only used for routing MCRISS trouble tickets that contain Personally Identifiable Information (PII) and Private Health Information (PHI). While MCRISS Legacy remains in use by MCRC, MCRISS related trouble tickets will be handled in MCRC’s Remedy instance. As capabilities migrate to MCRISS Next, MCRC anticipates eventually transitioning to an alternative service request system for MCRISS related trouble tickets. However, the Contractor must still be prepared to maintain and support use of the separate instance of Remedy if necessary. The following are the Remedy service modules currently in use:

· Incident Management module

· Change Management module

· Asset Management module

· Action Request (AR) Server

· Administrator Console

· Contract Management module

· Foundation Elements module

· Service Request Management module

· Smart Reporting module

· Task Management module

· Remedy Dashboard

· Remedy training for IT Personnel

4.2.1 The Contractor shall staff the ESD with qualified personnel, as stipulated in paragraph 8.0 (Security and Certification Requirements), to manage and/or resolve all requests, incidents, account creations, permissions modifications, and changes during normal duty hours, which consists of Monday-Friday 0600-2200 ET (excluding Federal holidays). Specific historical qualifications are found in Appendix B.

4.2.2 The Contractor shall provide on-call Tier 1 remote support coverage 24x7x365, to include outside of normal hours via government-provided duty-phone with a 60-minute response time on Sat/Sun/Holidays from 0700-2200 ET. Between the hours of 2200-0659 ET, a 120-minute response time is required.

4.2.3 The Contractor shall provide surge support (e.g. or staffed above normal capacity during normal duty hours when necessary) to support special events with anticipated need for increase ESD support (e.g. higher call volume). The government anticipates 5-10 of these events per year (e.g. MEPS Processing Saturday, extended mission day processing, etc.); each of which will be coordinated at least 72 hours in advance. The vendor is expected to submit a surge support plan to the COR within 24 hours of notification.

4.2.4 The Contractor shall accept, triage, and either solve or escalate network, end user device, and underlying IT Service-related issues to the appropriate supporting entity (e.g. Tier 2 or Tier 3 engineers, Marine Corps Cyberspace Operations Group (MCCOG), or appropriate elements in the chain of command). This includes troubleshooting conference room, VoIP and mobile devices.

4.2.5 The Contractor shall accept, triage, and either solve or escalate MCRISS related issues to the appropriate supporting entity (e.g. MCRISS Tier 2, MCRISS Tier 3, the MCRISS Program Office, or appropriate elements in the chain of command.)

4.2.6 The Contractor shall review, make recommendations, and update MCRC ESD SOPs and processes as necessary, and annually at a minimum.

4.2.7 The Contractor shall image, update, deploy and track (e.g. issue and collect receipts (1348, etc.) government furnished laptops to MCRC HQ staff. ESD will assist G6 Responsible Officer (RO) perform Consolidated Memorandum of Receipt (CMR) reviews either by physical inventory review or confirmation of signed receipt when deployed.

4.2.8 Section 4.2 Deliverables:

· ESD SOP updates (See Section 4.2.9)

· ESD related data for Weekly and Monthly Status Reports

4.3 Integrated Network Support

The Integrated Network Support (INS) section oversees MCRC’s centrally managed, CONUS/OCONUS distributed network infrastructure. INS ensures the availability, reliability, and assurance of key network infrastructure developing, employing, and sustaining architecture(s) and enabling transport for the RCEN and its associated information systems. INS uses a variety of network tools (e.g. Solar Winds, Aruba AirWave, SSH, etc.) to manage the connectivity and networking devices (e.g. Aruba Remote Access Points, Fortinet Perimeter Devices, Cisco switches, etc.) of more than 1,500 remote sites. The INS section is responsible for the maintenance of networking devices, including patching, updating, and ensuring compliance with USMC, DoN, DoD, and MCRC standards. Today, INS conducts liaison with the US Army Human Resources Command (HRC), which serves as an executive agent for the Recruiting Services Network (RSN) WAN. This relationship is required in order to respond to network outages or coordinate changes relating to a subset of the MCRC network that traverses a Multiprotocol Label Switching (MPLS) architecture. In the future MCRC’s WAN will be administered by a DISA Enterprise Information Services (EIS) selected vendor and liaison efforts similar to those currently coordinated through HRC will be required. The desired end state is a well provisioned WAN backbone between primary C2 nodes enabling collaboration and rapid decision making while simultaneously safeguarding data, systems, and underlying infrastructure.

INS also manages the device and user authentication systems for access to the network (e.g. Aruba ClearPass, 802.1x, Cisco ISE, TACACS+, Cisco AnyConnect). They work closely with MCRC EDM and Cybersecurity sections, as well as elements of MARFORCYBER or MARCORSYSCOM in order to integrate security tools into the network (e.g. Forescout, Assurance Compliance Assessment Solution (ACAS), Axonious, Microsoft Defender Suite, etc.). In addition, they operate MCRC’s local and remote devices and services (e.g. Perimeter Devices, Virtual Private Network (VPN) Concentrators, Routers, Switches, and others) in order to protect the network while simultaneously supporting situational awareness and speed of response for MARFORCYBER/MCCOG as Cybersecurity Service Provider (CSSP). INS manages and maintains reverse proxy services using combination of MENLO and on-prem Network appliances. INS Manages and maintains hardware load balancing services and forward proxy services using F5 BIG-IP appliances. As MCRC continues its transition to The Cloud, INS will be responsible for managing virtual networking devices and appliances, virtual networks, and circuits that connect MCRC users to Cloud Resources. INS is expected to collaborate with EDM and other sections or organizations like MCCOG, PEO Digital, and Microsoft or Amazon in the provisioning, operations, and maintenance of cloud-based resources.

4.3.1 The Contractor shall plan, install, operate, maintain, upgrade, and monitor the RCEN network in order to maximize availability, reliability, and assurance for MCRC users while maintaining alignment with broader Marine Corps policies, directives, and guidance.

4.3.2 The Contractor shall operate, upgrade, and maintain network and system hardware and software in accordance with approved Standard Operating Procedures (SOPs), the MCRC Change Management process, and vendor (e.g. Cisco, Aruba, Microsoft, Adobe, etc.) recommendations.

4.3.3 The Contractor shall review and update RCEN SOPs and network documentation as necessary and appropriate, and annually at a minimum.

4.3.4 The Contractor shall identify, architect, document, operate, maintain, and when directed, upgrade the configurations of MCRC wired and wireless LANs using the hardware and software approved and purchased by the Government.

4.3.5 The contractor shall use tools (e.g. SolarWinds and Aruba AirWave, etc.) to analyze bandwidth usage and forecast future needs. Forecasts shall include historical usage trends, anticipated growth, and recommendations for optimizing network capacity. Monthly bandwidth reports shall be submitted to the COR.

4.3.6 The Contractor shall configure and operate devices in accordance with Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), Department of Defense (DoD), and United States Marine Corps (USMC) policies (See PWS Section 5.0).

4.3.7 The Contractor shall use available tools/processes (e.g. network segmentation, firewall rules, ACLs, etc.) in order to configure and provision access control policies, as required.

4.3.8

4.3.9 The Contractor shall implement, manage, and monitor port-based security where appropriate.

4.3.10 The Contractor shall implement and maintain IPv6-capable LAN components, as required.

4.3.11 The Contractor shall execute any approved Change Request (CRQ). CRQs are used for modification to an existing network function or resource.

4.3.12 The Contractor shall monitor, operate, and maintain the remote sites’ networks, associated VPNs and LAN devices, and connectivity. This shall include coordinating site moves, new site installations, site decommissioning, and WAN connectivity changes.

4.3.13 The Contractor shall install, maintain, and operate authorized hardware and software associated with remote access capabilities (e.g. IPSEC and SSL based VPN) to provide end users ability to securely access core services from remote locations in accordance with Government policy.

4.3.14 The Contractor shall test and validate acceptable operation of MCRC Configuration Advisory Board (CAB) approved changes to the network hardware and software prior to implementing the configurations on the production network.

4.3.15 The Contractor shall ensure network interoperability with DoD and commercial networks.

4.3.16 The Contractor shall facilitate coordination and planning between the Government and commercial telecommunications and cloud service providers, to include establishing, planning, and troubleshooting voice and data networks; documenting network configurations and connections; and managing network inventories, warranty issues, and repairs/ replacements of faulty equipment.

4.3.17 The Contractor shall review test data, make technical judgments, and provide recommendations concerning telecommunications and network performance quality and need for changes and improvements to infrastructure, systems, and services.

4.3.18 The Contractor shall coordinate with HQMC C4 and MCCOG concerning unified communications enterprise guidance and ensure all RCEN initiatives are in line with HQMC C4 directives and with MSCS concerning IT contracting, program management support, and other MCRC IT initiatives as necessary.

4.3.19 The Contractor shall coordinate with the cybersecurity section and other involved entities to implement Near Real Time (NRT) Network Common Operational Picture (NetCOP), Network Access Control, Compliance, and Remediation (NACCR), Comply to Connect (C2C) (e.g. Forescout, Cisco ISE, Aruba ClearPass), and Zero-Trust networking models as directed by MCRC, USMC, DoN, and the DoD in order to ensure network environment security and performance optimization.

4.3.20 The Contractor shall update and track network asset and telecommunication device inventory and associated documentation and report any discrepancies to MCRC within 1 week of discovery. (Note: The Marine Corps may use systems such as GCSS-MC, DPAS, and/or BMC Remedy as elements of supply inventory management and tools such as Active Directory (or other Microsoft related tools), Axonious and ForeScout as elements of Cyber Security Inventory Management).

4.3.21 The Contractor shall supply MCRC with necessary technical information required to place DISA brokered circuit orders.

4.3.22 The Contractor shall configure, test installation of circuit services, DISA brokered WAN, DISA VSSD Broadband circuits, etc.), and continuously monitor circuit performance in order to make recommendations for capacity management.

4.3.23 The Contractor shall operate MCRC’s boundary devices, to include firewalls, single-sign on devices, web application firewalls, domain name system, load balancers, and intrusion prevention/detection systems in order to support availability, reliability and assurance.

4.3.24 The Contractor shall advise MCRC and the COR of any changes to Marine Corps, DoN, DODIN or DoD directed shifts to Joint Information Environment (JIE) resources or capabilities that may impact MCRC operations.

4.3.25 The Contractor shall facilitate the employment of necessary hardware, software, and maintain the systems documentation required for users to conduct videoconferences with other parties on the network or on other DoN, DoD, federal, or commercial networks.

4.3.26 The Contractor shall support routing, switching, firewall, PPSM, and related interface connectivity in support of MCRISS (both Legacy and MCRISS Next).

4.3.27 The Contractor shall track and report INS related hardware and software support and licensing counts and expiration dates in order to facilitate tech refresh planning and budgeting.

4.3.28 The Contractor shall interface/coordinate with MARFORCYBER, MARCORSYSCOM, DCI, HRC, MEPCOM, DISA, and other vendors as appropriate and necessary.

4.3.29 The Contractor shall provide comprehensive support for the transition to new telephony and Voice over Internet Protocol (VoIP) services. This support shall include installation, configuration, and maintenance of VoIP infrastructure across the enterprise. The Contractor shall ensure proper integration with existing unified communications platforms while facilitating user migration and providing necessary training. The Contractor shall implement and maintain Quality of Service (QoS) monitoring and optimization protocols, track call quality metrics, and provide regular reporting on system performance. Additionally, the Contractor shall establish and test system redundancy and failover capabilities to ensure continuous service availability.

4.3.30 The Contractor shall support the implementation and maintenance of Enhanced 911 (E911) services in accordance with MCRC, USMC, DON, and DOD policies. This support shall include configuration and maintenance of accurate E911 location information, regular testing and validation of emergency services access, and coordination with local Public Safety Answering Points (PSAPs). The Contractor shall track and report E911 implementation progress across the enterprise while providing assistance to subordinate elements in troubleshooting E911-related issues. The Contractor shall maintain comprehensive documentation of E911 procedures and contacts, conduct regular functionality testing, and ensure continuous compliance with all applicable E911 policies and regulations.

Section 4.3 Deliverables:

· INS SOP updates (See Section 4.3.3)

· Network and security configuration and documentation updates (See Sections 4.3.3 through 4.3.5)

4.4 Enterprise Directory and Messaging (EDM) Support

The Enterprise Directory and Messaging (EDM) section is responsible for the management of various RCEN capabilities, servers and cloud-hosted services. These capabilities are generally grouped under the umbrella of “Core Services,” and EDM’s responsibilities are focused on ensuring the Core Service capabilities underpinning the network are in place and supporting day to day operations. These Services include the management of Active Directory Domain Services, Microsoft Exchange, SharePoint Online, core image build and distribution, physical servers, virtual servers, unified communications, and others (See Appendix A for full list of current software and hardware managed). The hardware and cloud services that EDM manages resides primarily at the MCRC HQ building and in the Marine Corps Tenant of the Azure GovCloud. EDM will continue to inherit different responsibilities related to the administration of services as they are migrated to cloud-based resources and services, including managing and provisioning servers and services. It is anticipated that MCRC will operate a hybrid (cloud and on premise) environment for the foreseeable future. Additionally, EDM manages the operating systems, hardware, and maintenance for the MCRISS Legacy servers. This is anticipated to continue until MCRISS Next (hosted in the Appian GovCloud) becomes the system of record for accessions and Legacy is decommissioned. Each environment requires isolated access, patching, and security postures. The uptime of all enterprise services must stay at or above 99.9%, not including system maintenance. The RCEN Network Support team will utilize ITIL v 3 (and later versions) processes as general guidance for EDM support. EDM also manages MCRC’s current Unified Communications platform, Skype for Business 2019 along with Ribbon appliances for unified communications and VoIP capabilities. EDM will also manage the transition to, adoption and operations of upcoming unified communications technologies, including Microsoft Teams Direct Routing (TDR) or DISA DIPS when such technologies become available. EDM also designs and manages MCRC’s web-based collaboration tools. MCRC extensively uses Microsoft SharePoint Online sites to perform internal and external coordination and collaboration. EDM is responsible for the management of the enterprise network’s Storage Area Network (SAN) and backup solutions (e.g. NetApp SAN, Avamar, etc.). The RCEN currently uses on premise and offsite storage that resides in the MCRC HQ and an offsite location (Currently 8th District HQ). They are responsible for managing and monitoring storage efforts, ensuring that all resources have the storage they need to operate efficiently. They are responsible for configuring storage and backups in accordance with MCRC, USMC, DoN, and DoD policies (e.g. RAID levels, drive encryptions, etc.). They are also responsible for performing data transfers and hardware and software installations when MCRC upgrades storage appliances. It is anticipated that, with MCRC’s migration to cloud services, this task will likely include managing cloud-based storage resources (e.g. Azure Storage, Azure SQL, Virtual Machines). Currently, this section manages the storage and backups for MCRISS Legacy. EDM will continue to support MCRISS Legacy backups and storage until MCRISS NEXT is fully operational and MCRISS Legacy has been decommissioned. Should PEO MLB implement a Cloud based historical archive of MCRISS Legacy data post transition, the contractor shall assist in RCEN specific aspects of design, engineering, and delivery of such a capability.

4.4.1 The Contractor shall manage, operate, and maintain MCRC’s servers and services in accordance with processes and SOPs that align to DISA STIGs, SRGs, DoD and DON Policies, and USMC guidance. Internal SOP’s and guidance shall be updated at least on a quarterly basis and submitted to the COR; these will be reviewed on a quarterly basis by the MCRC G6 staff to ensure compliance.

4.4.2 The contractor shall manage Active Directory (AD), including creating and managing user accounts, group policies, organizational units (OUs), and security groups. AD configurations shall align with DISA STIGs and MCRC policies, and weekly audits shall be conducted to ensure compliance.

4.4.3 The Contractor shall install, operate, and maintain VoIP services in collaboration with INS and Cyber Security teams to include integration with Unified Communications systems (e.g. Skype for Business, Microsoft Teams, DISA DIPS etc.) in order to ensure telephony capabilities addressed in paragraph. 4.3.28.

4.4.4 The Contractor shall operate and maintain device and user identities in accordance with MCRC, USMC, DoN, and DoD policies.

4.4.5 The Contractor shall be prepared to install, operate, document, and maintain MCRISS Legacy production, staging, and training environments and supporting services/capabilities until MCRISS NEXT is fully operational. Internal SOPs and guidance shall be updated at least on an annual basis and submitted to the COR; these will be reviewed on an annual basis by the MCRC G6 staff to ensure compliance.

4.4.6 The Contractor shall operate, maintain, and coordinate new instances of MCRC SharePoint Online sites, instances, documentation, and workflows in accordance with MCRC, USMC, DoN, and DoD policies and guidelines. Internal SOPs shall be updated at least on an annual basis and submitted to the COR; these will be reviewed on an annual basis by the MCRC G6 staff to ensure compliance.

4.4.7 The Contractor shall operate, support and enable data mining, search, visualization, and reporting services for MCRC and other designated entities.

4.4.8 The Contractor shall operate, support, and maintain the enterprise Storage Area Network (SAN) for storage of network data and backups IAW the backup policy and SOP.

4.4.9 The Contractor shall operate, support, and maintain the enterprise backup and recovery solutions for the RCEN, and ensure backup strategies and procedures comply with all applicable MCRC, USMC, DoN, and DoD directives and polices.

4.4.10 The Contractor shall provide storage management services for MCRISS Legacy and MCRC core components, applications while they reside in the Marsh Building Data Center and will perform similar duties as appropriate to ensure resilient storage, backup and recovery when operating in the Cloud or at a designated location.

4.4.11 The Contractor shall monitor and forecast the pricing of storage in on-premises and cloud resources in order to provide a cost benefit analysis and risk-based recommendations to MCRC leadership.

Section 4.4 Deliverables:

· EDM SOP updates (See Section 4.4.1, 4.4.6, and 4.4.8).

4.5 Cybersecurity (CS) Support

Cybersecurity encompasses the protection and restoration of computers, electronic communications, and associated information, safeguarding its availability, integrity, confidentiality, authentication, and non-repudiation. The Contractor shall provide cybersecurity services, including Risk Management Framework (RMF) implementation, to obtain, maintain, and manage MCRC’s Authorities to Operate (ATOs). This includes coordinating with relevant stakeholders. The Contractor is responsible for ensuring ongoing compliance, patching, and performing other cybersecurity functions as required by MCRC, USMC, DoN, and DoD policy. MCRC requires the integration of cybersecurity into IT Operations for the RCEN and MCRISS applications. This integration must adhere to DoD RMF, continuous monitoring (ConMon) for ongoing assessment and authorization (A&A), and zero trust architecture (ZTA) requirements. The Contractor shall develop and maintain incident response plans and provide support to prevent, deter, detect, respond to, and recover from computer, information, and security incidents. In accordance with the Task Force network Modernization Command and Control Construct. MCRC has direct reporting requirements to MARFORCYBER via Operational Directives (OPDIRs), Cyber Task Orders (CTOs), the Marine Collection Database (MCD), and Vulnerability Management processes. As part of normal operations, the Contractor shall liaise with external entities such as MARFORCYBER, the MCCOG Vulnerability Management Team (VMT), Defensive Cyber Operations (DCO), Cyber Protection Teams (CPTs), and Red Teams, in support of broader Marine Corps Operations. The Contractor is required to support MCRC’s role as a cybersecurity service provider (CSSP) subscriber to the MCCOG.

4.5.1 The Contractor shall implement RMF and ConMon processes for all recruiting systems.

4.5.2 The Contractor shall create, update, manage, and track MCRC related RMF packages (as deemed essential by the MCRC CIO, Deputy CIO, and ISSM to support the MCRC mission) and associated artifacts in the Marine Corps Certification and Accreditation System Tool (MCCAST) pertaining to the RCEN and Advertising Information Technology System (AITS), a lead generation management and advertising related system created and supported by MCRC’s marketing and advertising agency.

4.5.3 The Contractor shall participate with and advise government personnel in weekly project and monthly status meetings to ensure the evaluation of hardware and software integration into the MCRC baseline and ensure successful execution of A&A processes.

4.5.4 The Contractor shall conduct regular Assured Compliance Assessment Solution (ACAS) vulnerability scans and report findings to the IAM and VMT.

4.5.5 The Contractor shall ensure compliancy reporting via OPDIRS is accurate and completed in a timely manner.

4.5.6 The Contractor shall conduct RMF and ConMon testing for A&A to evaluate and document the implementation and effectiveness of applicable security controls based on each system’s categorization and data processed. This will include the creation of updates to RMF packages and associated artifacts (e.g. SSP, SAP, SAR, RAR, and POA&M).

4.5.7 The Contractor shall facilitate the issuance, maintenance, and recertification of an ATO by the Marine Corps’ Authorizing Official for the RCEN and AITS. This task specifically requires the contractor to provide a Marine Corps’ certified validator as part of ATO certification process.

4.5.8 The Contractor shall maintain up-to-date data for MCRC systems in the DoD IT Portfolio Repository – DoN (DITPR-DON) for network information and the DoN Application and Database Management System (DADMS) for applications. At a minimum, this will consist of quarterly reviews and updates in DITPR-DON and DADMS.

4.5.9 The Contractor shall develop and implement local procedures in compliance with all higher echelon A&A requirements, policies, and DoD guidance.

4.5.10 The Contractor shall conduct policy and procedural reviews on at least an annual basis, to include the creation of any updates to MCRC cybersecurity policies and processes.

4.5.11 The Contractor shall operate a risk registry database of requested or approved risk acceptance and mitigations from the AO. At a minimum, this will include the creation of any updates to the DoD risk registry.

4.5.12 The Contractor shall maintain process incident reports received from the MCCOG Defensive Cyber Operations Cyber Incident Response Team (CIRT).

4.5.13 The Contractor shall respond to, update, track, and report all MCRC related MCDs.

4.5.14 The Contractor shall operate the security boundary between the RCEN and other Networks on the Global Information Grid in compliance with the DON Unclassified Transportation Network Protection Policy, the DoD Ports, Protocols, Standards Assurance Category Assignment List, and all applicable DISA STIGs.

4.5.15

4.5.16 The Contractor shall identify non-secure activities and rogue devices on the RCEN and recommend corrective/remedial actions immediately after they are discovered to the ISSM.

4.5.17 The Contractor shall conduct research and threat intelligence to provide recommendations for continual process and security improvements to the MCRC CS Program.

4.5.18 The Contractor shall support and maintain the Ongoing Authorization (Continuous ATO) for the RCEN.

4.5.19 The Contractor shall create necessary dashboards to monitor cybersecurity compliance tasks, including but not limited to Ongoing Authorization, Asset management, and Cyber Tasking Order (CTO) compliance. Cybersecurity staff shall work across the contractor team to troubleshoot issues with connections as needed to provide current monitoring.

4.5.20 The Contractor shall use a variety of threat emulation tools to test and maintain the security of the RCEN and shall coordinate the authorization for such tests with the appropriate agencies.

4.5.21 The Contractor shall plan, conduct, and document Penetration Testing in coordination with the MCCOG and MARFORCYBER based on DoD and Marine Corps processes.

4.5.22 The Contractor shall update MCRC Penetration Testing processes and templates in accordance with approved DoD and USMC guidelines.

4.5.23 The Contractor shall continue to pursue implement ZTA solutions in accordance with government direction, and documenting changes as they are proposed, tested, approved, and implemented.

4.5.24 The Contractor shall liaise with stakeholders to best facilitate understanding and appreciation of the evolution and change of Cyber Policies, directives, or initiatives with the potential to benefit, or detract from RCEN operations

4.5.25 The Contractor shall facilitate the sharing of cybersecurity related logs with the CSSP and…