S6. Attach.1_PWS_10.1.19.pdf

PERFORMANCE WORK STATEMENT (PWS)

Information Assurance and Cyber Security Program Office

PMW 130

Integrated Tool Suite (ITS) Training Services Contract

1 October 2019

TABLE OF CONTENTS

1.0 introductIon

2.0 SCOPE

3.0 aPPLICABLE DOCUMENTS and DIRECTIVES

4.0 Requirements

4.1 Training Services

4.1.1 Suitland, MD Training

4.1.2 San Diego, CA Training

4.2 Other Services

4.2.1 UEBA (CLIN 0001)

4.2.2 Software Licenses

5.0 reports, data, and deliverables

5.1 Deliverables

5.2 Government Furnished Property, Equipment, Information, and Data

6.0 security Requirements

6.1 Personnel Security

6.2 Operations Security

7.0 ENTERPRISE-WIDE CONTRACTOR MANPOWER REPORTING

APPLICATION (ECMRA)

8.0 SYSTEM SECURITY PLAN AND ANY ASSOCIATED PLANS OF ACTION

9.0 COVERED DEFENSE INFORMATION

9.1 Identify all covered defense information associated with the execution and performance of this contract

9.2 Track all covered defense information associated with the execution and performance of this contract

9.3 Restrict unnecessary sharing and/or flow down of covered defense information associated with the execution and performance of this contract

9.4 The Contractor shall flow down the requirements in 9.1, 9.2, and 9.3 to their tier 1 level subcontractors, vendors, and/or suppliers

10.0 Travel

11.0 Contract administration

11.1 Place of Performance

11.2 Period of Performance

ITS Training Services PWS

UNCLASSIFIED//FOR OFFICIAL USE ONLY (FOUO) 3

1.0 INTRODUCTION

Program Executive Office (PEO), Command, Control, Communications, Computers and Intelligence (C4I) Program Manager, Warfare (PMW) Information Assurance and Cyber Security (PMW 130) requires training services for acquired Integrated Tool Suite (ITS) products.

ITS provides the analytic and response capability to gather, integrate, review, assess, and respond to information derived from Counterintelligence, Cybersecurity, Human Resources, Law Enforcement, User Activity Monitoring (UAM), and other sources. ITS training requires trainers with proficient knowledge of the acquired ITS software and hardware products.

2.0 SCOPE

This Performance Work Statement’s (PWS) scope is for PMW 130 to receive training from technical subject matter experts (SME) with expertise in configuring, troubleshooting, installing, operating, maintaining, and sustaining the ITS software. The Contractor shall train Navy personnel how to configure, operate, and troubleshoot acquired ITS software and how to install software on Contractor-provided hardware or in Navy-provided Amazon Web Services (AWS) environments up to the SECRET level of classification. The Contractor shall provide Navy personnel training for acquired ITS products during the installation of the system at Naval Information Warfare Center Pacific (NIWC PAC) in San Diego, CA.

3.0 APPLICABLE DOCUMENTS AND DIRECTIVES

The Contractor shall adhere to the documents in the table below. The Government might update laws, regulations, policies, and instructions during the performance of the required training. The Contractor shall follow these updates when performing the required tasking.

Document Type Version Title Date Defense Federal Acquisition Regulations Supplement

(DFARS)

Subpart 252.204-

Safeguarding Covered Defense Information and Cyber Incident Reporting

October 2016

National Institute of Standards and Technology

(NIST)

Special Publication

(SP) 800-171

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

07 Jun 2018

Department of Defense Manual (DoDM)

Number 5200.01 Volume 4

Controlled Unclassified Information (CUI)

24 Feb 2012

Department of Defense Instruction (DoDI)

Number 5230.24 Distribution Statements on Technical Documents

23 Aug 2012

UNCLASSIFIED//FOR OFFICIAL USE ONLY (FOUO) 4

4.0 REQUIREMENTS

4.1 Training Services

The Contractor shall provide the following training services on acquired ITS software and hardware products (if the Government exercises hardware contract options):

4.1.1 Suitland, MD Training

a) The Contractor shall provide one 40-hour (five-day) session of operator training for up to 20 individuals at a Contractor-provided location within 25 miles of Suitland, MD. The Government estimates the frequency of this task will be once annually, and the Government will provide 90-day advance notice to the Contractor of when training shall be provided. The Contractor shall provide the following deliverables: Trip/Travel Report (A001), Training Materials (A004), and Contractor’s Progress, Status, and Management Report (A006);

b) The Contractor shall provide training to analysts, and training shall include all knowledge required to operate the system and hands-on practical exercises. The Contractor shall provide the following deliverables: Training Materials (A004);

c) The Contractor shall provide the training venue and the training system. The Contractor shall provide the following deliverables: Contractor’s Progress, Status, and Management Report (A006); and

d) The Contractor shall provide all materials for the ITS software that are commercially available from the software vendor and all available documentation for any Government-off-the-shelf (GOTS) components. These include materials the manufacturer normally provides with the procurement of the software and materials trainers normally use to conduct training courses by or on behalf of the software vendor. The Contractor shall provide the following deliverables: Commercial off-the-shelf (COTS) Equipment Manual Requirements (A005).

4.1.2 San Diego, CA Training

a) The Contractor shall provide one 40-hour (five-day) session of system installation, administration, and engineering training for up to ten individuals at Government facilities at NIWC PAC in San Diego, CA. The Government estimates the frequency of this task will be once annually, and the Government will provide 90-day advance notice to the Contractor of when training shall be provided. The Contractor shall provide the following deliverables: Trip/Travel Report (A001), Training Materials (A004), and Contractor’s Progress, Status, and Management Report (A006);

b) The Contractor shall provide training to system administrators with moderate Information Technology (IT) knowledge and experience, and training shall include all knowledge required to install the system in an AWS environment, perform daily administrative operations, complete system maintenance, and execute recovery from common system and hardware errors. The Contractor shall provide the following deliverables: Training Materials (A004), and Commercial off-the-shelf (COTS) Equipment Manual Requirements (A005); and

UNCLASSIFIED//FOR OFFICIAL USE ONLY (FOUO) 5

c) The Contractor shall provide hands-on practical exercises and guided, interactive instruction on installing the software in a government-provided AWS environment. The Contractor shall provide the following deliverables: Training Materials (A004), and Commercial off-the-shelf (COTS) Equipment Manual Requirements (A005).

4.2 Other Services

4.2.1 UEBA (CLIN 0001)

a) The Contractor shall assist the Government to make necessary configuration changes to comply with the requirements in CLIN 0001and shall resolve all non-compliant items identified in the Assessment and Authorization process. Information and tools on security requirements can be found at:

https://public.cyber.mil/ https://www.dss.mil/Portals/69/documents/io/rmf/CNSSI_No1253.pdf

4.2.2 Software Licenses

a) The Contractor shall include help desk support for at least eight hours per day, Monday through Friday, by phone and email. Helpdesk support shall be able to provide support up to SECRET classification via SIPRNet email.

5.0 REPORTS, DATA, AND DELIVERABLES

5.1 Deliverables

The Government will use the following CDRLs to fulfill the PWS requirements stated above.

The Contractor shall submit all deliverables under this contract to the Contracting Officer’s Representative (COR) as soft copy either via encrypted email, on a properly labeled and identified optical disk (CD-ROM or DVD-ROM), or other mutually agreed-upon secure file transfer or collaboration sites unless specified otherwise in individual DD1423 forms.

CDRL Data Delivery Frequency A001 Trip/Travel Report 10 Days After Trip, Twice Annually A002 System Security Plan and Associated Plans of Action for a Contractor’s Internal Unclassified Information System

No more than two times annually

A003 Contractor’s Record of Tier 1 Level Suppliers Receiving/Developing Covered Defense Information

No more than monthly

A004 Training Materials No more than two times annually

A005 Commercial off-the-shelf (COTS) Equipment Manual Requirements

No more than two times annually

A006 Contractor’s Progress, Status, and Management Report Monthly

UNCLASSIFIED//FOR OFFICIAL USE ONLY (FOUO) 6

5.2 Government Furnished Property, Equipment, Information, and Data

The Government may provide the Contractor access to Government Furnished Property (GFP) and necessary Government Furnished Information (GFI) if required for execution of the tasks on this contract. The Contractor shall return all GFP and GFI to the Government Program Office within 180 days of Contract Close Out, as deemed appropriate by the Government representative or COR.

6.0 SECURITY REQUIREMENTS

6.1 Personnel Security

ITS training requires all Contractor personnel providing services under this PWS at the San Diego training location to possess a General Service (GENSER) SECRET personal clearance with access to Secret Information. Training work shall require facilities and personnel to work at the Secret levels. ITS training might require access, receipt, generation, and storage of classified information up to and including material at the Secret level. In addition, the Contractor might be required to access Secret Internet Protocol Router Network (SIPRNet) and Navy Internet Protocol Router Network (NIPRNet) at government locations where work shall be performed (see attached DD 254).

6.2 Operations Security

The Contractor shall perform all work in accordance with DoD and Navy Operations Security (OPSEC) requirements.

7.0 ENTERPRISE-WIDE CONTRACTOR MANPOWER REPORTING APPLICATION

(ECMRA)

The Contractor shall report contractor labor hours (including subcontractor labor hours) required for the performance of services provided under this contract for training services for acquired ITS products via a secure data collection site. Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

(1) W, Lease/Rental of Equipment

(2) X, Lease/Rental of Facilities

(3) Y, Construction of Structures and Facilities

(4) D, Automatic Data Processing and Telecommunications Transmission (D304) and internet (D322) ONLY

(5) S, Utilities ONLY

(6) V, Freight and Shipping ONLY

The Contractor is required to completely fill in all required data fields using the following web address https://doncmra.nmci.navy.mil.

Reporting inputs shall be for the labor executed during the period of performance during each government fiscal year (FY), which runs 1 October through 30 September. While inputs may be

UNCLASSIFIED//FOR OFFICIAL USE ONLY (FOUO) 7

reported any time during the FY, all data shall be reported no later than 31 October of each calendar year.

Contractors may direct questions to the help desk, linked at https://doncmra.nmci.navy.mil.

For the purposes of ECMRA reporting, the Federal Supply Code/Product Service Code applicable is D319.

The Contractor shall provide the following deliverables: Contractor’s Progress, Status, and Management Report (A006). The Government estimates the frequency of this task will be monthly.

8.0 SYSTEM SECURITY PLAN AND ANY ASSOCIATED PLANS OF ACTION

The Contractor shall, upon request, provide to the Government, a system security plan (or extract thereof) and any associated plans of action developed to satisfy the adequate security requirements of DFARS 252.204-7012, and in accordance with NIST Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”, to describe the Contractor’s unclassified information system(s)/network(s) where covered defense information associated with the execution and performance of this contract is processed, is stored, or transmits.

The Contractor shall, upon request, provide the Government with access to the system security plan(s) (or extracts thereof) and any associated plans of action for each of the Contractor’s tier one level subcontractor(s), vendor(s), and/or supplier(s), and the subcontractor’s tier one level subcontractor(s), vendor(s), and/or supplier(s), who process, store, or transmit covered defense information associated with the execution and performance of this contract.

The Contractor shall provide the following deliverable: System Security Plan and Associated Plans of Action for a Contractor’s Internal Unclassified Information System (A002). The Government estimates the frequency of this task will be no more than twice annually.

9.0 COVERED DEFENSE INFORMATION

9.1 Identify all covered defense information associated with the execution and performance of this contract

The Contractor and the Government/Program Office shall identify and affirm marking requirements for all covered defense information, as prescribed by DoDM 5200.01 Vol 4, Controlled Unclassified Information, and DoDI 5230.24, Distribution Statements on Technical Documents, to be provided to the Contractor, and/or to be developed by the Contractor, associated with the execution and performance of this contract.

UNCLASSIFIED//FOR OFFICIAL USE ONLY (FOUO) 8

9.2 Track all covered defense information associated with the execution and performance of this contract

The Contractor shall document, maintain, and provide to the Government, a record of tier 1 level subcontractors, vendors, and/or suppliers who will receive or develop covered defense information – as defined in DFARS Clause 252.204-7012 and associated with the execution and performance of this contract.

The Contractor shall provide the following deliverable: Contractor’s Record of Tier 1 Level Suppliers Receiving/ Developing Covered Defense Information (A003). The Government estimates the frequency of this task will be no more than monthly.

9.3 Restrict unnecessary sharing and/or flow down of covered defense information associated with the execution and performance of this contract

The Contractor shall restrict unnecessary sharing and/or flow down of covered defense information – as defined in DFARS Clause 252.204-7012 and associated with the execution and performance of this contract – in accordance with marking and dissemination requirements specified in the contract and based on a ‘need-to-know’ to execute and perform the requirements of this contract.

9.4 The Contractor shall flow down the requirements in 9.1, 9.2, and 9.3 to their tier 1 level subcontractors, vendors, and/or suppliers

10.0 TRAVEL

Continental United States (CONUS) travel is required on this contract. The Contractor shall submit Trip/Travel Reports to document that all travel is in accordance with Federal Travel Regulations (FTR). The Contractor shall expect two 5 day trips for two personnel based on the place of performance. For planning purposes, the Contractor shall provide adequate personnel to meet the travel requirements planned over the period of performance for the locations listed below.

The Contractor shall provide the following deliverable: Trip/Travel Report (A001). The Government estimates the frequency of this task will be twice annually.

11.0 CONTRACT ADMINISTRATION

11.1 Place of Performance

The Contractor shall perform the work at Government facilities (NIWC PAC) in San Diego, CA and Contractor-provided facilities within 25 miles of Suitland, MD.

11.2 Period of Performance

The proposed action will have an anticipated Period of Performance (POP) of a one-year base period and four one-year option periods.

UNCLASSIFIED//FOR OFFICIAL USE ONLY (FOUO) 9

11.3