15R4240__-_IA_Support_-_Perf_Work_Statement__Updated_3-3-15.docx

DOCX document 37 KB Posted

Attached to
INFORMATION ASSURANCE SUPPORT Federal contract opportunity
Solicitation number
N0017815R4240
Issued by
Department of the Navy Naval Sea Systems Command

View the file

Other files for this federal contract opportunity

Other files attached to INFORMATION ASSURANCE SUPPORT, newest first.
File Type Posted
15R4240_-_IA_Support_-_CDRL_A001_(CTRs_Progress_Status__Mgmt_Report)_signed.pdf PDF
0122-04_-_IA_Support_-_Bidding_DD254.pdf PDF
15R4240_-_IA_Support_-_Source_Selection_Factors_incl_Tech_Eval_Factors_-_Attachment.doc DOC document

On GovTribe

Work with this file on GovTribe

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file
Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

VALIDATION SERVICES

PERFORMANCE WORK STATEMENT (PWS)

1.0 BACKGROUND

This PWS defines the requirements for Information Assurance / Validation Services support for Information Technology (IT) Systems at Naval Surface Warfare Center, Dahlgren Division (NSWCDD), located in Dahlgren, Virginia. Validation Services are defined as the independent third-party review, testing, and assessment of all information, artifacts, and other relevant data that is provided by the System Point of Contact (POC) (i.e., an Information System Owner (ISO) and/or Information Systems Security Engineer (ISSE)), to facilitate Certification and Accreditation (C&A) via the Naval Sea Systems Command (NAVSEA)/Authorizing Official Designated Representative (AODR) and Operational Designated Accrediting Authority (ODAA) processes. Under the Risk Management Framework (RMF) (when implemented), Validation Services will be equal to the duties of the Security Control Assessor (SCA) and/or SCA Representative. Certification and Accreditation (C&A) is equivalent to the Assessment and Authorization (A&A) approval process. The forms of DoD IT range in size and complexity from individual hardware and software products to stand-alone systems to massive computing environments.

1.1The IT systems fall into two categories:
1.1.1DoD Information Assurance C&A Process (DIACAP): The DoD process for identifying, implementing, validating, certifying, and managing Information Assurance (IA) capabilities and services, expressed as IA Controls (IACs), and authorizing the operation of DoD Information Systems (ISs), including testing in a live environment, in accordance with statutory, Federal, and DoD requirements. These types of IT systems often times consist of commercially available hardware and software such as Commercial Off-The-Shelf (COTS) products, but may consist of Government Off-The-Shelf (GOTS) products as well. Under RMF, DIACAP IT Systems are equivalent to Information Systems, IT Services, and/or IT Products.
1.1.2Platform Information Technology (PIT): Computer resources, both hardware and software, that are physically part of, dedicated to, or essential in real time to the mission performance of special purpose systems such as weapons, training simulators, diagnostic test and maintenance equipment, and calibration equipment used in the research and development of weapon systems, medical technologies, transport vehicles, buildings, and utility distribution systems such as water and electric. These IT systems often times consist of proprietary hardware and software such as Government Off-The-Shelf (GOTS) products, but may consist of Commercial Off-The-Shelf (COTS) products as well. Under RMF, PIT is equivalent to PIT and/or PIT Systems.
1.2The IT systems fall into three categories of complexity which are: small, medium, and large. The complexity distinctions between each are based primarily on: (i) number of operating systems; (ii) number of servers; and, (iii) number of workstations. In addition, for each of the categories, a system could either be DIACAP or PIT.
1.3The categories and percentages of DIACAP and PIT are shown in Table 1.1 (IT System Complexity):
Complexity
# of Operating Systems
# of Servers
# of Workstations
Base Year
Option Year 1
Option Year 2
Small
1-2
0-5
1-25
30
9
6
Medium
3-5
6-10
26-75
24
7
11
Large
6 or more
11 or more
76 or more
6
11
5

TOTAL

60
27
22

Table 1.1, IT System Complexity

1.4Table 1.2 shows the number of returns (based on NSWC Dahlgren historical data in 2012 and 2013) from NAVSEA/ODAA prior to receiving an accreditation decision (i.e., Authority to Operate (ATO)). As can be seen from the table, eleven (11) systems were submitted, not returned and an ATO received. This was the case for 21% of NSWCDD systems. Based on the table, 90% of all systems were returned five (5) times or less:
Systems
# Returns Prior to ATO
% of Total
11
0
21%
5
1
10%
10
2
19%
10
3
19%
4
4
8%
7
5
13%
1
6
2%
1
7
2%
2
8
4%
1
9
2%

Table 1.2, Number of Times Packages Returned Before an Accreditation Was Granted.

2.0 APPLICABLE DOCUMENTS

The list of applicable documents is listed below but is not limited to what is included in the list. Any documents/policies included as references in the below documents are also applicable.

2.1Certification and Accreditation (C&A) Requirements for DoD-Wide Managed Enterprise Services Procurements, DoD Chief Information Officer memorandum, 22 June 2006;
2.2DON CIO Memo 01-09, Information Assurance Policy for Platform Information Technology, 20 January 2009;
2.3DoDI 8500.01, Cybersecurity March 14, 2014;
2.4DoDI 8500.2x Information Assurance Implementation;
2.5DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), March 12, 2014;
2.6DoDD 8570.01, Information Assurance Training, Certification, and Workforce Management;
2.7DoDD 8570.01-M, Information Assurance Workforce Improvement Program;
2.8NIST 800-37, Guide for Security Certification and Accreditation of Federal Information Systems, May 2004;
2.9Navy Certification Agent Qualification Standards and Registration Guidebook; and
2.10Navy Enterprise Mission Assurance Support Service (eMASS) User Guide – Validator , U.S. FLEET CYBER COMMAND, Office of the Navy Operational Designated Accrediting Authority (ODAA), Version X;

2.11 DoN DIACAP HANDBOOK Version 1.0, 15 July 2008;

2.12 NAVSEA eMASS ODAA C&A Business Rules Version X;

2.13 NAVSEA eMASS RDT&E C&A Business Rules Version X.

2.14 NAVSEA eMASS PIT C&A Business (Afloat) Rules Version X;

2.15 NAVSEA eMASS PIT C&A Business (All Other) Rules Version X.

3.0REQUIREMENTS
3.1The Contractor shall provide Validation Services support, to include Validators, for sixty (60) packages in the contract base year, twenty seven (27) packages in option year one, and twenty two (22) packages in option year two for IT Systems that are located at the NSWCDD;
3.2The Validators shall be recognized as a Fully Qualified Navy Validator (FQNV) by the Navy Certification Authority (CA) and shall provide proof of appointment (Labor Qualification/Navy CA Appointment Certification);
3.3The Validators shall be an independent third party;
3.4The Validators shall meet the qualifications in accordance with DoD 8570.01-M Change 3 (IAM Level II);
3.5The Validators shall have experience with DoD Information Assurance Certification and Accreditation Process (DIACAP) and/or the Risk Management Framework (RMF) Lifecycle for evaluation of IT Systems and Platform Information Technology (PIT) Systems or as applicable, revised or changed;
3.6The Validators shall have direct working knowledge and experience with utilizing the Navy’s instance of Enterprise Mission Assurance Support Service (eMASS) in performing the Validator role (in the Control Approval Chain (CAC));
3.7The Validators shall have direct experience with Plan of Actions and Milestones (POA&Ms)/Risk Assessment Reports (RARs) creation/updates, conducting automated/manual scans and reviewing associated reports, DISA Security Compliance Automation Protocol (SCAP), DISA Security Technical Implementation Guides (STIGs), Retina and Assured Compliance Assessment Solution (ACAS) scans and IA/Security Control Assessment/Evaluation as well as Security Assessment Reports;
3.8The Validators shall provide support availability when necessary by phone or e-mail responding to requests within one (1) business day;
3.9The Validators shall be responsible for validating a system’s compliance, non-compliance, or applicability with all associated Information Assurance Controls (IACs) (referred to as Security Controls under RMF) for an assigned DON system, including developing the appropriate test procedures (if necessary); executing the test procedures; and accurately documenting the results of security testing. The Validator shall update the C&A Validation Report documentation for the assigned system(s);
3.10The Validators shall follow the published Navy, NAVSEA Business Rules (i.e., Operational Designated Accrediting Authority (ODAA), Authorizing Official Designated Representative (AODR), and PIT regarding validation. In addition to NSWCDD local policies and procedures, any conflicting interpretations will be resolved by the Government IAM;
3.11The Validators shall obtain or receive a system or site information and use it to evaluate security features of the IT system or site being certified and accredited;
3.12The Validators shall document Certification and Accreditation (C&A) information in the Comprehensive DIACAP package ensuring internal consistency of the information and that there are no omissions;
3.13The Validators shall assist the government by providing input/instructions/guidance as needed for the creation adequate package documentation/artifacts or shall review test plans and procedures to ensure the test plan addresses the correct level of effort and is sufficiently comprehensive to validate all IA requirements applicable to the IT system or site being certified and accredited;
3.14The Validators shall evaluate IA discrepancies and recommend mitigation measures for reducing or eliminating specific risk items. As an agent of the Navy CA, Validators may also engage the Navy CA Liaisons, AODR Reviewers, and ODAA Action Officers (AO) to discuss and obtain mitigation guidance;
3.15The Validators shall optimize C&A test and validation procedure results to ensure the most accurate reporting is done in the appropriate format and that all IA requirements have been addressed;
3.16The Validators shall develop the Certification Determination Letter (CDL) (or RMF equivalent) for the IT system or site seeking certification;
3.17The Validators shall perform all non-technical (i.e., physical and environmental controls) validation activities at NSWCDD;
3.18The Validators shall work with the Information System Security Engineer (ISSE)/Information System Owner (ISO) (equivalent to NSWCDD’s Information Assurance Officer (IAO) to determine fixes or mitigation for weaknesses and to determine the level of revalidation testing that is necessary if immediate fixes are applied;
3.19The Validators shall verify the accuracy of POA&Ms/RARs as identified by actual vulnerability test results/reports;
3.20The Validators shall determine when the C&A Package is complete and ready for submittal to the IAM for review and approval;
3.21The Validators shall respond to all reviewers, to include IAM, NAVSEA, Navy CA, ODAA, or others as needed to questions/comments within 5 calendar days after receipt of reviewer correspondence;
3.22The Validators shall represent NSWCDD IT Systems during Echelon II, Navy CA, and ODAA comment/review periods and collaboration meetings (All collaboration meetings with NAVSEA/ODAA are done via teleconferencing);
3.23The Validators shall perform all other validation activities required;

3.24 The Validators shall schedule, conduct, and record minutes for a monthly meeting to ensure milestones are met;

3.25 The Validators shall work with the System PM IA staff and formulate recommendation/strategies that will aid the system in achieving accreditation/authorization;

3.26 The Validators shall retain all assigned duties for specified systems until the expiration of the contract or until a receipt of an accreditation decision is received;

3.27 After submission of IACs by the ISSE/ISO, validation activities shall be performed within 15 calendar days after entry to eMASS.

NOTE: There is a feature built into eMASS that should notify the Validator (via email) that there is a “Workload Task". In addition the ISSE/ISO should notify the Validator the package is ready for validation.

3.28 Options: Pricing for additional packages shall be provided, as an option, to NSWCDD. The contractor shall provide services for the established number of Validation packages with options to add additional packages in increments of two (2) on an as-needed-basis not to exceed (NTE) twenty (20) in each period of performance (POP) executed under the contract. The contractor shall bill each package at a fixed price for any and all packages based on established criteria of size and requirements.

Complexity
# of Operating Systems
# of Servers
# of Workstations
# of Optional Packages Base Year
# of Optional Packages Option Year 1
# of Optional packages Option Year 2
Small
1-2
0-5
1-25
10
10
10
Medium
3-5
6-10
26-75
8
8
8
Large
6 or more
11 or more
76 or more
2
2
2

TOTAL

20
20
20

Table 3.1 Optional Packages Per Contract Year

4.0DELIVERABLES
4.1The Contractor shall provide progress reports in accordance with CDRL A001.
5.0SECURITY REQUIREMENTS
The Contractor shall maintain a SECRET facility clearance.All personnel performing work under this contract shall be a US Citizen and have a minimum of a Department of Defense (DoD) SECRET security clearance.Personnel hired for an IT support Level-l position will be required an SSBI every 5 years and maintain a SECRET clearance. Personnel security clearances shall be verified by the Contractor in the Joint Personnel Adjudication system (JPAS). On-site personnel shall have a current SECRET clearance at the time of the contract award. Off-site personnel shall have a SECRET security clearance within 30 days of contract issuance. Access to NATO is required to obtain a SIPRnet account. For Official Use Only (FOUO) and Personally Identifiable Information (PII) generated and/or provided under this contract shall be safeguarded and marked as specified in DoD 5400.7-R Chapters 3 and 4.
6.0NON-DISCLOSURE AGREEMENTS/CONFLICT OF INTEREST STATEMENTS

Contractor personnel performing work under this contract shall sign a non-disclosure agreement and conflict of interest statement upon award of the order.

7.0GOVERNMENT FURNISHED INFORMATION
7.1The Government will furnish NSWC Dahlgren C&A packages to the Contractor for validation;
7.2The Government will provide access to the Navy C&A tracking system, eMASS;
7.3The Government will provide non-disclosure agreements and conflict of interest statements; and
7.4The Government will provide work spaces for validators to include all NSWCDD allowable IT equipment, phone, and general office supplies.
8.0TRAVEL

It is anticipated that the contractor will be required to travel during this contract. When travel is required a trip report will be required within 10 days after completion of the trip. Travel will only be required when it is essential for the performance of the tasks.

9.0 LOCATION

All work under this order will be performed on-site at the NSWCDD in Dahlgren, VA.

10.0 TECHNICAL POINTS OF CONTACT

Paul E. Bryan

NSWCDD/1043

6143 Welsh Road Dahlgren, VA 22448 Phone: (540) 653-4150 Email: paul.e.bryan@navy.mil

Eileen Ordonez

NSWCDD/1041

6149 Welsh Road Dahlgren, VA 22448 Phone: (540) 653-6557 Email: eileen.ordonez@navy.mil

File details come from the government source that posted it. Updated .