N0018919QQ136_CDS_RFQ.pdf

SEE ADDENDUM

(No Collect Calls)

N0018919QQ136 13-Sep-2019

b. TELEPHONE NUMBER

717-605-2126

8. OFFER DUE DATE/LOCAL TIME

12:00 PM 17 Sep 2019

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

N001899. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

TAMMI S. REASNER

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

NAVSUP FLC NORFOLK CONTRACTING

MECHANICSBURG OFFICE

TAMMI REASNER, CODE 215.4

5450 CARLISLE PIKE, SUITE 407-WK11

MECHANICSBURG PA 17050-2411

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE N30321 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

NAVAL OCEANOGRAPHY OPERATIONS CMD (NOOC)

JEFFERY LORENS

1100 BALCH BOULEVARD

STENNIS SPACE CENTER MS 39522-5001

TEL: 228-688-5766 FAX: 228-688-5332

717-605-7295FAX:

TEL: 717-605-2126

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

X 8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$30,000,000

NAICS:

541519

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF46

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

N0018919QQ136

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 12 Months Cross Domain Solution Sust Spt Svs

FFP

IAW the attached PWS

FOB: Destination

MILSTRIP: N3032119RC011H2

PSC CD: D318

NET AMT

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0002 1 Each Travel

FFP

Urgent travel for travel requirements in accordance with Section 11.0 of the PWS.

Contractor is authorized to start travel, at the Government's direction when travel is required to perform the duties stated in the PWS. Additional Travel CLIN's may be added as travel requirements are required.

FOB: Destination

MILSTRIP: N3032119RC011H2

PSC CD: D318

NET AMT

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government

0002 Destination Government Destination Government

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 POP 25-SEP-2019 TO

24-SEP-2020

N/A NAVAL OCEANOGRAPHY OPERATIONS

CMD (NOOC)

JEFFERY LORENS

1100 BALCH BOULEVARD

STENNIS SPACE CENTER MS 39522-5001

228-688-5766

FOB: Destination

N30321

0002 POP 25-SEP-2019 TO

24-SEP-2020

N/A (SAME AS PREVIOUS LOCATION)

FOB: Destination

N30321

PERFORMANCE WORK STATEMENT

Performance Work Statement (PWS)

METOC Cross Domain Solution Support Services

1.0 Introduction:

Naval Oceanography Operations Command (NOOC) is acquiring contractor support services for

Cross Domain Solution (CDS) project management and sustainment engineering work. These services are required to allow Navy Meteorology and Oceanography (METOC) commands the capability to provide 24x7 global weather and ocean model prediction products and services, weather satellite imagery products, tropical cyclone divert and sortie recommendations, and related tactical decision aids and data in support of Naval Joint and Coalition operations worldwide.

2.0 Background:

The CDS systems in use at Fleet Numerical Meteorology & Oceanography Center (FNMOC), Naval Oceanographic Office (NAVO), Fleet Weather Center Norfolk (FWC-N), Fleet Weather

Center San Diego (FWC-SD), and Joint Typhoon Warning Center (JTWC) support the operational capabilities identified in Section 1.0. Contractor support services are necessary to sustain the proper operation of METOC CDS systems including all programmatic, engineering, and accreditation support activities necessary for the operation of the current systems and their eventual replacements to prevent any negative impacts to the METOC commands’ ability to provide the afore mentioned operational capabilities.

The current Secret and Below Interoperability (SABI) CDS systems in use are Forcepoint High

Speed Guard (HSG) systems running version 3.0.x.x of the HSG operating system and proxy software. The Joint Architecture Study (JAS) proxy provided by the HSG is the only proxy used. In total there are ten HSG systems running in five redundant pairs of two. Each pair is supported by a single administration server. The HSG systems interface with the sites’ local enclaves via endpoint servers running RHEL 6 operating systems, JAS transfer software, and custom Perl and bash scripts. The current CDS systems maintain a Cross Domain Solution

Authorization (CDSA) granted by the DSAWG. The CDS currently supports the automated, low latency, high bandwidth transfer of 53 data types ranging in complexity from common imagery and text files to specialized meteorological data types.

The currently utilized CDS (HSG version 3) is nearing end of life and will need to be replaced within the next couple years. A requirements reassessment is underway to redefine data transfer requirements and determine a suitable replacement for the aging CDS systems. In the future it is expected that some data will be transferred by the Defense Information Systems Agency (DISA)

Cross Domain Enterprise Service (CDES) and the remainder will continue to be transferred by point to point CDS implementations similar to the local CDSs in operation currently. The data that will continue to be transferred by a local point to point CDS will drive what replacement

CDS is most suitable. This replacement CDS may or may not be the next accredited version of

HSG. This effort will be headed up by a cross functional team comprised of all METOC CDS users and will be supported by the NOOC and this support contract.

The sustainment of the current and future physical CDS systems, associated software, and accreditation (i.e. Authority to Operate (ATO)) is centrally managed by the NOOC on behalf of all METOC commands. This central management is beneficial to realize economies of scale and to reduce the overall administrative burden of operating the CDS systems. While there are system administrators at each site that provide the day to day care for the CDS systems, they often reach back to the NOOC for guidance, troubleshooting support, and all software updates and configuration changes. The intent of this contract is to fulfill the role of the NOOC centralized management.

2.1 Requiring Organization: The organization requiring the services outlined in the

PWS is:

Naval Oceanography Operations Command (NOOC)

1002 Balch Boulevard

Stennis Space Center, MS 39522

3.0 Scope:

This effort includes all aspects of the operational SABI CDS systems in use at the METOC centers (FNMOC, NAVO, FWC-N, FWC-SD, and JTWC), the integration platform within the

NOOC Systems Integration Environment (SIE), collocated with NAVO, and their eventual replacements.

4.0 Directives:

Perform day-to-day management of and oversee all aspects of the METOC CDS to ensure any required technology assessments, systems design, systems analysis, programmatic support, quality assurance, acquisition planning, and budget planning are conducted as appropriate.

Organize, direct, and coordinate the planning and production of all activities and deliverables associated with the project. Such activities include system and software engineering support for the CDS, creation and update of system and software engineering documentation, installation of approved patches at all CDS operational locations in accordance with system and local site procedures, including ensuring operational success according to a Systems Operational

Verification Test (SOVT), providing system administration support with cybersecurity inspections of the CDS as well as with Security Test & Evaluations (ST&Es) and Joint

Vulnerability Assessment Procedures (JVAPs), updating all Cross Domain Appendixes (CDAs) as needed to support and reflect changes made to the CDS, supporting systems, and operating environment, and providing system and software engineering support for the endpoint servers.

Contract deliverables and work must follow applicable cybersecurity directives and shall align to

Defense Security Accreditation Working Group (DSAWG) guidance, National Security Agency

(NSA) direction for “raising the bar” on CDS security, and direction to utilize enterprise CDS capabilities where possible.

5.0 Requirements/Tasks:

Per DFARS 211.106, contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence.

Task Area 1 – Project Management

The Contractor shall:

1) Maintain current and future CDS and its ATO

a) Prepare and present overall status update briefings to management, leadership, and stakeholders.

b) Provide a comprehensive risk management plan to address, identify, assess, and provide prioritization of risks (including how risks will be recorded, reported and mitigated).

i) Plans shall include the full range of risks that could impact the project including but not limited to resources, access, physical and cyber security, and unplanned events.

ii) Identify high risk factors and develop a mitigation plan to reduce or eliminate the risk. Upon Government approval, the Contractor shall implement and monitor the selected mitigation.

c) Host meetings and tele-conferences for CDS project activities.

d) Provide monthly status reports on CDS related activities.

e) Prepare Documentation to support the continued services of the Navy Cross Domain

Solution Office (NCDSO).

i) Draft Information Technology Requirements Documents (ITRDs).

ii) Draft Information Technology Procurement Requests (ITPRs).

iii) Provide an assessment on the alignment of SPAWAR provided Statements of Work

(SOW) and current NOOC CDS project plans.

f) Update Cross Domain Appendix (CDA) documents to address any changes to verbiage or diagrams so that documents accurately reflect the operational systems.

g) Conduct annual JVAP assessments at (FNMOC, NAVO, FWC-N, FWC-SD, JTWC).

e) Review site self-assessment compliance reports (ST&E reports) and spot check.

f) Assess Site's compliance with required CDS periodic maintenance activities. (E.G. Virus definition updates, Log review and archive, etc…)

g) Collect data for CDES questionnaires as required for revalidation of CDSAs.

h) Complete CDES questionnaires and submit to NCDSO as required for revalidation of

CDSAs.

i) Work with the NCDSO to request reaccreditation/revalidation of CDS Tickets.

j) Attend Cross Domain Technical Advisory Board (CDTAB), DSAWG, and Information

Security Risk Management Committee (ISRMC) meetings every time METOC CDS tickets are on the agenda for discussion and/or approval.

k) Write briefs/point-papers/presentations for project stakeholders, CDTAB, DSAWG, &

ISRMC boards, and management.

l) Prepare documentation in support of and provide reminders to government approvers to assist with the timely renewal of hardware and software maintenance licenses.

i) Conduct market research for renewal of hardware and software maintenance.

ii) Assist with the preparation of other procurement package documents for the renewal of hardware and software maintenance licenses.

m) Maintain a log and/or database of reported issues and status of resolution.

n) Keep abreast of frequently changing CDS processes and emerging CDS risks as promulgated by CDTAB and DSAWG.

i) Review DSAWG Agendas

ii) Review DSAWG Minutes

iii) Review DSAWG Briefings

o) Work with project engineers to develop/integrate technical mechanisms to address/mitigate risks.

p) Attend, observe, and/or assist sites with CDS inspections during stage 2 & 3 cyber security inspections.

q) Ensure all project documentation is up-to-date, stored in a centralized location, accessible, and backed up routinely. Project documentation includes but is not limited to:

CDAs, Data validation Guide (DVG), Data Owner’s Guide (DOG), Privileged User

Guide (PUG) Addendum, Engineering Docs and Diagrams, Project Plans, Briefings, White Papers, etc…

r) Respond to CDS data calls from NCDSO and Commander Naval Meteorology &

Oceanography Command (CNMOC) and answer for all METOC CDS systems.

2) Maintain Security of Operational CDS (Security Patches)

a) Prepare documentation to assist government approvers with requests for funding for software and filter patch creation.

i) Draft ITRDs with appropriate verbiage using correct template.

ii) Draft ITPR executive summary and other verbiage.

b) Work with vendor to obtain software and filter patches.

c) Work with the vendor and governing bodies to obtain patch approval.

i) Prepare documentation to assist government approvers with requests for funding for

Lab Based Security Assessment (LBSA) of software and filter patches.

ii) Attend meetings with the vendor, Air Force Weather Agency (AFWA aka 557th

Weather Wing), DISA, NCDSO, Space and Naval Warfare Systems Command

(SPAWAR), Unified Cross Domain Solution Management Office (UCDSMO), CDTAB, and/or DSAWG throughout the approval process.

d) Work with NCDSO for approval to deploy patches, updated ruleset, and/or configuration changes.

i) Update CDAs including associated diagrams and supporting documents.

ii) Ensure Data Owner’s Guide (DOG) is updated appropriately

iii) Ensure PUG Addendum and other configuration documents and diagrams are updated appropriately.

iv) Ensure Site Based Security Assessment (SBSA aka ST&E) procedures are updated appropriately.

e) Coordinate among all CDS owners across METOC to deliver and schedule application of patches, updated ruleset, and/or configuration changes.

f) Track the deployment of patches, updated rulesets, and/or configuration changes across

METOC.

g) Collect SBSA artifacts post-deployment for NCDSO submission.

3) Adapt CDS to changing mission requirements (Changes to Filters or Configuration)

a) Maintain and update CDS requirements as needed.

i) Revalidate existing requirements with sites periodically (At lease Annually).

ii) For each file transfer requirement, identify a site stakeholder and technical POC.

iii) Provide technical guidance to assist decision makers decide whether or not to include a new requirement based on operational necessity and cost.

b) Prepare documentation to assist government approvers with requests for funding for implementing required changes if required.

i) Draft ITRDs with appropriate verbiage using correct template.

ii) Draft ITPR executive summary and other verbiage.

c) Assist with the preparation of procurement package documents for new requirements.

d) Shepherd Enterprise Change Requests (ECRs) or other tracking system requests to prevent oversights or items falling through the cracks.

e) Work with NCDSO for approval to deploy updated ruleset and/or configuration changes.

4) Provide Training and Guidance to CDS users

a) Assist with interpretations of JVAP checks, DVG, and other CDS related guidance.

b) Provide most current copies of vendor support contracts, CDSA letters, and other documentation when requested by site personnel.

c) Assist site Information Security (IS) personnel with understanding the CDS accreditation process.

d) Assist site users and admins in understanding the CDS change process.

5) Requirements Reassessment Support

a) Assist with the collection of data and CDS usage metrics in support of requirement reassessment efforts.

b) Keep abreast of frequently changing CDS processes and emerging CDS risks as promulgated by CDTAB and DSAWG.

c) Work with project engineers to develop/integrate technical mechanisms to address/mitigate risks.

d) Assist with the preparation of documentation and reports in support of requirement

Task Area 2 – Engineering Support

The Contractor shall:

1) Maintain current and future CDS and its ATO

a) Attend meetings and tele-conferences for CDS project activities.

b) Respond to bug reports from site engineers/administrators.

c) Trouble shoot and provide data to the vendor to aid the resolution of bugs found within the CDS and other vendor maintained components.

d) Work with the vendor to fine-tune/tweak rulesets and configurations to resolve reported issues.

e) Work to plan/develop/integrate technical mechanisms to address/mitigate risks identified by the CDTAB and DSAWG approving boards.

f) Collect, analyze, and report data types and volume CDS usage metrics for all METOC

CDS sites.

i) Assist the collection of usage metrics by creation of automated collection scripts and other technical means as appropriate.

2) Maintain Security of Operational CDS

a) Evaluate CDS software and filter patches/updates for performance impacts and viability for operational use.

i) Update SIE systems to run new patch if applicable.

ii) Validate patch with recent test data.

b) Maintain test data sample files for testing.

c) Maintain the CDS in the SIE for evaluation purposes if applicable.

d) Ensure the baseline endpoint custom scripts and configurations are up-to-date and backed up.

e) Evaluate the endpoint custom scripts and configurations for any needed updates. The following are examples of the endpoint custom scripts and configurations:

i) JAS Sort (Custom Perl scripts)

ii) Scripts for log management (Shell scripts)

iii) Scripts for log analysis (Shell scripts)

iv) JAS configurations and RPMs

f) Document any changes made to the CDS, endpoints, custom scripts, and/or configurations and ensure related engineering documents and diagrams are updated accordingly.

g) Send endpoint script and configuration updates to the sites for installation and operational use.

h) Work with site engineers/administrators to update/correct endpoint configurations as required.

i) Track the site’s progress applying any updates and document any post application artifacts or site specific changes made.

3) Adapt CDS to changing mission requirements

a) Review new requirements for completeness.

b) Manage the adaptation of the system to accommodate the new requirements.

i) Make changes to the rule code or system to accommodate the new requirements

(changes may be filter changes, guard configuration changes, endpoint changes, or whatever combination required to accommodate the new requirements).

ii) Test changes

iii) Baseline / Configuration Manage (CM) changes to the CDS and associated systems

(E.G. Endpoints).

iv) Write new or adapt existing SOVT to validate correct operation of operational system post application of changes.

v) Assist in obtaining approval to apply changes to operational systems.

vi) Write installation instructions and oversee application of changes.

c) Collect/analyze/report any artifacts from application of changes.

4) Provide Training and Guidance to CDS users

a) Assist users identifying why data will not pass through the CDS.

b) Assist site admins in understanding endpoint and CDS system configurations.

c) Provide training to new users and site CDS admins on how to utilize and manage the system.

5) Requirements Reassessment Support

a) Collect, analyze, and report data types and volume CDS usage metrics for all METOC

CDS sites.

i) Assist the collection of usage metrics by creation of automated collection scripts and other technical means as appropriate.

b) Assist with the determination of technical and non-technical mechanisms within future

CDS and surrounding system implementations to address/mitigate risks identified by the

CDTAB and DSAWG approving boards.

c) Assist with the preparation of documentation and reports in support of requirement

Task Area 1 – Project Management

Performance Standard Acceptable Quality Level (AQL) Frequency & Surveillance Method

Prepare and present overall status update briefings to management, leadership, and stakeholders

Target Criteria:

A status update brief detailing planned work, completed work, risks, issues, and impediments is presented to management once every 2 months.

Minimum Acceptable:

A status update brief detailing planned

The number of Calendar days between status update briefings shall not exceed 93 days with 62 days preferred. The first status update briefing shall be provided within 90 calendar days from the start of the period of performance.

Government management or a subject matter expert will review the work to insure acceptable quality levels are maintained.

work, completed work, risks, issues, and impediments is presented to management once every 3 months.

Provide a comprehensive risk management plan

Comprehensive risk management plan is provided to management monthly that identify, assess, and provide prioritization of risks (including how risks will be recorded, reported and mitigated).

Mitigation plans will be provided for all

Critical and High priority risks.

Comprehensive risk management plan is provided to management every 3 months that identify, assess, and provide prioritization of risks (including how risks will be recorded, reported and mitigated). Mitigation plans will be provided for all Critical and High priority risks.

The number of Calendar days between risk management plan deliveries shall not exceed 93 days with 31 days preferred. The first risk management plan shall be provided within 90 calendar days from the start of the period of performance.

acceptable quality levels are maintained.

Monthly Status Report Each status report shall contain the following information at a minimum:

a. Tasks completed during the reporting period

b. Current Issues

c. Upcoming Travel

d. Requests for revised work product due dates to include the justification for the request.

e. Anticipated activity for next reporting period

Each monthly status report shall be submitted not later than 5 business days after the end of the month reported on.

acceptable quality levels are maintained.

Update Cross Domain

Appendix (CDA) documents

Documentation is not returned to the author with defects more than 2 times during a review process with the NCDSO author with defects more than 5 times during a review process with the

NCDSO.

Government management or a subject matter expert will be copied on all communications between the contractor and the NCDSO and be able to observe the number of times the documents are returned for correction.

Conduct annual JVAP assessments

Assessments are completed prior to any stage 3 cyber security inspections and in time to send results to the NCDSO for the revalidation of the CDS Tickets. 100% of all finding found are corrected or otherwise resolved.

Government management or a subject matter expert will be copied on all communications between the contractor and the NCDSO and be able to inspect documentation and the timeliness of its submittal.

Assessments are completed in time to send results to the NCDSO for the revalidation of the CDS Tickets. 80% of all finding found are corrected or otherwise resolved.

Review site self-assessment compliance reports (ST&E reports)

Reviews are completed prior to any stage

3 cyber security inspections and in time to send results to the NCDSO for the revalidation of the CDS Tickets. 100% of all finding found are corrected or

Reviews are completed in time to send results to the NCDSO for the revalidation of the CDS Tickets. 80% of all finding found are corrected or otherwise resolved.

matter expert will be copied on all communications between the contractor and the NCDSO and be able to inspect documentation and the timeliness of its submittal.

Assess site's compliance Target Criteria:

Compliance assessments are completed prior to any stage 3 cyber security inspections and in time to send results to the NCDSO for the revalidation of the

CDS Tickets. 100% of all finding found are corrected or otherwise resolved.

Compliance assessments are completed in time to send results to the NCDSO for the revalidation of the CDS Tickets. 80% of all finding found are corrected or communications between the contractor and the NCDSO and be able to inspect documentation and the timeliness of its submittal.

Collect data for CDES questionnaires

Data is 100% representative of data types used and 90% representative of data volume used.

Data collection is completed within 4 months of the start of the period of performance.

Number of datatypes present in CDS logs match number of data types reported.

used and 80% representative of data

Data collection is completed within 6

Complete CDES questionnaires and submit to NCDSO during a review process with the NCDSO during a review process with the

NCDSO.

Government management or a subject matter expert will be copied on all communications between the contractor and the NCDSO and be able to observe the number of times the documents are returned for correction.

Work with NCDSO to request reaccreditation/ revalidation of

CDS Tickets

All CDS Tickets are granted new CDSA

Letters at least 1 month prior to the expiration of the previous CDSA Letters.

All CDS Tickets are granted approval to continue operation via DSAWG ballot prior to the expiration of the previous

CDSA Letters.

matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Write briefs/point-papers/presentations for project stakeholders, CDTAB, DSAWG, & ISRMC boards, and management during a review process.

author with defects more than 3 times during a review process.

Government management or a subject matter expert inspection.

Maintain a log and/or database of reported issues and status of resolution

All reported issues are recorded and tracked so no issues are lost. Number of active issues being tracked and resolution of issues will be reported during monthly status reports.

All reported issues are recorded and matter expert will be apprised of number of issues and resolutions within monthly status reports.

tracked so no issues are lost. Number of active issues being tracked will be reported during monthly status reports.

Keep abreast of frequently changing CDS processes and emerging CDS risks

All DSAWG meeting agendas, minutes, and relevant briefings are reviewed within 1 week of being posted.

All DSAWG meeting agendas, minutes, and relevant briefings are reviewed within 2 weeks of being posted.

relevant developments as part of the periodic status briefings and updates to the risk management plan.

Attend, observe, and/or assist sites with CDS inspections during stage 2 & 3 cyber security inspections

Site representatives are assisted in documentation updates, findings mitigation, and STIG check interpretation so that 100% of all checks do not constitute a finding when assessed by a cyber security inspector.

Site representatives are assisted in documentation updates, findings mitigation, and STIG check interpretation so that 95% of all checks do not constitute a finding when assessed by a cyber security inspector.

relevant developments as part of the periodic status briefings and updates to the risk management plan.

Ensure all project documentation is up-to-date, stored in a centralized location, accessible, and backed up routinely

All data is maintained on two separate, geographically dispersed USG systems and directly accessible by government management and subject matter experts.

All data is maintained on USG systems management and subject matter experts.

Government management or a subject matter expert inspection.

Respond to CDS data calls from NCDSO and CNMOC

All data calls are answered by the required due date with the information requested.

When data requested is not obtainable by matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

the due date of the data call, the contractor must report that to the requesting agency within two business days and assist in the formulation of a mutually acceptable plan to resolve the data call.

Prepare documentation to assist government approvers with requests for funding for software and filter patch creation during a review process with the government Financial Management (FM) specialists.

during a review process with the government FM specialists.

Government management or a subject matter expert inspection.

Work with the vendor and governing bodies to obtain patch approval

Approval is obtained within 6 months of making the request.

Approval is obtained within 18 months of relevant developments as part of the periodic status briefings and updates to the risk management plan.

Work with NCDSO for approval to deploy patches, updated ruleset, and/or configuration changes

Approval is obtained within 3 months of relevant developments as part of the periodic status briefings and updates to the risk management plan.

Coordinate among all CDS owners across METOC to deliver and schedule application of patches, updated ruleset, and/or configuration changes

Application of patches occurs within the window granted by the DSAWG or other approving bodies.

Application of patches occurs within the window granted by the DSAWG or other approving bodies.

relevant developments as part of the periodic status briefings and updates to the risk management plan.

Collect SBSA artifacts post-deployment for NCDSO submission

Artifacts are submitted to the NCDSO as communications between the contractor and required within 2 weeks of their collection.

Artifacts are submitted to the NCDSO as required within 4 weeks of their collection.

the NCDSO and be able to observe artifact submission.

Maintain and update CDS requirements as needed

Documented requirements are revalidated at least annually and updated when necessary to include all associated information and supporting documents.

Documented requirements are revalidated at least annually and updated when necessary to include all associated information and supporting documents.

relevant developments as part of the periodic status briefings and updates to the risk management plan.

Prepare documentation to assist government approvers with requests for funding for implementing required changes if required during a review process with the government FM specialists.

during a review process with the government FM specialists.

Government management or a subject matter expert inspection.

Assist with the preparation of procurement package documents for new requirements during a review process with the government FM specialists.

during a review process with the government FM specialists.

Government management or a subject matter expert inspection.

Work with NCDSO for approval to deploy updated ruleset and/or configuration

Approval is obtained within 3 months of matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Provide most current copies of vendor support contracts, CDSA letters, and other documentation when requested

Reply with requested documents or helpful information within 1 business days of receiving requests.

Reply with requested documents or helpful information within 3 business days of receiving requests.

Requests will be tracked as issues.

matter expert will be apprised of number of issues and resolutions within monthly status reports.

Task Area 2 – Engineering Support

Performance Standard Acceptable Quality Level (AQL) Frequency & Surveillance Method

Respond to bug reports from site engineers/administrators

Respond to bug reports within 1 business day of receiving a report.

Respond to bug reports within 2 business days of receiving a report.

Bug reports will be tracked as issues.

Government management or a subject matter expert will be apprised of number of issues and resolutions within monthly status reports.

Trouble shoot and provide data to the CDS vendor to aid the resolution of bugs

Provide Data within 2 weeks of the bug being reported or discovered.

Provide Data within 4 weeks of the bug being reported or discovered.

Bug reports will be tracked as issues.

matter expert will be apprised of number of issues and resolutions within monthly status reports.

Work with the vendor to fine-tune/tweak rulesets and configurations to resolve reported issues

All reported issues are resolved by 3 weeks after each issue is reported.

When a reported issue is not resolvable in a reasonable length of time, the contractor must report that to the reporting site within five business days and assist in the formulation of a mutually acceptable plan to resolve the issue.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Work to plan/develop/ integrate technical mechanisms to address/ mitigate risks identified by the CDTAB and

DSAWG approving boards

Mechanisms are found to be acceptable by the NCDSO and not returned to the author with defects more than 2 times during a review process with the NCDSO

Mechanisms are found to be acceptable by the NCDSO and not returned to the author with defects more than 5 times during a review process with the NCDSO.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Collect, analyze, and report data types and volume usage metrics for all METOC CDS sites used and 90% representative of data

Data collection is completed within 4 used and 80% representative of data

Data collection is completed within 6

Number of datatypes present in CDS logs match number of data types reported with government management or subject matter expert inspection.

Evaluate CDS software and filter patches/updates for performance impacts and viability for operational use

Performance evaluation is completed in a real-world environment that uses the same software and hardware as the operational systems.

Performance evaluation is completed in a close to real-world environment were the software and hardware used in appropriate to evaluate the changes under test.

relevant developments as part of the periodic status briefings and updates to the risk management plan.

Ensure the baseline endpoint custom scripts and configurations are up-to-date and backed up

All data is maintained on two separate, geographically dispersed USG systems matter expert inspection.

All data is maintained on USG systems

Evaluate the endpoint custom scripts and configurations for any needed updates

All endpoint custom scripts and configurations are evaluated to identify any changes needed to accommodate user and STIG requirement changes, endpoint operating system changes, or any other

CDS related changes every 6 months.

All endpoint custom scripts and configurations are evaluated to identify any changes needed to accommodate user and STIG requirement changes, endpoint operating system changes, or any other

CDS related changes annually.

relevant developments as part of the periodic status briefings and updates to the risk management plan.

Document any changes made to the CDS, endpoints, custom scripts, and/or configurations and ensure related engineering documents and diagrams are updated accordingly

Update all affected documentation during the course of the work of changing the system

Update all affected documentation within two weeks of completion of work.

matter expert inspection.

Track the site’s progress applying any updates and document any post application artifacts or site specific changes made

Installation progress will be tracked as an issue and any artifacts are documented and backed up within one week of completion of installation activities.

Installation progress will be tracked as an issue and any artifacts are documented and backed up within three weeks of completion of installation activities.

Installations will be tracked as issues.

matter expert will be apprised of number of issues and resolutions within monthly status reports.

Review new requirements for completeness

Review requirements and request additional information from the requester within one week of receiving the request.

New requirements will be tracked as issues. Government management or a subject matter expert will be apprised of number of issues and resolutions within monthly status reports.

Review requirements and request additional information from the requester within two weeks of receiving the request.

Manage the adaptation of the system to accommodate the new requirements

When possible new requirements should be worked into the operational systems within 4 months. Changes to the system will be made in conjunction with other system updates or changes when possible to minimize the overall numbers of times the systems are modified.

When possible new requirements should be worked into the operational systems within 8 months. Changes to the system will be made in conjunction with other system updates or changes when possible to minimize the overall numbers of times the systems are modified.

relevant developments as part of the periodic status briefings and updates to the risk management plan.

Collect/analyze/report any artifacts from application of

Artifacts should be collected analyzed and reported within 2 weeks of the conclusion of the application of changes. Artifacts and reports should be made available to the

NCDSO for review if necessary.

Artifacts should be collected analyzed and reported within 4 weeks of the conclusion of the application of changes. Artifacts and reports should be made available to the

NCDSO for review if necessary.

communications between the contractor and the NCDSO and be able to observe artifact submission.

6.0 Deliverables:

The support and sustainment of the CDS requires constant and consistent effort, however, the specific tasks are not always predictable in advance. Expected contract deliverables have been identified. The frequency and due dates of deliverable items have been stated when possible within the performance standard tables above.

1. Studies and Analyses

2. Plans (Systems Engineering, Project, Integrated Master Plans, Program Management)

3. Concepts of Operations

4. Work Breakdown Structures (WBS)

5. Functional, performance and technical requirements

6. Systems and Software requirements

7. Architecture artifacts

8. Planning, identification, analysis, handling and monitoring for risks and issues

9. Various documentation

10. Implementation plans

11. System Verification Plans and System Validation Plans

12. Systems Integration Master Plan (SIMP) and System Lifecycle Sustainment Plan

13. Monthly Report

14. Post-travel summary

15. Briefings, presentations, demonstrations

16. Meeting Minutes/Summaries

17. Functional code/scripts/configurations

18. Risk management plans

19. Procurement package documentation (E.G. ITRDs, ITPR worksheets, Market Research, SOWs, Salient Characteristics)

Scheduling Requirements:

All Deliverables will be provided on or before a date agreed upon by the contractor and the government that is sufficiently before the end of the period of performance to provide enough time for the contractor to correct any issues found by government review.

Any rework or correction of identified issues will be completed before the end of the period of performance to the extent possible.

7.0 Assumptions

The following assumptions are provided:

HSG version 3 is expected to be put on the sunset list and disapproved for operational use within the next couple of years. The exact timeline for this is unknown as the next version of HSG suitable for SABI use is currently undergoing accreditation testing.

The HSG systems currently in use at the METOC sites will continue to be covered under an active maintenance contract which includes software patches and vendor technical support.

Once the requirements reassessment has been conducted and a replacement CDS implementation has been solidified, additional contracts will be put in place with the selected CDS vendor(s) to do the heavy lifting needed for filter creation and any accreditation work that is required.

8.0 Qualifications/Experience:

Contractor personnel are expected to be high-level self-starters with demonstrated technical, operational, and project management experience in the appropriate functions. The Government anticipates that much of the work shall require independent performance. Personnel assigned to tasks must keep current on the respective technologies and programmatic advancements associated with the contract. The skill sets of the contractor personnel shall enable fulfillment of the responsibilities identified in Section 5. The contractor is responsible for providing personnel who are fully qualified to perform the requirements identified in this performance work statement and who possess the expertise and experience as identified below:

1. General knowledge of the CDS systems, their configuration, and security mechanisms

2. Comprehensive understanding of the SABI process and documentation required by it

3. Familiarity with the SABI Cross Domain Solution (CDS) process and the workings of the

CDTAB and DSAWG boards.

4. A Secret or greater security clearance is required to access and work on classified documentation and a Single Scope Background Investigation (SSBI) is required for privileged access to systems.

5. Approved Cybersecurity workforce certifications appropriate for each category and level as listed in the current version of SECNAVINST 5239.20A

6. Appropriate operating system certification for Cybersecurity technical positions as required by SECNAVINST 5239.20A

7. Experience in Risk Management Framework (RMF), DoD Information Assurance

Certification and Accreditation Program (DIACAP), and CDS risk models (RDAC and

CDRM)

8. Comprehensive knowledge of RHEL and shell scripts

9. Comprehensive knowledge of C and Perl programming languages

10. Knowledge of the Joint Architecture Study data transfer protocol, its software components, and configuration

11. Other training, experience and certifications necessary to perform all duties and roles as required

9.0 Period of Performance:

The period of performance will be 25 September 2019 – 24 September 2020.

The contractor shall perform Monday through Friday excluding all Federal holidays, with core hours of 8:00 am to 4:30 pm. The contractor shall have a protocol that their employees are to follow when the government work site is closed due to in-clement weather, hazardous conditions, or other special circumstances. The COR may direct the contractor in these instances to provide sufficient personnel under non-hazardous conditions to complete or continue work already in process or provide on-call response in accordance with the PWS.

As directed by the COR, the contractor shall continue performance in emergency or mission essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

10.0 Place of Performance:

Naval Oceanography Operations Command (NOOC): Stennis Space Center, MS

Alternate Place of Performance - Contingency Only. As determined by the Contracting Officer’s

Representative (COR), contractor employees may be required to work at an alternate place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather, government shutdowns, etc.). Non-emergency/non-essential contractors should not report to a closed government facility.

Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

11.0 Travel:

Contractor travel may be required to travel for the purposes of performing this requirement.

Travel destinations may include: Commander Naval Meteorology & Oceanography Command

(CNMOC): Stennis Space Center, MS, Fleet Numerical Meteorology & Oceanography Center

(FNMOC): Monterey, CA, Naval Oceanographic Office (NAVO): Stennis Space Center, MS, Fleet Weather Center San Diego (FWC-SD): San Diego CA, Joint Typhoon Warning Center

(JTWC): Pearl Harbor, HI, CDTAB & DSAWG Meeting Locations: Baltimore, MD and vicinity, Off-site contractor locations. When travel is required, the contractor is responsible for making all needed arrangements for their personnel.

All travel will be firm-fixed price, not as direct travel cost reimbursement. Travel has the potential to be urgent in nature. Urgent travel is defined as travel requirement identified 10 business days or less before travel is to commence. A CLIN has been established to provide the contractor the ability to travel immediatley by the direction of the Government, up to the Not to

Exceed (NTE) price of the line item. When urgent travel is required, the Contractor shall provide a FFP quote to the Contracting Office and COR within two business days of notice that travel is required. Urgent travel price shall be negotiated, when possible, prior to travel commencing. The urgent travel CLIN will be modified to the negotiated price for that travel requirement. Non-urgent travel shall be negotiated and contract modification executed prior to travel commencing.

All travel, to include urgent, will be evaluated to determine the price fair and reasonable; the contractor may be required to provide supporting documentation to support their travel prices.

Additional travel line items will be incorporated into the purchase order by modification when travel is required. All travel shall follow the authorized travel expenses in the Joint Travel

Regualtion (JTR).

12.0 Security:

The work to be performed under this contract is up to the Secret level. Therefore, contractor personnel must be cleared to the Secret level and the contractor must have a final Secret Facility

Clearance from the Defense Security Service Facility Clearance Branch if performing work within that facility.

13.0 Clauses:

Section 508 Compliance

Section 508 of the Rehabilitation Act requires Federal agencies to make their electronic and information technology accessible to people with disabilities. This applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology.

All electronic and information technology (EIT) procured through this task order must meet the applicable accessibility standards specified in 36 CFR 1194.2, unless an agency exception to this requirement exists. Any agency exceptions applicable to this task order are listed below.

The standards define Electronic and Information Technology, in part, as “any equipment or interconnected system or subsystem of equipment that is used in the creation, conversion, or duplication of data or information.” The standards define the type of technology covered and set forth provisions that establish a minimum level of accessibility. The application section of the standards (1194.2) outlines the scope and coverage of the standards. The standards cover the full range of electronic and information technologies in the Federal sector, including those used for communication, duplication, computing, storage, presentation, control transport and production.

This includes computers, software, networks, peripherals and other types of electronic office equipment.

Changes

(a) The Contracting Officer may at any time, by written order, and without notice to the sureties, if any, make changes within the general scope of this contract in any…