N0018919QQ136_DRAFT_N0018919QQ136.docx

N0018919QQ136

Section SF 1449 - CONTINUATION SHEET

Cross Domain Solution Sust Spt Svs

FFP

IAW the attached PWS FOB: Destination

MILSTRIP: N3032119RC011H2

PSC CD: D318

NET AMT

PERFORMANCE WORK STATEMENT

Performance Work Statement (PWS) METOC Cross Domain Solution Support Services

1.0 Introduction:

Naval Oceanography Operations Command (NOOC) is acquiring contractor support services for Cross Domain Solution (CDS) project management and sustainment engineering work. These services are required to allow Navy Meteorology and Oceanography (METOC) commands the capability to provide 24x7 global weather and ocean model prediction products and services, weather satellite imagery products, tropical cyclone divert and sortie recommendations, and related tactical decision aids and data in support of Naval Joint and Coalition operations worldwide.

2.0 Background:

The CDS systems in use at Fleet Numerical Meteorology & Oceanography Center (FNMOC), Naval Oceanographic Office (NAVO), Fleet Weather Center Norfolk (FWC-N), Fleet Weather Center San Diego (FWC-SD), and Joint Typhoon Warning Center (JTWC) support the operational capabilities identified in Section 1.0. Contractor support services are necessary to sustain the proper operation of METOC CDS systems including all programmatic, engineering, and accreditation support activities necessary for the operation of the current systems and their eventual replacements to prevent any negative impacts to the METOC commands’ ability to provide the afore mentioned operational capabilities.

The current Secret and Below Interoperability (SABI) CDS systems in use are Forcepoint High Speed Guard (HSG) systems running version 3.0.x.x of the HSG operating system and proxy software. The Joint Architecture Study (JAS) proxy provided by the HSG is the only proxy used. In total there are ten HSG systems running in five redundant pairs of two. Each pair is supported by a single administration server. The HSG systems interface with the sites’ local enclaves via endpoint servers running RHEL 6 operating systems, JAS transfer software, and custom Perl and bash scripts. The current CDS systems maintain a Cross Domain Solution Authorization (CDSA) granted by the DSAWG. The CDS currently supports the automated, low latency, high bandwidth transfer of 53 data types ranging in complexity from common imagery and text files to specialized meteorological data types.

The currently utilized CDS (HSG version 3) is nearing end of life and will need to be replaced within the next couple years. A requirements reassessment is underway to redefine data transfer requirements and determine a suitable replacement for the aging CDS systems. In the future it is expected that some data will be transferred by the Defense Information Systems Agency (DISA) Cross Domain Enterprise Service (CDES) and the remainder will continue to be transferred by point to point CDS implementations similar to the local CDSs in operation currently. The data that will continue to be transferred by a local point to point CDS will drive what replacement CDS is most suitable. This replacement CDS may or may not be the next accredited version of HSG. This effort will be headed up by a cross functional team comprised of all METOC CDS users and will be supported by the NOOC and this support contract.

The sustainment of the current and future physical CDS systems, associated software, and accreditation (i.e. Authority to Operate (ATO)) is centrally managed by the NOOC on behalf of all METOC commands. This central management is beneficial to realize economies of scale and to reduce the overall administrative burden of operating the CDS systems. While there are system administrators at each site that provide the day to day care for the CDS systems, they often reach back to the NOOC for guidance, troubleshooting support, and all software updates and configuration changes. The intent of this contract is to fulfill the role of the NOOC centralized management.

2.1 Requiring Organization: The organization requiring the services outlined in the PWS is:

Naval Oceanography Operations Command (NOOC) 1002 Balch Boulevard Stennis Space Center, MS 39522

3.0 Scope:

This effort includes all aspects of the operational SABI CDS systems in use at the METOC centers (FNMOC, NAVO, FWC-N, FWC-SD, and JTWC), the integration platform within the NOOC Systems Integration Environment (SIE), collocated with NAVO, and their eventual replacements.

4.0 Directives:

Perform day-to-day management of and oversee all aspects of the METOC CDS to ensure any required technology assessments, systems design, systems analysis, programmatic support, quality assurance, acquisition planning, and budget planning are conducted as appropriate. Organize, direct, and coordinate the planning and production of all activities and deliverables associated with the project. Such activities include system and software engineering support for the CDS, creation and update of system and software engineering documentation, installation of approved patches at all CDS operational locations in accordance with system and local site procedures, including ensuring operational success according to a Systems Operational Verification Test (SOVT), providing system administration support with cybersecurity inspections of the CDS as well as with Security Test & Evaluations (ST&Es) and Joint Vulnerability Assessment Procedures (JVAPs), updating all Cross Domain Appendixes (CDAs) as needed to support and reflect changes made to the CDS, supporting systems, and operating environment, and providing system and software engineering support for the endpoint servers.

Contract deliverables and work must follow applicable cybersecurity directives and shall align to Defense Security Accreditation Working Group (DSAWG) guidance, National Security Agency (NSA) direction for “raising the bar” on CDS security, and direction to utilize enterprise CDS capabilities where possible.

5.0 Requirements/Tasks:

Per DFARS 211.106, contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence.

Task Area 1 – Project Management

The Contractor shall:

1) Maintain current and future CDS and its ATO

a) Prepare and present overall status update briefings to management, leadership, and stakeholders.

b) Provide a comprehensive risk management plan to address, identify, assess, and provide prioritization of risks (including how risks will be recorded, reported and mitigated).

i) Plans shall include the full range of risks that could impact the project including but not limited to resources, access, physical and cyber security, and unplanned events.

ii) Identify high risk factors and develop a mitigation plan to reduce or eliminate the risk. Upon Government approval, the Contractor shall implement and monitor the selected mitigation.

c) Host meetings and tele-conferences for CDS project activities.

d) Provide monthly status reports on CDS related activities.

e) Prepare Documentation to support the continued services of the Navy Cross Domain Solution Office (NCDSO).

i) Draft Information Technology Requirements Documents (ITRDs).

ii) Draft Information Technology Procurement Requests (ITPRs).

iii) Provide an assessment on the alignment of SPAWAR provided Statements of Work (SOW) and current NOOC CDS project plans.

e) Review site self-assessment compliance reports (ST&E reports) and spot check.

f) Assess Site's compliance with required CDS periodic maintenance activities. (E.G. Virus definition updates, Log review and archive, etc…)

g) Collect data for CDES questionnaires as required for revalidation of CDSAs.

h) Complete CDES questionnaires and submit to NCDSO as required for revalidation of CDSAs.

i) Work with the NCDSO to request reaccreditation/revalidation of CDS Tickets.

j) Attend Cross Domain Technical Advisory Board (CDTAB), DSAWG, and Information Security Risk Management Committee (ISRMC) meetings every time METOC CDS tickets are on the agenda for discussion and/or approval.

k) Write briefs/point-papers/presentations for project stakeholders, CDTAB, DSAWG, & ISRMC boards, and management.

l) Prepare documentation in support of and provide reminders to government approvers to assist with the timely renewal of hardware and software maintenance licenses.

i) Conduct market research for renewal of hardware and software maintenance.

ii) Assist with the preparation of other procurement package documents for the renewal of hardware and software maintenance licenses.

m) Maintain a log and/or database of reported issues and status of resolution.

n) Keep abreast of frequently changing CDS processes and emerging CDS risks as promulgated by CDTAB and DSAWG.

i) Review DSAWG Agendas

ii) Review DSAWG Minutes

iii) Review DSAWG Briefings

o) Work with project engineers to develop/integrate technical mechanisms to address/mitigate risks.

p) Attend, observe, and/or assist sites with CDS inspections during stage 2 & 3 cyber security inspections.

q) Ensure all project documentation is up-to-date, stored in a centralized location, accessible, and backed up routinely. Project documentation includes but is not limited to: CDAs, Data validation Guide (DVG), Data Owner’s Guide (DOG), Privileged User Guide (PUG) Addendum, Engineering Docs and Diagrams, Project Plans, Briefings, White Papers, etc…

r) Respond to CDS data calls from NCDSO and Commander Naval Meteorology & Oceanography Command (CNMOC) and answer for all METOC CDS systems.

2) Maintain Security of Operational CDS (Security Patches)

a) Prepare documentation to assist government approvers with requests for funding for software and filter patch creation.

i) Draft ITRDs with appropriate verbiage using correct template.

ii) Draft ITPR executive summary and other verbiage.

b) Work with vendor to obtain software and filter patches.

c) Work with the vendor and governing bodies to obtain patch approval.

i) Prepare documentation to assist government approvers with requests for funding for Lab Based Security Assessment (LBSA) of software and filter patches.

ii) Attend meetings with the vendor, Air Force Weather Agency (AFWA aka 557th Weather Wing), DISA, NCDSO, Space and Naval Warfare Systems Command (SPAWAR), Unified Cross Domain Solution Management Office (UCDSMO), CDTAB, and/or DSAWG throughout the approval process.

d) Work with NCDSO for approval to deploy patches, updated ruleset, and/or configuration changes.

i) Update CDAs including associated diagrams and supporting documents.

ii) Ensure Data Owner’s Guide (DOG) is updated appropriately

iii) Ensure PUG Addendum and other configuration documents and diagrams are updated appropriately.

iv) Ensure Site Based Security Assessment (SBSA aka ST&E) procedures are updated appropriately.

e) Coordinate among all CDS owners across METOC to deliver and schedule application of patches, updated ruleset, and/or configuration changes.

f) Track the deployment of patches, updated rulesets, and/or configuration changes across METOC.

g) Collect SBSA artifacts post-deployment for NCDSO submission.

3) Adapt CDS to changing mission requirements (Changes to Filters or Configuration)

a) Maintain and update CDS requirements as needed.

i) Revalidate existing requirements with sites periodically (At lease Annually).

ii) For each file transfer requirement, identify a site stakeholder and technical POC.

iii) Provide technical guidance to assist decision makers decide whether or not to include a new requirement based on operational necessity and cost.

b) Prepare documentation to assist government approvers with requests for funding for implementing required changes if required.

i) Draft ITRDs with appropriate verbiage using correct template.

ii) Draft ITPR executive summary and other verbiage.

c) Assist with the preparation of procurement package documents for new requirements.

d) Shepherd Enterprise Change Requests (ECRs) or other tracking system requests to prevent oversights or items falling through the cracks.

e) Work with NCDSO for approval to deploy updated ruleset and/or configuration changes.

4) Provide Training and Guidance to CDS users

a) Assist with interpretations of JVAP checks, DVG, and other CDS related guidance.

b) Provide most current copies of vendor support contracts, CDSA letters, and other documentation when requested by site personnel.

c) Assist site Information Security (IS) personnel with understanding the CDS accreditation process.

d) Assist site users and admins in understanding the CDS change process.

5) Requirements Reassessment Support

a) Assist with the collection of data and CDS usage metrics in support of requirement reassessment efforts.

b) Keep abreast of frequently changing CDS processes and emerging CDS risks as promulgated by CDTAB and DSAWG.

c) Work with project engineers to develop/integrate technical mechanisms to address/mitigate risks.

d) Assist with the preparation of documentation and reports in support of requirement reassessment efforts.

Task Area 2 – Engineering Support

The Contractor shall:

1) Maintain current and future CDS and its ATO

a) Attend meetings and tele-conferences for CDS project activities.

b) Respond to bug reports from site engineers/administrators.

c) Trouble shoot and provide data to the vendor to aid the resolution of bugs found within the CDS and other vendor maintained components.

d) Work with the vendor to fine-tune/tweak rulesets and configurations to resolve reported issues.

e) Work to plan/develop/integrate technical mechanisms to address/mitigate risks identified by the CDTAB and DSAWG approving boards.

f) Collect, analyze, and report data types and volume CDS usage metrics for all METOC CDS sites.

i) Assist the collection of usage metrics by creation of automated collection scripts and other technical means as appropriate.

2) Maintain Security of Operational CDS

a) Evaluate CDS software and filter patches/updates for performance impacts and viability for operational use.

i) Update SIE systems to run new patch if applicable.

ii) Validate patch with recent test data.

b) Maintain test data sample files for testing.

c) Maintain the CDS in the SIE for evaluation purposes if applicable.

d) Ensure the baseline endpoint custom scripts and configurations are up-to-date and backed up.

e) Evaluate the endpoint custom scripts and configurations for any needed updates. The following are examples of the endpoint custom scripts and configurations:

i) JAS Sort (Custom Perl scripts)

ii) Scripts for log management (Shell scripts)

iii) Scripts for log analysis (Shell scripts)

iv) JAS configurations and RPMs

f) Document any changes made to the CDS, endpoints, custom scripts, and/or configurations and ensure related engineering documents and diagrams are updated accordingly.

g) Send endpoint script and configuration updates to the sites for installation and operational use.

h) Work with site engineers/administrators to update/correct endpoint configurations as required.

i) Track the site’s progress applying any updates and document any post application artifacts or site specific changes made.

3) Adapt CDS to changing mission requirements

a) Review new requirements for completeness.

b) Manage the adaptation of the system to accommodate the new requirements.

i) Make changes to the rule code or system to accommodate the new requirements (changes may be filter changes, guard configuration changes, endpoint changes, or whatever combination required to accommodate the new requirements).

ii) Test changes

iii) Baseline / Configuration Manage (CM) changes to the CDS and associated systems (E.G. Endpoints).

iv) Write new or adapt existing SOVT to validate correct operation of operational system post application of changes.

v) Assist in obtaining approval to apply changes to operational systems.

vi) Write installation instructions and oversee application of changes.

c) Collect/analyze/report any artifacts from application of changes.

4) Provide Training and Guidance to CDS users

a) Assist users identifying why data will not pass through the CDS.

b) Assist site admins in understanding endpoint and CDS system configurations.

c) Provide training to new users and site CDS admins on how to utilize and manage the system.

5) Requirements Reassessment Support

a) Collect, analyze, and report data types and volume CDS usage metrics for all METOC CDS sites.

i) Assist the collection of usage metrics by creation of automated collection scripts and other technical means as appropriate.

b) Assist with the determination of technical and non-technical mechanisms within future CDS and surrounding system implementations to address/mitigate risks identified by the CDTAB and DSAWG approving boards.

c) Assist with the preparation of documentation and reports in support of requirement reassessment efforts.

Task Area 1 – Project Management

A status update brief detailing planned work, completed work, risks, issues, and impediments is presented to management once every 2 months.

Minimum Acceptable:

A status update brief detailing planned work, completed work, risks, issues, and impediments is presented to management once every 3 months.

The number of Calendar days between status update briefings shall not exceed 93 days with 62 days preferred. The first status update briefing shall be provided within 90 calendar days from the start of the period of performance.

Government management or a subject matter expert will review the work to insure acceptable quality levels are maintained.

Comprehensive risk management plan is provided to management monthly that identify, assess, and provide prioritization of risks (including how risks will be recorded, reported and mitigated). Mitigation plans will be provided for all Critical and High priority risks.

Minimum Acceptable:

Comprehensive risk management plan is provided to management every 3 months that identify, assess, and provide prioritization of risks (including how risks will be recorded, reported and mitigated). Mitigation plans will be provided for all Critical and High priority risks.

The number of Calendar days between risk management plan deliveries shall not exceed 93 days with 31 days preferred. The first risk management plan shall be provided within 90 calendar days from the start of the period of performance.

Government management or a subject matter expert will review the work to insure acceptable quality levels are maintained.

a. Tasks completed during the reporting period

b. Current Issues

c. Upcoming Travel

d. Requests for revised work product due dates to include the justification for the request.

e. Anticipated activity for next reporting period

Each monthly status report shall be submitted not later than 5 business days after the end of the month reported on.

Government management or a subject matter expert will review the work to insure acceptable quality levels are maintained.

Documentation is not returned to the author with defects more than 2 times during a review process with the NCDSO

Minimum Acceptable:

Documentation is not returned to the author with defects more than 5 times during a review process with the NCDSO.

Government management or a subject matter expert will be copied on all communications between the contractor and the NCDSO and be able to observe the number of times the documents are returned for correction.

Assessments are completed prior to any stage 3 cyber security inspections and in time to send results to the NCDSO for the revalidation of the CDS Tickets. 100% of all finding found are corrected or otherwise resolved.

Minimum Acceptable:

Assessments are completed in time to send results to the NCDSO for the revalidation of the CDS Tickets. 80% of all finding found are corrected or otherwise resolved.

Government management or a subject matter expert will be copied on all communications between the contractor and the NCDSO and be able to inspect documentation and the timeliness of its submittal.

Reviews are completed prior to any stage 3 cyber security inspections and in time to send results to the NCDSO for the revalidation of the CDS Tickets. 100% of all finding found are corrected or otherwise resolved.

Minimum Acceptable:

Reviews are completed in time to send results to the NCDSO for the revalidation of the CDS Tickets. 80% of all finding found are corrected or otherwise resolved.

Government management or a subject matter expert will be copied on all communications between the contractor and the NCDSO and be able to inspect documentation and the timeliness of its submittal.

Compliance assessments are completed prior to any stage 3 cyber security inspections and in time to send results to the NCDSO for the revalidation of the CDS Tickets. 100% of all finding found are corrected or otherwise resolved.

Minimum Acceptable:

Compliance assessments are completed in time to send results to the NCDSO for the revalidation of the CDS Tickets. 80% of all finding found are corrected or otherwise resolved.

Government management or a subject matter expert will be copied on all communications between the contractor and the NCDSO and be able to inspect documentation and the timeliness of its submittal.

Data is 100% representative of data types used and 90% representative of data volume used.

Data collection is completed within 4 months of the start of the period of performance.

Minimum Acceptable:

Data is 100% representative of data types used and 80% representative of data volume used.

Data collection is completed within 6 months of the start of the period of performance.

Number of datatypes present in CDS logs match number of data types reported.

Documentation is not returned to the author with defects more than 2 times during a review process with the NCDSO

Minimum Acceptable:

Documentation is not returned to the author with defects more than 5 times during a review process with the NCDSO.

Government management or a subject matter expert will be copied on all communications between the contractor and the NCDSO and be able to observe the number of times the documents are returned for correction.

All CDS Tickets are granted new CDSA Letters at least 1 month prior to the expiration of the previous CDSA Letters.

Minimum Acceptable:

All CDS Tickets are granted approval to continue operation via DSAWG ballot prior to the expiration of the previous CDSA Letters.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Documentation is not returned to the author with defects more than 2 times during a review process.

Minimum Acceptable:

Documentation is not returned to the author with defects more than 3 times during a review process.

Government management or a subject matter expert inspection.

All reported issues are recorded and tracked so no issues are lost. Number of active issues being tracked and resolution of issues will be reported during monthly status reports.

Minimum Acceptable:

All reported issues are recorded and tracked so no issues are lost. Number of active issues being tracked will be reported during monthly status reports.

Government management or a subject matter expert will be apprised of number of issues and resolutions within monthly status reports.

All DSAWG meeting agendas, minutes, and relevant briefings are reviewed within 1 week of being posted.

Minimum Acceptable:

All DSAWG meeting agendas, minutes, and relevant briefings are reviewed within 2 weeks of being posted.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Site representatives are assisted in documentation updates, findings mitigation, and STIG check interpretation so that 100% of all checks do not constitute a finding when assessed by a cyber security inspector.

Minimum Acceptable:

Site representatives are assisted in documentation updates, findings mitigation, and STIG check interpretation so that 95% of all checks do not constitute a finding when assessed by a cyber security inspector.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

All data is maintained on two separate, geographically dispersed USG systems and directly accessible by government management and subject matter experts.

Minimum Acceptable:

All data is maintained on USG systems and directly accessible by government management and subject matter experts.

Government management or a subject matter expert inspection.

All data calls are answered by the required due date with the information requested.

Minimum Acceptable:

When data requested is not obtainable by the due date of the data call, the contractor must report that to the requesting agency within two business days and assist in the formulation of a mutually acceptable plan to resolve the data call.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Documentation is not returned to the author with defects more than 2 times during a review process with the government Financial Management (FM) specialists.

Minimum Acceptable:

Documentation is not returned to the author with defects more than 5 times during a review process with the government FM specialists.

Government management or a subject matter expert inspection.

Approval is obtained within 6 months of making the request.

Minimum Acceptable:

Approval is obtained within 18 months of making the request.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Approval is obtained within 3 months of making the request.

Minimum Acceptable:

Approval is obtained within 6 months of making the request.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Application of patches occurs within the window granted by the DSAWG or other approving bodies.

Minimum Acceptable:

Application of patches occurs within the window granted by the DSAWG or other approving bodies.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Artifacts are submitted to the NCDSO as required within 2 weeks of their collection.

Minimum Acceptable:

Artifacts are submitted to the NCDSO as required within 4 weeks of their collection.

Government management or a subject matter expert will be copied on all communications between the contractor and the NCDSO and be able to observe artifact submission.

Documented requirements are revalidated at least annually and updated when necessary to include all associated information and supporting documents.

Minimum Acceptable:

Documented requirements are revalidated at least annually and updated when necessary to include all associated information and supporting documents.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Documentation is not returned to the author with defects more than 2 times during a review process with the government FM specialists.

Minimum Acceptable:

Documentation is not returned to the author with defects more than 5 times during a review process with the government FM specialists.

Government management or a subject matter expert inspection.

Documentation is not returned to the author with defects more than 2 times during a review process with the government FM specialists.

Minimum Acceptable:

Documentation is not returned to the author with defects more than 5 times during a review process with the government FM specialists.

Government management or a subject matter expert inspection.

Approval is obtained within 3 months of making the request.

Minimum Acceptable:

Approval is obtained within 6 months of making the request.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Reply with requested documents or helpful information within 1 business days of receiving requests.

Minimum Acceptable:

Reply with requested documents or helpful information within 3 business days of receiving requests.

Requests will be tracked as issues. Government management or a subject matter expert will be apprised of number of issues and resolutions within monthly status reports.

Task Area 2 – Engineering Support

Respond to bug reports within 1 business day of receiving a report.

Minimum Acceptable:

Respond to bug reports within 2 business days of receiving a report.

Bug reports will be tracked as issues. Government management or a subject matter expert will be apprised of number of issues and resolutions within monthly status reports.

Provide Data within 2 weeks of the bug being reported or discovered.

Minimum Acceptable:

Provide Data within 4 weeks of the bug being reported or discovered.

Bug reports will be tracked as issues. Government management or a subject matter expert will be apprised of number of issues and resolutions within monthly status reports.

All reported issues are resolved by 3 weeks after each issue is reported.

Minimum Acceptable:

When a reported issue is not resolvable in a reasonable length of time, the contractor must report that to the reporting site within five business days and assist in the formulation of a mutually acceptable plan to resolve the issue.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Mechanisms are found to be acceptable by the NCDSO and not returned to the author with defects more than 2 times during a review process with the NCDSO

Minimum Acceptable:

Mechanisms are found to be acceptable by the NCDSO and not returned to the author with defects more than 5 times during a review process with the NCDSO.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Data is 100% representative of data types used and 90% representative of data volume used.

Data collection is completed within 4 months of the start of the period of performance.

Minimum Acceptable:

Data is 100% representative of data types used and 80% representative of data volume used.

Data collection is completed within 6 months of the start of the period of performance.

Number of datatypes present in CDS logs match number of data types reported with government management or subject matter expert inspection.

Performance evaluation is completed in a real-world environment that uses the same software and hardware as the operational systems.

Minimum Acceptable:

Performance evaluation is completed in a close to real-world environment were the software and hardware used in appropriate to evaluate the changes under test.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

All data is maintained on two separate, geographically dispersed USG systems and directly accessible by government management and subject matter experts.

Minimum Acceptable:

All data is maintained on USG systems and directly accessible by government management and subject matter experts.

Government management or a subject matter expert inspection.

All endpoint custom scripts and configurations are evaluated to identify any changes needed to accommodate user and STIG requirement changes, endpoint operating system changes, or any other CDS related changes every 6 months.

Minimum Acceptable:

All endpoint custom scripts and configurations are evaluated to identify any changes needed to accommodate user and STIG requirement changes, endpoint operating system changes, or any other CDS related changes annually.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Update all affected documentation during the course of the work of changing the system

Minimum Acceptable:

Update all affected documentation within two weeks of completion of work.

Government management or a subject matter expert inspection.

Installation progress will be tracked as an issue and any artifacts are documented and backed up within one week of completion of installation activities.

Minimum Acceptable:

Installation progress will be tracked as an issue and any artifacts are documented and backed up within three weeks of completion of installation activities.

Installations will be tracked as issues. Government management or a subject matter expert will be apprised of number of issues and resolutions within monthly status reports.

Review requirements and request additional information from the requester within one week of receiving the request.

Minimum Acceptable:

Review requirements and request additional information from the requester within two weeks of receiving the request.

New requirements will be tracked as issues. Government management or a subject matter expert will be apprised of number of issues and resolutions within monthly status reports.

When possible new requirements should be worked into the operational systems within 4 months. Changes to the system will be made in conjunction with other system updates or changes when possible to minimize the overall numbers of times the systems are modified.

Minimum Acceptable:

When possible new requirements should be worked into the operational systems within 8 months. Changes to the system will be made in conjunction with other system updates or changes when possible to minimize the overall numbers of times the systems are modified.

Government management or a subject matter expert will be apprised of any relevant developments as part of the periodic status briefings and updates to the risk management plan.

Artifacts should be collected analyzed and reported within 2 weeks of the conclusion of the application of changes. Artifacts and reports should be made available to the NCDSO for review if necessary.

Minimum Acceptable:

Artifacts should be collected analyzed and reported within 4 weeks of the conclusion of the application of changes. Artifacts and reports should be made available to the NCDSO for review if necessary.

Government management or a subject matter expert will be copied on all communications between the contractor and the NCDSO and be able to observe artifact submission.

6.0 Deliverables:

The support and sustainment of the CDS requires constant and consistent effort, however, the specific tasks are not always predictable in advance. Expected contract deliverables have been identified. The frequency and due dates of deliverable items have been stated when possible within the performance standard tables above.

Scheduling Requirements:

· All Deliverables will be provided on or before a date agreed upon by the contractor and the government that is sufficiently before the end of the period of performance to provide enough time for the contractor to correct any issues found by government review.

· Any rework or correction of identified issues will be completed before the end of the period of performance to the extent possible.

7.0 Assumptions

The following assumptions are provided:

· HSG version 3 is expected to be put on the sunset list and disapproved for operational use within the next couple of years. The exact timeline for this is unknown as the next version of HSG suitable for SABI use is currently undergoing accreditation testing.

· The HSG systems currently in use at the METOC sites will continue to be covered under an active maintenance contract which includes software patches and vendor technical support.

· Once the requirements reassessment has been conducted and a replacement CDS implementation has been solidified, additional contracts will be put in place with the selected CDS vendor(s) to do the heavy lifting needed for filter creation and any accreditation work that is required.

8.0 Qualifications/Experience:

Contractor personnel are expected to be high-level self-starters with demonstrated technical, operational, and project management experience in the appropriate functions. The Government anticipates that much of the work shall require independent performance. Personnel assigned to tasks must keep current on the respective technologies and programmatic advancements associated with the contract. The skill sets of the contractor personnel shall enable fulfillment of the responsibilities identified in Section 5. The contractor is responsible for providing personnel who are fully qualified to perform the requirements identified in this performance work statement and who possess the expertise and experience as identified below:

1. General knowledge of the CDS systems, their configuration, and security mechanisms

2. Comprehensive understanding of the SABI process and documentation required by it

3. Familiarity with the SABI Cross Domain Solution (CDS) process and the workings of the CDTAB and DSAWG boards.

4. A Secret or greater security clearance is required to access and work on classified documentation and a Single Scope Background Investigation (SSBI) is required for privileged access to systems.

5. Approved Cybersecurity workforce certifications appropriate for each category and level as listed in the current version of SECNAVINST 5239.20A

6. Appropriate operating system certification for Cybersecurity technical positions as required by SECNAVINST 5239.20A

7. Experience in Risk Management Framework (RMF), DoD Information Assurance Certification and Accreditation Program (DIACAP), and CDS risk models (RDAC and CDRM)

8. Comprehensive knowledge of RHEL and shell scripts

9. Comprehensive knowledge of C and Perl programming languages

10. Knowledge of the Joint Architecture Study data transfer protocol, its software components, and configuration

11. Other training, experience and certifications necessary to perform all duties and roles as required

9.0 Period of Performance:

The period of performance will be 25 September 2019 – 24 September 2020.

The contractor shall perform Monday through Friday excluding all Federal holidays, with core hours of 8:00 am to 4:30 pm. The contractor shall have a protocol that their employees are to follow when the government work site is closed due to in-clement weather, hazardous conditions, or other special circumstances. The COR may direct the contractor in these instances to provide sufficient personnel under non-hazardous conditions to complete or continue work already in process or provide on-call response in accordance with the PWS.

As directed by the COR, the contractor shall continue performance in emergency or mission essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

10.0 Place of Performance:

· Naval Oceanography Operations Command (NOOC): Stennis Space Center, MS

Alternate Place of Performance - Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at an alternate place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather, government shutdowns, etc.). Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

11.0 Travel:

Contractor travel may be required to travel for the purposes of performing this requirement. Travel destinations may include: Commander Naval Meteorology & Oceanography Command (CNMOC): Stennis Space Center, MS, Fleet Numerical Meteorology & Oceanography Center (FNMOC): Monterey, CA, Naval Oceanographic Office (NAVO): Stennis Space Center, MS, Fleet Weather Center San Diego (FWC-SD): San Diego CA, Joint Typhoon Warning Center (JTWC): Pearl Harbor, HI, CDTAB & DSAWG Meeting Locations: Baltimore, MD and vicinity, Off-site contractor locations. When travel is required, the contractor is responsible for making all needed arrangements for his/her personnel.

Travel will be defined and incorporated into the purchase order by modification/s when travel can be further defined. Travel will be firm fixed price.

12.0 Security:

The work to be performed under this contract is up to the Secret level. Therefore, contractor personnel must be cleared to the Secret level and the contractor must have a final Secret Facility Clearance from the Defense Security Service Facility Clearance Branch if performing work within that facility.

13.0 Clauses:

Section 508 Compliance Section 508 of the Rehabilitation Act requires Federal agencies to make their electronic and information technology accessible to people with disabilities. This applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology.

All electronic and information technology (EIT) procured through this task order must meet the applicable accessibility standards specified in 36 CFR 1194.2, unless an agency exception to this requirement exists. Any agency exceptions applicable to this task order are listed below.

The standards define Electronic and Information Technology, in part, as “any equipment or interconnected system or subsystem of equipment that is used in the creation, conversion, or duplication of data or information.” The standards define the type of technology covered and set forth provisions that establish a minimum level of accessibility. The application section of the standards (1194.2) outlines the scope and coverage of the standards. The standards cover the full range of electronic and information technologies in the Federal sector, including those used for communication, duplication, computing, storage, presentation, control transport and production. This includes computers, software, networks, peripherals and other types of electronic office equipment.

Changes

(a) The Contracting Officer may at any time, by written order, and without notice to the sureties, if any, make changes within the general scope of this contract in any one or more of the following:

(1) Description of services to be performed.

(2) Time of performance (i.e., hours of the day, days of the week, etc.).

(3) Place of performance of the services.

(b) If any such change causes an increase or decrease in the cost of, or the time required for, performance of any part of the work under this contract, whether or not changed by the order, the Contracting Officer shall make an equitable adjustment in the contract price, the delivery schedule, or both, and shall modify the contract.

(c) The Contractor must assert its right to an adjustment under this clause within 30 days from the date of receipt of the written order. However, if the Contracting Officer decides that the facts justify it, the Contracting Officer may receive and act upon a proposal submitted before final payment of the contract.

(d) If the Contractor’s proposal includes the cost of property made obsolete or excess by the change, the Contracting Officer shall have the right to prescribe the manner of the disposition of the property.

(e) Failure to agree to any adjustment shall be a dispute under the Disputes clause. However, nothing in this clause shall excuse the Contractor from proceeding with the contract as changed.

Privacy Act During performance of this order, the contractor may have access to Privacy Act data. Should this occur, the contractor shall safeguard all privacy information, and ensure this data is accessed and maintained in accordance with applicable laws and regulations. If access occurs, FAR 52.224-1 and 52.224-2 apply.

Ownership In accordance with FAR 52.227-14, Rights in Data-General (Jun 1987), the Government shall have unlimited rights under this agreement to all information and materials…