Sources Sougt A1 N0018920QQ045 Draft PWS.pdf

Scanning Information Systems Security Officer (ISSO) Support

PERFORMANCE WORK STATEMENT

Fleet Numerical Meteorology and Oceanography Center (FLENUMMETOCCEN) Scanning Information Systems Security Officer (ISSO) Support

1.0 INTRODUCTION

This requirement is to provide services in support of Authorization & Accreditation (A&A) activities for the Cyber Security group. Work will include planning, preparation, validation, documentation, implementation, and coordination of Cyber Security (CS) Assured Compliance Assessment Solution (ACAS) scanning and Vulnerability Remediation Asset Manager (VRAM) reporting requirements.

2.0 BACKGROUND

FLENUMMETOCCEN, under the direction of the Commander, Naval Meteorology and Oceanography Command, has the mission to collect, interpret, and apply global atmospheric and oceanographic data and information in support of strategic and tactical warfare and peace-keeping initiatives. Located in Monterey, CA, FLENUMMETOCCEN provides around-the-clock operational oceanographic and meteorological support. This support consists of running regularly scheduled large environmental numerical global forecast models. Greater emphasis on preparation of and reaction to regional conflicts and the littoral threat has resulted in a greatly increased demand for high resolution coupled model meteorological guidance and forecasts, as well as oceanographic support to tactical coastal operations. FLENUMMETOCCEN operates a sophisticated suite of numerical environmental models and customer product applications that exploit all levels of High Performance Computing (HPC). The systems that comprise FLENUMMETOCCEN's computing suite are called the Primary Oceanographic Prediction System – Meteorology, POPS – MET.

FLENUMMETOCCEN incubates and provides a portfolio of unique, value-added products tailored to the mission and requirements of the DOD warfighter via reach-back operations. To produce these numerical weather products, a combination of HPC and Virtualization technologies are used. HPC is the backbone of the systems running Numerical Weather Prediction (NWP) and Virtualization allows reduced IT-footprints in support of data processing and of HPC products.

2.1 Requiring Organization:

The organization requiring the services outlined in the Performance Work Statement (PWS) is:

FLENUMMETOCCEN/FNMOC

7 Grace Hopper Avenue, Stop 1

Monterey, CA 93943-5501

3.0 SCOPE

The contractor shall:

• Perform assigned CS duties associated with Network systems across all classification levels

• Perform assigned CS tasks using established DoD and Navy CS policies and procedures

• Perform work with limited technical direction

• Perform work that is varied, may be somewhat difficult in nature and involves limited technical direction

• Perform Cyber Security Officer duties to include incident handling, drafting CS policy, guidance and/or standard operating procedures

• Create and recommend CS policy, guidance, and standard operating procedures

• Plan, implement or monitor CS safeguards for networks in association with approved plans

• Perform compliance monitoring to include network and/or systems audits to assess CS related factors

• Assist in preparing and maintaining A&A documentation

• Assist in conducting CS safeguard tests in accordance with test plans

• Assist with providing CS requirements

• Participate in CS risk assessments

• Ensure necessary reporting is captured and maintained for evaluation

• Ensure conformity of password policies

• Provide and monitor security counter measures

• Assist with coordination of CS activities associated with remote access to include VPN

• Assist with or perform CS tasks to include proper handling of personal, confidential and privacy act information

• Attend meetings as directed by the ISSM

• Perform other CS duties as directed by the ISSM

• Coordinate timely notification and resolution of pending CS issues to include FISMA POA&M, pending items in the VRAM

4.0 DIRECTIVES

The contractor shall comply with the following directives and any updated/future versions as they are released:

• ISSM Handbook Version 1.0 – 15 July 2008

• U.S. Navy Risk Management Framework Process Guide, Version 3.0, 10 October 2019

• DoD Instruction 8500.01, Cybersecurity, 14 March 2014 (incorporating Change 1, 7

October 2019) DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology, 12 March 2014 (incorporating Change 2, 28 July 2017)

• DoD Manual 8570.01-M, Cybersecurity Workforce Improvement Program, 19 December 2005 (incorporating Change 4, 10 November 2015)

• DoD Directive 8140.01, Cyberspace Workforce Management, 11 August 2015 (incorporating Change 1, 31 July 2017)

• SECNAV Manual M-5239.2, DON Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual, 27 June 2016

• DISA Security Technical Implementation Guides (STIGs) --https://public.cyber.mil/stigs/downloads

• DOD Manual 5105.21 V1, Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Information and Information Systems Security, 19 October 2012 (incorporating change 1, 16 May 2018)

• DOD Manual 5105.21 V2, Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Physical Security, Visitor Control, and Technical Security, 19 October 2012 (incorporating change 1, 5 April 2018)

• DOD Manual 5105.21 V3, Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Physical Security, Industrial Security, and Special Activities, 19 October 2012 (incorporating change 1, 5 April 2018)

• SECNAVINST 5510.30C Department of the Navy (DON) Personnel Security Program (PSP) Instruction, 24 January 2020

• Navy Department Supplement to DOD 5105.21-M-1, Defense Intelligence Agency (DCS), 18 March 1997 https://public.cyber.mil/stigs/downloads

• DoD Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP), 3 April

• DODI 5200.46, DoD Investigative and Adjudicative Guidelines for Issuing the Common

Access Card (CAC), 9 September 2014 (incorporating change 1, 4 May 2018)

• DoDM 5200.01 Volume 1, DoD Information Security Program: Overview, Classification, and Declassification, 4 May 2018

• DoDM 5200.01 Volume 2, DoD Information Security Program: Marking of Information, 14 May 2019

• DoDM 5200.01 Volume 3, DoD Information Security Program: Protection of Classified

Information, 19 March 2013

• DoDM 5200.01 Volume 4, DoD Information Security Program: Controlled Unclassified

Information, 9 May 2018

• DoD Manual 5200.08-R Change 1, Physical Security Program, 27 May, 2009

• DoD 5220.22-M, National Industrial Security Program Operating Manual, 18 May 2016

• DoD 5220.22, Volume 2, National Industrial Security Program: Security Procedures for

Government Activities Operating Manual, 1 August 2018

• DODD 5240.06, Counter Intelligence Awareness and Reporting (CCSR), 17 May 2011

(incorporating change 2, 21 July 2017)

• DODD 4500.54E, DoD Foreign Clearance Program, 28 December 2009 (incorporating change 1, 24 May 2017)

• SECNAVINST 5510.36B, Department of the Navy Information Security Program

Instruction, 12 July 2019

• OPNAVINST F3300.53C, Navy Antiterrorism (AT) Program, 26 May 2009

• OPNAVINST 5530.14E, Navy Physical Security and Law Enforcement Program, 28

January 2009 (incorporating change 2, 23 September 2014)

• Intelligence Community Directive (ICD) 503, Intelligence Community Information

Technology Systems Security, Risk Management, Certification, and Accreditation, 15 September 2008

• ICD 700, Protection of National Intelligence, 7 June 2012

• ICD 703, Protection of Classified National Intelligence, Including Sensitive

Compartmented Information, 21 June 2013

• ICD 704, Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information, 1 October 2008 (incorporating technical amendment, 20 June 2019)

• ICD 705, Sensitive Compartmented Information Facilities, 26 May 2010

• ICD 710, Classification Control and Markings System, 21 June 2013

• ICD 750, Counterintelligence Programs, 5 July 2013

• FLENUMMETOCCENINST 5510.1K, Command Information and Personnel Security

Manual, 6 July 2018

• FLENUMMETOCCENINST 5239.3C, Access Policy for Command Information Systems, 24 May 2018

• FLENUMMETOCCENINST 5239.4A, Command Cybersecurity Workforce

Implementation Plan, 12 October 2017

• FLENUMMETOCCEN A2 User’s Guide v-3.2, 23 March 2016

5.0 SPECIFIC REQUIREMENTS AND TASKS

5.1 SPECIFIC TASKING

The objective of this requirement is to provide services to plan, prepare, validate, document, implement and coordinate Information Assurance Vulnerability Management (IAVM) as well as A&A activities for the CS division.

The vendor shall:

5.1.1 Plan, prepare, validate, document, implement, and coordinate IAV management requirements to support the A&A of the FLENUMMETOCCEN enclave

Performance Standard

Documentation is delivered within standards and on time

Assessment Method

Documentation is completed within FLENUMMETOCCEN standards

5.1.2 Participate in technical meetings

Performance Standard

Attendance at technical meetings

Assessment Method

Participation in meetings

5.1.3 Assist the ISSM in creating and presenting documents pertaining to CS policy, technical procedures, and guidelines. Documents can include CS Requirements, Risk Assessments, and Policy Statements

Performance Standard

Deliverables are complete and functional

Assessment Method

Deliverables are complete and on time

5.1.4 Provide Monthly Status Reports (MSR) to the ISSM and/or Contracting Officer’s Representative (COR). The MSR shall provide a high level monthly summary of activities and project challenges as well as anticipated direction. The MSR shall contain the following sections:

• A Brief Description of Requirements

• Summary of Accomplishments and Significant Events

• Deliverables Assigned/Milestones/Status

• Deliverables Submitted

• Current or Anticipated Issues

• Government-Identified Topics and Issues

• Summary of Activity Planned for the Next Reporting Period

• Task Financial Status

• Resource Planning/Status

Performance Standard

Monthly status reports are provided

Assessment Method

Reports are accurate and on time

5.1.5 Plan, implement, and monitor CS safeguards for Network and Computer systems in association with approved plans, to include compliance monitoring for Network and Computer system audits

Performance Standard

Completion of required monitoring of findings and mitigations

Assessment Method

Deliverables are complete and on time

5.1.6 Coordinate timely notification and resolution of pending CS issues to include Federal Information System Management Act (FISMA) Plan of Action and Milestones (POA&M), pending items in the VRAM

Performance Standard

Deliverables are complete and functional

Assessment Method

Demonstration of functionality and completion of testing

5.1.7 Other tasks as assigned by the ISSM

Performance Standard

Meet scheduled tasking dates

Assessment Method

Output from tasking is completed

5.2 TECHNICAL CLARIFICATION NOTICE

Technical Clarification Notices (TCN) will be used to clarify areas of support required by this task order. TCNs may be used to: prioritize support; further define level, location or schedule of support to be provided; and/or output (e.g., deliverable) requirements. TCNs may be generated by either the contractor or the Government, but must be fully coordinated and approved by the Contracting Officer’s Representative (COR) prior to execution. TCNs shall not be used to change the intent, scope or value of this task order.

6.0 DELIVERABLES AND MILESTONES:

Deliverables shall be provided by the contractor to the FLENUMMETOCCEN COR. Electronic documents shall be in Microsoft Office, Project or Adobe format unless otherwise agreed to by the Government. Electronic documents will be in an editable form without password protection. The government will review and approve or disapprove deliverables within 10 working days of receipt.

The contractor shall consider the deliverable accepted if a Government response has not been provided within the 10-day review time. Disapproved deliverables shall be reworked and resubmitted within 5 working days of contractor notification unless the COR and contractor mutually agree upon other terms.

Deliverable Section Frequency Format/Quantities Due Date

Document plans, processes, procedures, guidance, or technical requirements

5.1.1, 5.1.3

As required

MS Office Product with electronic copy for files;

15 workdays after receipt of request or as agreed with

ISSM.

Technical Meeting Minutes

5.1.2 As

required

MS Office Product with electronic copy for files;

2 workdays after meeting or as agreed with ISSM.

Report as to actions 5.1.5 – 5.1.7

As needed One electronic copy. 15 workdays after receipt of request or as agreed with

ISSM.

Monthly Status Report 5.1.4 Monthly One electronic copy. 10th calendar day of each month, or the next business day.

7.0 PERIOD OF PERFORMANCE

The period of performance shall be a 12-month base period from 9/2/2020 – 9/1/2021, with four 12-month option periods.

8.0 PLACE OF PERFORMANCE

The primary place of performance shall be on-site at the FLENUMMETOCCEN facility located at 7 Grace Hopper Avenue, Monterey, CA 93943. The primary work setting is a general office area environment. Contractor tasks may require work anywhere within the FLENUMMETOCCEN compound including the computer center(s).

9.0 TRAVEL REQUIREMENTS

No travel is anticipated.

10.0 SECURITY REQUIREMENTS

The primary place of performance shall be on-site at the FLENUMMETOCCEN Monterey facility, which dictates that all personnel performing on-site must possess and maintain U.S. Citizenship and an active DOD security clearance. The scope of this work includes CSM level 2, which is considered a critical-sensitive position. DOD Manual 8570.01-M requires a TOP SECRET clearance based on a current Tier 5 Investigation. This position requires the incumbent to be trained and certified to DOD requirements as outlined in section 12.

10.1 In performance of services under this task order, the Contractor may be required to perform operations on, have access to, or handle data and information that contains sensitive, proprietary, privacy information and data. The Contractor shall be responsible for safeguarding the information and data while under the control of or available to the contractor and preventing it from being compromised, damaged, lost, or properly disseminated.

10.2 The Contractors and any employees or consultants of the Contractors are prohibited from using

U.S. Government facilities; equipment and/or information for any purpose except as specifically described herein and related to this task order. Contractor personnel shall not divulge or release data or information developed or obtained in performance of this contract until made public by the Government, except to any authorized Government personnel. The Contractor shall not use, disclose, or reproduce proprietary data other than as required in the performance of this task order.

10.3 The contractors shall be responsible for adhering to all DOD, DoN and Command instructions, guidance, orders, directives, and supplements relative to performing programming tasks within FLENUMMETOCCEN.

10.4 The contract holder and actual service provider must have facility clearances at the same level as the individuals required in the PWS.

10.5 Duties require access to Sensitive Compartmented Information (SCI) material.

Personnel assigned to work on SCI accredited systems must have a completed Tier 5 investigation favorably adjudicated for eligibility to access SCI, per ICD 704.

11.0 GOVERNMENT PROVIDED RESOURCES

11.1 The Government will provide the contractor certain resources required to support performance of the effort in this task order.

11.2 The Government will provide the contractor access to IT systems and software required to complete the assigned tasks. The contractor shall identify and notify the Government of system documentation necessary for the proper performance of this task.

11.3 The contractors will be furnished with documentation, task working papers, project descriptions, program briefing material and other pertinent information, and other documentation or material required to support performance of the effort in this task order.

Information will be provided to the contractor within a reasonable time commensurate with schedules and target completion dates for assigned tasks and activities.

11.4 In performance of services under this task order, the contractor may be required to perform operations on, have access to, or handle data and information that contains sensitive, proprietary, privacy information and data. The contractor shall be responsible for safeguarding the information and data while under the control of or available to the contractor and preventing it from being compromised, damaged, lost, or properly disseminated.

11.5 The contractor and any employees or consultants of the Contractor is prohibited from using US

Government facilities; equipment and/or information for any purpose except as specifically described herein and related to this task order. Contractor personnel shall not divulge or release data or information created or obtained in performance of this task order until made public by the Government, except to any authorized Government personnel. The contractor shall not use, disclose, or reproduce proprietary data other than as required in the performance of this task order.

11.6 The Government will provide the contractor with access to appropriate documentation.

11.7 The Government will provide required office space and equipment necessary to accomplish prescribed tasks.

11.8 The Government will provide office supplies necessary for completion of tasks.

11.9 Government will provide security access cards to allow contractor access to all spaces required to carry out assigned tasks.

12.0 SKILL OR RELEVANT EXPERIENCE REQUIREMENTS

12.1 Requires Bachelor’s degree in computer science or computer information security, with a minimum of five years of related experience. Related experience should include aspects of the following: understanding of CS best practices and procedures; knowledge of current CS tools available; hardware/software CS implementation; communication protocols; Public Key Infrastructure and encryption techniques; familiarity with commercial products, and current Internet technology.

12.2 Requires ability to understand and implement technical vulnerability remediation in response to ACAS Scans and DISA STIG SRR Scans, based on prior work experience.

12.3 This position has been designated as a Cybersecurity Workforce (CSWF) position.

12.3.1 Earn and maintain appropriate credentials for the CSWF Qualification with the scope of the major assigned duties for the position to which the incumbent is assigned, and;

12.3.2 Participate in a continuous learning program as described in DoD 8570.01-M. A minimum of 40 hours of CSWF related continuous learning annually as documented through submission of training certificates.

12.4 This position is designated as a Special-Sensitive/IT-I position that requires privileged access and/or manages CS controls and a Tier 5 investigation is required. As a condition of employment, the required certifications must be obtained prior to engagement.

Specific certifications required for this position:

12.4.1 Operating System and/or Technical Certifications: ACAS Certification required; Red Hat Certified Administrator (RHCA) or CompTIA Linux+ desired

12.4.2 CSWF Certification: GSLC or CISSP or CISM or CAP or CASP required

12.5 Requires a minimum of five years’ experience with Networking and Computing technologies, preferably certification is desirable.

12.6 Demonstrate understanding and use of DoD CS and security concepts, practices and procedures; possesses understanding of sensitive unclassified and classified information;

requires working knowledge of DoD Directives to include 8500.1, as well as Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIG) based on prior work experience or education.

12.7 Demonstrate an understanding of the various IT system security essentials to include: hardware (e.g. servers, routers, and firewalls), software (e.g. operating systems, CISCO IOS, VMWare), system audits, overall CS, access control systems and methodology, physical security and information security.

12.8 Requires a minimum of three years’ experience with ACAS scanner administration, preparing and implementing Certification and Accreditation policies and procedures; and performing IT security assessments involving system and enclave policy protections within a complex Window, Linux, VMWare and Cisco IOS environment.

12.9 Required to have basic office administration and organizational skills as well as working knowledge of the Microsoft Windows Office products.

12.10 Excellent written and verbal communication skills required.

12.11 Individual must possess ability to oversee and integrate all aspects of system documentation and related Cyber Security elements; ability to assess CS impact to the overall IT program or platform and determine best vulnerability mitigation requirements.

13.0 CLAUSES:

Privacy Act During performance of this order, the contractor may have access to Privacy Act data. Should this occur, the contractor shall safeguard all privacy information, and ensure this data is accessed and maintained IAW applicable laws and regulations.

Non-Disclosure Agreement:

The Business Sensitive Information Non-disclosure Agreement is required for this order.

Data Rights:

The Government shall have unlimited rights under this agreement to all information and materials furnished by the contractor performing work under this PWS. This shall include documentation thereof, reports and listings and all other items pertaining to the work and services pursuant to this agreement. The Government has the right to inspect the work and will have access to, and the right to make copies of the above mentioned items. All digital files, data and other items generated in performance of this effort shall become the property of the Government.

14.0 QUALITY CONTROL

The Contractor is solely responsible for the quality of services provided. The Contractor is also liable for Contractor employee negligence, and any fraud, waste or abuse.

15.0 HOURS OF OPERATION

The Contractor shall provide services during normal working hours excluding Federal holidays. Normal working hours are 0800-1700, Monday through Friday, unless requirements dictate otherwise. An after-hours response may be required in some cases and will be at the COR’s discretion and arrangements made with the contractor ahead of time. Exceptions can be permitted by the COR upon request and at the COR’s discretion.

16.0 CONTRACTOR IDENTIFICATION

IAW DFAR 211.106, there shall be a clear distinction between government employees and service contractor employees. Service contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel. They must also display distinguishing badges or other visible items of identification for meetings with government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence.

17.0 KEY PERSONNEL QUALIFICATION REQUIREMENTS

The contractor shall commit key personnel to this effort for a period of one year from the date performance commences on the contract or task order. Relief may be provided on a case by case basis by the contracting officer. The contractor’s replacement employee/s for key personnel shall possess the skill or relevant experience requirements set forth in paragraph seven (7) of this document. Documentation shall be submitted to the Contracting Officer or COR.