N0018923R0043.pdf

SEE ADDENDUM

(No Collect Calls)

N0018923R0043 11-Jul-2023

b. TELEPHONE NUMBER

757-443-1968

8. OFFER DUE DATE/LOCAL TIME

10:00 AM 25 Jul 2023

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA X ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

N001899. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

AMBER V. BRADLEY

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

1301084152

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

NAVSUP FLC NORFOLK CONTRACTING

NORFOLK OFFICE

ATTN: A BRADLEY

1968 GILBERT STREET STE600

NORFOLK VA 23511

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE N57023 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

OPERATIONAL TEST & EVALUATION FORCE

TIMOTHY BURROWS

7970 DIVEN STREET

NORFOLK VA 23505-1498

TEL: 757-282-5546 X3136 FAX:

757-443-1333FAX:

TEL: 757-443-1968

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

X 8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$34,000,000

NAICS:

541519

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF85

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

N0018923R0043

Section SF 1449 - CONTINUATION SHEET

PERFORMANCE WORK STATEMENT

1. Scope. This performance work statement is to provide information technology support services to Operational

Test and Evaluation Force (OPTEVFOR) in the areas of System Administration, Network

Engineering/Administration, Customer Service, Cyber Security, and Configuration Management. This support will be required in one or more of the following forms: Information Technology (IT) software, hardware, system support, and administration.

1.1. Background. OPTEVFOR maintains one (1) unclassified Research, Development, Test, & Evaluation

(RDT&E) network, one (1) unclassified cybersecurity Operational, Test, & Evaluation (OT&E) network, one (1) collateral classified secret excepted network, one (1) collateral classified secret cybersecurity

OT&E network, one (1) unclassified commercial cybersecurity OT&E network, and Cyber Adversarial

Simulation Toolset (CAST).

1.2. The required services shall provide technical and administrative support for the network infrastructure devices connected and cyber security support for all five networks, client and help desk support for the unclassified RDT&E network and the collateral classified secret excepted network, as well as provide configuration management, client and help desk support for the unclassified RDT&E network and the collateral classified secret excepted network.

1.3. Period of Performance. The period of performance associated with this PWS shall be for a twelve-month base period, four (4) twelve (12) month option periods, and one (1) six-month option period to be exercised at the discretion of the Government.

1.4. Place of Performance. Unless required to support mission accomplishment, work shall primarily be performed at the government’s site. If the number of personnel exceeds onsite capabilities, unclassified work will be expected to be performed offsite. The performance location is:

Operational Test and Evaluation Force

7970 Diven Street

Norfolk, VA 23505-1498

NOTE: Any Daily Telework must be approved by the Deputy CIO prior to executing by the contractor, and shall be considered “Situational”.

While onsite at OPTEVFOR, the contractor shall comply with OPNAVINST 5239 (series), with specific regard to non-government hardware and software. The Information Assurance (IA) program instruction will be provided upon contract award.

1.5. Personal Services. This is not a personal services contract. The contractors/sub-contractors should be well educated in respect to “personal services”. No one (Government employee or military) may task the contractor to perform work that is not listed in the contract, nor do the contractors take direction in the performance of their task from anyone other than their corporate manager and/or prime contractor, as appropriate.

1.6. Privity Defined. The legal term that defines the relationship between two parties of a contract, does not exist between the Government and the sub-contractor. Therefore, the Prime contractor is responsible for ensuring, through its own internal processes, that quality work is performed and delivered on time, by any subcontractors to meet the objectives of the prime contract. Formal direction to sub-contractors flows only through the prime contractor. There can be simultaneous communication between the prime contractor and the subcontractor, but the Government and the subcontractor cannot bypass the prime contractor to communicate directly with each other.

1.7. Automated Data Processing (ADP) Requirements: The Government will provide, if required, the necessary computer, work station/system access for on-site work. Employees of the contractor which are assigned as Off-site, will not be assigned government furnished ADP assets. Additionally, contractor employees assigned ADP Government Furnished Property (GFP) will be held accountable to respond to the governments ADP inventory requirements conducted semi-annually re-occurring every March and

September to ensure 100% accountability of all ADP assets. Any contractor employees not adhering to this call for inventory of ADP assets may be directed to forfeit their ADP GFP at no additional cost to the government in accordance with FAR 52.245-1.

1.8. Receipt and Acceptance of Deliverables All Deliverables in Section 3.0 shall be provided in accordance with the requirements listed in Section 2.0. Upon receipt and acceptance by the government, the respective government point of contact will acknowledge receipt and acceptance by sending an email to the

Contracting Officer’s Representative (COR) stating so. This email will facilitate the formal government’s position that they have accepted the respective product.

1.8 Personnel Required: The Government will require:

1.8.1 Systems Administrator – PoP start date 6 SEP 2023. Assigned tasks in section 2.4

1.8.2 All Remaining Skill Sets – PoP start date on Date of Award ISO Assigned tasks.

1.9. Historical Information – Personnel

This Performance Work Statement is to obtain CIO Support Services for a twelve (12) month base period plus four (4) 12-month Option periods, and one (1) six-month option period for OPTEVFOR. This PWS addresses the labor categories and the type of work that may be required during the period of performance; however, it is unknown to the exact level of effort that will be required. Therefore, the following historical information is provided to address the number of man-hours the government has used annually, in the past, in maintaining CIO assets. This information does not represent the government’s current need, but is to inform Contractors as to the amount of support that could be required.

POSITION HOURS PER YEAR

Customer Service Support Specialist-

Intermediate 7,680

Configuration Management Specialist II 1,920

Security Specialist I 1,920

Security Specialist II 3,840

System Administrator 1,920

Network Analyst 1,920

Network Engineer 1,920

Total 21,120

2. Tasks.

2.1 Customer Service Specialist Intermediate.

2.1.1 Provides technical support to end users for computer, application, system, device, printer, access and hardware issues.

2.1.2 Identifies, researches and resolves technical problems of moderate complexity.

2.1.3 Responds to telephone, email and online ticket requests for technical support.

2.1.4 Documents, tracks, and monitors the problem using applicable systems and tools. May coordinate with other teams or departments to resolve user problems.

2.1.5 Perform hardware and software installations, configurations and updates as needed.

2.1.6 Conducts Windows imaging and cloning of laptops and computers.

2.1.7 Applies Microsoft and other third-party security patches and updates to Windows 10 client workstations.

2.1.8 Provides Video Teleconference (VTC) technical support and assists end users with making VTC calls.

2.1.9 Conducts new user check-ins and check-outs.

2.1.10 Creates and modifies Microsoft Active Directory user accounts.

2.1.11 Will Issue Gov reviewed IT Assets to OPTEVFOR personnel and receive back IT assets for receipt by a Gov/Mil OPTEVFOR member

2.1.12 Assists new users with completing check-in forms and accessing online training.

2.1.13 Provides a monthly status report which contains the progress of work on assigned tasks and future work plans for the upcoming month.

2.2 Configuration Management Specialist II

2.2.1 Creates, implements, and maintains master data management solutions that enable users to optimize systems capabilities.

2.2.2 Provides data governance by coordinating and integrating data management efforts across the organization.

2.2.3 Manages projects to analyze, cleanse, enrich and monitor master data elements.

2.2.4 Provide daily support for configuration management planning.

2.2.5 Review and apply DISA Security Technical Information Guides (STIG) for Microsoft Windows and applications.

2.2.6 Create and/or update existing DISA STIG checklists.

2.2.6.1 Make updates and changes to existing Microsoft Group Policies to implement DISA STIG settings.

2.2.7 Build, test and deploy software releases.

2.2.7.1 Administer and maintain version control software.

2.2.8 Support the source change process so that only approved and validated changes are incorporated into product documents and related software.

2.2.9 Define provisions for configuration identification, change control, configuration status accounting and configuration audits.

2.2.10 Perform hardware and software installations, configurations and updates as needed.

2.2.10.1 Applies Microsoft and other third-party security patches and updates to Windows 10 client workstations.

2.2.11 Build and deploy System Center Configuration Manager (SCCM) installation packages for application updates and patches as well as operating system updates.

2.2.11.1 Validate successful deployment of software update packages through the use of reporting tools.

2.2.12 Manage software distribution and hardware/software inventories using Endpoint Manager/SCCM.

2.2.13 Provide a monthly status report which contains the progress of work on assigned tasks and future

2.3 Security Specialist SS-I and SS-II

2.3.1 (SS-II) Assist the Information Systems Security Manager (ISSM) in the development, review, endorsement and maintenance of cyber security certifications and accreditations.

2.3.2 (SS-II) Act as the Information System Security Engineer (ISSE) by providing technical support for the Risk Management Framework (RMF) Assessment and Authorization (A&A) process.

2.3.3 (SS-I) Conduct risk and vulnerability assessments of planned and installed information systems to identify vulnerabilities, risks and protection needs.

2.3.4 (SS-I) Assess security events and DISA STIGs to determine impacts and implement corrective actions.

2.3.5 (SS-I) Categorize systems under accreditation in accordance with the Committee on National

Security Systems Instruction (CNSSI) 1253 and create or modify the System Security Plan for all

OPTEVFOR systems.

2.3.6 (SS-I) Identify and select applicable Common Controls for all OPTEVFOR systems under accreditation.

2.3.7 (SS-I) Assist the ISSM in the development or modification of system-level continuous monitoring strategy for all OPTEVFOR systems.

2.3.8 (SS-I) Document security control implementation in the security plan for all OPTEVFOR systems.

2.3.9 (SS-I) Assist the ISSM in the development or modification of the Security Assessment Plan for all

OPTEVFOR systems.

2.3.10 (SS-I) Assist the ISSM in the development or modification of any policies, plans, and documentation required for the accreditation of all OPTEVFOR systems.

2.3.10.1 Perform Risk Management Framework (RMF) support for Authorization Steps 1 through 4 and Step 6 throughout the systems cybersecurity lifecycle.

2.3.11 (SS-II) Establish RMF Security Plan in eMASS.

2.3.12 (SS-II) Ensure proper Architecture, Boundary, and Dataflow diagrams are completed for systems being authorized.

2.3.13 (SS-II) Inventory and documentation of hardware/software/firmware within assessment boundary.

2.3.14 (SS-II) Develop Continuous Monitoring Strategy.

2.3.15 (SS-II) Completion of eMASS Implementation Plan based on Continuous Monitoring Strategy.

2.3.16 (SS-II) Ensure 100% execution of the approved Security Assessment Plan.

2.3.17 (SS-II) Ensure ACAS automated vulnerability scans are completed on all assets with-in assessment boundary and establish hardened baseline configuration with consistent, repeatable successful results.

2.3.18 (SS-II) Ensure system(s) are DISA STIG compliant - through SCAP scripts and manual checks.

2.3.19 (SS-II) Maintain the RMF POA&M to accurately portray the risk posture of assigned solutions.

2.3.20 (SS-II) Detail all relevant mitigation and remediation activities to vulnerabilities noted on the

RMF POA&M through the Change Management Process.

2.3.21 (SS-II) Ensure all RMF documentation is updated based on change and vulnerability management efforts.

2.3.22 (SS-II) Perform continuous security reviews of RMF Security Controls (per approved continuous monitoring strategy).

2.3.23 (SS-II) Support the development of the Plan of Action and Milestones (POA&M) and the development and update of the Security Authorization Package (SAP).

2.3.24 (SS-II) Assemble all required documentation as outlined by the ISSM for the RMF packages.

2.3.25 (SS-II) Assess security controls, Security Technical Implementation Guides (STIGs), and Assured

Compliance Assessment Solution (ACAS) scans in accordance with governing policies for servers, networking equipment, workstations, etc.

2.3.26 (SS-II) Process, maintain compliance, and verify completion of ACAS, STIG, and SCAP files, report any open findings or vulnerabilities to the program, propose and implement mitigations as required and construct necessary POA&M when required.

2.3.27 (SS-II) Monitor cyber security compliance for all OPTEVFOR systems using tools to include but not limited to the Enterprise Mission Assurance Support Service (eMASS), Vulnerability

Remediation Asset Manager (VRAM), and Assured Compliance Assessment Solution (ACAS).

2.3.28 (SS-II) Administer the ACAS server and vulnerability scans.

2.3.29 (SS-II) Apply security updates to the ACAS server application and Linux operating system as required.

2.3.30 (SS-II) Assist the ISSM in the development or modification of any policies, plans, and documentation required for the accreditation of all OPTEVFOR systems.

2.3.31 (SS-II) Administer and monitor Host Based Security System (HBSS) servers to maintain optimum operating status and install required server and client updates to HBSS components within mandated time-lines.

2.3.32 (SS-II) Make approved policy changes to HBSS configuration when required.

2.3.33 (SS-I and II) Provide a monthly status report which contains the progress of work on assigned tasks and future work plans for the upcoming month.

2.4 Systems Administrator

2.4.1 Provide daily technical support and troubleshooting of problems as required for all network

Windows servers, virtual and physical.

2.4.1.1 Perform server administration tasks, including user/group administration, security permissions, group policies, Windows updates, and research event log warnings and errors.

2.4.1.2 Configure and manage Microsoft Windows Server Active Directory infrastructure for

OPTEVFOR networks running in a single domain and single forest.

2.4.2 Maintain, upgrade, and implement improvements to the VMWare ESXi infrastructure and provide administration support of the virtual servers hosted in the environment.

2.4.2.1 Support of an enterprise-wide virtual infrastructure including security management and vulnerability management as well as system health monitoring and problem resolution.

2.4.3 Review and assess DISA Security Technical Implementation Guides (STIGs) for Microsoft

Windows Server and VMware ESXi hosts to determine impacts and implement mitigations and/or corrective actions.

2.4.3.1 Complete or update STIG checklists quarterly.

2.4.4 Administer, maintain and update the network backup infrastructure utilizing Commvault Backup and Recovery software.

2.4.4.1 Provide problem management and resolution for the backup of network servers using backup software, tape libraries, drives and media, and SAN infrastructure environment.

2.4.4.2 Provide support for backup job failures and user restore needs.

2.4.5 Configure and manage SolarWinds Security Event Manager software installed on OPTEVFOR servers.

2.4.5.1 Assist with planning and administering changes to the SolarWinds IT infrastructure management platform including adding/removing infrastructure into the monitoring tool, SolarWinds updates, upgrades, patching and module implementation.

2.4.5.2 Set up custom thresholds and alerts in SolarWinds for each category of object on the network.

2.4.6 Provide a monthly status report which contains the progress of work on assigned tasks and future

2.5 Network Analyst

2.5.1 Provide daily administration for Microsoft Endpoint Manager/Systems Center Configuration

Manager (SCCM) and Windows Software Update Server (WSUS) products installed on

OPTEVFOR servers.

2.5.1.1 Analyzes SCCM deployment failures and takes corrective actions.

2.5.1.2 Monitors and troubleshoots systems health and availability; recovers data in the event of hardware or software failure

2.5.2 Update Microsoft Endpoint Manager/SCCM servers with the latest software patches and fixes.

2.5.3 Build and deploy SCCM installation packages for application updates and patches as well as operating system updates.

2.5.3.1 Validate successful deployment of software update packages through the use of reporting tools.

2.5.4 Manage software distribution and hardware/software inventories using Endpoint Manager/SCCM.

2.5.5 Provide computer operations and customer support services for the Endpoint Manager/SCCM infrastructure and assist with modifying and creating software application packages and scripts.

2.5.6 Provide technical assistance with computer hardware and software to resolve issues for staff via phone, in person, or electronically.

2.5.7 Perform hardware and software installations, configurations and updates as needed.

2.5.8 Provide a monthly status report which contains the progress of work on assigned tasks and future

2.6 Network Engineer

2.6.1 Provide daily technical support and troubleshooting of problems as required for all network infrastructure devices to include but not limited to Cisco Nexus and Catalyst switches, Integrated

Services Routers (ISR), Firepower Next Generation Firewalls (NGFW), Identity Services Engine

(ISE), Prime Infrastructure, and Digital Network Architecture Center (DNAC).

2.6.2 Provide daily technical support and troubleshooting of problems as required for all network infrastructure devices to include but not limited to Cisco Nexus and Catalyst switches, Integrated

Services Routers (ISR), Firepower Next Generation Firewalls (NGFW), Identity Services Engine

(ISE), Prime Infrastructure, and Digital Network Architecture Center (DNAC).

2.6.3 Review applicable DISA Security Technical Implementation Guides (STIGs) and make required configuration changes quarterly IAW these STIGs for all network infrastructure devices to include but not limited to Cisco Nexus and Catalyst switches, Integrated Services Routers (ISR), Firepower Next Generation Firewalls (NGFW), Identity Services Engine (ISE), Prime

Infrastructure, and Digital Network Architecture Center (DNAC).

2.6.4 Install, configure, test and implement new network infrastructure devices to include but not limited to routers, switches, firewalls and gateways as required.

2.6.5 Assist with the deployment of IPv6 for the OPTEVFOR unclassified network and execute by configuring IPv6 on all network infrastructure devices.

2.6.6 Update network diagrams as necessary using Visio.

2.6.7 Provide a monthly status report which contains the progress of work on assigned tasks and future

3. Deliverables. List all goods, products, services, work, work product, items, materials and/or property to be created, developed, produced, delivered, performed or provided by or on behalf of the Contractors in connection with this contract. Data items required from the contractor are specified in the following paragraphs:

3.1. Services

3.1.1 The Customer Service Specialists will provide installation, configuration, testing, and technical support services.

3.1.2 The Security Specialist and Configuration Management Specialists will provide configuration, testing, technical support services and administrative support.

3.1.3 The Network Engineer and Systems Administrator will provide installation, configuration, testing, and technical support services.

3.1.4 The Security Specialist and Network Analyst will provide configuration, testing, technical support services and administrative support.

3.2. Documentation

3.2.1 The Configuration Management Specialists and Network Engineer will create, modify and provide network diagrams using the layout specified by OPTEVFOR in Visio 2019 format.

3.2.2 The Cyber Security Support Services Specialist will create, modify and provide accreditation documents, policies and plans.

3.3. Monthly Status Report

All contractors will provide a monthly status report in either Microsoft Word or PDF format to align with

Invoice Submissions as the Monthly Reports are used to validate the invoiced costs.

4. Minimum Personnel Requirements. If the Government questions the qualifications or competence of any person performing under the contract, the burden of proof to sustain the person as qualified as prescribed herein shall be upon the Contractor.

The Contractor shall meet the following minimum requirements.

4.1. Customer Service Support Specialist Intermediate

4.1.1. Experience

4.1.1.1. Experience with configuring and maintaining Windows 10/11 workstations.

4.1.1.2. Experience with installing and supporting Microsoft Office 2019 or higher.

4.1.2. Certifications (Provide ALL Copies at time of award)

4.1.2.1. The Contractor shall ensure that personnel accessing information systems have the proper and current cyber security certification to perform IT privileged administrative functions in accordance with DoD 8570.01-M (Table AP3.T1), Cyber Security Workforce (CSWF)

Improvement Program. Contractor personnel who do not have proper and current CSWF certifications shall be denied access to DoD information systems for the purpose of performing privileged user functions and will be dismissed from this contract.

4.1.2.2. The Contractor shall meet the applicable cyber security certification requirements for an

Information Assurance Technical (IAT) Level II which include:

4.1.2.2.1. One DoD-approved baseline security cybersecurity workforce certification appropriate for each category and level as listed in the current version of DoD

8570.01-M; and

4.1.2.2.2. Appropriate operating system certification for cyber security technical positions as required by DoD 8570.01-M; and

4.1.2.2.3. This position requires an IAT level II certification

(https://public.cyber.mil/wid/cwmp/dod-approved-8570-baseline-certifications/).

for either Security+ CE, CCNA-Security, GIAC Security Essentials (GSEC), or

Systems Security Certified Practitioner (SSCP).

4.2. Configuration Management Specialist II

4.2.1. Experience

4.2.1.1. Minimum of 3 years’ experience with in software configuration management.

4.2.2. Certifications

4.2.2.1. The Contractor shall ensure that personnel accessing information systems have the proper and current cyber security certification to perform IT privileged administrative functions in accordance with DoD 8570.01-M (Table AP3.T1), Cyber

Security Workforce (CSWF) Improvement Program. Contractor personnel who do not have proper and current CSWF certifications shall be denied access to DoD information systems for the purpose of performing privileged user functions and will be dismissed from this contract.

4.2.2.2. The Contractor shall meet the applicable cyber security certification requirements for an Information Assurance Technical (IAT) Level II which include:

4.2.2.2.1. One DoD-approved baseline security cybersecurity workforce certification appropriate for each category and level as listed in the current version of

DoD 8570.01-M; and

4.2.2.2.2. Appropriate operating system certification for cyber security technical positions as required by DoD 8570.01-M; and

4.2.2.2.3. This position requires an IAT level II certification

(https://public.cyber.mil/wid/cwmp/dod-approved-8570-baseline-certifications/). for either Security+ CE, CCNA-Security, GIAC Security Essentials (GSEC), or Systems

Security Certified Practitioner (SSCP).

4.3 Security Specialist II

4.3.1 Experience

4.3.1.1 Experience with monitoring information system security compliance using Enterprise Mission

Assurance Support Service (eMASS), Vulnerability Remediation Assurance Manager

(VRAM) and Assured Compliance Assessment Solution (ACAS).

4.3.1.2 Must have a minimum of 5 years’ Navy Assessment and Authorization (A&A) process experience with Risk Management Framework (RMF).

4.3.1.3 Must have a minimum of 5 years’ experience administering the DISA Endpoint Security

Solutions (ESS), formerly called Host Based Security System (HBSS) or have successfully completed the Endpoint Security Solutions (ESS) Administrator 201 ePO 5.10 and Endpoint

Security Solutions (ESS) Advanced Administrator 301 ePO 5.10 courses. Courses can be completed online at https://cyber.mil/training/ess-201/ and https://cyber.mil/training/ess-301/.

4.3.2 Certifications

4.3.2.1 The Contractor shall ensure that personnel accessing information systems have the proper and current cyber security certification to perform IT privileged administrative functions in accordance with DoD 8570.01-M (Table AP3.T1), Cyber Security Workforce (CSWF)

Improvement Program. Contractor personnel who do not have proper and current CSWF certifications shall be denied access to DoD information systems for the purpose of performing privileged user functions and will be dismissed from this contract.

4.3.2.2 This position requires a DoD IAM level II or III compliant certification

(https://public.cyber.mil/wid/cwmp/dod-approved-8570-baseline-certifications/). for either

Certified Authorization Professional (CAP), CompTIA Advanced Security Practitioner

(CASP+CE), Certified Information Security Manager (CISM), Certified Information Systems

Security Professional (CISSP) or GIAC Security Leadership Certification (GSLC).

4.4 Security Specialist I

4.4.1 Experience

4.4.1.1 Experience with monitoring information system security compliance using Enterprise Mission

Assurance Support Service (eMASS), Vulnerability Remediation Assurance Manager

(VRAM) and Assured Compliance Assessment Solution (ACAS).

4.4.1.2 Must have Navy Assessment and Authorization (A&A) process experience with Risk

Management Framework (RMF).

4.4.2 Certifications

4.4.2.1 (Security Specialist I) The Contractor shall be a Navy Qualified Validator (NQV) at the minimum of Level II) and on the list of approved NQVs maintained and published by the

Naval Information Warfare Systems Command (NAVWAR) Information Assurance

Technical Authority.

4.4.2.2 The Contractor shall ensure that personnel accessing information systems have the proper and current cyber security certification to perform IT privileged administrative functions in accordance with DoD 8570.01-M (Table AP3.T1), Cyber Security Workforce (CSWF)

Improvement Program. Documentation supporting CSWF certification status of candidates shall be included as part of contract proposals. Contractor personnel who do not have proper and current CSWF certifications shall be denied access to DoD information systems for the purpose of performing privileged user functions and will be dismissed from this contract.

4.4.2.3 The Contractor shall meet the applicable cyber security certification requirements for an IAM

Level I which include:

4.4.2.3.1 One DoD-approved baseline security cybersecurity workforce certification appropriate for each category and level as listed in the current version of DoD

8570.01-M. Copy of certification must be provided; and

4.4.2.3.2 Appropriate operating system certification for cyber security technical positions as required by DoD 8570.01-M. Copy of certification must be provided; and

4.4.2.4 This position requires an IAM level I certification (http://iase.disa.mil/eta/iawip/ content pages/iabaseline.html). Contractor must provide a certificate for either Security+ CE, Certified Authorization Professional (CAP), or GIAC Security Leadership Certification

(GSLC).

4.5 Systems Administrator

4.5.1 Experience

4.5.1.1 Minimum of 3 years’ experience with configuring and maintaining Microsoft Windows

Servers 2016 or higher.

https://cyber.mil/training/ess-301/ https://public.cyber.mil/wid/cwmp/dod-approved-8570-baseline-certifications/

4.5.1.2 Minimum of 1-year experience with Commvault Backup and Recovery software.

4.5.1.3 Minimum of 2 years’ experience with administrating VMware vSphere and vCenter

Server 6 or higher.

4.5.2 Certifications

4.5.2.1 Contractor must be certified as a Microsoft Certified Solutions Associate (MCSA)

Windows Server 2016 or Windows Server Hybrid Administrator Associate certification.

4.5.2.2 The Contractor shall ensure that personnel accessing information systems have the proper and current cyber security certification to perform IT privileged administrative functions in accordance with DoD 8570.01-M (Table AP3.T1), Cyber Security Workforce (CSWF)

Improvement Program. Documentation supporting the CSWF certification status of candidates shall be included as part of contract proposals. Contractor personnel who do not have proper and current CSWF certifications shall be denied access to DoD information systems for the purpose of performing privileged user functions and will be dismissed from this contract.

4.5.2.3 The Contractor shall meet the applicable cyber security certification requirements for an

Information Assurance Technical (IAT) Level II which include:

4.5.2.3.1 One DoD-approved baseline security cybersecurity workforce certification appropriate for each category and level as listed in the current version of DoD

8570.01-M. Copy of certification must be provided; and

4.5.2.3.2 Appropriate operating system certification for cyber security technical positions as required by DoD 8570.01-M. Copy of certification must be provided; and

4.5.2.3.3 This position requires an IAT level II certification

(http://iase.disa.mil/eta/iawip/ content pages/iabaseline.html).

Contractor must provide certificate for either Security+ CE, CCNA-

Security, GIAC Security Essentials (GSEC), or Systems Security

Certified Practitioner (SSCP).

4.6 Network Analyst

4.6.1 Experience

4.6.1.1 Minimum of 2 years’ experience with configuring and maintaining Microsoft Windows 10 or higher.

4.6.1.2 Minimum of 3 years’ experience with Microsoft Endpoint Manager/Systems Center

Configuration Manager (SCCM).

4.6.2 Certifications

4.6.2.1 Contractor must have the Microsoft 365 Certified: Modern Desktop Administrator

Associate certification.

4.6.2.2 The Contractor shall ensure that personnel accessing information systems have the proper and current cyber security certification to perform IT privileged administrative functions in accordance with DoD 8570.01-M (Table AP3.T1), Cyber Security Workforce (CSWF)

Improvement Program. Documentation supporting the CSWF certification status of candidates shall be included as part of contract proposals. Contractor personnel who do not have proper and current CSWF certifications shall be denied access to DoD information systems for the purpose of performing privileged user functions and will be dismissed from this contract.

4.6.2.3 The Contractor shall meet the applicable cyber security certification requirements for an

Information Assurance Technical (IAT) Level II which include:

4.6.2.4 One DoD-approved baseline security cybersecurity workforce certification appropriate for each category and level as listed in the current version of DoD 8570.01-M. Copy of certification must be provided; and

4.6.2.5 Appropriate operating system certification for cyber security technical positions as required by DoD 8570.01-M. Copy of certification must be provided; and

4.6.2.6 This position requires an IAT level II certification (http://iase.disa.mil/eta/iawip/ content pages/iabaseline.html). Contractor must provide certificate for either Security+ CE, CCNA-Security, GIAC Security Essentials (GSEC), or Systems Security Certified

Practitioner (SSCP).

4.7 Network Engineer

4.7.1 Experience

4.7.1.1 Experience with configuring and maintaining Cisco switches, routers, firewalls and security appliances.

4.7.1.2 Experience with configuring and deploying IPv6 on network infrastructure devices.

4.7.2 Certifications

4.7.2.1 Contractor must be certified as a Cisco Certified Network Professional (CCNP) or a

Cisco Certified Network Associate (CCNA). A copy of the certificate must be provided.

4.7.2.2 The Contractor shall ensure that personnel accessing information systems have the proper and current cyber security certification to perform IT privileged administrative functions in accordance with DoD 8570.01-M (Table AP3.T1), Cyber Security

Workforce (CSWF) Improvement Program. Documentation supporting the CSWF certification status of candidates shall be included as part of contract proposals.

Contractor personnel who do not have proper and current CSWF certifications shall be denied access to DoD information systems for the purpose of performing privileged user functions and will be dismissed from this contract.

4.7.2.3 The Contractor shall meet the applicable cyber security certification requirements for an

Information Assurance Technical (IAT) Level II which include:

4.7.2.3.1 One DoD-approved baseline security cybersecurity workforce certification appropriate for each category and level as listed in the current version of DoD

8570.01-M. Copy of certification must be provided; and:

4.7.2.3.2 Appropriate operating system certification for cyber security technical positions as required by DoD 8570.01-M. Copy of certification must be provided; and

4.7.2.3.3 This position requires an IAT level II certification

(http://iase.disa.mil/eta/iawip/ content pages/iabaseline.html). Contractor must provide certificate for either Security+ CE, CCNA-Security, GIAC Security

Essentials (GSEC), or Systems Security Certified Practitioner (SSCP).

5.0 Security Clearance. All Contractor personnel associated with this PWS shall have a current Defense Security

Service issued SECRET clearance and be ready to immediately begin performance at the time of proposal submission.

Defense Security Service issued SECRET clearance must be maintained during the performance of this contract.

Additionally, all Contractors shall also have a current SECRET FACILITIES clearance at the time of proposal submission.

- WORK HOURS: Normal working hours are 7:30 AM to 4:00 PM, Monday through Friday, with the exception of Federal government holidays, and include an allowance for a 30-minute lunch period.

However, there may be circumstances where work hours may be adjusted to meet mission critical requirements.

- GOVERNMENT HOLIDAYS: The following government holidays are typically observed by government personnel: New Year’s Day, Martin Luther King’s Birthday, Presidential Inauguration

Day (metropolitan DC area only), President’s Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day, Christmas Day, and any other day designated by

Federal Statute, Executive Order, and/or Presidential Proclamation.

- SAFETY: Safety shall be paramount. The contractor shall comply with applicable OPNAV, NETC, OSHA and command safety instructions and standards governing these requirements. The contractor shall maintain all employee qualification and certification records as required by these instructions.

- CONTRACTOR IDENTIFICATION: Contractor employees shall identify themselves as contractor personnel by introducing themselves or requesting they be introduced as contractor personnel and display distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and formal and informal written correspondence.

- CONTRACTING OFFICER REPRESENTATIVE: Only a duly appointed Procuring Contracting

Officer (PCO), and no other government personnel, is authorized to change the specifications, terms and conditions under this contract. The OPTEVFOR Contracting Officer’s Representative (COR) is responsible for technical management of this contract, and will serve as the Contracting Officer’s

Primary Point of Contact. The COR shall oversee execution of this PWS and resolve any potential issues. The COR is responsible for: liaising with OPTEVFOR personnel and Contractor personnel on site; contractual advice, recommendations and clarification regarding the statement of work;

delivery of this PWS placed under this contract; providing an independent government estimate of the effort described in the statement of work; quality assurance of services performed and acceptance of the services or deliverables; government furnished property; security requirements aboard government installations; providing the PCO or his designated Ordering Officer with appropriate funds for issuance of the delivery; and the certification of invoice for payment.

***Wage Determination 2015-4341 Revision No. 23 Dated 06/21/2023 is incorporated into this contract***

6.0 Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information

Technology (IT) Systems or Protected Health Information

Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement

Federal security standards for Federal employees and contractors. The Deputy Secretary of Defense Directive-Type

Memorandum (DTM) 08-006 – “DoD Implementation of Homeland Security Presidential Directive – 12 (HSPD-

12)” dated November 26, 2008 (or its subsequent DoD instruction) directs implementation of HSPD-12. This clause is in accordance with HSPD-12 and its implementing directives.

APPLICABILITY

This text applies to contractor employees requiring physical access to any area of a federally controlled base, facility or activity and/or requiring access to a DoN or DoD computer/network/system to perform certain unclassified sensitive duties. This clause also applies to contractor employees who access Privacy Act and Protected Health

Information, provide support associated with fiduciary duties, or perform duties that have been identified as National

Security Position, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance.

Each contractor employee providing services at a Navy Command under this contract is required to obtain a

Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

ACCESS TO DOD IT SYSTEMS

In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act, to include Protected Health Information

(PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command

Information Assurance Manager.

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher-level investigation than the National Agency Check with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government

IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N;

therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the “supervisor”.

The SAAR-N shall be forwarded to the Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

INTERIM ACCESS

The Command's Security Manager may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTORS SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractors Security Representative. Within three work days after contract award, the contractor shall provide to the requiring activity’s Command COR in writing, the name, title, address and phone number for the Contractors Security Representative. The Contractors Security

Representative shall be the primary point of contact on any security matter. The Contractors Security

Representative shall not be replaced or removed without prior notice to the Command COR.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR

CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE

DUTIES

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-

Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected

Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product)

Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

Original Signed Release Statements

Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The

Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the

Command’s Security Manager upon arrival to the command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy Command’s Information Assurance Manager. Completion and approval of a System

Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information

Technology resources. The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual

Information Assurance (IA) training, and maintain a current requisite background investigation.