Updated DRAFT - NAO PWS Rev_2.0.pdf

THIS IS A DRAFT PERFORMANCE WORK

STATEMENT (PWS)

U.S. FLEET CYBER COMMAND/U.S. TENTH FLEET

Navy Authorizing Official (NAO)

Performance Work Statement

1. GENERAL INFORMATION

1.1. SCOPE OF WORK: This Performance Work Statement (PWS) describes the performance requirements for contractor services in support of U. S. Fleet Cyber Command/U. S. Tenth Fleet Department of Defense (DoD) Risk Management Framework (RMF) Assessment and Authorization (A&A) and Authorization to Use/Connect (ATU/C) processes as it pertains to roles, responsibilities and functions. The scope of work includes operations in a secure environment for classified and unclassified information technology (IT) processes and satisfies requirements in support of, Department of Navy (DON), Joint and other service/agency goals and directives. Services shall be performed at both Government and Contractor facilities.

1.2. BACKGROUND: The Chief of Naval Operations has appointed Commander, U.S. Fleet Cyber Command (FLTCYBERCOM) as the Navy Authorizing Official (NAO) for specified classified, unclassified, and general services (GENSER) Top Secret and below Navy IT/IS portfolio as defined in OPNAVINST 5239.1E “U.S Navy Cybersecurity Program of 17 Nov 23”.

Furthermore, Chief of Naval Operations has delegated authorities for specified mission, function, and tasks as defined in OPNAVINST 5450.345 “Functions and Tasks of COMFLTCYBERCOM and COMTENTHFLT” of 04 Apr 2012 that encompasses NAO specific mission elements and operational authorities.

1.2.1 NAO has been tasked to execute Authorization to Use/Connect processes for all Functional Authorizing Official (FAO) authorizations as defined by FLTCYBERCOM Command Tasking Order 23-016 and follow-on Fragmentary Orders (FRAGORD) and other established governance. This work is directly derived from statute, including Executive Order 13800, Subchapter II of Chapter 35 of Title 44, United States Code (U.S.C.), also known as Federal Information Security Management Act (FISMA) of 2014; Public Law 113-283; and section 11331 of Title 40, U.S.C. and designated orders.

1.2.2 NAO manages and maintains oversight of community risk in DoDIN-N for all assigned Navy IT portfolio through the RMF A & A and ATU/C processes which directly support FLTCYBERCOM secure and defend mission in DoDIN-N. FLTCYBERCOM NAO has authority to issue Authorizations to Operate (ATO), Interim Authorizations to

Test (IATT), Denial of Authorizations to Operate (DATO). Authorization to Connect (ATC (reciprocal)), and ATU/C directly supporting and maintaining an acceptable level of cybersecurity and operational risk for IT/IS in DoDIN-N throughout its lifecycle.

1.2.3 Key customers include Navy Echelon I and II Commands, Program Management Offices (PMOs), Package Submitting Offices (PSOs), Joint Program Offices, DoD entities, federal agencies, and other stakeholders as required. The support provided encompasses a wide range of activities, including but not limited to:

o End-to-end support for RMF and ATU/C processes o Technical expertise and authorization strategy development for key technologies or initiatives o Customer engagement and collaboration o Development of business rules and processes o Concept of Operations (CONOPS) reviews o IS/IT technical analysis and reviews o Formulation, application, and adjudication of policies, directives, instructions, and guidance as needed o Provision of technical and administrative guidance to Navy organizations in the context of FLTCYBERCOM Mission and assigned roles

1.3 RMF, A & A AND ATU/C PROCESSES: In executing the DoD RMF steps—Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor—NAO staff (civilian, military, and contractors) serve as RMF and risk analysts, providing critical support to FLTCYBERCOM’s mission by enabling informed operational risk decisions. These analysts perform in-depth evaluations and quality assessments of customer RMF authorization packages to ensure appropriate due diligence has been executed throughout each RMF step. Their responsibilities extend beyond reviewing documentation; they rigorously analyze a broad range of cybersecurity artifacts—including, but not limited to, governance frameworks, security controls, vulnerability assessments, STIG compliance reports, Security Assessment Reports (SARs), contingency plans, and disaster recovery plans. These evaluations are essential to identifying and addressing operational risks that could impact mission readiness, effectiveness, and continuity. The Navy's IT portfolio requiring these analyses is diverse, encompassing operational systems, non-conventional IT, Research, Development, Test, and Evaluation (RDT&E) systems, test exercises, special projects, and Combatant Command/Service/Agency (CC/S/A) IT joint authorizations.

2.0 TASKING AND REQUIREMENTS:

2.1 RMF A & A AND ATU/C SUPPORT: The RMF Assessment and Authorization (A&A) and Authorization to Use/Connect (ATU/C) processes are integral to FLTCYBERCOM’s mission to secure and defend the DoDIN-N. These processes ensure that Navy IS/IT systems operating on the DoDIN-N meet cybersecurity compliance requirements, adhere to operational risk thresholds, and align with mission readiness objectives. The Contractor shall provide expert support for RMF A&A and ATU/C processes, leveraging set standards, guidance and procedures set by the NAO as well as tools, methodologies, and operational risk analysis to ensure risk-informed decisions that safeguard mission success and compliance with DoD and Navy policies, directives, and NAO processes and procedures. The contractor is required to provide appropriate resources to support execution of RMF A&A and ATU/C processes and meet government quality objectives.

2.2 RMF A & A PROCESS:

The RMF A&A process requires the contractor execution in:

a. System Categorization (RMF Step 1): Assist in categorizing Navy IS/IT systems based on their mission impact, ensuring proper alignment with FIPS 199 and CNSSI 1253. This includes evaluating confidentiality, integrity, and availability requirements as part of the operational risk analysis.

b. Detailed Analysis of Security Controls (RMF Step 2): Analyze and evaluate RMF security controls tailored to the system’s operational and cybersecurity risks. Ensure controls mitigate identified risks effectively while aligning with mission requirements.

c. Cybersecurity Compliance and Risk Evaluation (RMF Steps 4 and 5): Assess the implementation of security controls to confirm compliance with DoD and Navy cybersecurity policies. Validate that controls are implemented correctly, operating as intended, and achieving the desired security and privacy outcomes to support operational risk analysis and AO authorization decisions.

d. Continuous Monitoring (RMF Step 6): Support Continuous Monitoring (CONMON) activities, including ongoing risk assessments, vulnerability management, and compliance tracking, to ensure systems remain secure and operational on the DoDIN-N.

e. Alignment with Policies and Standards: Ensure adherence to DoD and Navy cybersecurity directives, orders, policies, instructions, and local SOPs throughout the RMF process to maintain compliance and operational readiness.

f. Tools and Technology Utilization: Use tools such as eMASS, ACAS, and other authorized platforms to support RMF compliance, risk assessments, and documentation of A&A artifacts.

g. Stakeholder Collaboration: Collaborate with stakeholders to provide detailed technical findings, compliance recommendations, and risk analysis to support AO authorization decisions.

2.3 ATU/C PROCESS:

The ATU/C process is a distinct and complementary operational risk management process owned by FLTCYBERCOM and is executed upon FAO authorization decisions. It ensures that Navy IS/IT systems operating in DoDIN-N meet cybersecurity compliance and FLTCYBERCOM mission readiness and cybersecurity requirements.

The ATU/C process requires the contractor execution in:

a. Cyberspace Operational Risk Indicators (ORIs): Evaluate and apply defined ORIs to assess operational risks and cybersecurity implications for systems operating on the DoDIN-N. ORIs are rigorously applied and continuously refined to ensure alignment with FLTCYBERCOM’s Defensive Cyberspace Operations – Internal Defensive Measures (DCO-IDM).

b. Artifact Integration: Integrate RMF tools, evidence, and artifacts into the ATU/C review process, ensuring alignment with DoD and Navy cybersecurity compliance standards and operational risk management requirements.

c. Risk-Based Decision Support: Provide detailed operational risk analyses and compliance assessments to support ATU/C approval or disapproval, ensuring decisions balance mission priorities with cybersecurity protections.

d. System Operational Assessments: Conduct thorough evaluations of system readiness for operating on the DoDIN-N, including reviews of conditional authorizations, escalation packages, and in-progress reviews. Ensure all assessments are aligned with compliance requirements and operational risk thresholds.

e. Continuous Evaluation: Monitor ongoing system changes, vulnerabilities, and risks to ensure continued compliance with ATU/C requirements and alignment with mission objectives.

f. Stakeholder Collaboration: Coordinate with Navy organizations, external mission partners, and program offices to address cybersecurity compliance concerns, operational risks, and documentation needs for systems operating on the DoDIN-N.

The RMF A&A and ATU/C processes require thorough analysis and evaluation of RMF and ATU/C artifacts, including Objective Quality Evidence (OQE), Body of Evidence (BOE), and supporting documentation. These evaluations must validate cybersecurity compliance and incorporate comprehensive operational risk analysis, vulnerability assessments, and threat assessments. The Contractor shall analyze key data from red team reports or similar evaluations to identify and quantify operational risks associated with Navy IS/IT systems. This analysis must include a detailed review of mitigation and remediation data to ensure appropriate risk reduction measures are identified, validated, and implemented.

The majority of OQE/BOE and RMF or ATU/C artifacts are provided to FLTCYBERCOM NAO by other Navy organizations and their functional teams. Effective execution of these processes requires strong teamwork, collaboration, and peer-to-peer analyses. The Contractor must foster partnerships with these entities while ensuring that FLTCYBERCOM’s mission, interests, and requirements are clearly communicated, understood, and achieved.

Given the dynamic nature of RMF artifacts, tools, and processes, the Contractor must remain agile and prepared to quickly acquire expertise in new risk management tools, methodologies, and procedures introduced to support NAO operational risk decisions. This may include Contractor-led training or advanced cognitive analysis to effectively interpret varied and complex RMF documentation. The ability to adapt to evolving tools and practices is essential to producing sound, risk-informed recommendations that align with FLTCYBERCOM’s mission to secure, operate, and defend the DoDIN-N. Both the RMF A&A and ATU/C processes directly support FLTCYBERCOM’s secure, operate and defend mission within the DoDIN-N. By integrating operational risk analysis, advanced tools, and compliance methodologies, these processes enable sound, risk-informed decisions that protect Navy systems and sustain mission-critical operations.

3.0 BASE LEVEL SUPPORT TASKS:

3.2.1 Participate in collaboration and checkpoint activities with assigned Echelon I/II or PSO commands and other Navy stakeholders as needed to achieve authorization, or approvals for other related tasking, from the NAO as it relates to Navy IS/IT.

3.2.2 Perform risk analyses on Navy IS/IT and provide authorization recommendations to NAO Government staff. This includes detailed analysis of risk acceptance reviews in support of NAO approval.

3.2.3 Conduct comprehensive operational risk assessments for Navy IS/IT systems as documented in A&A and ATU/C submissions from Navy organizations. Evaluate risk mitigation measures and their effectiveness in addressing identified vulnerabilities as related to impact and threat.

3.2.4 Provide detailed authorization recommendations to NAO Government employees, ensuring alignment with operational risk thresholds set by established governance as well as NAO SOPS, Rules of Engagement, and process guidance documents and tools necessary for A&A and ATU/C approvals.

3.2.5 Provide detailed technical analysis and risk assessments to NAO and Navy organizational customers as it pertains to emerging technologies in support of A&A, ATU/C and NAO core tasks and functions. For example, commercial cloud SAAS, PAAS, IAAS service platforms and Cloud Service Provider managed services supporting diverse DoD and Navy enterprise initiatives, to include execution of DEVSECOPS, micro services, and containers across diverse platforms on DoDIN-N.

3.2.6 Evaluate application security, mobile device management, including “bring your own device” and enterprise authorization development.

3.2.7 Review IS architectures, operating mode, applications, data types, system boundaries, connections, and other relevant information that will allow a full risk assessment and/or result in an authorization risk decision.

3.2.8 Review Navy IS/IT for compliance/adherence with/to Federal, DoD, DON, FISMA, and NAO policies/guidance/direction.

3.2.9 Assist in the implementation and promulgation of Navy Ports, Protocols, and Service Management (PPSM) guidance IAW DoD PPS policy. Support PPSM coordination activities with NAO government personnel and/or directed stakeholders and provide detailed analysis and recommendation with reference to PPSM use on DoDIN-N, with consideration of the AO authorization and NAO ATU/C, in supporting PPSM approvals.

3.2.10 Review and process entries to the PPSM databases (unclassified and classified). Validate registration records against eMASS artifacts for accurate system identification numbers, authorization termination dates (ATD), update system points of contact information, and check for systems that are under a Denial of Authorization to Operate (DATO) , Denial ATU/C, or decommissioned.

3.2.11 Review PPSM submission requests and register or update Navy Systems to the DoD PPS unclassified and classified Registries in compliance with DoD Instruction 8551.01 and the Navy PPSM manual. Verify registration of the RMF A&A for system authorization and for Navy and DISA firewall connections. Ensure FAO authorizations have ATU/C approvals when performing PPSM functions.

3.2.12 Conduct in-depth analysis and review of customer Boundary Change Requests (BCRs) and provide decision recommendation to the NAO government staff. Ensure compliance with

DoD Instruction 8551.01, assessing impacts on PPSM, security, and DoDIN-N operations.

Document findings and address deficiencies to align changes with mission priorities and cybersecurity standards.

3.2.13 Review and submit to NAO government staff Component Level Services Assessments (CLSAs) for additions to the Category Assurance List (CAL) in accordance with NAO required SOPS and related governance in support of approval.

3.2.14 Conduct in-depth analysis and review; provide authorization decision recommendations to the government staff for systems or circuits requiring escalation via the Navy’s High-Risk Review (HRR) process for Component CIO approval via DDCIO (Navy) for the continued operation of IT with residual high/very high risk. This includes ATU/C assessments and recommendations when warranted.

3.2.15 Conduct in-depth analysis and review; provide authorization decision recommendations to the government staff for Conditional Authorization Request (CAR) to include expired or expiring systems or circuits requiring a follow-on authorization under the Expiring Systems process. This includes ATU/C assessments and recommendations when warranted.

3.2.16 Develop and/or contribute to processes to capture out-of-cycle updates to authorization approvals (e.g., CSI or CORA results, POA&M updates, DISA scans) and any BOE/OQE required to support such approvals.

3.2.17 Develop, track and monitor A&A and ATU/C authorization follow-up for IT/IS reviews as directed to include any FLTCYBERCOM intra-directorate, NAO intra-divisional, and other Navy organizational reviews that are directed. This may include but is not limited to Navy or Joint Cyber Protection Team Activities, CORA, and other similar activities.

3.2.18 Track and monitor authorization conditions follow-up to ensure continued cybersecurity posture is maintained and integrated into the A&A and ATU/C process when vulnerabilities are identified on Navy IT/IS. Conduct in-depth analysis and review of ACF completion and extension requests; provide recommendations to the government staff for final adjudication or closure of NAO authorization decisions and ATU/C stipulations with scope of the ACF process.

3.2.19 Support data analysis to identify IT/IS authorization or cybersecurity issues and recommend actions or plans to remediate or mitigate issue to reduce organization risk in support of FLTCYBERCOM mission.

3.2.20 Review and provide recommendations for various waivers/extensions/exceptions as requested by Navy organizations in accordance DOD, Navy or NAO published governance

3.2.20 Provide post-inspection support for CSI and CORA activities, specifically for sites that received failing scores during their inspection to support the NAO in his role as voting member of the governing quarantine/risk review board. Support includes pre-scoping efforts, post inspection out briefs, as well as post inspection findings adjudication (e.g. preparation of Quarantine /Risk Review Boards (QRB/RRB)), and post risk review board deliverables analysis with recommendations to concur/non-concur with associated analysis to NAO leadership.

3.2.21 On a daily basis, participate in the required A&A or ATU/C collaborations, checkpoints, in progress reviews (IPR), or any required meetings as defined by NAO designated staff. Provide minutes, technical analysis, risk assessment, and recommendation to support NAO authorization or approval decisions.

3.2.22 Develop point papers, naval messages, and memorandums for the record (MFR), presentations, drafted formal emails, briefings and other forms of written documentation on an as-needed basis to support NAO.

3.2.23 Develop project plans and related project documents as directed in support of Navy or NAO projects and tasks. Lead or support various project methods to include PMBOK based and agile based projects that include but are not limited to, SRUM, Scaled Agile Framework (SaFE), and Kanban methods.

3.2.24 Ensure comprehensive documentation and reporting for RMF Steps 1 (Categorize System), 2 (Select Security Controls), 5 (Authorize System), and 6 (Monitor Security Controls) as they progress through the A&A or ATU/C processes. Accurately categorize and/or evaluate categorizations to reflect their confidentiality, integrity, and availability requirements, ensuring alignment with operational risk thresholds and mission-critical priorities. Keep NAO-designated staff informed of the status, identified issues, and potential risks throughout A&A or ATU/C processing steps. Present findings from submitted authorization packages as defined by NAO-designated staff, ensuring compliance with established timelines and processes.

3.2.25 Review and process AO-level agreements per DoD access control requirements for connecting Information Systems.

2.2.26 Track reciprocity agreements and annual reviews in support of continuous connection requirements for IT assets under the authority of multiple AOs.

3.2.27 Support mission area cybersecurity risk assessment activities at the RMF Tier 2/Tier 3 level that cross multiple individual systems or capabilities. This may include supporting research in the areas of mission assurance and related policies and procedures and in the development of draft process steps.

3.2.28 Support NAO coordination for participation in DoD, DON and Navy cybersecurity initiatives in the development of standards to align with mandated policy to include ATU/C process standards.

3.2.29 Support NAO participation in continuous improvement of A&A and ATU/C processes with consideration to DoD, DON, and Navy initiatives such as Cyber Ready and Comply to Connect. Coordinate the analysis and design for new processes, tools, and technologies designed to integrate and streamline current process automation and procedures.

3.2.30 Support NAO coordination for emerging A&A and ATU/C processes/policy/governance implementation to include but not limited to Navy for Next Generation Enterprise Network (NGEN), Consolidated Afloat Networks and Enterprise Services (CANES), cloud computing, coalition agreements, and joint acquisition programs requiring a Navy authorization (e.g., Joint Strike Fighter, Mobile User Objective System (MUOS), ballistic missile defense (BMD)).

3.2.31 Lead efforts to develop, implement, and monitor A&A metrics in coordination with NAO Government representatives. These metrics shall identify barriers, inefficiencies, and trends, providing actionable insights to support decision-making and process improvements. Collaborate closely with Government stakeholders to define requirements, ensure alignment with NAO objectives, and deliver metrics that enable effective analysis.

3.2.32 Support NAO as a stakeholder in the development and improvement of Cybersecurity Technical Authority (CS TA) Navy policy and standards (e.g., RMF Security Control Specific Assigned Values (SPAV), security controls inheritance).

3.2.33 Lead and or support NAO in execution of A&A and ATU/C training to FLTCYBERCOM staff, CSAs, and external customers in support of continual process improvement.

3.2.34 Lead or assist, as directed by NAO, in the development of A&A and ATU/C processes, procedures, applications, office tools, and formal or informal governance. This includes creating and refining Standard Operating Procedures (SOPs), memorandums, checklists, procedures, Rules of Engagement (ROEs), and communication mechanisms to support the effective implementation and execution of the NAO mission. Efforts shall ensure alignment with organizational objectives, enhance operational efficiency, and enable consistent and transparent execution of NAO responsibilities.

3.2.35 Support risk decisions by FCC NAO as part of collective decision (e.g. Functional Authorizing Officials (FAO), Functional Security Control Assessor (FSCA), NAO, CTF 1010, CTF 1020) to allow FAO approved information Technology that has been issued an authorization decision to operate on the DoDIN-N.

3.2.36 Assist NAO in providing inputs for feedback to support the evaluation and assessment.

Department Of Navy Information Security Continuous Monitoring (ISCM) Alignment and Data Framework.

3.2.37 Assist NAO in providing inputs to establish a baseline definition and data requirements of ISCM to be applied to all systems and ecosystems.

For all tasks, the Body of Evidence (BOE) is considered deficient if submitted artifacts or deliverables—such as authorization letters, coversheets, technical assessments, or supporting documentation—fail to comply with established DoD and Navy policies, internal NAO governance, or related correspondence provided by the Government. For the purposes of this PWS, governance includes Standard Operating Procedures (SOPs), Rules of Engagement (ROEs), policies, directives, and other documents that guide NAO processes and procedures.

Identified deficiencies will be communicated through established NAO business processes to ensure timely resolution.

Administrative Errors: These refer to inaccuracies in documents prepared by the Contractor for Government review. Such errors may include issues with grammar, punctuation, spelling, formatting, or non-compliance with NAO procedural requirements in items such as authorization letters, coversheets, and other governance-related documents.

Technical Errors: These refer to inaccuracies that fail to comply with FCC Operational Orders, DoD/Navy RMF requirements, policies, instructions, internal NAO related governance, or cybersecurity guidance specified in related Government correspondence. Such errors can affect compliance, operational risk assessments, and authorization outcomes.

4.0 PERFORMANCE STANDARDS:

4.1 Proactive, highly skilled cybersecurity professionals with proven technical expertise and strong administrative capabilities within their respective roles and labor categories.

4.2 Meet the DoD Cybersecurity Specialty Area 611 (Advanced/Intermediate) requirements of the SECNAV 5239.2M "Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual" and the requirements of any successor manuals or instructions which establishes training and certification standards for the DoD cybersecurity workforce.

4.3 Obtain appropriate security clearance for their respective positions. Interim Secret and Top Secret (TS) security clearances are acceptable until final adjudication is received. They will be placed into positions with TS/Sensitive Compartmented Information (SCI) clearance requirements must have a final Top-Secret clearance to be SCI eligible. They shall comply with DON and local security requirements to gain access to the facility.

4.4 Shall be responsible for the provision of adequate levels of staffing required to meet NAO’s functional requirements and Performance Measures. Will fill vacancies caused by loss of personnel due to turnover, (e.g., extended sick leave) not later than three weeks from the last work date of the departing contractor.

4.5 Shall work no more than the standard 40-hour work week. Contractors are expected to support an eight-hour day with required coverage during the core hours of 0930 and 1430, Monday through Friday starting not earlier than 0700. Government facilities will be closed on federal holidays.

4.6 Shall stay proficient in the technologies relevant to the organization's functions and roles as outlined in the task order. They shall ensure their personnel are trained to sustain and advance the skills and expertise required for their roles. Additionally, they shall monitor and document individual qualifications and certifications of all assigned personnel monthly and provide status reports to the COR.

4.7 During the first 180 days of task order performance, shall make no substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment.

They shall notify the Contracting Officer within 7 calendar days after the occurrence of any of these events and provide any necessary explanatory information and plan to fill the vacancy.

After the initial 180-day period, they should inform the Government when a personnel change is anticipated or contemplated.

4.8 Shall be required to complete mandatory Navy training requirements including but not limited to The Active Shooter, Annual Security Refresher, Intelligence Oversight, DoD Cyber Awareness, Privacy Act and PII, Level One Antiterrorism, Operations Security (OPSEC), and Records Management.

4.9 Shall identify themselves as contractor employees to avoid creating any impression that they are Government officials. Such identification shall be made in all meetings attended, when answering Government telephones, on all e-mails, and when working in other situations where their contractor status is not obvious to third parties. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

5.0. ANTICIPATED PERIOD OF PERFORMANCE:

The period of performance is detailed in the table below:

YEAR PERIOD OF PERFORMANCE

BASE 27 July 2025 – 26 July 2026 OPTION YEAR 1 27 July 2026 – 26 July 2027 OPTION YEAR 2 27 July 2027 – 26 July 2028 OPTION YEAR 3 27 July 2028 – 26 July 2029 OPTION YEAR 4 27 July 2029 – 26 July 2030 FAR 52.217.8 27 July 2030 – 26 December 2030

6.0 TRANSITION IN/OUT: Should the incumbent not be selected as the follow-on contractor; they shall participate in a transition phase to orderly and efficiently transition to a successor. The transition phase shall be considered the last thirty (30) days prior to the end of the task order period of performance.

The transition phase shall consist of briefing the Government and successor on the status of the task order and providing task order deliverables to the Government by the respective due dates. The incumbent shall submit a Transition Plan to the Government 30 days after the plan is requested. The Transition Plan shall include, at a minimum, a staffing plan to ensure task order is fully staffed throughout transition, and a date for the status briefing.

7.0 PLACE OF PERFORMANCE: Task order requirements will be conducted at Government facilities located at U.S. Fleet Cyber Command Suffolk, VA. Contractor may execute task order requirements via telework and/or contractor facility up to 20% of the time, in the event of space limitations at government facility and/or in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, Government closure due to inclement weather (see section 8.0). The contractor’s facilities shall be located within 250 miles of the Tidewater, Virginia area. This facility shall only be used to process controlled, unclassified information. Contractor and Contractor facility shall follow DoD/Navy policy for processing, storing, receiving, transmitting, viewing DoD/Navy information, including DoDINST 8582.01 of June 2012, Security of Unclassified DoD Information on Non-DoD Information Systems.

8.0 ALTERNATE PLACE OF PERFORMANCE: In cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, Government closure due to inclement weather), contractor employees may be required to work at an alternate place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) as determined by the Contracting Officer’s Representative (COR). Non-emergency/non-essential contractors should not report to a closed Government facility. To the maximum extent possible, the contractor shall use best efforts to provide the same level of support. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer (CO) or the contractor may request an equitable adjustment pursuant to the Changes clause of the task order.

9.0 GOVERNMENT FURNISHED INFORMATION (GFI): The Government will make available copies of technical documentation, drawings, and magnetic media as appropriate, in support of task requirements. All GFI is provided for information purposes and remains the property of the Government.

Upon completion of work or technical artifacts/media, all GFI copies shall be returned to and remain in possession of the Government.

10.0 GOVERNMENT FURNISHED MATERIALS/EQUIPMENT (GFM/E): Materials considered reasonably required for the completion of the described work will be furnished to the contractor upon request made to the COR. These materials will be furnished to the contractor for use in connection with and under the terms of this order. Contractors physically located in a FLTCYBERCOM facility will be provided an NMCI seat and all associated hardware/software that will be needed to complete above-described tasks. Upon completion of work, all GFM/E shall be returned to the Government.

11.0 SECURITY: Personnel performing on this PWS shall obtain a Secret or Top Secret (see Labor Requirements in Section 17.0) clearance in accordance with the DD 254, Contract Security Classification Specification. The Contractor shall register and request security clearances through the National Industrial Security Program Central Access Information Security System (NCAISS) (https://www.dss.mil/is/ncaiss/). Contractor personnel assigned to this task order that are designated to work with information at the Top Secret (TS), Sensitive Compartmented Information (SCI) and non-SCI level are required to be cleared at the appropriate level, Interim TS clearances are permitted. The contractor shall ensure the ability to obtain personnel above SECRET security clearance to meet the terms of this task order, therefore, a TS facility clearance is required and must be maintained throughout the life of the task order. As applicable, FLTCYBERCOM shall prepare and submit appropriate DD Form 254 to meet security requirements.

11.1 INFORMATION ASSURANCE & INFORMATION SECURITY: The Contractor shall protect DoD classified and sensitive unclassified data regardless of the location or ownership of the transport media, including, but not limited to mobile computing devices and removable storage media, whether Government furnished, or contractor owned/leased. Contractor shall comply with all current information assurance and information security policies, procedures, and statutes applicable to DoD information technology, including the August 21, 2008, Communications Tasking Order (CTO) 08-001, Encryption of Sensitive Unclassified Data at Rest (DAR) on Mobile Computing Devices and Removable Storage Media Used Within the DoD.

When supporting this task order from vendor location as place of performance, sensitive but unclassified DoD information will be protected in accordance with reference (h).

11.2 INFORMATION SYSTEM SECURITY: Information systems used by contractor personnel shall be operated in accordance with DoD 5220.22-M National Industrial Security Program (NISP) and reference(s).

12.0 NON-DISCLOSURE AGREEMENT (NDA) REQUIREMENTS: The Contractor shall provide corporate NDA prior to award, and employee NDAs upon award and over the Agreement life as workforce changes occur. NDA templates are attached.

13.0 PRIVACY ACT STATEMENT: “Pursuant to Title 5 United States Code 552a(m)(l), the contractor and all employees of the contractor working under this contract are required to comply with the requirements of 5 U.S.C. 552a (“The Privacy Act of 1974”).”

14.0 PROPRIETARY INFORMATION: No data provided to, or developed by, the contractor shall be used for any purpose other than the tasks assigned. All information (i.e., data files and hard copy) becomes the property of the Government and the contractor shall return them at the completion of the task. The Government shall not be required to pay royalties, recurring license fees, use tax or similar additional payments for any contractor-developed product or associated software presentation.

15.0 RESUMES: The Government reserves the right to review resumes for contractor personnel employed in this effort upon request. Upon request, resumes shall be provided to the Contracting Officer Representative (COR), Alternate Contracting Officer Representative (ACOR), and Technical Assistant

(TA).

16.0 SAFETY: The contractor shall comply with all Federal Occupational Safety and Health Administration (OSHA), local and base safety requirements, whichever is the most stringent. The contractor shall also comply with all local and base regulations pertaining to the environment, including but not limited to, water, air, solid waste, and noise pollution.

17.0 LABOR CATEGORY REQUIREMENTS:

Labor Category/

Description

Clearance Level

CSWF

Designation

Code

Required Staffing

Estimate d Annual

LOE

Estimated Annual Total Hours

Senior Cybersecurity Analyst/ Program Manager

TS/SCI

Advanced 1 1912 1912

Senior Cybersecurity Analyst

TS/SCI

Advanced 5 1912 9560

Senior Cybersecurity Analyst/ eMASS

TS/SCI

Intermediate 1 1912 1912

Cybersecurity Analyst

S

Intermediate 4 1912 7648

Cloud Cybersecurity Analyst

TS/SCI 611

Intermediate

1 1912 1912

Cloud Cybersecurity Analyst

S 611 Intermediate

1 1912 1912

18.0 PERSONNEL REQUIREMENTS:

18.1 Senior Cybersecurity Analyst/ Program Manager: Responsible for the execution and oversight of all task order and project-related activities, ensuring alignment with agency and enterprise priorities. Serves as the primary point of contact with the Government on all PWS-related matters, ensuring the quality, timeliness, and accuracy of deliverables and methodologies.

Oversees contractor performance through an internal management system that tracks project progress and ensures all requirements are met within the prescribed timeline and scope. Maintains accountability for ensuring that all task order deliverables comply with PWS requirements and agency standards.

Required Security Clearance: TS/SCI

Required Cyberspace Workforce Member Credentials: Per references: DODM

8140.3, DODI 8140.02. DODD 8140.01, SECNAVIST 5239.25, SECNAV M-5239.2

o Work Role Code: 611 Authorizing Official/Designating Representative o Proficiency Level: Advanced

Required Experience: Additional requirements include more than 8 years’ experience for each section below:

o Possesses expertise in Federal Acquisition Regulation (FAR) and DoD procurement policies and procedures.

o Demonstrates advanced program management capabilities, including program strategy development, task delegation, implementation planning, technology assessments, systems design and analysis, acquisition strategy, budget development, business process improvements/analysis, managing administrative/technical support related to IA/CS and INFOSEC.

o Prepares detailed reports, correspondence, white papers, memos, and other documentation required to support the AO and assigned projects, emphasizing alignment with the mission-critical objectives outlined in the PWS.

o Provides technical leadership in relevant cybersecurity and programmatic fields, managing task order operations for mission-critical and strategic programs.

o Provides expert-level analysis of RMF artifacts and processes in support of the Authorizing Official (AO), ensuring that all work products meet operational and compliance standards.

o Demonstrates a comprehensive understanding of the Navy Risk Management Framework (RMF) tools and processes and its application to DoD/Navy cybersecurity compliance, DoD Cloud architectures/technologies, Development, Security, and Operations (DevSecOps) implementation and methodologies.

In addition, must possess one of the following:

o ITIL v4 Strategist (or higher) o Lean Six Sigma (Green belt or higher) o Program Management Professional (PMP) Certification

18.2 Senior Cybersecurity Analyst: Provides expert support to the FLTCYBERCOM Authorizing Official (AO) in the execution of Risk Management Framework (RMF), Authorization to Use/Connect (ATU/C) processes and other NAO division(s) core functions to inform and support AO authorization decisions. Supports the ATU/C process by evaluating operational risk indicators (ORIs) and cybersecurity implications to inform FLTCYBERCOM risk decisions for systems connecting to the DoDIN-N. Coordinates with customers and program offices to ensure compliance with applicable directives, policies, and instructions, including but not limited to the Federal Information Security Management Act (FISMA), OMB Circular A-130, NIST SP 800 Series, FIPS Publications, and Navy RMF governance. Assists in negotiating RMF Assessment and Authorization (A&A) and ATU/C processes, as well as task management, to achieve or maintain Authorization to Operate (ATO) approvals or ATU/C approvals. Prepares and updates A&A and ATU/C work products to meet compliance standards and sustain operational readiness for mission-critical systems. Prepares reports, correspondence, white papers, letters, and other related documentation to support AO objectives and assigned projects, maintaining alignment with FLTCYBERCOM mission priorities, including the secure, operate, and defend mission for the DoDIN-N.

8140.3, DODI 8140.02. DODD 8140.01, SECNAVIST 5239.25, SECNAV M-5239.2

o Work Role Code: 611 Authorizing Official/Designating Representative o Proficiency Level: Advanced

Required Experience: More than 6 years’ experience for each section below:

o Conducts comprehensive risk and vulnerability assessments, performs analyses of security controls, and develops remediation and mitigation strategies to address identified risks.

o Experience in providing business process improvements/ analysis, lean/agile methodologies and providing administrative/ technical support services and management.

o Provides oversight of Continuous Monitoring (CONMON) activities, including vulnerability analysis, risk assessments, and security posture evaluations, ensuring compliance with DoD and Navy cybersecurity directives.

o Prepares and delivers technical reports, white papers, and analyses of vulnerabilities associated with complex Navy information systems and emerging technologies, providing critical input for sound, risk-informed decisions at all levels.

o Evaluates and validates RMF and ATU/C-related work products from external agencies, Navy organizations, and mission partners, ensuring alignment with Navy and DoD cybersecurity compliance requirements.

o Demonstrates a high level of competence in process analysis (vulnerability analysis, operational risk analysis/threat analysis/assessment) and the development of RMF and ATU/C artifacts to support AO responsibilities and decisions.

o Possesses advanced technical expertise in DoD cloud architectures, DevSecOps, enterprise architectures, 5G technologies, tactical platforms, and other relevant technologies in use with modern enterprises.

o Experience and understanding of DoD cybersecurity and policies, instructions and NIST publications as they relate to the Authorizing Official.

o Demonstrates a high level of expertise in critical domains such as DoD Ports, Protocols, and Services Management (PPSM), Cross Domain Solutions (CDS), Security Technical Implementation Guides (STIGs), Security Requirements Guides (SRGs), ACAS, eMASS, and other DoD tools essential for RMF, ATU/C, and ATO processes.

o Advanced level with MS office tools and related services.

18.3 Senior Cybersecurity Analyst/eMASS System Support: Supports RMF policy and process improvement; and eMASS System support functions to support AO in the execution of RMF processes and procedures. Provides JWICS eMASS support to include establishing administrative accounts for PSO personnel, establishing initial enterprise groups (e.g. SCA, NQV, FM, ISSE’s, ISSM’s, etc.). Coordinates with customers and program offices on eMASS requests.

In addition, ensures compliance with applicable directives, policies, and instructions, including but not limited to the Federal Information Security Management Act (FISMA), OMB Circular A- 130, NIST SP 800 Series, FIPS & CNSS Publications, and Navy RMF governance. Prepare, manage, and submit Tier 1 & 2 Common Control Provider (CCP) packages/records to AO for authorization.

8140.3, DODI 8140.02. DODD 8140.01, SECNAVIST 5239.25, SECNAV M-5239.2

o Work Role Code: 611 Authorizing Official/Designating Representative o Proficiency Level: Advanced

Required Experience: More than 6 years’ experience for each section below:

o Conducting comprehensive risk and vulnerability assessments, performing analyses of security controls, and develops remediation and mitigation strategies to address identified risks.

o Providing business process improvements/analysis, lean/agile methodologies and providing administrative/technical support services and management.

o Providing oversight of Continuous Monitoring (CONMON) activities, including vulnerability analysis, risk assessments, and security posture evaluations, ensuring compliance with DoD and Navy cybersecurity directives.

o Preparing and delivering technical reports, white papers, and analyses of vulnerabilities associated with Navy information systems and emerging technologies, providing critical input for sound, risk-informed decisions at all levels.

o Evaluating and validating RMF and ATU/C-related work products from external agencies, Navy organizations, and mission partners. Ensuring alignment with Navy and DoD cybersecurity compliance requirements.

o Demonstrating a high level of competence in process analysis (vulnerability analysis, operational risk analysis/threat analysis/assessment) and the development of RMF and ATU/C artifacts to support AO responsibilities and decisions.

o Understanding of DoD cybersecurity and policies, instructions and NIST publications as they relate to DoD/CNSS/NIST RMF processes (e.g., Assessment & Authorization, Assess Only).

o Experience in User & Role Management (Add, remove or modify user account(s)), Group Management (Add, modify or remove group(s), System Requests (Update system record (e.g., Registration Type, Information System Owner, record deletion).

o Experience with Reciprocity Requests – (Update guest system authorization information or request information from another service/agency record for reciprocity consideration) o Experience with Inheritance Requests - Approve inheritance, API Request (Provide Application Programming Interface (API) documentation and endorse connection (endorsement is performed by the Navy eMASS CCB Rep), all other request types; report eMASS issues/errors, Cybersecurity Content updates.

o Experience with Problem resolution – troubleshooting user account issues, package access, workflows, POA&Ms, imports & exports, cybersecurity content, reports, technically all modules, escalate problems to DISA when applicable, org structure maintenance (changes/updates), look up table maintenance.

o Experience in sending out announcements for scheduled and unscheduled service interruptions reminders to users, provide feature release summaries to users.

o Advanced experience with MS office tools and related services.

o Prepares reports, correspondence, white/point papers, letters, briefs, and other related documentation to support AO objectives and assigned projects, maintaining alignment with FLTCYBERCOM mission priorities, including the secure, operate, and defend mission for the DoDIN-N.

18.4 Cybersecurity Analyst: Supports the Authorizing Official (AO) in the execution of Risk Management Framework (RMF) and Authorization to Use/Connect (ATU/C) processes and other NAO division(s) core functions and missions to inform and support AO authorization decisions.

Supports program objectives by assisting project teams in meeting deadlines and ensuring effective delivery of tasks. Supports the ATU/C process by evaluating operational risk indicators (ORIs) and cybersecurity implications for systems connecting to the DoDIN-N, ensuring FLTCYBERCOM’s risk decision authority is exercised effectively. Coordinates, reviews, approves, and tracks high-risk escalation documentation for Navy circuits and non-circuits requiring DON Chief Information Officer (CIO) recommendation and approval, conditional authorization requests, in-progress reviews, and other exceptions. Develops reports, correspondence, and process documents to support AO and ATU/C missions and objectives.

Assists in managing and coordinating project activities as assigned, ensuring alignment with Navy AO and FLTCYBERCOM mission priorities to secure, operate, and defend the DoDIN-N.

Required Security Clearance: TS/SCI Required Cyberspace Workforce Member Credentials: Per references: DODM

8140.3, DODI 8140.02. DODD 8140.01, SECNAVIST 5239.25, SECNAV M-5239.2

o Work Role Code: 611 Authorizing Official/Designating Representative o Proficiency Level: Intermediate/Journeyman

Required Experience: More than 4 years’ experience for each section below:

o Demonstrates a comprehensive understanding of RMF and ATU/C processes, with the ability to coordinate and manage projects from initiation through completion, culminating in Authorization to Operate (ATO) or ATU/C approval.

o Experience and understanding in process analysis (vulnerability analysis, operational risk analysis/threat analysis/assessment) and the development of RMF and ATU/C artifacts to support AO responsibilities and decisions.

o Experience in Continuous Monitoring (CONMON), vulnerability analysis, risk assessments, security controls evaluation, and the development of remediation and mitigation strategies. Analyzes data and system architectures to create and implement information system solutions.

o Experience with adjudicating findings from Cybersecurity Inspections (CSI) and Cyber Operational Readiness Assessment (CORA) inspections, incorporating them into Assessment and Authorization (A&A) and ATU/C remediation plans as part of RMF Step 6 (Monitor).

o Experience conducting functional reviews and lifecycle tracking of Memorandums of Agreement (MOA), Memorandums of Understanding (MOU), and Interconnection Security Agreements (ISA), ensuring alignment with DoD/Navy requirements.

o Applies experience in interpreting and implementing policies for modern technologies, including enterprise and tactical platforms. Demonstrates knowledge of DoD cloud architectures and technologies, DevSecOps fundamentals (e.g., DoD Enterprise Strategy, container hardening), 5G, mobile devices, and other advanced technologies utilized by the DoD and Navy.

o Exhibits full understanding of unique DoD/Navy processes related to RMF and ATU/C, as well as associated domains such as Ports, Protocols, and Services Management (PPSM), Cross Domain Solutions (CDS), Defense Information Systems Agency (DISA) circuits, and related policies and business practices.

o Intermediate level with MS office tools and related services.

18.5 Cloud Cybersecurity Analyst: Supports the Authorizing Official (AO) in the execution of Risk Management Framework (RMF) and Authorization to Use/Connect (ATU/C) processes and other NAO division(s) core functions and missions to inform and support AO authorization decisions.

Required Security Clearance: TS/SCI (1 FTE), Secret (1 FTE) Required Cyberspace Workforce Member Credentials: Per references: DODM

8140.3, DODI 8140.02. DODD 8140.01, SECNAVIST 5239.25, SECNAV M-5239.2

o Work Role Code: 611 Authorizing Official/Designating Representative o Proficiency Level: Intermediate/Journeyman

Required Experience: More than 4 years’ experience for each section…