NIT PWS - DRAFT.pdf

PERFORMANCE WORK

STATEMENT

(PWS)

Professional Support Services for the U.S. Navy Insider Threat Program

Prepared By: NIA/N72

Effective Date: March 2027 Version: 1.0

NIA/N72 | Performance Work Statement (PWS)

1.0 INTRODUCTION, BACKGROUND, AND SCOPE

1.1 Introduction

The U.S. Navy Insider Threat Program (InTP) is a centralized Navy program, mandated by Executive Order 13587 and focused on early identification and reporting of potential malicious activity. The Director of Navy Staff (DNS) is the Navy’s designated Senior Official for Insider Threat, and the OPNAV N2 under the Deputy Chief of Naval Operations (DCNO) for Intelligence, Operations, Plans, Strategy, and Warfighting Development (N2N3N5N7) is the Navy’s executive agent for the Navy program. The Naval Intelligence Activity (NIA) manages the day-to-day execution of the Navy InTP in support of OPNAV N2 and the DNS. The NIA requires professional support services to meet National and DoW InTP requirements and advance policy and capabilities to ensure program effectiveness in ensuring Navy warfighting, personnel, and operational readiness.

The Navy InTP is a capability executing the Navy Insider Threat (InT) mission to prevent, detect, deter and mitigate insider threats from witting or unwitting insiders that may harm or place at risk Navy personnel, information, or resources.

1.2 Background

Executive Order and National policy documents issued in response to compromises of classified information, active shooter, physical destruction and unauthorized disclosure incidents provide specific guidance to Departments and Agencies to counter threats from insiders. Per Executive Order 13587, “Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information” (October 7, 2011), and the “National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs”, agency heads “shall build and maintain an insider threat analytic and response capability.” The National Insider Threat Task Force identified an established hub as a “best practice” for agency insider threat programs and is an inspectable requirement. Navy received approval of an InT program of record in 2015/16 and began execution of the program in 2018.

In accordance with guidance in the FY17 National Defense Authorization Act, Sec 951; the Navy InTP is focused on maintaining a program for protection and mitigation of insider threat risks to include loss or degradation of government information, resources, or capabilities as well as destructive acts/physical harm to others in the workplace. The elements of the program shall include the latest information protection technologies, capable of detecting, analyzing and coordinating the mitigation of insider threats and associated support capabilities.

1.3 Scope

The primary purpose and scope of support services is to provide the Navy InTP with studies, research, analysis, advisement, and execution of requirements/deliverables supporting capabilities across the program’s multiple lines of operations that include:

1. Navy insider threat policy

2. User Activity Monitoring (UAM) on Navy classified and other designated networks

3. Navy Insider Threat Analytical Hub

4. Random Polygraph Program (RPP) for Privileged Users (PUs)

5. Navy InTP Strategic Outreach and Engagement (SOE)

6. Emerging InTP standards and requirements

The services required under this task order are grouped into Program (Policy, RPP, and SOE), UAM, Hub, and Other Related support. Support within these groups include Executive Level (short-term projects, special studies, strategic analyses support, and high-level briefings) and Basic Level (analytical, technical, financial management support, programmatic support, data collection, policy review, process research and ADHOC task as applicable).

1.4 Period of Performance

The base period of performance for this requirement is from 09 March 2027 through 08 March 2028 and will include four 12-month option periods.

• Base: 09 March 2027 through 08 March 2028

• Option Period I: 09 March 2028 through 08 March 2029

• Option Period II: 09 March 2029 through 08 March 2030

• Option Period III: 09 March 2030 through 08 March 2031

• Option Period IV: 09 March 2031 through 08 March 2032

1.5 Place of Performance

The place of performance will primarily be at the Government’s facilities in the Washington DC metropolitan National Capital Region/NCR (i.e. areas to include NSF Arlington (NSF-A), VA, Pentagon, Northern Virginia and Southern Maryland (Office of Naval Intelligence/ONI), etc.).

The contractor may be required to have a facility in the Northern Virginia metro area to house contractor personnel should the need for personnel exceed those accommodated at the Government facilities.

In those exceptional cases when contractor personnel work efforts are performed outside of Government facilities due to events which cause these facilities to be inaccessible, performance of appropriate work efforts will be limited to contractor facilities that comply with all requirements of the contract, including but not limited to facilities that comply with applicable security requirements. The contractor shall submit a request to the NIA/N72 leadership via the COR prior to contractor personnel commencing any work efforts outside Government facilities; this includes adhoc or situational telework upon government approval.

In accordance with U.S. Navy policy and responsibilities for the implementation of a U.S. Navy Continuity of Operations (NAVCOOP) in the event of a Pandemic that restricts access to the contractor’s government facilities place of performance to include the Pentagon, the contractor will be notified by NIA/N72 leadership via the COR that normal access has been restricted and to whom such restrictions apply. In that event the contractor shall change the place of performance under the task order to contractor facilities that comply with all requirements of the contract. The change in place of performance shall remain in effect until NIA/N72 leadership, via the COR, notifies the Contractor that restrictions to government facilities have been removed.

1.6 Level of Effort

The following level of effort is provided for proposal purposes only.

Labor Category Loc. Hours (Base)

Hours (Opt I)

Hours (Opt II)

Hours (Opt

III)

Hours (Opt

IV)

Total Hours

SSO Navy, SCI Security Program (1)

Gov’t 1,920 1,920 1,920 1,920 1,920 9,600

Data Scientist (1) Gov’t 1,920 1,920 1,920 1,920 1,920 9,600

Information Assurance/ Security and Insider Threat (Policy) (3)

Gov’t 5,760 5,760 5,760 5,760 5,760 28,800

Information Assurance/Insider Threat Analyst HUB (11)

Gov’t 21,120 21,120 21,120 21,120 21,120 105,600

Information Assurance, Insider Threat User Activity (UAM) Analyst (7)

Gov’t 13,440 13,440 13,440 13,440 13,440 67,200

Total (23) Gov’t 44,160 44,160 44,160 44,160 44,160 220,800

1.7 Minimum Qualifications

1.7.1 Navy Insider Threat Random Polygraph Program

As a Contractor for the Navy Insider Threat Program, all Contractors are subject to Navy Insider Threat Random Polygraphs. (Note: The minimum qualifications listed below must be met by the team, not on an individual basis, unless otherwise specified).

1.7.2 SSO Navy, SSO Navy SCI Security Program

Required Experience: 5 Years Minimum Experience.

Preferred Experience: Contract Program Management Professional certification courses.

Administrative skills in database management and data tool development, as well as policy development, systems engineering and analysis, clearance process and project management is desired.

1.7.3 Cyber Security / Security and Insider Threat (Policy)

Required Experience: 5 Years Minimum Experience. Certificate exhibiting completion of an Insider Threat Course at no cost to the government is required.

• The contractor shall obtain the Certified Insider Threat Professional – Fundamentals (CITP-

F) certification within six (6) months of contract award.

• Contractors must be able to convey written information in an organized clear and concise manner for the intended audience and make clear and convincing oral presentations as necessary.

Preferred Experience: Project Management Professional (PMP) credential is desired.

Certifications as an Acquisition Professional are desired.

1.7.4 Security and Insider Threat (System Engineer / Analyst) / HUB (These minimum qualifications must be met at the individual level)

• Required Experience: Must have a minimum of five (5) years of direct professional experience working in/with a Counter-Insider Threat Program.

• The contractor shall obtain the Certified Insider Threat Program – Fundamentals (CITP-F) and Analysis (CITP-A) certifications within six (6) months and twelve (12) months, respectively, of contract award.

1.7.5 Cybersecurity / Security and Insider Threat (System Engineer / Analyst) /

UAM

(These minimum qualifications must be met at the individual level)

Required Experience: Must possess a minimum of five (5) years of direct, hands-on experience in insider threat mitigation, counterintelligence, User Activity Monitoring (UAM), or behavioral analysis within a US Government or comparable enterprise environment.

• The contractor shall obtain the Certified Insider Threat Program – Fundamentals (CITP-F) and Analysis (CITP-A) certifications within six (6) months and twelve (12) months, respectively, of contract award.

• The contractor shall successfully complete the DCSA CDSE courses: Insider Threat Awareness (INT101) and Cyber Insider Threat (INT280) within six (6) months.

Preferred Experience: A Certified Information Systems Security Professional (CISSP) certification is desired. Project Management Professional (PMP) credential is desired.

1.7.6 Insider Threat Data Scientist and Analyst

(These minimum qualifications must be met at the individual level)

Required Experience: Must possess a minimum of five (5) years of direct professional experience in analytics, data science, business intelligence, predictive modeling, or machine learning, or a closely related field. Experience working within a Department of Defense (DoD) or intelligence environment.

Domain Knowledge: Must possess a minimum of two (2) years of experience supporting Insider Threat, User Activity Monitoring (UAM), cyber security, or intelligence activities.

• The contractor must possess and maintain an active Top Secret security clearance with access to Sensitive Compartmented Information (SCI) at all times during the performance of the contract.

• The contractor shall possess a Bachelor of Arts (BA) or Bachelor of Science (BS) degree in a quantitative discipline (e.g., Management Information Systems, Statistics, Computer Science).

2.0 DEFINITIONS AND ACRONYMS

2.1 Definitions

The following definitions are applicable to this Performance Work Statement (PWS). These terms are binding for the duration of the contract.

Contracting Officer

(KO)

The only Government official authorized to obligate the Government, legally bind the United States, enter into, administer, or terminate contracts, and make related determinations and findings.

Contracting Officer’s Representative (COR)

A representative from the requiring activity appointed in writing by the KO. The COR performs technical surveillance of contractor performance. The COR does not have the authority to alter the contract’s scope, price, terms, or conditions.

Contractor A supplier or vendor awarded a contract to provide specific supplies or services to the government. The term used in this contract refers to the prime contractor and their personnel.

Government Lead / Technical Assistant

(TA)

A designated Government employee responsible for providing day-to-day technical direction, assigning routine workload priorities, and managing mission requirements within the scope of the PWS.

Incident Response The structured process of responding to a security event, cyber breach, or insider threat anomaly to mitigate damage, contain the threat, and investigate the root cause.

Normal Duty Hours The standard operating hours of the NIA/N72 facility, defined as Monday through Friday, 0600 to 1800 (EST), excluding Federal Holidays.

Off-Limits / Restricted Area

Any secure area within the facility, including SCIFs, where access is strictly controlled and limited only to personnel with a verified “need-to-know” and the appropriate security clearance/indoctrination.

Piggybacking The strictly prohibited act of an authorized person knowingly allowing an unauthorized individual to follow them through a secure door or access control point without presenting their own valid credentials.

Quality Assurance Surveillance Plan

A written document utilized by the Government to systematically evaluate the Contractor’s execution of the PWS tasks and ensure

(QASP)

Questionable Intelligence Activity

(QIA)

Significant or Highly Sensitive Matter

(S/HSM)

performance standards are met.

Any intelligence or intelligence related activity conducted by, or on behalf of, a DoD or IC component that may violate federal law, Executive Order, Presidential Directive, or DoD policy.

Any intelligence or intelligence related activity (or serious unauthorized disclosure) that could impact foreign policy, national security, or civil liberties, or generate intense public/Congressional scrutiny.

User Activity Monitoring (UAM)

The technical and analytical process of observing and logging user actions on Government networks (e.g., SIPRNet, JWICS) to detect anomalous behavior and prevent insider threats.

2.2 Acronyms

Acronym Definition

A&A Assessment & Authorization

BOL BUPERS (Bureau of Naval Personnel) On-Line

CAC Common Access Card

CCITP-A Certified Counter-Insider Threat Program – Advanced

CCITP-F Certified Counter-Insider Threat Program – Fundamentals

CDRL Contract Data Requirements List

CI Counterintelligence

CNO Chief of Naval Operations

CONUS Continental United States

COR Contracting Officer's Representative

CUI Controlled Unclassified Information

DCSA Defense Counterintelligence and Security Agency

DFARS Defense Federal Acquisition Regulation Supplement

DISS CATS Defense Information System for Security Case Adjudication Tracking System

DITMAC DSATS DoD Insider Threat Management Analysis Center, Defense Security Analysis and Threat System

DLP Data Loss Prevention

DNS Director of Navy Staff

DoD Department of Defense

DoDI Department of Defense Instruction

DON Department of the Navy

FAR Federal Acquisition Regulation

FLTMPS Fleet Training Management and Planning System

FTE Full-Time Equivalent

GFE / GFI Government Furnished Equipment / Government Furnished Information

HR Human Resources

IA Information Assurance

IG Inspector General

IPT Integrated Product Team

ITRA Insider Threat Risk Assessment

JTR Joint Travel Regulations

JWICS Joint Worldwide Intelligence Communications System

KO Contracting Officer

LE Law Enforcement

LOA Letter of Authorization

NTE Not-To-Exceed

OCONUS Outside the Continental United States

PMP Project Management Plan

POA&M Plan of Action and Milestones

PWS Performance Work Statement

QASP Quality Assurance Surveillance Plan

QIA Questionable Intelligence Activity

REDD Reenlistment Eligibility Data Display

RPP Random Polygraph Program

SCIF Sensitive Compartmented Information Facility

SIEM Security Information and Event Management

S/HSM Significant or Highly Sensitive Matter

SOE Strategic Outreach and Engagement

SOP Standard Operating Procedure

SPOT Synchronized Predeployment and Operational Tracker

TS/SCI Top Secret / Sensitive Compartmented Information

TWMS Total Workforce Management Services

UAM User Activity Monitoring

3.0 GOVERNMENT FURNISHED PROPERTY,

EQUIPMENT, AND INFORMATION (GFP/GFE/GFI)

3.1 Government Provided Workspaces and Equipment

The Government will provide designated onsite workspaces at NIA/N72 facilities for contractor personnel.

• Workspace Components: Workspaces will include a desk, chair, telephone, standard office supplies, and a standard Navy Marine Corps Intranet (NMCI) computer workstation with associated software.

• Property Management: All Government-furnished IT equipment and software shall be managed, tracked, and utilized in accordance with FAR Part 45 and applicable DoD/Navy IT asset management regulations.

3.2 Contractor IT Security and Training

• Compliance: The Contractor shall operate all Government-provided computer equipment and networks in strict accordance with Navy information assurance (IA), cyber security, and network access instructions.

• Mandatory Training: Contractor personnel shall complete all mandatory Government-provided training required to obtain and maintain network access as detailed in the table below. The contractor shall provide training completion certificates to the Contractor Lead and COR during the onboarding and annually thereafter as required.

Course Title Method of Training Frequency

DoD Cyber Awareness Challenge

Online via TWMS / NeL Annually

Intelligence Oversight (IO) In-person at Command Orientation, then Online via TWMS

Initial, then Annually

Antiterrorism Level I Awareness

Command Orientation, then Online via NeL

Initial, then every 2 years

Security Orientation ONI In-house Initial, scheduled by ONI

SMO

3.3 Office Relocation Services

• Minor Reorganization: If the Government reallocates or redistributes designated office spaces, the Contractor shall be responsible for packing, unpacking, and securing their own work materials and contractor-provided files during the transition.

• Logistical Support: Physical relocation of heavy office furniture, desks, and IT infrastructure wiring will be coordinated and executed by the Government’s facilities management team, not the Contractor.

3.4 Utility Services and Communications

The Government will provide standard utilities (electricity, water, sewage, and heating/cooling) at no cost to the Contractor. The Government will provide telephone and official network connectivity solely for the performance of official duties in support of this contract’s requirements.

3.5 Reporting Loss, Damage, or Destruction

The Contractor shall immediately report any lost, stolen, damaged, or destroyed Government property to the Contracting Officer’s Representative (COR) and designated security personnel.

The Contractor shall prepare a formal Report of Loss in accordance with DFARS 252.245-7002 and forward it to the COR within twenty-four (24) hours of discovery. The Contractor shall fully cooperate with any subsequent Government survey or security investigation.

3.6 Physical Security and Safeguarding

The Contractor shall be responsible for safeguarding all Government equipment, information, and property provided for Contractor use within their designated work area. At the close of each work period, the Contractor shall ensure their immediate workstations are clear of unprotected sensitive materials, computer terminals are locked/logged off, and any localized security cabinets under their control are secured. Physical locking and securing of the overall NIA/N72 facility remains the sole responsibility of designated Government personnel.

4.0 CONTRACTOR FURNISHED ITEMS

4.1 Contractor-Acquired Materials (Not Authorized)

The Contractor is not authorized to acquire or purchase any materials, equipment, or consumable supplies under this task order. All incidental consumables and materials required for the direct performance of work under this task order will be provided exclusively by the Government as Government Furnished Information/Equipment (GFI/GFE) in accordance with Section 3.0.

5.0 SPECIFIC TASKS & REQUIREMENTS

The contractor shall provide support by reviewing processes, organizational structures, and ongoing efficiency efforts at the corporate, individual command and activity levels. The services are for strategic and operational level support regarding current and future initiatives in the following areas:

5.1 InT Program Support (Policy, RPP, SOE) - 3

5.1.1 The Contractor shall develop Navy Doctrine, Organization, Training, Materiel, Leadership and Education, Personnel, Facilities and Policy (DOTMLPF-P) related products to support a wide range of Navy antiterrorism, force protection, counterintelligence, human resources, law enforcement, security, user activity monitoring, and information assurance related activities that directly and indirectly support the Navy’s insider threat deterrence, detection, and mitigation mission.

5.1.2 The Contractor shall manage and update assigned SharePoint sites and the Navy’s Insider Threat website, establish social media platforms, and create new content as required to ensure platforms remain current and relevant.

5.1.3 The Contractor shall produce Insider Threat Security briefings and analysis reports to provide an evaluation of current or planned capabilities, policies, and their impact on the Navy program.

5.1.4 The Contractor shall contribute to the Insider Threat Program Newsletter by researching content, drafting articles, and creating visual products (e.g., posters) on a daily basis to support the quarterly newsletter publication.

5.1.5 The Contractor shall evaluate and report on National, Agency, and civilian insider threat program-related technologies, controls, and procedures, with emphasis on those reflected within the Department of Defense (DoD) and Intelligence Community (IC) environments, to identify potential standardization and interoperability opportunities and challenges.

5.1.6 The Contractor shall convey written information in an organized, clear, and concise manner, tailoring products for specific intended audiences to persuasively communicate and reinforce program messaging.

5.1.7 The Contractor shall clearly articulate, present, and promote varied ideas and issues— including sensitive or controversial topics—to various audiences by delivering clear and convincing oral presentations as required.

5.1.8 The Contractor shall develop effective strategic communications, education plans, and associated products designed to increase Navy workforce awareness of insider threats and how the Navy is working to mitigate those threats.

5.1.9 The Contractor shall analyze DoD, IC, Navy, and Industry best practices and knowledge bases to develop recommendations for deploying insider threat mitigation capabilities across Navy architectures (ashore and afloat), aligned appropriately with the DoD, IC, and other mission partners.

5.1.10 The Contractor shall develop and update insider threat-related Concepts of Operation (CONOPS), Implementation Plans, Standard Operating Procedures (SOPs), strategy documents, instructions, directives, policy documents, program briefings, white papers, reports, and staffing packages up to the SECRET / Not Releasable to Foreign Nationals (NOFORN) classification level.

5.1.11 The Contractor shall attend and participate in Government and contractor meetings, providing subject matter expertise in support of insider threat-related briefings, program working group meetings, seminars, symposiums, insider threat conferences, technical exchanges, and workshops.

5.1.12 The Contractor shall provide administrative support for the coordination, facilitation, and execution of insider threat-related meetings and technical conferences.

5.1.13 The Contractor shall provide support to develop, implement, and maintain compliance of the Navy Random Polygraph program.

5.1.14 The Contractor shall assist with the Navy Random Polygraph program by maintaining legacy systems, conducting quality control checks on polygraph reports provided by NCIS, scheduling and randomizing polygraphs for privileged users, and providing monthly reports to the Director of the Insider Threat Program.

5.1.15 The Contractor shall provide administrative, information technology, and database/tracker management support for privileged users in support of the Navy Random Polygraph program.

5.1.16 The Contractor shall develop integrated training products to meet National, DoD, and Service mission training requirements, addressing the overarching Navy mission training requirement as directed within Executive Order 13587, DoD Directive 5205.16, SECNAV Instruction 5510.37, and OPNAV Instruction 5510.165.

5.1.17 The Contractor shall document recommendations and develop analytic and mission support products.

5.1.18 The Contractor shall maintain the Navy’s Insider Threat Program Designated Representative database for all Navy Commands, ensuring the database is constantly updated with new Insider Threat Designated Representatives, and all representatives are included in the Navy Insider Threat Program Designated Representative collaboration portal (e.g., Microsoft Teams channel).

5.1.19 The Contractor shall develop various briefs, presentations, data drills, processes, metrics, and technical data based on technical knowledge or subject matter expertise.

5.1.20 The Contractor shall meet with the Government Lead on a weekly basis to highlight planned and ongoing tasks, as well as any concerns that may negatively impact Navy programs.

5.1.21 The Contractor shall meet with the Government Lead monthly to discuss mission assurance, review personnel assigned to the program, assess potential impacts (e.g., upcoming leave, training, conference attendance, and departures), evaluate replacement personnel and overlap, and review deliverable status.

5.1.22 The Contractor Site Lead shall serve as the focal point and primary chain of communication between contract personnel, the Branch Chiefs, and the Insider Threat Director. The Site Lead shall also assist in the onboarding of new contract personnel.

5.1.23 The Contractor Site Lead shall receive and synthesize raw information from the Hub, UAM, Strategic Engagement, and Random Polygraph sections to provide editorial support for the Weekly Activities Report (WAR), the weekly Talking Points Memo, and other products as necessary.

5.2 Cybersecurity / Insider Threat User Activity Monitoring (UAM) Analyst Support — 7

5.2.1 The Contractor shall possess and maintain a Top-Secret security clearance with access to Sensitive Compartmented Information (SCI) at all times during the performance of the contract.

5.2.2 The Contractor shall maintain cyber workforce qualifications in accordance with Department of the Navy (DON) Cyber Workforce Program requirements (SECNAV M- 5239.2) and DoDI 8140 (which supersedes DoD 8570.01-M).

5.2.3 The Contractor shall be enrolled in the random polygraph program and shall be subject to counterintelligence (CI) polygraph examinations as required for system access.

5.2.4 The Contractor shall handle all data, including Controlled Unclassified Information (CUI), in strict accordance with DoDI 5200.48 and all applicable Government data handling policies.

5.2.5 Contractor personnel performing under this role shall possess a minimum of five (5) to seven (7) years of direct, hands-on experience in insider threat mitigation, counterintelligence, User Activity Monitoring (UAM), or behavioral analysis within a U.S.

Government or comparable enterprise environment.

5.2.6 Contractor personnel shall demonstrate expert-level proficiency utilizing enterprise-class UAM and Security Information and Event Management (SIEM) platforms, including but not limited to Securonix, Splunk, or EverFox.

5.2.7 The Contractor shall develop and tune complex detection rules and correlation searches within the aforementioned UAM and SIEM platforms.

5.2.8 The Contractor shall utilize scripting languages (e.g., Python, PowerShell) to support advanced data analysis, automation, and prototyping as required by the Government Lead.

5.2.9 The Contractor shall lead complex digital investigations and manage the full lifecycle of highly sensitive cases, from initial detection and analysis through to final resolution.

5.2.10 The Contractor shall obtain the Certified Counter-Insider Threat Program – Fundamentals (CCITP-F) certification within six (6) months of contract award, and the Certified Counter-Insider Threat Program – Advanced (CCITP-A) certification within twelve (12) months of contract award.

5.2.11 The Contractor shall successfully complete the Defense Counterintelligence and Security Agency (DCSA) CDSE courses for Insider Threat Awareness (INT101) and Cyber Insider Threat (INT280) within six (6) months of contract award.

5.2.12 The Contractor shall perform the duties of a UAM Analyst, responsible for the analysis, development, and implementation of UAM policies, procedures, and standards designed to protect critical information, personnel, and operations.

5.2.13 The Contractor shall conduct UAM system demonstrations, perform continuous analysis of UAM audit data, and monitor system alerts to detect, identify, and report anomalous activities.

5.2.14 The Contractor shall coordinate with applicable stakeholders (e.g., Personnel Security, CI, LE, IA, IG, HR) to resolve audit alerts in accordance with documented guidance.

5.2.15 The Contractor shall collaborate with designated Pillar Leads to assist with the development and regular refinement of analytical dashboards, data filters, and audit policy triggers.

5.2.16 The Contractor shall leverage subject matter expertise across multiple domains— including Cybersecurity, Counterintelligence, Incident Response, Digital Forensics, and Data Loss Prevention (DLP)—to develop and refine technical mitigation strategies.

5.2.17 The Contractor shall provide project management support throughout the full lifecycle of designated UAM projects, to include developing, managing, and maintaining all required project documentation.

5.2.18 The Contractor shall generate progress, status, and financial reports that identify risks, issues, cost variances, and scope creep.

5.2.19 The Contractor shall lead and direct designated Integrated Product Teams (IPTs) to ensure the successful achievement of organizational objectives, collecting and analyzing requirements from stakeholders to provide implementation recommendations.

5.2.20 The Contractor shall travel up to 25% of the time in support of assigned tasks and organizational objectives.

5.2.21 The Contractor shall notify the Government of any contractor personnel changes at least fourteen (14) calendar days prior to the change occurring and shall provide a Course of Action (COA) to fill vacancies with qualified replacements meeting all PWS requirements.

5.2.22 The Contractor shall complete all assigned tasks and support activities within the timeframes specified by the Government Lead.

5.3 Insider Threat HUB Analyst Support — 11

5.3.1 The Contractor shall collect and conduct analysis of information received from various data sets and assist in the development, implementation, and management of Insider Threat/cybersecurity collection, prevention, detection, deterrence, analysis, and mitigation activities.

5.3.2 The Contractor shall perform tasks in one or more of the following security disciplines:

cyber threat analysis, incident response, intrusion detection, network/computer forensics, data loss prevention technologies, enterprise audit analysis, and/or automated Audit/Anomaly Threat Detection technology.

5.3.3 The Contractor shall conduct information technology audits, incident responses, and/or network monitoring at the Enterprise level, to include utilizing standard security tools to execute monitoring tasks.

5.3.4 The Contractor shall assist in generating analytical reports, technical findings, and executive briefs to other team members and senior leadership on captured, researched, and analyzed data.

5.3.5 The Contractor shall serve as a subject matter expert, providing professional briefings and active participation in meetings, working groups, technical demonstrations, and conferences as required by the Government.

5.3.6 The Contractor shall demonstrate proficient written and oral communication competencies, utilizing these skills for daily routine tasks, assignments, and the development of supporting program documentation.

5.3.7 The Contractor shall possess and maintain all applicable professional certifications required for this work role in accordance with DoDI 8140 and Navy cybersecurity workforce mandates within twenty-four (24) months of task order award.

5.3.8 The Contractor shall review and incorporate automated User Activity Monitoring (UAM) data and security alerts from Navy unclassified, classified, and SCI networks into analytical reports and Insider Threat Risk Assessments (ITRAs).

5.3.9 The Contractor shall compile and submit daily, weekly, and monthly metrics to the Government, including cases worked/opened/closed, risk assessments completed, and successful submissions to Navy case management systems and the DoD Insider Threat Management Analysis Center, Defense Security Analysis and Threat System (DITMAC

DSATS).

5.3.10 The Contractor shall perform detailed analysis of data captured from various sources to identify anomalous, suspicious, or policy-violating activity, providing final analytical assessments to the Government to actively prevent, detect, deter, and mitigate potential insider threats. Authorized sources include, but are not limited to:

• LEXISNEXIS (ACCURINT)

• Transunion (TLO)

• THOMSON REUTERS (CLEAR)

• Fleet Training Management and Planning System (FLTMPS)

• Reenlistment Eligibility Data Display (REDD)

• Human Resources (HR) data

• Bupers On-line (BOL)

• Data Person Search (DPS)

• Total Workforce Management Services (TWMS)

• Defense Information System for Security Case Adjudication Tracking System (DISS

CATS)

5.3.11 The Contractor shall coordinate with designated points of contact across Personnel Security, Counterintelligence (CI), Law Enforcement (LE), Information Assurance (IA), Inspector General (IG), Human Resources (HR), and other Mission Business Owners (MBO) to resolve insider threat issues in accordance with documented Standard Operating Procedures (SOPs).

5.3.12 The Contractor shall support Government Team Leads by coordinating with other specialized organizational elements (e.g., CI, Security, CND, IA) to maintain awareness of active Advanced Persistent Threats (APTs), emerging cybersecurity trends, and evolving insider threat methodologies.

5.3.13 The Contractor shall collaborate with cross-functional teams and the program office to assist with testing and evaluating new or existing software used for case management, data set review, and Hub policy development.

5.3.14 The Contractor shall evaluate existing Hub policies, recommend modifications to optimize program objectives, and assist in the development of new security policies as directed.

5.3.15 The Contractor shall capture, document, and deliver formal Lessons Learned documents to the Government following major operations, training events, or system transitions.

5.3.16 The Contractor shall assist in the development of technical and functional business processes, workflows, Standard Operating Procedures (SOPs), training materials, and informational Insider Threat guides. Unless otherwise directed, the Contractor shall utilize Government-furnished templates and formats.

5.3.17 The Contractor shall assist in developing supporting Concepts of Operations (CONOPs) and response/reporting procedures for managing status events (non-critical) and referral events (critical) with appropriate authorities (e.g., Command Leadership, Security, IA, CI/LE, IG, HR).

5.3.18 The Contractor shall provide the Government with copies of all task order-related documentation, analyses, and work products developed in the performance of this contract.

5.3.19 The Contractor shall execute and complete all assigned tasks within the timelines mutually agreed upon with the Government Team Lead.

5.3.20 The Contractor shall submit a Weekly Status Report (WSR) utilizing the Government-provided template. The report shall, at a minimum, detail: Work performed and key accomplishments; Projected tasks and planned activities; Deliverable target dates and schedule status; and identification and mitigation plans for any risks, challenges, or issues pertaining to assigned tasks.

5.4 Other Related Support Insider Threat Data Scientist and Analyst —

5.4.1 Insider Threat Data Scientist and Analyst Support - 1

5.4.1.1 The Contractor shall possess and maintain an active Top Secret security clearance with access to Sensitive Compartmented Information (SCI) at all times during the performance of the contract.

5.4.1.2 Contractor personnel performing under this role shall possess a Bachelor of Arts (BA) or Bachelor of Science (BS) degree in a quantitative discipline (e.g., Management Information Systems, Statistics, Computer Science).

5.4.1.3 Contractor personnel shall possess a minimum of five (5) years of direct professional experience in analytics, data science, business intelligence, predictive modeling, or machine learning, or a closely related field. Experience working within a Department of Defense (DoD) or intelligence environment.

5.4.1.4 Contractor personnel shall demonstrate advanced technical proficiency and experience in distributed computing, predictive modeling, advanced mathematics, statistics, machine learning, and data storytelling.

5.4.1.5 The Contractor shall extract, transform, and load (ETL) complex data from various Insider Threat datasets into approved Government data visualization tools and platforms.

5.4.1.6 The Contractor shall process, analyze, and disseminate data, incorporating analytical findings into actionable products such as intelligence reports, executive presentations, strategic marketing/awareness materials, and interactive dashboards.

5.4.1.7 The Contractor shall design, build, and continuously refine specialized threat lexicons, indicator keywords, and risk-scoring logic to assist UAM and HUB analysts in prioritizing alerts and focusing on high-risk data.

5.4.1.8 The Contractor shall develop and implement innovative technical approaches to improve the utilization, integration, and visualization of existing data sources and analytical techniques.

5.4.1.9 The Contractor shall extract and interpret complex data sets utilizing a variety of advanced methods, including applied statistics and machine learning algorithms.

5.4.1.10 The Contractor shall collect, process, exploit, and manage Publicly Available Information (PAI) in support of continuous Insider Threat assessments and data enrichment efforts.

5.4.2. SSO Navy SCI Security Program - 1

5.4.2.1 The contractor shall apply developed critical thinking expertise in and knowledge of communications capabilities and channels to design and implement strategies that advance the goals and objectives of a broad range of SSO Navy initiatives.

5.4.2.2 The contractor shall produce SSO Navy briefings and analysis reports on a weekly basis to provide an evaluation of current or planned capabilities or policies and impacts to the Navy program.

5.4.2.3 The contractor shall develop and update SSO Navy Implementation Plans, Weekly Activity Reports (WARs), Standard Operating Procedures (SOPs), and various strategy documents, metrics, instructions, directives, policy documents, program briefings, white papers, information papers, reports, and staffing packages.

5.4.2.4 The contractor shall attend and participate in Government and contractor meetings, providing subject matter expertise in support of SSO Navy related briefings, program working group meetings, seminars, symposiums, technical exchanges, and workshops.

5.4.2.5 The contractor shall provide administrative support for the coordination, facilitation, and execution of SSO Navy related meetings and conferences.

5.4.2.6 The contractor shall provide support to develop, implement, and assess compliance of Navy’s background investigation and adjudication program.

5.4.2.7 The contractor shall provide administrative, information technology, and database support to the Navy’s background investigation and adjudication program and to SSO Navy’s SCI Policy, SCIF Management and Technical Security efforts.

5.4.2.8 The contractor shall develop enterprise architecture alignment reports to highlight challenges or concerns with current or planned initiatives and recommend associated mitigation solutions.

5.4.2.9 The contractor shall document recommendations and develop analytic and mission support products.

5.4.2.10 The contractor shall develop various briefs, presentations, data drills, processes, metrics, and technical data based on technical knowledge or subject matter expertise.

5.4.2.11 The contractor shall meet with the customer on a weekly basis to highlight planned and ongoing tasks, as well as any concerns that may negatively impact Navy programs.

5.4.2.12 The contractor shall meet with the customer on a monthly basis to hold discussions to ensure mission assurance and review personnel assigned to the program, status of potential impacts (i.e., upcoming leave, training, or departures), replacement personnel and overlap, and deliverable status.

5.4.2.13 The contractor shall develop effective strategic communications, education plans, and associated products designed to increase Navy workforce awareness of SSO Navy initiatives, and how those initiatives support the maintenance of a steady state inventory of current Navy investigations and adjudications.

6.0 SECURITY REQUIREMENTS

6.1 Clearance Level and Network Access

The highest level of security clearance required for performance under this contract is TOP SECRET / Sensitive Compartmented Information (TS/SCI) with access to SI/TK/G/HCS.

• Network Access: Contractor personnel shall require active access to the Joint Worldwide Intelligence Communications System (JWICS) and standard Secret Internet Protocol Router Network (SIPRNET) systems to perform their daily duties.

• Polygraph Requirements: Contractor personnel holding elevated Privileged User (PU) capabilities on Government Information Systems shall maintain eligibility for, and participate in, the Government’s Random Polygraph Program as a condition of system access.

6.2 Facility Access and Controlled Spaces

The Contractor shall strictly comply with all security rules, regulations, directives, and Standard Operating Procedures (SOPs) governing access to NIA/N72 facilities and Sensitive Compartmented Information Facilities (SCIFs).

• Restricted Areas: Certain NIA/N72 designated spaces are strictly restricted or “off-limits.”

Contractor personnel shall not enter these spaces without explicit, prior authorization from the Government’s designated security official.

• Non-Duty Access: All requests for contractor access outside of normal business hours (non-duty hours) must be coordinated and approved in writing through the Contracting Officer’s Representative (COR) and the assigned Technical Assistant (TA).

6.3 Credentials, Badges, and Access Devices

• Issuance: The Government will issue necessary Common Access Cards (CACs), facility passes, and security badges to authorized Contractor personnel.

• Control: Contractor personnel shall not permit their issued badges, passes, or access devices to be used by any other individual. Piggybacking (knowingly allowing unauthorized individuals to follow through secure access points) and sharing credentials are strictly prohibited.

• Lost Credentials: The Contractor shall immediately report any lost, stolen, or compromised badges, passes, or access devices to the COR and NIA/N72 security personnel.

6.4 Escort Procedures

Contractor personnel may be required to escort visitors within NIA/N72 facilities at the request of the Government.

• Escort Qualifications: Contractor personnel performing escort duties must possess the appropriate clearance level, security indoctrination, and local security training required to escort uncleared or lower-cleared visitors in the designated space.

• Adherence: All escorts shall be executed in strict accordance with local SCIF escort policies and physical security directives.

6.5 Non-Disclosure Agreement (NDA) Requirements

In the course of their normal duties, Contractor personnel will have access to sensitive, non-public Department of Defense (DoD) financial, operational, and proprietary information.

• Prior to commencing work under this task order, all Contractor personnel shall sign a standard Non-Disclosure Agreement (NDA) provided by NIA/N72.

• Signed NDAs shall be submitted to the contractor Team Lead, NIA-OPNAV SSO, and COR for filing prior to the contractor being granted access to any Government systems or spaces.

6.6 Intelligence Oversight and Reporting

6.6.1 Scope and Compliance: The Contractor shall comply with all applicable federal laws, Executive Orders, and Department of Defense (DoD) / Intelligence Community (IC) directives regarding the conduct of intelligence and intelligence-related activities. Specifically, the Contractor and all assigned personnel shall adhere to the requirements of Executive Order 12333, DoD Manual 5240.01, and DoD Directive 5148.13.

6.6.2 Mandate to Report: Contractor employees who perceive, suspect, or have knowledge of any Questionable Intelligence Activity (QIA) or Significant or Highly Sensitive Matter (S/HSM) shall immediately report such activity to the designated Government point of contact identified in this contract.

6.6.3 Reporting Procedures:

• Immediate Notification: QIA Reports shall be made within 24 hours of discovery; report the S/HSM immediately upon discovery.

• Primary Channels: Reports shall be made directly to the Contracting Officer’s Representative (COR) and the Government Program Manager (PM).

• Oversight Channels: If reporting through the program chain of command is inappropriate or ineffective, the employee shall report directly to the NIA Inspector General (IG) or the NIA/ONI Intelligence Oversight Official (IOO).

6.6.4 Whistleblower and Non-Retaliation Protection: The Contractor shall not take any adverse personnel action or retaliate against any employee for reporting a suspected QIA or S/HSM in good faith. Contractor employees retain all protections afforded under federal whistleblower protection laws, including 10 U.S.C 4701 and 41 U.S.C 4712.

7.0 OTHER DIRECT COSTS (ODCs) & TRAVEL

7.1 Travel Regulations and Reimbursable Expenses

The Contractor shall be required to travel in the performance of this task order to attend conferences, meetings, briefings, and training, or to conduct site surveys.

• Compliance: All travel expenses invoiced to the Government shall be in accordance with FAR 31.205-46 and the current Joint Travel Regulations (JTR). Expenditures that exceed JTR limits (e.g., unauthorized premium airfare or lodging above per diem) will not be reimbursed.

• Pre-Approval: All travel requirements shall be pre-approved in writing by the Government Lead or the COR in advance of travel dates. CONUS travel requests must be submitted at least fourteen (14) calendar days prior to departure.

• Urgent Mission Approvals: In cases of documented mission urgencies where prior written approval is not feasible, the Contractor may obtain verbal approval from the COR. However, this verbal approval must be confirmed in writing (via email) by the COR within twenty-four

(24) hours of the verbal authorization and prior to the initiation of travel or invoicing.

• Invoicing: Travel will be reimbursed on an actual cost-only basis. No fee or profit shall be applied to travel costs. All travel invoices must be supported by legible receipts.

7.2 OCONUS Travel and SPOT Requirements

For any Outside the Continental United States (OCONUS) travel (e.g., to Naples, Italy, or Japan), the Contractor must be tracked in the DoD’s official overseas database.

• Contractor’s Responsibility: The Contractor shall enter all traveler data into the Synchronized Predeployment and Operational Tracker (SPOT) system and generate a Letter of Authorization (LOA) request at least forty-five (45) days prior to departure.

• Government’s Responsibility: The Contracting Officer (KO) must sign and approve the LOA generated before any travel arrangements are finalized.

• No LOA, No Travel: Contractor personnel are strictly prohibited from traveling OCONUS, and the Government will not reimburse any OCONUS travel costs, unless a fully approved and signed LOA is issued. The Contractor shall always carry a physical copy of the approved LOA while performing work OCONUS.

7.3 Budget Ceiling

The total Not-to-Exceed (NTE) amount for ODCs is $20,000 per Fiscal Year / Performance Period (excluding applicable indirect costs). This ceiling is reserved strictly for pre-approved, reimbursable travel expenses. No material costs shall be invoiced against this task order.

7.4 Potential Travel Locations (Illustrative)

The following table represents a pool of potential travel destinations in support of this task order.

This list is provided for illustrative and planning purposes only and does not constitute a guaranteed travel schedule.

Actual travel will be dictated by operational necessity and executed strictly on an “as-needed” basis, subject to COR pre-approval. Total annual travel costs shall not exceed the $20,000 NTE ceiling. Once the annual budget ceiling is reached, no further travel will be authorized or reimbursed.

Potential Destination / Location Max Authorized Trips Per Year

Max FTEs Per Trip

San Diego, CA 2 2

Groton, CT 2 2

Washington, DC 2 2

Jacksonville, FL 2 2

Mayport, FL 2 2

Honolulu, HI 2 2

Norfolk, VA 2 2

Suffolk, VA 2 2

Puget Sound, WA 2 2

Naples, Italy (OCONUS) 2 2

Yokosuka / Okinawa, Japan (OCONUS) 2 2

8.0 DELIVERABLES AND REPORTING

Required deliverables are defined below. All deliverables shall be submitted under official company letterhead signed by a designated company representative. The cover letter shall be addressed to the Contracting Officer Representative (COR) unless otherwise directed. The cover letter shall include as a minimum, the title of the applicable deliverable, date performed, and the appropriate contract number and task order number to which the deliverable applies.

Additional instructions may be provided in DD1423 (CDRLS).

The Government retains unlimited rights to all data and processes developed for all deliverables. The Contractor shall not provide or reference proprietary data to non-DoD organizations without written permission from the COR. The Contractor shall obtain approval from the COR before releasing any information outside of the Department of Defense that has been stored, generated, or archived related to this Contract.

8.1…