N0024418R0053_DRAFT_PWS.docx

Performance Based Statement of Work Amazon Web Services (AWS) Commercial Cloud and Professional Services Information Technology and Communication Services Naval Postgraduate School

1.0 Background/Introduction:

The Naval Postgraduate School (NPS) located in Monterey, California supports the U.S. Navy, other military branches, and foreign military services with postgraduate education for personnel. Additionally, NPS provides significant research capabilities to the Department of Defense (DoD). The Information Technology and Communication Services (ITACS) Department at NPS provides information technology (IT) support to the entire school.

NPS requires continued use of Amazon Web Services (AWS) Infrastructure-as-a-Service (IaaS) in order to provide a highly-reliable, scalable and low-cost infrastructure platform in the cloud that offers Naval Postgraduate School users the ability to utilize, stand up and take down IT infrastructure (both programs and platforms) on demand. The on-demand nature of commercial cloud services reduces the necessity for NPS users to expend the time and resources required to procure, sustain and maintain IT infrastructure which may only be needed for limited periods of time.

NPS has utilized AWS commercial cloud services for over two years. In that time, more than 40 individual users in various departments, as well as multiple network and enterprise services providers, have utilized, or are currently utilizing, the following AWS cloud services: compute, storage, databases, high-speed computing/analytics, Domain Name System (DNS), virtual private cloud and web hosting. As part of this cloud service usage, multiple research projects have been initiated, completed or are ongoing.

2.0 Scope:

NPS requires access to the full range of Amazon Web Services (AWS) commercial cloud services and features (including GovCloud), as well as AWS Professional Services, in support of NPS programs and platforms based in the AWS cloud.

3.0 Tasks:

The contractor shall perform the following tasks:

3.1 Provide access to the full range of AWS commercial cloud services, including GovCloud.

3.2 Provide access to any new AWS cloud services or features that may become available after the effective date of the contract.

3.3 Provide access to the CloudCheckr portal for real-time online monitoring of AWS account usage.

3.4 Provide Enterprise Acceleration Program (EAP) services for the following:

3.5 Provide professional services assistance in evaluating future migrations to the AWS cloud, to include developing an overall plan for cloud adoption and evaluation of impacts to business processes.

3.6 Provide professional services in evaluating current applications and architectures and planning specific migrations to the AWS cloud.

3.7 Provide professional services assistance in migrating workloads to AWS, developing new cloud-native applications and adopting new capabilities using the AWS cloud (to include migration of existing AWS instances to Reserve Instances).

3.8 Provide professional services to assist in improving services and processes running in the AWS cloud.

4.0 Deliverables:

The contractor shall deliver the services outlined in section 3.0.

Performance Measurement - Quality Assurance Plan

RDS - 99.95%, S3 - 99.9%, EC2 - 99.95%, Route 53 - 100% (reference http://cloudiqtech.com/aws-sla-summary/)

If performance falls below the AQL defined above, the Contracting Officer’s Representative (COR) shall document the instance(s), coordinate with the Contracting Officer and advise the Contractor. The Contractor will be requested to review the documentation and provide a written response on how performance will be corrected in the future. Re-performance of any work for failure to perform in accordance with the specified AQL or task requirement shall be completed at the Contractor’s own expense and at no additional cost to the Government.

5.0 Minimum Technical Requirements:

· FISMA moderate compliance.

· Provide and apply tactical patching in defense of real-time vulnerabilities within 24 hours or less and have no more than one non-compliant incident per fiscal year.

· Sustain operations with no more than three non-compliant FISMA findings per fiscal year

· Provide a solution in which data calls (requests for information) do not exceed two incidents of non-compliance per fiscal year.

· Comply with directed mandates to protect and defend information systems from recurring security threats or in response to real-time vulnerabilities and have no more than one non-compliant incident per fiscal year.

· Any and all contractor facilities proposed in relation to this shall be in compliance with FedRAMP controls.

6.0 Period of Performance:

7.0 Place of Performance:

7.1 Cloud Services

Cloud Services shall be performed at the site(s)/region(s) designated by the Government during account set up.

7.2 Professional Services

Professional services shall be performed remotely at the contractor's place of business or on-site at the Naval Postgraduate School, Monterey, CA as required by the particular services engagement.

8.0 Work Week and Hours of Operation:

The Contractor shall provide services during normal working hours excluding federal holidays. Normal working hours are 0730-1630, Monday through Friday, unless requirements dictate otherwise. Exceptions can be permitted by the COR upon request and at the COR’s discretion.

Following is a list of holidays observed by the Government.

If any of the above holidays occur on a Saturday or a Sunday, then such holiday shall be observed by the Contractor in accordance with the practice as observed by the assigned Government employees at the using activity

9.0 Travel:

Travel will be in accordance with the Joint Travel Regulations (JTR) and will be reimbursed by the government on an as-incurred basis.

10.0 Security Requirements:

Contractor Personnel must be U.S. Citizens.

Contractors performing on this contract are required to familiarize themselves with, and participate in, the Naval Postgraduate School’s OPSEC program. Must be familiar with and comply with NPSINST 3432.1B, the NPS Critical Information List, DOD Directive 5205.02E and their applicable references. The contractor will be required to complete OPSEC and counter-intelligence training within 30 days of beginning the work, or provide proof of OPSEC and counterintelligence training completed within the previous 12 months. The contractor may not publicly release any information about developmental work or curriculum at NPS without prior written approval from the Principal Investigator (PI).

11.0 Privacy Act Statement:

“Pursuant to Title 5 United States Code 552a(m)(l), the contractor and all employees of the contractor working under this contract are required to comply with the requirements of 5 U.S.C. 552a (“The Privacy Act of 1974”).”

12.0 Identification of Contractor Employees:

In accordance with DFAR 211.106, there shall be a clear distinction between Government employees and service contractor employees. Service contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel. Contractor personnel will be required to obtain and wear badges or other visible identification for meetings with Government personnel to provide a clear distinction between service contractor employees and Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

13.0 Non-Personal Services Statement:

Contractor employees performing services under this order will be controlled, directed, and supervised at all times by management personnel of the contractor. Contractor management will insure that employees properly comply with the performance work standards outlined in the SOW. Contractor employees will perform their duties independent of, and without the supervision of, any Government official or other Defense Contractor. The tasks, duties, and responsibilities set forth in the task order may not be interpreted or implemented in any manner that results in any contractor employee creating or modifying Federal policy, obligating the appropriated funds of the United States Government, overseeing the work of Federal employees, or otherwise violating the prohibitions set forth in Parts 7.5 and 37.1 of the Federal Acquisition Regulation (FAR). The Government will control access to the facility and will perform the inspection and acceptance of the completed work.

14.0 SUPTXT 204-9400 Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information (Jan 2017)

Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The Deputy Secretary of Defense Directive-Type Memorandum (DTM) 08-006 – “DoD Implementation of Homeland Security Presidential Directive – 12 (HSPD-12)” dated November 26, 2008 (or its subsequent DoD instruction) directs implementation of HSPD-12. This clause is in accordance with HSPD-12 and its implementing directives.

APPLICABILITY

This clause applies to contractor employees requiring physical access to any area of a federally controlled base, facility or activity and/or requiring access to a DoN or DoD computer/network/system to perform certain unclassified sensitive duties. This clause also applies to contractor employees who access Privacy Act and Protected Health Information, provide support associated with fiduciary duties, or perform duties that have been identified by DON as National Security Position, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance.

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Navy Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

ACCESS TO DOD IT SYSTEMS

In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command Information Assurance Manager.

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check with Law and Credit (NACLC) described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the “supervisor.”

The SAAR-N shall be forwarded to the Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

INTERIM ACCESS

The Command's Security Manager may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR’S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor’s Security Representative. Within three work days after contract award, the contractor shall provide to the requiring activity’s Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor’s Security Representative. The Contractor’s Security Representative shall be the primary point of contact on any security matter. The Contractor’s Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO OR PERFORMING NON-SENSITIVE DUTIES Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc.) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

· Must be either a US citizen or a US permanent resident with a minimum of 3 years legal residency in the United States (as required by The Deputy Secretary of Defense DTM 08-006 or its subsequent DoD instruction) and

· Must have a favorably completed National Agency Check with Written Inquiries (NACI) or T1 investigation equivalent including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the Contractor’s Security Representative must submit for all employees each of the following:

· SF-85 Questionnaire for Non-Sensitive Positions

· Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

· Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably completed National Agency Check with Written Inquiries (NACI) or T1 equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM

Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

* Consult with your Command Security Manager and Information Assurance Manager for local policy when IT-III (non-sensitive) access is required for non-US citizens outside the United States.

15.0 Points of Contact:

NPS Contracting Officer Representative (COR):

NPS Technical POC:

NPS POC for Acceptance of Deliverables:

NPS Financial POC:

Office of Contracting and Logistics Management Revised 04 Aug 17