Att_C_Performance_Work_Statement.docx

PERFORMANCE WORK STATEMENT

COLLECTOR-ENVIRONMENTAL INTELLIGENCE

PREPARATION OF THE BATTLESPACE (C- EIPB)

25 March 2019

2.2 All tasks outlined in below sections shall be completed per month with a possibility of multiple customers, simultaneously.

· Status report summarizing accomplishments made during the previous two weeks.

· Problem report summarizing problems encountered during the previous two weeks, especially any problems that could potentially delay project completion.

21.1.5 The contractor shall provide monthly and quarterly reports for projects describing the following no later than the 10th of each month. Report shall include:

· Task list with percentage completed for each task

· Task accomplishments supporting percentage completed with sufficient detail to allow NAVOCEANO to determine and assess the contractor’s technical progress

· Problems or issues encountered

· Timeline changes and updates

· Intermediate and final deliveries

· Funding expended during period, including travel, total expended and remaining balance.

24.8 “All information technology (IT) solutions will adhere to Department of Defense (DoD) and Navy cybersecurity requirements as defined in DOD Instruction 8500.01, OPNAV Instruction 5239.1D, and applicable Security Technical Implementation Guides (STIGs). In particular, all applications developed for use on Navy information systems must adhere to the latest active release of the Application Security and Development (ASD) STIG. All data transmitted to a Navy information system must be protected in accordance with transmission confidentiality controls defined in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 and protection measures mandated by the Defense Information Systems Agency (DISA) Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and Vulnerability Assessments (VAs). No function of the aforementioned information systems may circumvent or weaken the cybersecurity mechanisms of existing Navy information systems. Security Technical Implementation Guide (STIG) V-32372 requires "IT position designations (which) are assigned to each civilian and military position or contractor employee duties contained in statements of work in which an employee has duties requiring access to a Government Information System. In most cases this will encompass 100% of all employees." IT levels are defined in SECNAV M5510.30.

Compliance strategy shall conform to the cybersecurity risk management best practices set forth in the NIST framework for improving critical infrastructure cybersecurity and DISA STIGs. These methods and processes shall be documented in the system security plan and updated as necessary to ensure continuing compliance throughout the period of performance.”

· The contractor shall follow current IA regulations and guidelines.

· DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M; and

· Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M

UNCLASSIFIED

UNCLASSIFIED

32.3 Incentive or Disincentive for meeting/not meeting the Required Service and Performance Standard/Measurement will result in the following:

32.3.1 Incentive: Satisfactory or above ratings on past performance.

32.3.2 Disincentive: Delivery of document not within the performance standard and guidance contained in the PWS or failure to meet agreed schedules for delivery; Negotiated consideration for deficiency or delay.

32.4 Performance Requirements Summary Table:

Desired Outcomes

PWS

Paragraph

Measurement Monitoring Method

Maintain and update current capability of C-EIPB Toolkit

PWS Sections 3&4

(b) Any discrepancies in data must be corrected within 7 Days of SME review Random Sampling, Unscheduled Inspections, Customer Complaints

(b) Any discrepancies in data must be corrected within 7 Days of SME review Random Sampling, Unscheduled Inspections, Customer Complaints

33. THE FOLLOWING NAVSUP LOCAL TEXT IS HEREBY MADE PART OF THE STATEMENT OF WORK/PERFORMANCE WORK STATEMENT.

Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information

Executive Order 13467, Reforming Processes Related to Suitability for Government Employee, Fitness for Contractor Employees and Eligibility for Access to Classified National Security Information, Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 Part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the…