COFS PRESOLICITATION PWS DRAFT 20180507.pdf

[Ver dtd 30 Jun 17] 1 of 36

DRAFT

SECTION C – DESCRIPTION/SPECS/WORK STATEMENT

SPECIFICATIONS/STATEMENT OF WORK/PERFORMANCE WORK STATEMENT

Work under this performance-based contract will be performed in accordance with the following description/ specifications/ statement of work (SOW) which herein will be referred to as Performance

Work Statement (PWS):

SHORT TITLE: COMMAND OPERATIONS FUNCTIONAL SUPPORT

1.0 PURPOSE

1.1 SCOPE

The purpose of the effort is to provide services to support Corporate Operations functional areas with responsibilities to sustain mission capabilities. The scope and focus is on those Command functions that support day-to-day operations that are critical to SSC Atlantic's mission success. Functions include: Force Management, Personnel and Physical Security, Cybersecurity, Communications, Business Intelligence, Facilities, Safety and Administrative Management.

1.1.1 Multiple Funding

This contract is funded with multiple appropriations as delineated on specified contract line item numbers (CLINs). The applicable PWS task(s) associated with each funding CLIN is outlined in

Section B and Section G.

1.2 BACKGROUND

This effort supports operational functions and responsibilities primarily within the Corporate

Operations Competency and seeks to align selective supporting services to gain efficiencies in processes, expedience to capabilities and FIAR compliance support to achieve the Command’s primary goal of Integrated Product Team (IPT) success. The Contractor shall apply a holistic approach to managing the support to the functions outlined in this PWS with the intent to rapidly make assets and resources available to supported functions. The expectation is for the contractor to readily identify and improve process efficiencies with a flexible workforce.

2.0 PLACE(S) OF PERFORMANCE

The contractor shall provide support at the following location:

a. SPAWARSYSCEN Atlantic

b. Contractor facility

2.1 GOVERNMENT FACILITIES

The Government will provide facilities (i.e., office space, computer hardware/software, or lab space) to those labor categories that would otherwise adversely affect the work performance if they were not available on-site. The location of contractor personnel with supplied Government facilities will be identified at the task order level.

2.1.1 Training Requirements

Contractor personnel working full-time or partially at a Government facility shall complete all applicable mandatory training requirements as specified under Security Training, PWS Para 8.0.

2.2 CONTRACTOR FACILITIES

[Ver dtd 30 Jun 17] 2 of 36

A significant portion of work issued under this contract requires close liaison with the Government.

The contractor shall be prepared to establish a local facility within a thirty (30)-mile radius of

SPAWARSYSCEN Atlantic. Close proximity allows for proper contract administration duties. The contractor’s facility is not necessary for the exclusive use of this contract and can be utilized on a shared basis. For contracts with Government Property, the contractor’s facility shall include physical security to protect Government assets as identified in Para10.0. The contractor shall meet all facility location and size requirements within 30 days after contract award.

3.0 PERFORMANCE REQUIREMENTS

The following paragraphs list all required non-personal services tasks that will be required throughout the contract. The contractor shall provide necessary resources with knowledge and experience as cited in the personal qualification clause to support the listed tasks. Contractors shall perform requirements in accordance with Federal Acquisition Regulation (FAR) and/or Defense Federal

Acquisition Regulation Supplement (DFARS) which do not include performance of inherently governmental functions. The contractor shall complete all required tasks while controlling and tracking performance and goals in terms of costs, schedules, and resources.

3.1 COMMAND SECURITY SERVICES SUPPORT

3.1.1 New Accounts Service Support

3.1.1.1 The Contractor shall monitor the workflow database daily and process check-in, check-out, move/add/change actions and work tickets within the queue, investigate anomalies, enter data and work with customers to resolve each ticket.

3.1.2 Security Support Services

3.1.2.1 The Contractor shall perform authorized installations, upgrades, relocations, removal and preventative maintenance management on the SPAWARSYSCEN Atlantic physical electronic security system for all Sensitive Compartmented Information Facilities (SCIF) and non-SCIF areas.

Perform installation, maintenance and hardware repair on the closed circuit television system, intrusion detection, and badging and access control system, collectively referred to as the security system. Perform base level system hardware configuration, authorized upgrades, software updates and upgrades, removals and relocations of workstations equipment and hardware.

3.1.2.2 The Contractor shall receive, handle, store and dispose of classified material/equipment in accordance with local and Navy guidelines. Assist in the annual physical inventory of classified material; conduct and reconcile inventories. Maintain records and files pertaining to the

SPAWARSYCEN Atlantic's CMS account; ensure prompt and accurate preparation, signature, and submission of account correspondence, message and accounting reports. Ensure classified material shipped outside SPAWARSYSCEN Atlantic is properly packaged and shipped via authorized methods. Maintain proper physical security measures when transporting or shipping classified materials. Make bi-monthly defense courier service runs. Maintain the government's computer database tracing the history of classified material. Prepare classified material for transfer or shipment in accordance with applicable guidelines.

3.1.2.3 The Contractor shall operate the Visitor Control Center to include working directly with customers, entering data, managing visitor logs, issuing badges, monitoring the Electronic Security

System control console, preparing correspondence, maintaining records and file system. Functions include those required in support of security requirements for planning and analysis of management's procedures in performance of tasks associated with physical, personnel, information, or information systems security programs. Process visit requests from contractor facilities and other government

[Ver dtd 30 Jun 17] 3 of 36 agencies. Process outgoing visit requests for SPAWARSYSCEN Atlantic employees visiting other agencies.

3.1.3 Safety and Environmental Support Services

3.1.3.1 The Contractor shall assist in administering the Fire and Life Safety Program and provide advisory and risk prevention support services to the Safety Office; Contractor shall provide subject matter expertise in the areas of fire safety, fire protection, and management of fire extinguisher maintenance. The contractor shall perform Fire and Life Safety inspections IAW relevant NFPA

Codes, OSHA and other relevant requirements and report results to the SPAWARSYSCEN Atlantic

Safety Office

3.1.3.2 The Contractor shall assist in administering the Hazardous Materials Control and

Management Program at all SPAWARSYSCEN Atlantic locations to include managing the Command

Authorized Use List (AUL) in the SPAWARSYSCEN Atlantic Microsoft Access database. The contractor shall administer and provide subject matter expertise in all aspects of hazardous material purchasing and regulatory compliance. For South Carolina locations, the contractor shall manage the

Command AUL in the Air Force Environmental Safety and Occupational Management Information

System online database in addition to the SPAWARSYSCEN Atlantic Microsoft Access database. At

South Carolina locations the Contractor shall assist in administering the SPAWARSYSCEN Atlantic

Hazardous Waste Program performing/coordinating waste pick-ups from work centers and designated turn-in locations to include heavy batteries. Contractor will manage all paperwork and documentation as required by the state and federal hazardous waste regulations as well as Joint Base

Charleston requirements. The contractor will provide database support for the Clean Air Act Program and Storage Tank program. The contractor will enter and maintain required data in the online Air

Force Air Program Information Management System.

3.1.4 Facilities and Space Management Support

3.1.4.1 The Contractor shall work as a team member responsible for the project management and oversight of large facilities space management projects and activities for both administrative and lab areas of the Command. Manage all phases and aspects of a project from project inception to completion to include, coordinating and documenting project requirements; developing space utilization plans and AutoDeskTM software (AutoCAD, Revit, and ARCHIBUS, from here forward referred to as CAD Software) layouts to include both current and future-state layouts for short and long-term planning scenarios; designing systems furniture layouts; communicating project requirements and schedule with outside vendors, other contractors, Government personnel, and installation teams; and monitoring facility upgrades and project status.

3.1.4.2 The Contractor shall inspect vacant spaces in all SSC Atlantic Charleston buildings to survey conditions of the spaces as they become available due to personnel moves, retirement, or resignations. The contractor shall survey vacant spaces to determine if materials have been abandoned or placed in vacant spaces. The contractor shall organize any materials, coordinate with the appropriate groups for proper disposition of materials, and pack up the items for transport.

3.1.4.3 The Contractor shall be responsible for the management, administration, and execution of material storage operations in support of the Facilities staff and shall maintain the existing inventory of all material in the warehouse in real time.

3.1.4.4 The Contractor shall perform field site-surveys, investigation and drafting services to support the SSC Atlantic Facilities engineering staff with development of design drawings in accordance with National CAD Standards (NCS), Unified Facility Criteria, and SSC Atlantic

Facilities CAD standards to implement modifications to all existing buildings and to install new facility components or equipment.

[Ver dtd 30 Jun 17] 4 of 36

3.1.4.5 Perform field site-surveys, investigation and drafting services to support the SSC Atlantic

Facilities Space Management staff with development of design drawings in accordance with National

CAD Standards (NCS), Unified Facility Criteria, and SSC Atlantic Facilities CAD standards to implement modifications to all existing furniture installations.

3.1.4.6 The Contractor shall be responsible for all Facilities Service Desk operations. Calls may originate from multiple sources including the Command Duty Officer, Base Emergency

Personnel, SSC Atlantic employees (civilian and contractors). The Contractor shall forward the ticket to the maintenance repair contractor or to the appropriate Base personnel for action. The Contractor shall also determine the urgency of the call and whether it is necessary to initiate immediate corrective action. The contractor shall be responsible for tracking all work requests in a workflow database, which shall be accessible by Facilities government personnel and allow the government to view work tickets in any status, input notes on open work tickets, and create and run reports.

3.2 COMMAND INFORMATION TECHNOLOGY SUPPORT SERVICES

3.2.1 Information Systems Security Manager Support

3.2.1.1 The contractor shall provide support to the Command ISSM Office supporting it mission to develop, execute, and maintain the Cybersecurity Management Program at SPAWARSYSCEN

Atlantic. The Contractor shall provide personnel, physical and information security related support for Sensitive Compartmented Information (SCI) programs. This support will include processing individuals for SCI access, maintaining personnel security related records, conducting security inspections, providing escort services and assisting with the proper handling of SCI material.

3.2.1.2 The Contractor shall provide support to the Cybersecurity Management Program at

SPAWARSYSCEN Atlantic and all remote offices/sites. The contractor shall support the following areas:

3.2.1.2.1 Audit Readiness/Cyber Directive management program to include management and execution of all facets of vulnerability management program at SPAWARSYSCEN Atlantic to include policy, process, and procedure for cyber vulnerability reporting, resolution, compliance, and auditing;

3.2.1.2.2 Cyber-IT/CSWF Program to include development of cyberspace workforce plans, strategies and guidance to support cyberspace workforce manpower, personnel, training and education requirements and to address changes to cyberspace policy, doctrine, material, force structure, and education and training requirements;

3.2.1.2.3 Cybersecurity (CS) Operations Support to include managing IT access, user agreements, vetting, and training requirements for SCI IT access, drafting appointment letters, and media management;

3.2.1.2.4 FISMA Program support for management and execution of all facets of SCI Risk

Management Framework implementation program at SPAWARSYSCEN Atlantic to include policy, process, and procedure for system categorization, security control selection, assessment, and validation for SCI systems;

3.2.1.2.5 SCI Cyber Incident Response management and execution of all facets of the cyber incident response program at SPAWARSYSCEN Atlantic to include policy, process, and procedures related to the investigation and resolution of security events and incidents;

[Ver dtd 30 Jun 17] 5 of 36

3.2.1.2.6 Electronic removable media (RM) management program support for the development, and execution of all facets of the protection and accountability of RM in Sensitive Compartmented

Information Facilities (SCIFs), including assisting with destruction, inventories, inspections, and training;

3.2.1.2.7 SCI ISSM Daily Operations general support, providing professional customer service, guidance, escort services, assistance with security inspections, proper handling of SCI classified material, coordination/scheduling/documentation for meetings, documentation development while ensuring accuracy, completeness, correct English grammar, spelling, punctuation and attention to detail in all written and oral communications, inventory, records and documents.

3.2.2 Knowledge Management Support Services

3.2.2.1 The Contractor shall support Knowledge Management through working with content managers from across the command to create, capture, share, maintain, and reuse content that directly supports the workforce. The Contractor will also facilitate the continuous improvement and clean-up of a vast amount of web content, allowing for greater efficiencies and organizational performance.

3.2.3 Enterprise Corporate Solutions Services

3.2.3.1 The Contractor shall provide NMCI and Telecommunications Services in a managed service approach. Ensuring compliance with DoD, DoN and SPAWAR Governance for the command.

Provides service utilization oversight and inventory management for services at the command level.

This support shall include systems administration actions to support operational move, add, change, and delete requests and migration/optimization of NMCI accounts, NMCI shares, and public folders.

Support shall include problem resolution and troubleshooting actions within NMCI SIPR and NIPR

Active Directory (AD), File Shares (FS), public folders, and/or include interface to NOC processes, Capacity Management, and the NMCI trouble ticketing system.

3.2.3.2 The Contractor shall provide quality assurance activities including problem resolution of pre delivered and delivered mobile or fixed services, assisting in invoice reconciliation for delivered services, reconciling NET data with correct information, tracking the proper cancellation and transfer of mobile or fixed services, adjudication of problem billing, and track invoicing.

3.2.4 Video/Teleconference (VTC) Support Service

3.2.4.1 The Contractor shall perform technical support and life cycle management services on the

Naval Video Services system infrastructure including cryptographic equipment and key management.

Provide technical support, facilitation, and integration services for VTCs at endpoints and manage the

VTC help desk for Naval Video Services. Perform usage analysis to support Service Center Fee billing. Support the VTC Information Assurance and Accreditation requirements.

3.3 COMMAND BUSINESS INTELLIGENCE SUPPORT SERVICES

3.3.1 Business Analytics

3.3.1.1 The contractor shall develop and use efficient, standardized data methodologies to support shaping and executing command-wide strategic and operational analyses associated with complex and frequently unprecedented business problems with bi-directional situational awareness.

The contractor shall ensure consistent, standardized data input to authoritative data systems to perform advanced analytics in operational and business decision-making methodologies throughout a life cycle including development, mathematical modelling, analytical reasoning, predictive analytics, statistical analysis and simulations. They must be familiar with best practices associated with data modeling, continuous process improvements, and organizational management.

[Ver dtd 30 Jun 17] 6 of 36

3.3.2 Predictive Analysis (PA)

3.3.2.1 The Contractor shall extract information from existing data sets in order to determine patterns and predict future outcomes and trends. PA efforts will seek to frame future outcomes within an acceptable level of reliability, and includes development of what-if scenarios and risk assessments in order to better understand customer requirements, product and service value to capitalize on potential opportunities and / or avoid future risks. PA will include a number of techniques, including data mining, statistical modeling and machine learning to help analysts make future business forecasts.

3.3.3 Environmental Scans

3.3.3.1 The Contractor shall gather and analyze strategic information both internal and external to the command to identify trends, opportunities and threats to future operations based on current strategic and operational goals. The contractor shall support with scenario-based planning and the development and analysis of likely future scenarios based on current relevant indicators.

3.3.4 Business Intelligence (BI)

3.3.4.1 The Contractor shall support requirements, development, deployment and sustainment of the organization's Data Warehouse, Business Intelligence capabilities and Business analytics. This support will include creation of organization's metrics, self-service BI reporting capabilities using

SAP Business Objects suite of tools, multi-source complex data calls, ETL (Extract Transform and

Load) strategies and implementation, business analysis and visualizations. The contractor shall provide support with creating and maintaining BI knowledge transfer artifacts, materials, BI software development lifecycle processes, data dictionaries, and end-user supporting documentation. The contractor shall develop and recommend visualization options through dashboards and business objects to link decision makers to the data in a meaningful and actionable way.

3.3.5 Command Business Intelligence System and Navy ERP Support

3.3.5.1 The Contractor shall maintain Navy ERP Workflow for SPAWAR Atlantic and also function as a Workflow Extended Module Lead for the SPAWAR Business Office. Perform daily data extract-transform-validation-load operations for assigned business intelligence systems.

Administer and operate multiple enterprise Linux servers and installed applications located in a Navy

Data Center for assigned business intelligence systems. Administer and operate multiple Windows and CITRIX applications located in a Navy Data Center for assigned business intelligence systems.

Administer and operate SAP Business Objects and SAP Data Services in a Navy Data Center. Apply and maintain Information Assurance controls for assigned business systems to meet Department of

Defense requirements. Adjust Information Assurance controls to meet Navy Functional Area

Manager (FAM) supported application version requirements and also support system reaccreditation requirements as directed by the Navy Data Center.

3.3.6 Organizational Analysis

3.3.6.1 The Contractor shall support organizational survey design, implementation, results and analysis. Assess surveyed communities with a qualitative review that identifies trends and common themes amongst surveys.

3.3.7 Process Management Analysis

3.3.7.1 The Contractor shall support all aspects of Process Management, including Continuous

Performance/Process Improvement (CPI), with managing and analyzing data, metrics, and reports for

[Ver dtd 30 Jun 17] 7 of 36 program performance, special projects and risk analysis. The contractor shall assist the government in optimizing the use of disparate data sources for timely, accurate, and relevant inputs to critical business decisions.

3.4 COMMAND ORGANIZATIONAL SUPPORT SERVICES

3.4.1 Public Affairs Support Services

3.4.1.1 The Contractors shall provide support to the Public Affairs Office to include business arrangements, planning, scheduling, security liaison and administrative and multimedia support and presentations in the Briefing Theater, Executive Conference Room (ECR), Executive Board Room

(EBR) and other assigned conference/meeting rooms. Coordinate and plan high level on- and off-site meetings for the Commanding Officer, Executive Director, Deputy Executive Director, and Technical

Director. Provide planning, logistical and management support for small and large-scale conferences and symposiums to include schedule and coordinate usage and maintenance of Command vehicles under the Corporate Communications and Public Affairs Office (PAO). Collect room requirements and prepare rooms for events. Collect, analyze and assess feedback from official visits and generate lessons learned. Coordinate with Joint Base Charleston MWR or other vendors to provide food/drink accommodations.

3.4.1.2 The Contractors shall provide support to the Public Affairs Office to included responding to public inquiries via SPAWARSYSCEN Atlantic Information telephone line and PAO email functional mailbox. Monitor and post to Daily News Blog and other blogs as necessary; maintain

PAO section on the Command Operating Guide (COG). Create, implement and maintain various public and internal information platforms, including social media, Daily News Blog, COG, electronic signs and all hands notifications.

3.4.2 Administrative Support Services

3.4.1.3 The Contractor shall provide general administrative support services throughout

SPAWARSYSCEN Atlantic to include coordinating and planning onsite/offsite meetings; prepare correspondence; update and maintain competency files; incoming/outgoing mail services; travel orders/vouchers; compile data for data calls and data entry; develop and execute administrative processes and procedures; prepare personnel packages; track training requirements; execute the

Check In/Check Out process and timekeeping functions; coordinating events and managing attendance. Serve as Conference Administrator to facilitate conference attendance requests to ensure compliance with SPAWARSYSCEN Atlantic policy and assist with Department of Navy approval process. Facilitate and track actions utilizing TV5 and DON Tracker by assigning, monitoring, and closing out action items. Serve as a member of the OCONUS travel team to process personnel traveling in support of mission requirements.

3.4.1.6 The Contractor shall provide general mail services to include pickup and delivery of incoming/outgoing mail, passports, and other miscellaneous documents; maintain accountability logs for package/item pickup and delivery; complete mail volume usage reports; and refuel vehicle used for mail services, logging each occurrence. Provide postal financial services, supply, receipt, dispatch functions, and mail delivery services; prepare forms and reports as well as maintain postal records, supplies, operating plans, and adequate stock of postage; coordinate engraving services; and maintain mail management certification as prescribed by the Command Official Mail Manager (OMM).

3.4.1.8 The Contractor shall administer Message Center services to include downloading, maintaining, and archiving of all classified/unclassified message files and materials controlled by the

Message Center; receive, review, and process all outgoing classified/unclassified message traffic;

ensure message center computer(s) remain operational; and serve as point of contact for SIPRNET

Safe room.

[Ver dtd 30 Jun 17] 8 of 36

3.4.2.7 The Contractor shall provide professional switchboard operator services to include promptly answering and relaying incoming calls to appropriate organizational element, record and transmit messages, and maintain organizational telephone directory.

3.4.1.9 The Contractor shall provide records management support to include correspondence serialization and maintenance of serialized records throughout the document lifecycle, including final disposition; distribute designated correspondence; update information pertaining to records management on the Command Operating Guide; and coordinate/assist with shred events.

3.4.1.10 The Contractor shall manage the Command's directives issuance program to include directives library, serve as consultant on requirements to issue directives, update directives and notices, review directives for content and compliance, prepare directives for signature, and perform annual review. Provide comments on Headquarters' directives when presented for review. Serve as

POC for preparation of Command history report and maintain historical library. Coordinate with the

Executive Director and senior leaders to determine appropriate level of signature approval for command documents; maintain and update the Signature Delegation Matrix to communicate signature authority; and ensure this authoritative source is current on the command operating guide (COG) site.

Serve as the Command Editor to ensure proper format, language, and grammar for correspondence, and provide correspondence guidance to Command personnel. Compiles and finalizes reports, correspondence, directives, and other documents that are presented to senior leadership for concurrence and signature, and responsible for loading final product into TV5 or DON Tracker

3.4.1.11 The Contractor shall perform clerical and physical tasks in connection with procurement and requisitioning of command consumable goods. Responsible for tracking receipt, storage, and issuance of supplies used recurrently. Tasks include picking items from warehouse shelves to fill requests, verifying the correctness of incoming shipments, checking for damaged goods, and insuring goods are appropriately identified for routing. In addition, comparing items and quantities of goods gathered for shipment against documents; insuring that shipments are properly packaged, identified with shipping information, and loaded into transporting vehicles; and preparing and keeping records of goods shipped. In performing day-to-day, routine tasks, follows established guidelines and regulations. In handling unusual non-routine problems, receives specific guidance from government officials.

3.4.3 Total Force Management Support Services

3.4.3.1 The Contractor shall provide support to the Military Affairs Office, which includes providing guidance and assistance on military protocol for military ceremonies and visits; assisting with the preparation and maintenance of the Biennial Military End Strength Budget Report;

administering officer and enlisted manpower billet reviews for the Commanding Officer’s approval;

and compiling and processing information required for military personnel award recommendations and advancement nominations.

3.4.3.2 The Contractor shall act as an Instructional Systems Designer (ISD) for Total Force

Management. Duties will require classroom delivery of Command Directed Training. Identifying, develop and delivery of training packages and measuring the learning transfer effectiveness.

Coordinate specialized curriculum to meet long term organizational training/ competency development goals and objectives. Conduct research, identify or modify educational programs for a competency model or functional description development. Work with SPAWAR Competency

Manager Support Leads to determine training approaches to the goals of competency leadership.

Ensure alignment of work products and learning objectives with the Command's mission. Works with Competency Development Support Manager branch to identify opportunities for specialized educational programs to meet demand for emergent technologies.

[Ver dtd 30 Jun 17] 9 of 36

3.4.3.3 The Contractor shall support the management of the Command Awards Program with tracking and updating the Awards Status Tracker and managing inquiries. Responsible for managing/monitor the Awards Functional Mailbox and preparing Mass Award Spreadsheets.

3.4.4 Employee Equal Opportunity (EEO) Support Services

3.4.4.1 The Contractor shall provide support to the EEO Office with an American Sign Language

Signer to support Command briefings, All-Hands, training functions and other official gatherings.

The Signer will sign designated briefing materials, announcements and other official information during the event.

3.4.5 Command Financial Analysis Services Support

3.4.5.1 The Contractor shall perform analyses and make recommendations regarding evolving regulations, policies, statutes and all Comptroller/Budget/Accounting/Business functions with the goal of helping the Comptroller Office continue improving and performing its financial and accounting/business functions in a Navy Working Capital Fund environment. Contribute to the day to day operations of the Finance Department with the proper recording, organizing and reporting of standard accounting information.

3.4.5.2 The Contractor shall support the Defense Travel System (DTS) help desk. Provide assistance to travelers with the input of travel orders and liquidations of claims in DTS. Occasionally problems of a systems nature arise that must be reported to the Navy help desk. Perform the review function for all travel vouchers within DTS. For example, the reviewer ensures all required receipts are attached to the record, the amounts on the receipts are entered correctly for reimbursement, and that no receipts are claimed twice. The reviewer also ensures advances are not claimed as expense and that no glaring errors have occurred.

3.4.6 Command Contracting Analysis Support Services

3.4.6.1 The Contractor shall provide support to the Contracts Department, which includes typing, data entry, scanning, and utilizing various computer programs and software applications; perform research of information, gather statistics, review contractual documents, and make recommendations that will improve the efficiency and ensure compliance with current procurement regulations; analyze and evaluate contract close out matters; initiate, develop, and make recommendations on contract close out procedures and activities; make recommendations on disposition of actions; and review, evaluate, and provide advice and guidance concerning contract close out policies, procedures, and issues.

4.0 INFORMATION TECHNOLOGY (IT) SERVICES REQUIREMENTS

4.1 INFORMATION TECHNOLOGY (IT) GENERAL REQUIREMENTS

The contractor shall be responsible for the following:

4.1.1 Ensure that no production systems are operational on any research, development, test and evaluation (RDT&E) network.

4.1.2 Follow DoDI 8510.01 when deploying, integrating, and implementing IT capabilities.

4.1.3 Migrate all Navy Ashore production systems to the Navy, Marine Corps Intranet (NMCI) environment where available.

[Ver dtd 30 Jun 17] 10 of 36

4.1.4 Work with Government personnel to ensure compliance with all current Navy IT & cybersecurity policies, including those pertaining to Cyber Asset Reduction and Security (CARS).

4.1.5 Follow SECNAVINST 5239.3B & DoDI 8510.01 prior to integration and implementation of IT solutions or systems.

4.1.6 Register any contractor-owned or contractor-maintained IT systems utilized on contract in the Department of Defense IT Portfolio Registry (DITPR)-DON.

4.1.7 Ensure all software recommended, procured, and/or developed is compliant with Section

508 of the Rehabilitation Act of 1973, 26 CFR Part 1194 and pursuant to SPAWARINST 5721.1B.

4.1.8 Only perform work specified within the limitations of the basic contract and task order, if applicable.

4.4 SECURITY IT POSITION CATEGORIES

Pursuant to DoDI 8500.01, DoD 8570.01-M, SECNAVINST 5510.30, SECNAV M-5239.2, and applicable to unclassified DoD information systems, a designator is assigned to certain individuals that indicates the level of IT access required to execute the responsibilities of the position based on the potential for an individual assigned to the position to adversely impact DoD missions or functions.

As defined in DoD 5200.2-R (and subsequent revisions), SECNAVINST 5510.30 and SECNAV M-

5510.30, three basic DoN IT levels/Position categories exist:

IT-I (Privileged access)

IT-II (Limited Privileged, sensitive information)

IT-III (Non-Privileged, no sensitive information)

Note: The term IT Position is synonymous with the older term Automated Data Processing (ADP)

Position (as used in DoD 5200.2-R, Appendix 10).

Investigative requirements for each category vary, depending on the role and whether the individual is a U.S. civilian contractor or a foreign national. The contractor PM shall assist the Government

Project Manager or Contracting Officer’s representative (COR) in determining the appropriate IT

Position Category assignment for all contractor personnel. All required Single-Scope Background

Investigation (SSBI), SSBI Periodic Reinvestigation (SSBI-PR), and National Agency Check (NAC) adjudication will be performed Pursuant to DoDI 8500.01 and SECNAVINST 5510.30. Requests for investigation of contractor personnel for fitness determinations or IT eligibility without classified access are submitted by SPAWARSYSCEN Atlantic Security Office, processed by the OPM, and adjudicated by Department of Defense Consolidated Adjudications Facility (DoD CAF). IT Position

Categories are determined based on the following criteria:

4.4.1 IT-I Level (Privileged)

Personnel in this position support cybersecurity roles at command enclave infrastructure to include

RDT&E, Data Centers and any other network and/or are responsible for the planning, direction, and implementation of a computer security program; major responsibility for the direction, planning and design of a computer system, including the hardware and software; or, can access a system during the operation or maintenance in such a way, and with a relatively high risk for causing grave damage, or realize a significant personal gain. Personnel whose duties meet the criteria for IT-I Position designation shall have a favorably adjudicated Tier 5 (T5) investigation (formerly a Single Scope

Background Investigation (SSBI) or SSBI-PR). The T5 is updated a minimum of every 5 years.

Personnel assigned to designated IT-I positions shall have a U.S. citizenship unless a waiver request is approved by CNO. IT-1 roles include the following:

Boundary Devices Management (proxies, firewalls, traffic analyzers, VPN Gateways)

Intrusion Detection/Prevention Systems (IDS/IPS)

[Ver dtd 30 Jun 17] 11 of 36

Host Based Security Systems (HBSS)

Network infrastructure (routers, switches, enterprise wireless)

Domain and Authentication System Administrators (Active Directory, LDAP, Kerberos, etc.)

(enclave wide scope)

Vulnerability Scanner Operators (Retina, ACAS, HP Web Inspect, etc.)

Virtualization Technology Administrators that host any of the above (ESX, Solaris Zones, etc.)

4.4.2 IT-II Level (Limited Privileged)

Personnel in this position support the-direction, planning, design, operation, or maintenance of a computer system, have privileged access to assets and systems that are tenants on SPAWARSYSCEN

Atlantic networks and/or similar system constructs, and has work that is technically reviewed by a higher authority at the IT-II Position level to insure the integrity of the system. Personnel whose duties meet the criteria for an IT-II Position shall have a favorably adjudicated Tier 3 (T3) investigation (formerly National Agency Check with Law and Credit (formerly ANACI/NACLC).

Personnel assigned to designated IT-II positions shall have a U.S. citizenship unless a waiver request is approved by CNO. Examples of IT-II roles include the following:

Webserver Administrators

Developers

Testers

Database Administrators

4.4.3 IT-III Level (Non-privileged)

Personnel in this position support include all other positions (not considered IT-I or IT-II) involved in computer activities. A contractor in this position has non-privileged access to one or more DoD information systems/applications or database to which they are authorized access. Personnel whose duties meet the criteria for an IT-III Position designation shall have a favorably adjudicated Tier 1

(T1) investigation National Agency Check with Written Inquiries (formerly NACI).

4.5 CYBERSECURITY SUPPORT

Cybersecurity (which replaced the term Information Assurance (IA)) is defined as prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation. Contractor personnel shall perform tasks to ensure Navy applications, systems, and networks satisfy Federal/DoD/DON/Navy cybersecurity requirements.

4.5.1 Cyber IT and Cybersecurity Personnel

4.5.1.1 The Cyberspace workforce elements addressed include contractors performing functions in designated Cyber IT positions and Cybersecurity positions. In accordance with DFARS Subpart

5239.71, DoDD 8140.01, SECNAVINST 5239.20A, and SECNAV M-5239.2, contractor personnel performing cybersecurity functions shall meet all cybersecurity training, certification, and tracking requirements as cited in DoD 8570.01-M prior to accessing DoD information systems. Proposed contractor Cyber IT and cybersecurity personnel shall be appropriately qualified prior to the start of the contract performance period or before assignment to the contract during the course of the performance period.

4.5.1.2 Contractors that access Navy IT shall also follow guidelines and provisions documented in Navy Telecommunications Directive (NTD 10-11) and are required to complete a System

Authorization Access Request (SAAR) – Navy form as documented in Para 8.2.2.4(b).

[Ver dtd 30 Jun 17] 12 of 36

4.5.1.3 Contractor personnel with privileged access shall acknowledge special responsibilities with a Privileged Access Agreement (PAA) IAW SECNAVINST 5239.20A.

4.5.2 Design, Integration, Configuration or Installation of Hardware and Software

The contractor shall ensure any equipment/system installed or integrated into Navy platform will meet the cybersecurity requirements as specified under DoDI 8500.01. The contractor shall ensure that any design change, integration change, configuration change, or installation of hardware and software is in accordance with established DoD/DON/Navy cyber directives and does not violate the terms and conditions of the accreditation/authorization issued by the appropriate

Accreditation/Authorization official. Contractors that access Navy IT are also required to follow the provisions contained in DON CIO Memorandum: Acceptable Use of Department of the Navy

Information Technology (IT). Use of blacklisted software is specifically prohibited and only software that is registered in DON Application and Database Management System (DADMS) and is

Functional Area Manager (FAM) approved can be used as documented in Para 4.2.2. Procurement and installation of software governed by DON Enterprise License Agreements (ELAs) – Microsoft, Oracle, Cisco, Axway, Symantec, ActivIdentity, VMware, Red Hat, NetApp, and EMC shall be in accordance with DON CIO Policy and DON ELAs awarded.

4.5.3 Cybersecurity Workforce (CSWF) Report

In accordance with DFARS clause 252.239-7001 and DoD 8570.01-M, the contractor shall identify cybersecurity personnel, also known as CSWF and Cyber IT workforce personnel. The contractor shall develop, maintain, and submit a monthly CSWF Report (CDRL A###) identifying CSWF individuals who are IA trained and certified. Utilizing the format provided in CDRL A###

Attachment 1of Exhibit A, the prime contractor shall be responsible for collecting, integrating, and reporting all subcontractor personnel. See applicable DD Form 1423 for additional reporting details and distribution instructions. Although the minimum frequency of reporting is monthly, the COR can require additional updates at any time. Contractor shall verify with the COR or other Government representative the proper labor category CSWF designation and certification requirements. The primary point of contact (POC) for all related CSWF questions is the Command CSWF Program

Manager (PM) in the office of the SPAWARSYSCEN Atlantic Information Systems Security

Manager (ISSM).

4.5.4 Cybersecurity Workforce (CSWF) Designation

CSWF contractor personnel shall perform cybersecurity functions. In accordance with DoD 8570.01-

M Information Assurance Workforce Improvement Program Manual, the CSWF is comprised of the following categories: IA Technical (IAT) and IA Management (IAM)); and specialties: Computer

Network Defense Service Providers (CND-SPs) and IA System Architects and Engineers (IASAEs).

Based on the IA function provided by the individual, an IA designator is assigned that references an

IA category or specialty. Labor category IA designator and level/positions will be identified at the task order level.

5.0 CONTRACT ADMINISTRATION

Administration of the work being performed is required; it provides the Government a means for contract/task order management and monitoring. Regardless of the level of support, the ultimate objective of the contractor is ensuring the Government’s requirements are met, delivered on schedule, and performed within budget.

5.1 CONTRACTING OFFICER REPRESENTATIVE (COR) DESIGNATION

The COR will be specified at the task order level.

5.2 CONTRACTOR LIAISON

[Ver dtd 30 Jun 17] 13 of 36

The contractor shall assign a technical single point of contact, also known as the Program Manager

(PM) who shall work closely with the Government Contracting Officer and COR. The contractor

PM, located in the contractor’s facility, shall ultimately be responsible for ensuring that the contractor’s performance meets all Government contract requirements within cost and schedule. PM shall have the requisite authority for full control over all company resources necessary for contract and task order performance and be available to support emergent situations. The PM shall ultimately be responsible for the following: personnel management; management of Government material and assets; and personnel and facility security. In support of open communication, the contractor shall initiate periodic meetings with the COR.

5.3 CONTRACTOR MONITORING AND MAINTENANCE

The contractor shall have processes established in order to provide all necessary resources and documentation during various times throughout the day including business and non-business hours in order to facilitate a timely contract/task order response or modification in particular during urgent requirements.

5.3.1 Contract Administration & Documentation

Various types of administration documents are required throughout the life of the contract. At a minimum, the contractor shall provide the following documentation:

5.3.1.1 Task Order Status Report (TOSR)

The contractor shall develop a Task Order Status Reports (TOSR) (CDRL A###) and submit it monthly, weekly, and/or as cited in the requirements of each task order. The prime contractor shall be responsible for collecting, integrating, and reporting all subcontractor reports. The TOSR include the following variations of reports:

(a) Monthly TOSR – the contractor shall develop and submit a task order status report monthly at least 30 days after task order award on the 10th of each month for those months the task order is active. The contractor shall report on various task order functions: performance, schedule, financial, business relations, and staffing plan/key personnel; see applicable DD Form 1423 for additional reporting details and distribution instructions. This CDRL includes a Staffing Plan (CDRL A###

Attachment 1 of Exhibit A), Personnel Listing (CDRL A### Attachment 2of Exhibit A), and

Government-furnished property (GFP) Template (CDRL A### Attachment 3 of Exhibit A) necessary for additional data collection as applicable.

5.3.1.2 Contract/Task Order Closeout Report

The contractor shall develop a contract/task order closeout report (CDRL A###) and submit it no later than 15 days before the contract/task order completion date. The prime contractor shall be responsible for collecting, integrating, and reporting all subcontracting information. See applicable

DD Form 1423 for additional reporting details and distribution instructions.

5.3.1.3 Enterprise-wide Contractor Manpower Reporting Application

Pursuant to NMCARS 5237.102-90, the contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided under this task order for the

DoD via a secure data collection website – Enterprise-wide Contractor Manpower Reporting

Application (eCMRA). The Product/Service Codes (PSC) for contracted services excluded from reporting are as follows:

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities;

(4) S, Utilities ONLY;

(5) V, Freight and Shipping ONLY.

[Ver dtd 30 Jun 17] 14 of 36

The contractor shall completely fill-in all required data fields using the following web address:

https:// doncmra.nmci.navy.mil/. Reporting inputs consists of labor hours executed during the task order period of performance within each Government fiscal year (FY) which runs from October 1 through September 30. While inputs may be reported any time during the FY, the contractor shall report all data no later than October 31 of each calendar year. Contractors may direct questions to the help desk at http://www.ecrma.mil/.

5.3.1.4 WAWF Invoicing Notification and Support Documentation

Pursuant to DFARS clause 252.232-7003 and 252.232-7006, the contractor shall submit payment requests and receiving reports using DoD Invoicing, Receipt, Acceptance, and Property Transfer

(iRAPT) application (part of the Wide Area Work Flow (WAWF) e-Business Suite) which is a secure

Government web-based system for electronic invoicing, receipt, and acceptance. The contractor shall provide e-mail notification to the COR when payment requests are submitted to the iRAPT/WAWF and the contractor shall include cost back–up documentation (e.g., delivery receipts, time sheets, & material/travel costs, etc.) to the invoice in iRAPT/WAWF. When requested by the COR, the contractor shall directly provide a soft copy of the invoice and any supporting invoice documentation

(CDRL A###) directly to the COR within 24 hours of request to assist in validating the invoiced amount against the products/services provided during the billing cycle.

5.3.1.5 Labor Rate Limitation Notification

For level of effort (LOE) service task orders (cost type labor-hour and fixed-price) above the

Simplified Acquisition Procedures (SAP) threshold, the contractors shall monitor the following labor rates as part of the monthly TOSR (see CDRL A### Attachment 2of Exhibit A – Personnel Listing).

The contractor shall initiate required notification if specified threshold values cited below are met.

The ability of a contractor to monitor labor rates effectively will be included in the contract/task order

Quality Assurance Surveillance Plan (QASP).

(a) Fully burden labor rates per person (subcontractor included) charged on task order – If the actual invoiced fully burden rate (inclusive of fee) of any individual in any labor category exceeds the threshold amount of $182.00/hour and the individual’s rate was not disclosed in pre-award of the task order, the contractor shall send notice and rationale (CDRL A###) for the identified labor rate to the

COR who will then send appropriate notification to the Contracting Officer. NOTE: Within one labor category, if the total collective estimated and/or actual hours in any given period of performance are less than or equal to 500 labor hours, the labor category is excluded from the required CDRL notification regardless if an individual within that labor category exceeds the threshold.

(b) Average actual labor rates (total actual fully burdened labor costs “divided by” total number of hours performed) compared to average negotiated labor rates (total negotiated fully burdened labor costs “divided by” total number of hours negotiated) – If the average actual burdened labor rates exceeds the average proposed/negotiated rate by 15%, the contractor shall send notice and rationale

(CDRL A###) for the rate variance to the COR who will then send appropriate notification to the

Contracting Officer. Additionally, contractors shall notify the COR if variances exceed 15% for more than three consecutive months. Contractors shall annotate the variance percentage of monthly average actual labor rates versus average negotiated labor rates in the monthly TOSR.