N66001-17-R-0066 RFP.pdf

CODE

(Hour)

PAGE(S)

until 02:00 PM local time 30 Jan 2018

X

A X B X C X D

EX

X

G F 72 - 82

83 - 98 X H 99 - 103

RATING PAGE OF PAGES

7. ISSUED BY

(Date)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

Previous Edition is Unusable 33-134 STANDARD FORM 33 (REV. 9-97)

Prescribed by GSA FAR (48 CFR) 53.214(c)

1 103

(If other than Item 7)

15A. NAME 16. NAME AND TITLE OF PERSON AUTHORIZED TO

AND

ADDRESS

SIGN OFFER (Type or print)

OF

OFFEROR

AMENDMENT NO. DATE

15B. TELEPHONE NO (Include area code) 17. SIGNATURE15C. CHECK IF REMITTANCE ADDRESS

IS DIFFERENT FROM ABOVE - ENTER

SUCH ADDRESS IN SCHEDULE.

18. OFFER DATE

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

2. CONTRACT NO.

N66001 8. ADDRESS OFFER TO

See Item 7

9. Sealed offers in original and 1 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in

CAUTION - LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and

L-TXT-38

conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME (NO COLLECT CALLS)

11. TABLE OF CONTENTS

SOLICITATION/ CONTRACT FORM

SUPPLIES OR SERVICES AND PRICES/ COSTS

2 - 6

X I CONTRACT CLAUSES

DESCRIPTION/ SPECS./ WORK STATEMENT X

PACKAGING AND MARKING

7 - 26

J LIST OF ATTACHMENTS

INSPECTION AND ACCEPTANCE

DELIVERIES OR PERFORMANCE

X K

REPRESENTATIONS, CERTIFICATIONS AND

OTHER STATEMENTS OF OFFERORS

CONTRACT ADMINISTRATION DATA 30 - 33 X

SPECIAL CONTRACT REQUIREMENTS

OFFER (Must be fully completed by offeror) 34 - 44 X M

L INSTRS., CONDS., AND NOTICES TO OFFERORS

EVALUATION FACTORS FOR AWARD

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52.232-8)

14. ACKNOWLEDGMENT OF AMENDMENTS

(The offeror acknowledges receipt of amendments

AMENDMENT NO. DATE

to the SOLICITATION for offerors and related documents numbered and dated):

FACILITY

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period

SOLICITATION, OFFER AND AWARD

X

(X) SEC. DESCRIPTION (X) SEC. DESCRIPTION PAGE(S)

PART I - THE SCHEDULE

26. NAME OF CONTRACTING OFFICER (Type or print) 27. UNITED STATES OF AMERICA 28. AWARD DATE

EMAIL:TEL: (Signature of Contracting Officer)

CODE CODE

B. TELEPHONE (Include area code) C. E-MAIL ADDRESS

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT 21. ACCOUNTING AND APPROPRIATION

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

10 U.S.C. 2304(c)( ) 41 U.S.C. 253(c)( ) (4 copies unless otherwise specified)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN ITEM

24. ADMINISTERED BY (If other than Item 7) CODE 25. PAYMENT WILL BE MADE BY CODE

PART IV - REPRESENTATIONS AND INSTRUCTIONS

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

45 - 70

PART II - CONTRACT CLAUSES

SPAWAR SYSTEMS CENTER PACIFIC

VERONICA VELARDE, CODE 22530

VERONICA.VELARDE@NAVY.MIL

53560 HULL STREET

SAN DIEGO CA 92152

619-553-7734

FAX:

TEL:

FAX:

TEL:

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

SOLICITATION

6. REQUISITION/PURCHASE NO.5. DATE ISSUED

28 Dec 2017

4. TYPE OF SOLICITATION

SEALED BID (IFB)

NEGOTIATED (RFP)

[ X ]

3. SOLICITATION NO.

N6600117R0066

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 Lot Engineering Services

CPFF

Base Period of two years. Provide services in accordance with the Statement of Work, Section C, as specified in individual task orders.

FOB: Destination

ESTIMATED COST

FIXED FEE

TOTAL EST COST + FEE

0002 Lot Other Direct Costs (ODC)

COST

Base period of two years. ODC including but not limited to travel, materials, and equipment.

NOTE: The requirements in DFARS 252.211-7003, Item Identification and Valuation, are applicable for this line item. The contractor shall provide DoD unique identification or a DoD recognized unique identification equivalent.

0003 Lot Data-Base Period-Not Separately Priced

0004 Lot OPTION Engineering Services

CPFF

Option period of three years. Provide services in accordance with the Statement of Work, Section C, as specified in individual task orders.

FIXED FEE

TOTAL EST COST + FEE

0005 Lot Other Direct Costs (ODC)

COST

Option period of three years. ODC including but not limited to travel, materials, and equipment.

NOTE: The requirements in DFARS 252.211-7003, Item Identification and Valuation, are applicable for this line item. The contractor shall provide DoD unique identification or a DoD recognized unique identification equivalent.

OPTION

0006 Lot OPTION Data-Option Period-Not Separately Priced

CLAUSES INCORPORATED BY FULL TEXT

B-TXT-01 PAYMENT OF FIXED FEE (COMPLETION TYPE) (JUN 2017)

FIXED FEE: $*. The Government shall make payment to the Contractor when requested as work progresses, but no more frequently than biweekly, on account of the fixed fee, equal to ** percent of the amounts invoiced by the Contractor under the “Allowable Cost and Payment” clause hereof for the related period, subject to the withholding provisions of paragraph (b) of the “Fixed Fee” clause. In the event of discontinuance of the work in accordance with clause of this contract entitled “Limitation of *** the fixed fee shall be redetermined by mutual agreement equitably to reflect the diminution of the work performed; the amount by which such fixed fee is less than, or exceeds payments previously made on account of fee, shall be paid, or repaid by, the Contractor, as the case may be.

*To be completed upon award of the contract.

**To be determined at the Task Order level. The allowable fee percentage will be negotiated at the Task Order level, and shall not exceed the percentage proposed at the basic contract level.

***To be determined at the Task Order level.

(End of clause)

B-TXT-04 LEVEL OF EFFORT--FEE ADJUSTMENT FORMULA (JUN 2017)

(a) Subject to the provisions of the “Limitation of Cost” or “Limitation of Funds” clause (whichever is applicable to this contract), it is hereby understood and agreed that the fixed fee is based upon the Contractor providing the below listed number of staff-hours of direct labor, hereinafter referred to as X, at the estimated cost and during the term of this contract specified elsewhere herein:

TBD at the Task Order Level.

The Contractor agrees to provide the total level of effort specified above in performance of work described in Sections “B” and “C” of this contract. The total staff-hours of direct labor shall include subcontractor direct labor hours for those subcontractors identified in the Contractor’s proposal as having hours included in the proposed level of effort.

(b) Of the total staff-hours of direct labor set forth above, it is estimated that 0 staff-hours are competitive time (uncompensated overtime). Competitive time (uncompensated overtime) is defined as hours provided by personnel in excess of 40 hours per week without additional compensation for such excess work. All other effort is defined as compensated effort. If no amount is indicated in the first sentence of this paragraph, competitive time (uncompensated overtime) effort performed by the contractor shall not be counted in fulfillment of the level of effort obligations under this contract.

(c) Effort performed in fulfilling the total level of effort obligations specified above shall only include effort performed in direct support of this contract and shall not include time and effort expended on such things as local travel from an employee’s residence to their usual work location, uncompensated effort while on travel status, truncated lunch periods, or other time and effort which does not have a specific and direct contribution to the tasks described in Section B.

(d) It is understood and agreed that various conditions may exist prior to or upon expiration of the term of the contract, with regard to the expenditure of labor staff-hours and/or costs thereunder which may require adjustment to the aggregate fixed fee. The following actions shall be dictated by the existence of said conditions:

(1) If the Contractor has provided not more than 105 % of X or not less than 95% of X, within the estimated cost, and at the term of the contract, then the fee shall remain as set forth in Section B.

(2) If the Contractor has provided X-staff-hours, within the term, and has not exceeded the estimated cost then the Contracting Officer may require the Contractor to continue performance until the expiration of the term, or until the expenditure of the estimated cost of the contract except that, in the case of any items or tasks funded with

O&MN funds, performance shall not extend beyond 30 September. In no event shall the Contractor be required to provide more than 105 % of X within the term and estimated cost of this contract. The fee shall remain as set forth in Section B.

(3) If the Contractor expends the estimated cost of the contract, during the term of the contract and has provided less than X staff-hours, the Government may require the Contractor to continue performance, by providing cost growth funding, without adjusting the fixed fee, until such time as the Contractor has provided X staff-hours.

(4) If the Contracting Officer does not elect to exercise the Government’s rights as set forth in paragraph (d)(2) and (d)(3) above, and the Contractor has not expended more than 95% of X staff-hours, the fixed fee shall be equitably adjusted downward to reflect the diminution of work.

(5) Nothing herein contained shall, in any way, abrogate the Contractor’s responsibilities, and/or the Government’s rights within the terms of the contract provision entitled “Limitation of Cost” or “Limitation of Funds” as they shall apply throughout the term of the contract, based upon the total amount of funding allotted to the contract during its specified term.

(e) Within 45 days after completion of the work under each separately identified period of performance hereunder, the Contractor shall submit the following information in writing to the Contracting Officer with copies to the cognizant Contract Administration Office and DCAA office to which vouchers are submitted:

(1) The total number of staff-hours of direct labor expended during the applicable period.

(2) A breakdown of this total showing the number of staff-hours expended in each direct labor classification and associated direct and indirect costs.

(3) A breakdown of other costs incurred.

(4) The Contractor’s estimate of the total allowable cost incurred under the contract for the period.

In the case of a cost under-run, the Contractor shall submit the following information in addition to that required above:

(5) The amount by which the estimated cost of this contract may be reduced to recover excess funds and the total amount of staff-hours not expended, if any.

(6) A calculation of the appropriate fee reduction in accordance with this clause.

All submissions required by this paragraph shall include subcontractor information, if any.

(f) SPECIAL INSTRUCTION TO THE PAYING OFFICE REGARDING WITHHELD FEE

Fees withheld pursuant to the provisions of this contract, such as the withholding provided by the “Allowable Cost and Payment” and “Fixed Fee” clauses, shall not be paid until the contract has been modified to reduce the fixed fee in accordance with paragraph (d) above, except that no such action is required if the total level of effort provided falls within the limits established in paragraph (d) above.

B-TXT-08 MINIMUM AND MAXIMUM QUANTITIES (JUN 2017)

As referred to in paragraph (b) of the “Indefinite Quantity” clause of this contract, the contract minimum quantity is a total of $10,000 worth of orders at the contract unit price(s). The maximum quantity is the total estimated amount of the contract. The maximum quantity is not to be exceeded without prior approval of the Procuring Contracting Officer.

B-TXT-12 LIMITATION OF LIABILITY--INCREMENTAL FUNDING (JUN 2017)

This “when specified in the task order” is incrementally funded and the amount currently available for payment hereunder is limited to “$ TBD at Task Order Level” inclusive of fee. It is estimated that these funds will cover the cost of performance through “TBD at Task Order Level”. Subject to the provisions of the FAR 52.232-22 “Limitation of Funds” clause of this contract, no legal liability on the part of the Government for payment in excess of “$ TBD at Task Order Level” shall arise unless additional funds are made available and are incorporated as modifications to this contract.

Section C - Descriptions and Specifications

Statement of Work

SPAWAR SYSTEMS CENTER PACIFIC

Codes 538 C4ISR Cybersecurity and Security Engineering

1.0 Scope

The Space and Naval Warfare Systems Center Pacific (SSC Pacific) Code 538 Integrated Command, Control and Intelligence (C2I) Engineering Division provides a number of Cybersecurity (CS) and security engineering-related services to its Department of Defense (DoD), National Guard Bureau, and Department of Homeland Security (DHS) customers. This Statement of Work defines the task requirements and materials to support the performance of these services. It should be noted that the terms information assurance and cybersecurity are used interchangeably throughout this Statement of Work.

1.1 Background

The Defense Information Systems Agency (DISA), in coordination with the National Security Agency (NSA) and the Services and Agencies throughout the DoD, has developed a standard process to minimize the risks associated with non-standard security implementations across shared infrastructure and end systems. The DoD Intelligence Information System (DoDIIS) Assessment and Authorization Process, Intelligence Community Directive 503, Intelligence Community Information Systems Security (ICD 503), DoD Joint Special Access Program Implementation Guide (JSIG) , the DoD Information Assurance Assessment and Authorization Process (DIACAP), Risk Management Framework (RMF), the Common Criteria Guidelines, and the corresponding Committee on National Security Systems (CNSS) and National Institute of Standards and Technology (NIST) Guidelines for non- DoD systems integrate security directly into the system lifecycle and are designed to be applied uniformly across the DoD.

As the requirement for ensuring system and network security for all DoD, Coast Guard, and NSA Command, Control, Communications, Computers, Intelligence, Surveillance and Reconnaissance (C4ISR) systems becomes more critical in today’s threat-rich environment, and the mandate for all systems to be authorized before they can be put into operational use continues to be enforced, the need for sources of security expertise has grown significantly.

This growth has led to a shortage of qualified security specialists who are not only experts in all aspects of network security, but also experienced in the application of that expertise to the unique challenges and constraints of ensuring the security of C4ISR systems operating in a classified environment. In response to this need, the SSC Pacific Integrated C2I Engineering Division has established a team of highly trained professionals with a depth and breadth of experience to meet the needs of the C4ISR community. This Statement of Work supports the team.

2.0 Applicable Documents

CCMB-2009-07-004, Common Methodology for Information Technology Security Evaluation, Version 3.1, Revision 3, Final, July 2009

Department of Defense Directive 8140.01 Cyberspace Workforce Management 11 August, 2015

Department of Defense Directive 8570.01 M Information Assurance Workforce Improvement Program 10 November, 2015

Department of Defense Instruction 8500.2, Information Assurance Implementation, 6 February 2003

Department of Defense Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), 24 May 2016

Department of Defense Instruction 8551.1, Ports, Protocols, and Services Management, 13 August 2014

Department of Defense Directive O-8530.1 Computer Network Defense, 25 July 2017

Department of Navy Chief Information Officer Memorandum (DON CIO) 02-10, Information Assurance Policy Update for Platform Information Technology (IT), 26 April 2010

Department of Navy Policy on Digital Product/Technical Data, ASN RD&A memo of 23 Oct 2004

Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347, Section III, December 2002

Intelligence Community Directive 503, Intelligence Community Information Systems Security, Risk Management, Certification and Accreditation, 15 September 2008

Joint Department of Defense Intelligence Information System (DoDIIS)/Cryptologic SCI Information Systems Security Standards, Revision 3, 11 April 2003

National Institute of Standards and Technology Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, February 2010

National Institute of Standards and Technology Special Publication (NIST-SP) 800-53 Rev. 4, Recommended Security Controls for Federal Information Systems and Organizations, January 2015.

National Institute of Standards and Technology Special Publication (NIST-SP) 800-53A Rev. 4, Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans, December 2014

Office of the Chief of Naval Operations Instruction OPNAVINST F3300.53C, Navy Antiterrorism Program

JSIG, Joint Special Access Programs Implementation Guide, (JSIG) October 9, 2013

DoD Directive (DoDD) 8500.01E Cybersecurity

NIST SP 800-59, Guideline for Identifying an Information System as a National Security System, April 2003.

NIST SP 800-60 Volume I, Revision 1, Guide for Mapping Types of Information and Information Systems to Security Categories, August 2008.

NIST SP 800-60 Volume II, Revision 1, Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, August 2008.

NIST SP 800-64, Revision 2, Security Considerations in the System Development Life Cycle, October 2008.

NIST SP 800-137, Information Security Continuous Monitoring for Federal Information Systems and Organizations, September 2011.

NIST SP 800-30, Revision 1, Guide for Conducting Risk Assessments, September 2012.

Rapid Integration and Test Environment (RITE) Agile Incremental Development Process

Rapid Integration and Test Environment (RITE) Capability Assessment Gates – Standard Operating Procedure

(SOP) 01

Rapid Integration and Test Environment (RITE) Continuous Software Integration – Standard Operating Procedure

(SOP) 02

Rapid Integration and Test Environment (RITE) Deficiency Report (DR) Life Cycle – Standard Operating Procedure (SOP) 03

Rapid Integration and Test Environment (RITE) Control Boards Operation – Standard Operating Procedure (SOP)

NIST SP800-115, "Technical Guide to Information Security Testing and Assessment", September 2008 Chairman of the Joint Chiefs of Staff Manual 6510.01B “Cyber Incident Handling Program”, 10 July 2012

3.0 Specific Development and Support Tasks

The task areas below shall be performed by DoDD 8570.01/ DoDD 8140.01-certified personnel on US Navy, Army, Marine Corps, NSA, Coast Guard C4ISR Systems, NGB, and other Federal Government information systems.

These systems include, but are not limited to, the US Coast Guard’s Shipboard Command and Control System (SCCS), Coast Guard Command and Control System (CG-C2), SeaWatch, Shore-based Intelligence and C2 Systems, Maritime Security Cutter Large (WMSL), High Endurance Cutter (WHEC), Medium Endurance Cutter (WMEC), Fast Response Cutter (FRC), Long Range Surveillance Maritime Patrol Aircraft (LRS MPA), Medium Range Surveillance Maritime Patrol Aircraft (MRS MPS) and related support assets, and Data Center and Application Optimization (DCAO)/Navy Enterprise Data Center (NEDC) systems, such as N2/N6, Other Consumer Funds (OCF), and Non-Navy funded. Performances of these tasks also require an extensive, in-depth, demonstrated knowledge of command and control systems, Cross Domain Solution technologies, and secure wireless technology.

3.1 TASK 1 – Generate Common Criteria/DIACAP/RMF Documentation for C4ISR Systems This task comprises the activities necessary to generate the documentation required to meet DIACAP/RMF/ICD 503/JSIG, and/or Common Criteria assessment and authorization requirements for C4ISR systems. This effort shall include the following specific subtasks:

Generation of the DIACAP/RMF documentation package that meets all DoD requirements and is tailored to a specific C4ISR system to include but not limited to; Security Categorization Determination, Implementation Plan, System Security Plan(SSP), Configuration Management Plan(CMP), Incident Response Plans (IRP), Contingency Plans(CP), Authorization documentation, IT Security Plans of Action & Milestones (POA&Ms), Scorecards, Security Assessment Reports(SAR), Continuous Monitoring Strategy, Hardware/Software lists, Threat Models, Cybersecurity Strategy, Network Topology, Network Cybersecurity Boundary Diagrams, and Data Flow Diagrams.

Tasks will include evaluating compliance with all applicable DISA STIGs, performing Security Readiness Reviews (SRRs) for the Operating Systems and applications, performing automated scans, tests, and analysis using DISA Secure Content Automation Protocol (SCAP) benchmarks, performing automated scans using the Assured Compliance Assessment Solution (ACAS) and other Government-approved tools, and performing manual inspections. In addition, other custom security evaluation tools may be used to assess the quality of the system lockdown and the security of the external interfaces. Additionally, other security tasks such as the assessment of the system’s physical security and security control assessments shall be performed.

The use of tools, such as eMASS, XACTA, and RSA Archer for automating the Assessment and Authorization (A&A) process will be required. Security Controls and DIACAP/RMF documentation shall be generated and included in the packages.

Generation of a Risk Assessment to assess the Risk of systems to the Department of Defense Information Network.

Additional tasks performed will contribute to all steps of the RMF and/or DIACAP process.

3.2 TASK 2 – Perform Security Certification Test and Evaluation of C4ISR Systems This task comprises all activities required to perform a Certification Test and Evaluation of a C4ISR System.

Specifically, it includes

Generation of Security Certification Test and Evaluation (CT&E) Plan – generate a CT&E Plan that is designed to test the capability of the C4ISR system implementation to eliminate or mitigate the potential security vulnerabilities.

The Plan must meet all DIACAP/RMF requirements and must ensure that all system security vulnerabilities are demonstrated.

Conducting a Certification Analysis – perform a detailed certification analysis of the software associated with each of the C4ISR system components. Certification analysis is the process activity that determines if the IT system is ready to be evaluated and tested. The analysis shall include system architecture analysis, software design analysis, network connection rule compliance analysis, integrity analysis of integrated products, life-cycle management analysis, and vulnerability assessment. Based on this analysis, identify security vulnerabilities resulting from the software development tools used, operating system deficiencies, and the actual software implementation. Also validate the Commercial Off-The-Shelf (COTS) and Government-Off-The-Shelf (GOTS) products used in the system design to assure that they have been integrated properly and that their functionality meets the security needs of the system. COTS products include all Operating Systems components (such as all DoD/DHS current and future deployed versions of Microsoft Windows, HP UX, SOLARIS, LINUX, Mac OS, Red Hat, and other *NIX variants), network systems (such as Cisco and Juniper) and system device drivers.

Performing software component level security performance testing and system level vulnerability scanning against the C4ISR system workstations, servers, switches and routers based on the Certification and Accreditation (C&A) Plan/SSP generated in Task 1 - 3.1. The testing will include evaluating compliance with DISA Security Technical Implementation Guides (STIGs), performing Security Readiness Reviews (SRRs) for the Operating Systems and applications, performing automated scans using DISA Secure Content Automation Protocol (SCAP) benchmarks with the SCAP compliance Checker Tool, performing automated scans using the Assured Compliance Assessment Solution (ACAS), STIG Checklists (CKLs) using STIGViewer and other Government-approved tools, and performing manual inspections. In addition, other custom security evaluation tools may be used to assess the quality of the system lockdown and the security of the external interfaces.

Generation of a Certification Test and Evaluation Report.

Generation of a Risk Assessment Report (RAR).

3.3 TASK 3 – Perform System Security Test and Evaluation (ST&E) of C4ISR Systems This task comprises all activities required to perform a System-level Security Test and Evaluation of a C4ISR System. Specifically, it includes

Generation of Security Test and Evaluation (ST&E) Plan – generate an ST&E Plan that is designed to test the security performance of the C4ISR system in its operational environment and ensure compliance with all applicable STIGs. The Plan must meet all Assessment and Authorization requirements and must ensure that all system security vulnerabilities are demonstrated.

Conducting Security Test and Evaluation – perform on-site, system-level security testing in the system’s operational environment. The testing will include evaluating compliance with DISA STIGs, performing SRRs for the Operating Systems and applications, performing automated scans, tests, and analysis using DISA SCAP benchmarks, performing automated scans using the Assured Compliance Assessment Solution (ACAS) and other Government-approved tools, and performing manual inspections. In addition, other custom security evaluation tools may be used to assess the quality of the system lockdown and the security of the external interfaces. Additionally, other security tasks such as the assessment of the system’s physical security and security control assessments shall be performed.

This task shall also include the ability to perform static/dynamic code analysis, and Web-Application Security testing utilizing government approved toolsets.

Generation of a System Security Test and Evaluation Report.

This task also comprises full-spectrum Blue, Green, and Red Team support IAW the NIST SP800-115, "Technical Guide to Information Security Testing and Assessment" or the equivalent follow-on or replacement technical guidance, as well as assessing vulnerabilities and/or deficiencies of cyber warfare capabilities to the latest threats emanating from adversaries and other malicious sources, identifying solutions and/or trade-offs to correct any deficiencies.

3.4 TASK 4 – Perform Security Control Evaluation and Platform IT Determination of C4ISR Systems This task comprises all activities required to perform security control evaluations of DoD and other Federal Government information systems, and a Platform IT determination. Specifically, it includes

Conducting an evaluation of the implementation of Cybersecurity/security control requirements per NIST SP 800-53 and DoDI 8500.2, using documented validation guidance (e.g. NIST SP 800-53A, DIACAP Knowledge Service IA Control Validation Procedures, RMF Knowledge Service Assessment Procedures, etc.) and/or automated tools.

Generation of a security control assessment or validation report.

Generation of a Risk Assessment to assess the Risk of systems to the Department of Defense Information

Network.

Conducting a Platform IT determination analysis and assessment of an information system according to the DON CIO Memo 02-10.

Generation of a Platform IT determination checklist.

Review or generation of required documentation including but not limited to; Security Categorization

Determination, Implementation Plan, System Security Plan, Configuration Management Plan, Incident Response Plans, Contingency Plans, Authorization documentation, IT Security Plans of Action & Milestones (POA&Ms), Scorecards, Security Assessment Reports, Continuous Monitoring Strategy, Hardware/Software lists, Threat Models, Network Topology, Network Cybersecurity Boundary Diagrams, and Data Flow Diagrams.

3.5 TASK 5 – Provide Prevention/Recovery/Investigative Services This task comprises performance of network security assessments, and the development and implementation of network protection plans. The contractor shall conduct assessments using the automated toolset identified in Tasks 2 and 3 and shall include a detailed analysis. The types of assessments shall include Network Intrusion Detection, monitoring of network throughput, efficiency, and loading, and evaluation of network integrity, security, and information protection. The focus of the assessments shall be the identification of specific potential vulnerabilities existing in the network infrastructure and detailed recommendations for the elimination or mitigation of these vulnerabilities.

This task shall include providing all necessary services for recovering networks that have been victims of network attacks. The contractor shall use the network security toolset to identify the source and nature of the attack and shall perform the activities required to eliminate the problem and restore the network to its operational state.

This task shall include providing all necessary services to rapidly identify and respond to cyber incidents that adversely affect DoD information networks and information systems (ISs) IAW CJCSM 6510.01B “Cyber Incident Handling Program” or the equivalent follow-on or replacement technical guidance.

This task shall also include the performance of digital investigative services and analyses required to identify risks to the organization based on the activities occurring on the network. This effort will focus on identifying activities such as the improper use of Government assets and the improper handling of sensitive or classified information.

The contractor shall use Government-approved tools to conduct these investigations. The contractor shall create and secure network monitoring platforms to identify and monitor targets. The contractor shall identify the nature and sources of any problems as part of the analyses. The contractor shall also identify the features of the network configuration that enabled the problem to occur and provide recommendations for preventing future occurrences.

3.6 TASK 6 – Provide Cybersecurity Engineering Services

Network Engineering Cybersecurity - This task comprises the performance of cybersecurity engineering-related technical consultation to include expert assessment of access control systems and methodology, application and file security, security practices, hostile intrusion detection and prevention, logical and physical security, cross-security boundary guards and interfaces, servers (enterprise, distributed, network), public key infrastructure, network architecture, cybersecurity (authentication and integrity), and virtual private networks. These engineering efforts shall include support of system design reviews for systems incorporating any of these technologies or having any security requirements, evaluation of system integration strategies with respect to security impacts, and recommendation of design approaches to address system vulnerabilities. This effort shall cover the security of applications and systems from test environment to operational environment, for both systems and networks.

System Engineering Cybersecurity - Provide cybersecurity engineering-related technical consultation and participate in Engineering Integrated Product Teams (IPT), organizing and managing team processes, meetings, and objectives for leadership for the following events: Integrated Product Teams (IPTs) (e.g. Integrated Test Lab (ITL-IPT), etc.), Technical Exchange Meetings (TEMs), and Engineering Technical Reviews (ETRs). Provide subject matter expertise, advice, and project planning for integrated product data management and knowledge management solutions required to accomplish cyber security objectives.

Hardware Engineering Cybersecurity - Provide hardware engineering-related technical consultation in support of cyber security for systems produced for military missions where systems may be deployed to operational military units. May span from initial concept exploration and requirements definition through to development of systems.

Software Engineering Cybersecurity - Perform software security engineering-related technical consultation for the requirements, design, implementation/development, integration, and support of software to support developmental efforts. These efforts may necessitate analyses, design concepts, architecture definitions, and development of prototypes, Engineering Development Models (EDM's), and proof of concept demonstrations.

The contractor(s) will be required to provide cleared staff at the TS/SCI level or Secret level, depending upon operational environment of these facilities. The contractor may be required to attend meetings classified up to Top Secret/SCI level.

3.7 TASK 7 – Software Development and Prototyping (and Documentation) This task comprises the performance of specifying, designing, developing, coding, testing, integrating and documenting software modules systems and subsystems to provide new functional capabilities and improve existing information assurance posture. This effort includes performing reverse engineering of software components and systems to support vulnerability and exploitation analysis. The functions to be implemented include the full spectrum of information assurance and cyber warfare. The performance of this task will adhere to open standards and modern software development methodologies, including what is considered ‘best’ practices by the industry.

This task also includes rapid prototyping to meet time critical requirements, and the development of software documentation (Software Design Document, Software User’s Manual, Data Flow Description, etc.) This task shall require familiarity with Software Development Environments such as Eclipse, NetBeans, etc. The software developer shall also know common web based languages (Java JSP, .NET, HTML5, JavaScript, CSS, XML, etc.)

and be able develop using best software design practices such as Object Oriented Coding and code re-use. The task will include evaluating software compliance with code analyzers, such as HP Fortify.

Provide software development/coding expertise employing the Rapid Integration and Test Environment (RITE) process for the creation, modification, and maintenance of SSC-Pacific (Code 53824/53826) developed software.

3.8 TASK 8 – Provide Cross Domain Analysis and Evaluation Services This task comprises the performance of security engineering design support, product evaluation, and device certification for Cross Domain Solutions (CDSs) to include the evolving Very Low Attack Risk (VLAR) Cross Domain Process. This effort will focus on identifying and recommending DISA-approved products that can be incorporated into systems that require the spanning of multiple security domains, development of certification packages to obtain approval for multi-level security connections, evaluating CDS products for specific applications, and conducting security assessments of systems using CDSs.

3.9 TASK 9 - Provide Cybersecurity Planning, Coordination and Evaluation Services This task comprises the efforts to provide Cybersecurity policy recommendations for Programs and organizations supported under this effort, acting as a liaison between Program Offices and accreditation authorities, providing Cybersecurity -related inputs to acquisition programs, developing Cybersecurity test plans, analyzing compliance with weapon system certification (where appropriate), and performing special studies and generating point papers on specific Cybersecurity issues including, but not limited to, policy impacts, product evaluations, and Cybersecurity processes. The contractor(s) will be required to provide cleared staff at the TS/SCI level or Secret level, depending upon operational environment of these facilities. The contractor may be required to attend meetings classified up to Top Secret/SCI level.

3.10 TASK 10 - Programmatic Support.

The contractor shall execute a variety of "Programmatic Support" activities. These activities will include, as a minimum: (a) Establish and maintain a comprehensive Work Breakdown Structure, reporting labor and cost accruals against specific paragraphs of the WBS. (b) Perform Risk Management activities in accordance with project requirements. (c) Establish and maintain a system of continuous process and quality improvement. (d) Support a variety of project meetings and data collection/analysis/reporting activities

4.0 Deliverables

Data deliverables shall have been reviewed in accordance with “DON Policy on Digital Product/Technical Data, ASN RD&A memo of 23 Oct 2004,” and as specified in the CDRL for the individual delivery/task orders.

5.0 Travel

Travel will be required as per individual task orders.

If foreign travel is required, all outgoing Country/Theater clearance message requests shall be submitted to Commanding Officer, Attn: Foreign Travel Team, Space and Naval Warfare Systems Center Pacific, 53560 Hull Street, Building 27, 2nd Floor -Room 206, San Diego, CA 92152 for action. A Request for Foreign Travel form shall be submitted for each traveler, in advance of the travel, to initiate the release of a clearance message at least 30 days in advance of departure. Each Traveler must also submit a Personal Protection Plan and have a Level 1 Antiterrorism/Force Protection briefing within one year of departure and a country specific briefing within 90 days of departure. Anti-Terrorism/Force Protection (AT/FP) briefings are required for all personnel (Military, DOD Civilian, and contractor) per OPNAVINST F3300.53C. Contractor employees must receive the AT/FP briefing annually. The briefing is available at Joint Knowledge Online (JKO): https://jkodirect.jten.mil (prefix): course number: US007; title: Level 1 Anti-terrorism Awareness Training, if experiencing problems accessing this website contact ssc_fortrav@navy.mil. Forward a copy of the training certificate to the previous email address or fax to

(619) 553-6863. Sere 100.2 Level A code of conduct training is also required prior to Oconus travel for all personnel. Sere 100.2 Level A training can be accessed at http://jko.jfcom.mil (recommended), https://jkodirect.jten.mil/atlas2/faces/page/login/login.seam, recommended course: prefix: J3T: course #: A-US1329, for civilian, military, and contractors. Personnel utilizing this site must have a CAC. A Sere 100.2 Level A training disk can be borrowed at the SSC Pacific Point Loma Office or Old Town Campus Office. Specialized training for specific locations, such as SOUTHCOM human rights, or U.S. forces Korea entry training, may also be required;

SSC Pacific security personnel will inform you if there are additional training requirements. Finally, EUCOM has mandated that all personnel going on official travel to the EUCOM AOR must now register with the Smart Traveler Enrollment Program (STEP). When you sign up, you will automatically receive the most current information the State Department compiles about your destination country. You will also receive updates, including Travel Warnings and Travel Alerts. Sign up is one-time only, after you have established your STEP account, you can easily add official or personal travel to anywhere in the world, not just EUCOM.

http://travel.state.gov/content/passports/en/go/step.html

6.0 Place of Performance

Tasks shall be performed at the contractor’s facilities, at SSC Pacific Integrated C2I Engineering Division, 700 Robbins St., Philadelphia, PA, on-site at tenant locations (Moorestown, NJ, San Diego, CA, Washington D.C., Portsmouth, VA, Alexandria, VA, Arlington, VA, Quantico, VA, Aberdeen, MD, Fort Meade, MD, Kansas City, MS, Bremerton, WA, Charleston, SC), and at locations of the C4ISR systems and associated technical meetings.

The prime contractor must have a facility located within a radius of 50 miles (see H-TXT-26A(c)(1)) of the 700 Robbins St. location at time of award. The reason for this requirement is due to a significant amount of contractor-site personnel being required to temporarily commute (without travel charges) to the Government office during post-scanning activities. This local contractor facility must include a T&E network capable of performing the tasking identified in paragraphs 3.2, 3.3, 3.6, 3.7, and 3.8 of the SOW. The T&E network must be in place prior to the Government awarding any task orders to the contractor that requires the utilization of such T&E network availability.

6.1.1 Government Furnished Equipment/Information (GFE/GFI)

None anticipated at this time. If required, GFE/GFI will be identified under individual task orders.

6.1.2 Security Clearance

The nature of this task requires access to Top Secret information. Some tasks shall require personnel with TOP Secret/Sensitive Compartmented Information (SCI) clearances. The work performed by the Contractor will include access to unclassified and up to Top Secret data, information, and at times spaces. The Contractor will be required to attend meetings classified up to the Top Secret level. The work performed by the Contractor will include access to unclassified and up to Top Secret/Sensitive Compartmented Information (SCI) data, information, and spaces. The Contractor will be required to attend meetings classified up to Top Secret/SCI. The contractor will be required to provide individuals with security clearances at the appropriate classification levels, as specified in individual task orders. Identified Key contractor personnel performing C4ISR Cybersecurity duties are required to possess TS/SCI clearances. The Contractor will require access to Confidential/Secret Communications Security (COMSEC) and the Secure Internet Protocol Router Network (SIPRNet) and Joint Worldwide Intelligence Communications System (JWICS). Although there is no requirement for the contractor to access NATO on this contract per Naval Intelligence Security Policy Directive 17-008 those contractors that have SCI access and a SIPRnet account or JWICS shall be North Atlantic Treaty Organization (NATO) read-on and complete the derivative classification training prior to being granted access to SIPRnet; training is provided by the facility security officer with an entry in JPAS. In addition, contractor personnel that are designated system administrators for systems that process and receive NATO classified data must be NATO read-on and complete the derivative classification training.

Contractors performing tasks at the TS or below level without SCI access shall only receive the North Atlantic Treaty Organization (NATO) awareness brief and complete the derivative classification training prior to being granted access to SIPRnet; training is provided by the facility security officer.

Contractor personnel assigned to this effort who require access to SCI data and spaces must possess a current SSBI with ICD 704 eligibility (which replaced DCID 6/4 eligibility).

NATO information: This means information/documents belonging to, and circulated by, the North Atlantic Treaty Organization (NATO). Access to NATO information requires a (Interim or Final) U.S. government clearance at the appropriated level and a special briefing. The special briefing is provided by the contracting company’s facility security officer along with the derivative classification training with an entry in JPAS. Prior approval from the contracting activity’s NATO Control Officer (NCO)/Alternate (CODE 83310, 619-553-3005/3191) is required before the prime contractor or the subcontracting facility can be granted access to or store NATO material at their facility no exceptions for this contract. The SSC Pacific NCO/Alternate have reviewed the requirement support this contractual obligation and have approved the review to the prime contractor only that in performance of SYSTEM ADMIN duties on SIPRNET/JWICS the contractor may come into contact with NATO Secret information.

As required by National Industrial Security Program Operating Manual (NISPOM) Chapter 1, Section 3, contractors are required to report certain events that have an impact on: 1) the status of the facility clearance (FCL); 2) the status of an employee's personnel clearance (PCL); 3) the proper safeguarding of classified information; 4) or an indication that classified information has been lost or compromised. Contractors working under SSC Pacific contracts will ensure information pertaining to assigned contractor personnel are reported to the Contracting Officer

Representative (COR)/Technical Point of Contact (TPOC), the Contracting Specialist, and the Security's COR in addition to notifying appropriate agencies such as Cognizant Security Agency (CSA), Cognizant Security Office (CSO), or Department Of Defense Central Adjudication Facility (DODCAF) when that information relates to the denial, suspension, or revocation of a security clearance of any assigned personnel; any adverse information on an assigned employee's continued suitability for continued access to classified access; any instance of loss or compromise, or suspected loss or compromise, of classified information; actual, probable or possible espionage, sabotage, or subversive information; or any other circumstances of a security nature that would affect the contractor's operation while working under SSC Pacific contracts.

Applicable documents are as follows SECNAV Manual 5510.30 (Series), Department of Navy Personnel Security Program, SECNAV Manual 5510.36 (Series), Department of Navy Information Security Program, DOD 5200.01 Volumes 1 through 4 (Series), DOD Security Program, DOD 5220.22-M (Series), National Industrial Security Program Operating Manual (NISPOM), and OPNAVINST F3300.53C (Series), Navy Antiterrorism Program.

6.1.3 CYBERSECURITY WORKFORCE (CSWF)

(a) Cybersecurity Compliance

(1) Cybersecurity (which replaced the term Information Assurance (IA)) is defined as prevention of damage to protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation. Contractor personnel shall perform tasks to ensure Navy applications, systems, and networks satisfy Federal/DoD/DON/Navy cybersecurity requirements..

(2) Cyber IT and Cybersecurity Personnel

(i) The Cyberspace workforce elements addressed include contractors performing functions in designated Cyber IT positions and Cybersecurity positions. In accordance with DFARS Subpart 239.71, DoDD 8140.01, SECNAVINST 5239.20A, and SECNAV M-5239.2, contractor personnel performing cybersecurity functions shall meet all cybersecurity training, certification, and tracking requirements as cited in DoD 8570.01-M prior to accessing DoD information systems. Proposed contractor Cyber IT and cybersecurity personnel shall be appropriately qualified prior to the start of the contract performance period or before assignment to the contract during the course of the performance period.

(ii) The contractor shall be responsible for identifying, tracking and reporting cybersecurity personnel, also known as Cybersecurity Workforce (CSWF) and Cyber IT workforce personnel. CSWF Report requirements are explained in a following paragraph. Although the minimum frequency of reporting is monthly, the task order can require additional updates at any time.

(iii) Contractors that access Navy IT shall also follow guidelines and provisions documented in Navy Telecommunications Directive (NTD 10-11) and are required to complete a System Authorization Access Request (SAAR) – Navy form as documented below.

When a contractor requires logical access to a government IT system or resource (directly or indirectly), the required CAC will have a Public Key Infrastructure (PKI). A hardware solution and software (e.g., ActiveGold) is required to securely read the card via a personal computer. Pursuant to DoDM 1000.13-MV1, CAC PKI certificates will be associated with an official government issued e-mail address (e.g. .mil,.gov, .edu). Prior to receipt of a CAC with PKI, contractor personnel shall complete the mandatory Cybersecurity Awareness training and submit a signed System Authorization Access Request Navy (SAAR-N) form to the contract’s specified COR. Note: In order for personnel to maintain a CAC with PKI, each contractor employee shall complete annual cybersecurity training. The following guidance for training and form submittal is provided; however, contractors shall seek latest guidance from their appointed company Security Officer and the SPAWAR/SSC Atlantic/SSC Pacific Information Assurance Management (IAM) office:

For annual DoD Cybersecurity/IA Awareness training, contractors shall use this site:

https://twms.nmci.navy.mil/. For those contractors requiring initial training and do not have a CAC, contact the SPAWAR/SSC Atlantic/SSC Pacific IAM office at phone number [insert applicable contract information] (843)218-6152 or e-mail…