SOW_N66001-18-R-0005_Synopsis.pdf

STATEMENT OF WORK (SOW)

INFORMATION TECHNOLOGY MANAGEMENT

1. INTRODUCTION

Space and Naval Warfare Systems Center Pacific’s (SSC Pacific’s) Information Technology Management (ITM) Competency, Code 82000, has a requirement for professional and technical services to support the physical and logical infrastructure of the Research, Development, Testing, and Evaluation (RDT&E) network and associated IT services.

1.1. BACKGROUND

The RDT&E network is a complex network of computing and communications systems and software supporting a scientific user community that relies on available and stable access to timely information.

The RDT&E environment allows customers to utilize Navy computers and network infrastructure to develop, test, and certify new systems that are either directly in support of Navy initiatives or support internal or external customer requirements. Included in the overall RDT&E network environment is the SECRET network (SRDT&E), which provides local secure connectivity. The RDT&E network is not affiliated with the Navy Marine Corps Intranet (NMCI) network or NMCI desktop services.

1.2. SCOPE

This is a service acquisition to provide RDT&E IT infrastructure support as an enabling service to the 130+ Research & Development labs associated with SSC Pacific. The objective is to provide Information Technology Infrastructure Library (ITIL) aligned professional and technical IT support services in the following areas:

• Video Teleconferencing (VTC)

• Telephone Infrastructure Support

• Information Resources Management (IRM)

• RDT&E Operations Center (ROC)

• IT Project Support

• Server System Administration/Engineering

• Microsoft System Center Configuration Management Engineering and Administration

• Virtualization Infrastructure Management

• Client System Administration

• IT Registrar

• Navy Marine Corps Intranet (NMCI) Support

• Cybersecurity

• Network Security

• RDT&E Infrastructure Support

• Secret RDT&E Network (SRDT&E)

2. APPLICABLE DIRECTIVES AND REFERENCES

The following documents were used in the development of this SOW and may be invoked for individual task orders. The contractor shall also adhere to the following documents, current and future updates as applicable:

Document Date Title ANSI/NECA/BICSI 568-2006 5/25/2011 Standard for Installing Commercial Building

Telecommunications Cabling

CJCSM 6510.01B 12/18/2014 Cyber Incident Handling Program

DOD Manual 5200.01 Volumes 1 through 4

2/24/2012 DOD Information Security Program

DOD Directive 5205.02E 6/20/2012 DOD Operations Security (OPSEC) Program

DOD 5220.22-M 5/18/2016 National Industrial Security Program Operating Manual (NISPOM)

DOD Manual 5200.02 4/3/2017 Procedures For The DoD Personnel Security Program (PSP)

DoD Instruction 8500.01 14-Mar-14 Cybersecurity

DoD Instruction 8510.01 12-Mar-14 Risk Management Framework (RMF) for DoD Information Technology (IT)

DOD 8570.01-M 11/10/2015 Information Assurance Workforce Improvement Program

National Security Decision Directive Number 298

1/22/1988 National Operations Security Program

OPNAVINST 3432.1A 8/4/2011 Operation Security

OPNAVINST 5239.1C 8/20/2008 NAVY INFORMATION ASSURANCE (IA)

PROGRAM

SECNAVINST 3300.2B 12/28/2005 DEPARTMENT OF THE NAVY (DON)

ANTITERRORISM (AT) PROGRAM

S.2521 - Federal Information Security Modernization Act of

12/18/2014 Federal Information Security Modernization Act of 2014

SECNAV M-5239.1 11/1/2005 Department of the Navy Information Assurance Manual

SECNAV M-5239.2 6/27/2016 DEPARTMENT OF THE NAVY

CYBERSPACE INFORMATION

TECHNOLOGY AND CYBERSECURITY

WORKFORCE MANAGEMENT AND

QUALIFICATION MANUAL

SECNAV M-5510.30 6/1/2006 Department of the Navy Personnel Security Program

SECNAV M-5510.36 6/1/2006 Department of the Navy Information Security Program

SECNAVINST 5239.3C 5/2/2016 DEPARTMENT OF THE NAVY

CYBERSECURITY POLICY

SPAWARINST 3432.1 2/2/2005 Operations Security (OPSEC) Policy

SSCPACINST 2280.2C 9/23/2014 Communications Security Material System Material and Equipment Guidance

SSCPACINST 5239.4 CH-1 1/11/2017 Cybersecurity Policy

3. TECHNICAL REQUIREMENTS

3.1. GENERAL

3.1.1. The support services annotated in this section shall follow ITIL and IT Service Management (ITSM) best practices, where applicable. The requirements in this SOW are for support services and the contractor shall not be acquiring or purchasing equipment and/or materials.

3.1.2. All contractor personnel shall be proficient in the use of Microsoft Windows and office products.

3.1.3. The contractor shall prepare and deliver the contractor’s Monthly Status Report, which indicates the cost, schedule, performance, personnel, travel and other direct cost status.

3.1.4. The contractor shall deliver all contract and technical information in digital form. All applications must be compatible with the latest NMCI approved versions or as coordinated with the Government. All required data and documentation will be delivered in electronic media format via email, CD or DVD. All data shall be in Microsoft Word and Microsoft Excel with the exception of presentation material, which shall be delivered in Microsoft PowerPoint. Any electronic submittals, including attachments, submitted via e-mail shall be readable on a standard Personal Computer (PC) using Windows 7; OSX or later, Microsoft Office Suite 2007 or later, Microsoft Project 2007 or later.

3.2. IT PROJECT SUPPORT

3.2.1. The contractor shall manage IT project schedules and plans as required by IT Management.

The contractor shall also administrate project meetings, maintain lists of action items, and prepare reports and presentations as required.

3.3. NETWORK SECURITY

3.3.1. The contractor shall provide RDT&E Security Operations Center (SOC) support to the Network Security Branch. This will include, but is not limited to IT project support; cyber security auditing and compliance; incident response and digital forensic analysis; cyber defense operations; network monitoring; vulnerability and web risk assessment; software engineering, integration and development operations; system architecture and administration support for security stack appliances, servers, hosts, and applications.

3.4. CYBERSECURITY

3.4.1. The contractor shall provide diverse Cybersecurity services that enforce, comply with, and support the DoD and cybersecurity security directives, policies and procedures. The contractor shall also work directly with customers as well as other Cybersecurity teams to ensure timely resolution of vulnerabilities.

3.4.2. The contractor shall assist with preparations for Command Cyber Readiness Inspections

(CCRIs), Cyber Security Inspections (CSIs), and other network inspections.

3.4.3. The contractor shall prepare, review, validate, and submit required Certification and Accreditation (C&A) and Assessment and Authorization (A&A) documentation to obtain and maintain network Authorities to Operate (ATOs). The contractor shall analyze system security scans, completed testing (i.e. STIGs, etc), make recommendations to remedy and mitigate vulnerabilities through applying approved remediation’s, mitigations, updates, fixes or patches.

3.4.4. The contractor shall conduct threat, vulnerability and risk analysis of existing, new, and developing systems. The contractor shall document analysis results and recommend corrective action, contingencies, and justifications as appropriate.

3.5. RDT&E AND SECRET RDT&E NETWORK (SRDT&E INFRASTRUCTURE

SUPPORT

3.5.1. The contractor shall provide day-to-day operational support for the physical, data link, and network layers of the RDT&E network environment (i.e., Open Systems Interconnection (OSI) layers 1/2/3). This support will encompass integration, analysis, testing, troubleshooting of network devices and services, RDT&E layer 1/2/3 asset management, and use of enterprise network management tools to monitor and analyze network performance at the physical infrastructure and Internet Protocol packet level.

3.5.2. The contractor shall provide day-to-day operational support for the physical, data link, and network layers of the SRDT&E network environment. The support includes, at minimum, hardware/software installation, firmware upgrades, and enhancements to switches, routers, hubs, and bridges. This support will encompass, integration, analysis, testing, troubleshooting of network devices and services, SRDT&E layer 1/2/3 asset management, and use of enterprise network management tools to monitor and analyze network performance physical layer and the IP packet level.

3.5.3. The contractor shall support the inspection of SSC Pacific’s Protected Distribution System

(PDS). Inspections shall take place on a daily basis, including weekends and holidays, to validate the integrity of welds on PDS manhole covers and vaults, as well as the integrity of all PDS cable runs and/or conduit. Any suspected compromise of the PDS shall be immediately reported to the SRDT&E Security Officer.

3.5.4. The contractor shall support Cryptographic equipment hardware/software installation, firmware upgrades, Cryptographic Keying Material loading, testing, and troubleshooting.

3.6. RDT&E OPERATIONS CENTER (ROC)

3.6.1. The contractor shall provide ROC support by managing all RDT&E IT incident, service and change request tickets to resolution utilizing an ITIL aligned methodology. Requests which are in scope for ownership by the ROC will include, but are not limited to network account, operating system, application, and network configuration requests.

3.6.2. The contractor shall ensure that all requests received in-person or via telephone, facsimile, e-mail, or other electronic means are documented, assigned, communicated, and either resolved and closed or as appropriate escalated and reassigned to higher support tiers within documented Ticket Target Resolution Times (TRT).

3.6.3. The contractor shall assist the Government in defining and creating incident, service, and change request processes for delivered IT services.

3.7. SERVER SYSTEM ADMINISTRATION/ENGINEERING

3.7.1. The contractor shall provide system administration services for enterprise Windows, UNIX/Linux, and Macintosh operating systems.

3.7.2. The contractor shall manage enterprise servers, monitor infrastructure performance/availability, and complete root cause analysis of identified issues. This includes automating system patch availability, and performing configuration management and compliance auditing. The contractor shall also harden servers in compliance with DISA Security Technical Implementation Guidelines (STIGs) and develop process documentation.

3.8. MICROSOFT SYSTEM CENTER CONFIGURATION MANAGEMENT

ENGINEERING AND ADMINISTRATION

3.8.1. The contractor shall provide Microsoft System Center client imaging and patch management. This includes installing, configuring, and maintaining the infrastructure necessary to deploy corporate operating system images, performing lifecycle management, and Microsoft or third party patching. The contractor shall also maintain a system image inventory, run reports on compliance and patch levels and perform other administrative duties as required.

3.9. VIRTUALIZATION INFRASTRUCTURE MANAGEMENT

3.9.1. The contractor shall manage virtual infrastructure at SSC Pacific and remote sites to include allocating resources through hypervisor console, creating images, cloning, mounting images, creating snapshots and performing backup and restore functions. This also includes host maintenance and supporting servers and patching, vulnerability management and testing of upgrades.

3.10. CLIENT SYSTEM ADMINISTRATION

3.10.1. The contractor shall provide system administration support for RDT&E computer systems, to include application installation, software and operating system patching, imaging, complying with local and Navy computing directives and DISA STIGs, network connectivity configuration and troubleshooting, hardware repair/break-fix, network imaging, end-user data transfers, and other general root level administrative tasks necessary to support end-users.

3.11. VIDEO TELECONFERENCING

3.11.1. The contractor shall support the installation, configuration, operation and troubleshooting of hardware systems for the purpose of maintaining the Defense Information Systems Network Video Services Global facility as well as other VTC (both classified and unclassified) facilities throughout SSC Pacific.

3.11.2. The contractor shall support cryptographic equipment hardware/software installation, firmware upgrades, cryptographic keying material loading, testing, and troubleshooting.

3.11.3. The contractor shall perform communications support for Integrated Services Digital Network, Defense Information Systems Agency (DISA) networks, Defense Collaboration Services (DCS), and commercial interconnects.

3.12. TELEPHONE INFRASTRUCTURE

3.12.1. The contractor shall perform administrative support for telephone and usage infrastructure, as well as system administration support for the telephone voice mail system.

3.12.2. The contractor shall provide software engineering, integration, and development operations support for network registration and telephone infrastructure tools.

3.13. NMCI SUPPORT

3.13.1. The contractor shall support the SSC Pacific NMCI Service Center team in the overall management of NMCI for SSC Pacific. The contractor shall interface with personnel as required to complete NMCI related transactions and requests for end-users at SSC Pacific.

3.14. INFORMATION RESOURCES MANAGEMENT

3.14.1. The contractor shall perform administrative support for the Information Resource

Management team using enterprise-level databases i.e. Defense Application & Database Management System (DADMS)/ DoD IT Portfolio Repository- DON (DITPR-DON) and Navy Enterprise Resource Planning (N-ERP).

3.14.2. The contractor shall ensure Cybersecurity compliance in procurement requests.

3.15. IT REGISTRAR

3.15.1. The contractor shall administrate and manage changes to SSC Pacific’s Lightweight

Directory Access Protocol (LDAP) database, and request and manage soft Public Key Infrastructure (PKI) certificates for unclassified and SECRET servers, systems and designated personnel.

3.15.2. The contractor shall serve as the Trusted Agent (TA) for alternate tokens (hard PKI certificates on Smart Card) for end-users at SSC Pacific.

4. CYBER SECURITY

4.1. Cybersecurity Workforce (CSWF). All CSWF functions to be performed under this contract will be identified at the task order level in the performance work statement. Task order performance work statements will specify, as applicable, CSWF category, level, training, and certification requirements for contractor personnel and will include a requirement for the contractor to provide CSWF certification status and compliance upon hire.

5. TRAVEL

If required, travel requirements will be identified at the task order level.

6. GOVERNMENT FURNISHED PROPERTY/INFORMATION (GFP/GFI)

If required, GFP/GFI will be identified at the task order level.

7. SECURITY

7.1. Security. The security requirement for this tasking will be up to and including Secret. The work performed by the Contractor will include access to unclassified and up to Secret data, information, and spaces. The Contractor will be required to attend meetings classified up to Secret level. The contractor will require access to Communications Security (COMSEC) and the Secure Internet Protocol Router Network (SIPRNet). The contractor shall receive North Atlantic Treaty Organization (NATO) awareness brief and complete the derivative classification training prior to being granted access to SIPRnet; training is provided by the facility security officer.

If foreign travel is required, all outgoing Country/Theater clearance message requests shall be submitted to Commanding Officer, Attn: Foreign Travel Team, Space and Naval Warfare

Systems Center Pacific, 53560 Hull Street, Building 27, 2nd Floor -Room 206, San Diego, CA 92152 for action. A Request for Foreign Travel form shall be submitted for each traveler, in advance of the travel, to initiate the release of a clearance message at least 30 days in advance of departure. Each Traveler must also submit a Personal Protection Plan and have a Level 1 Antiterrorism/Force Protection briefing within one year of departure and a country specific briefing within 90 days of departure. Anti-Terrorism/Force Protection (AT/FP) briefings are required for all personnel (Military, DOD Civilian, and contractor) per OPNAVINST F3300.53C. Contractor employees must receive the AT/FP briefing annually. The briefing is available at https://atlevel1.dtic.mil/at/, if experiencing problems accessing this website contact ssc_fortrav@navy.mil. Forward a copy of the training certificate to the previous email address or fax to (619) 553-6863. SERE 100.1 Level A Code of Conduct training is also required prior to OConus travel for all personnel. SERE 100.1 Level A training can be accessed at https://wwwa.nko.navy.mil. Other specialized training for specific locations may also be required; contact the SSC Pacific foreign travel team. Applicable documents are as follows:

SECNAV Manual 5510.30 (Series), Department of Navy Personnel Security Program, SECNAV Manual 5510.36 (Series), Department of Navy Information Security Program, DOD 5200.01 Volumes 1 through 4 (Series), DOD Security Program, and DOD 5220.22-M (Series), National Industrial Security Program Operating Manual (NISPOM).

7.2. Operations Security (OPSEC). OPSEC is a five step analytical process (identify critical information; analyze the threat; analyze vulnerabilities; assess risk; develop countermeasures) that is used as a means to identify, control, and protect unclassified and unclassified sensitive information associated with U.S. national security related programs and activities.

All personnel working under this task will at some time handle, produce or process Critical Information or Critical Program Information, and therefore all Contractor personnel must practice OPSEC. All work is to be performed in accordance with DoD OPSEC requirements, and in accordance with the OPSEC attachment to the DD254. Applicable documents are as follows: OPNAVINST F3300.53C (Series), Navy Antiterrorism Program, National Security Decision Directive 298 (Series), National Operations Security Program (NSDD) 298, DOD

5205.02 (Series), DOD Operations Security (OPSEC) Program, OPNAVINST 3432.1 (Series), DON Operations Security, and SPAWARINST 3432.1 (Series), Operations Security Policy.

8. OTHER

8.1. Enterprise-Wide Contract Management Application (ECMRA). The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the SSC Pacific via a secure data collection site.

Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities;

(4) D, Automatic Data Processing and Telecommunications, IT and Telecom- Telecommunications Transmission (D304) and Internet (D322) ONLY;

(5) S, Utilities ONLY;

(6) V, Freight and Shipping ONLY.

The contractor is required to completely fill in all required data fields using the following web address: www.ecmra.mil.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk at: www.ecmra.mil.

For the purposes of CMRA reporting, the Federal Supply Code/Product Service Code applicable to the contract is TBD.

9. DATA DELIVERABLES

Reports, technical data, and computer software delivery requirements shall be specified through use of a Contract Data Requirements List, DD Form 1423, at the individual delivery/task order level.