Performance Work Statement_Enterprise Systems Security Support Services.docx

PERFORMANCE WORK STATEMENT (PWS)

PRECISE TIME AND ASTROMETRY TRANSPORT SECURITY AND MAINTENANCE CONTRACT

UNITED STATES NAVAL OBSERVATORY (USNO)

1.0 INTRODUCTION

The USNO is the sole provider of Precise Time and Astrometry (hereinafter, “PTA”) data products to the DoD under Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 4650.01H and DoD Instruction (DoDI) 4650.06. PTA data products include Precise Time (hereinafter, “PT”) and time dissemination tools, Celestial Reference Frame (hereinafter, “CRF”) data products and applications, and Earth Orientation Parameters (EOPs). These products are critical to navigation for any DoD system, and, most importantly, the United States Global Positioning System (hereinafter, “GPS”). The security and integrity of the transport systems from which these systems disseminate data is paramount, requiring 24/7 monitoring, life cycle replacement, and regular sustainment activities

The purpose of this contract is to obtain the infrastructure and services required to build and sustain security services that ensure the integrity and availability of PTA Enterprise systems. In addition to the hardware and software required for the security infrastructure, the services requested herein will require timing transport engineers, observatory control engineers, cyber security operators, and project specialist experts to provide technical support, cyber monitoring, and operations and maintenance support for PTA dissemination systems.

2.0 SCOPE

The contractor services and hardware/software procurements shall fall within the scope of work delineated herein. Services to be furnished under this contract shall be set forth in individual Tasks Orders. It shall be the responsibility of the Contractor to organize, furnish, and supervise a working force which, within the limitations of the provisions of the proposed contract, is capable of effectively performing the work as established in paragraph 3.0 and further defined in the individual Task Orders (TO) and supporting PWS. It shall be the responsibility of the Contractor to ensure all contractors possess the specialized education and experience specified under personnel qualifications in Section C of this document and as identified in the task order issued. The Contractor shall notify the Contracting Officer’s Representative (hereinafter, “COR”) promptly with hiring status and changes of personnel for each TO.

3.0 TECHNICAL REQUIREMENTS

The Contractor shall provide infrastructure and manpower for support in the disciplines of transport engineering, cyber security, cyber engineering, Supervisory Control and Data Acquisition (hereinafter, “SCADA”) management, instrumentation engineering, and computer sciences. Work shall be in accordance with tasks such as the following as ordered on individual task orders for specified PTA research, engineering or operations and maintenance projects.

3.1 Technical Services Requirements

3.1.1 Implement, operate and maintain PTA transport systems capable of meeting the requirements in Section 3.2.

3.1.2 Collect, develop, and analyze transport and SCADA data for cyber security and readiness with hardware meeting the requirements outlined in Section 3.3. Supply the necessary skillsets to monitor and interpret the data.

3.1.3 Design, develop, and deploy SCADA control hardware. Supply the necessary skillsets to analyze and monitor data

3.1.4 Review, analyze and document specific operational procedures; and/or perform feasibility studies.

3.1.5 Develop and maintain cyber security monitoring infrastructure. Provide the necessary skillsets and hardware to perform cyber screening, incident detection and response, and risk assessments. Hardware shall adhere to the requirements in section 3.3.

3.1.6 Assist in the design, development and maintenance of PTA-specialized Internet and Intranet web sites.

3.1.7 Design, develop, test computer software, models, and/or develop computer libraries and databases.

3.1.8 Lend expertise, assistance, guidance and/or coordination services for all engineering, maintenance, monitoring, computer science or project management activities

3.2 Transport Maintenance and Sustainment Requirements

3.2.1 The system maintenance and sustainment shall ensure availability greater than 99.999%

3.2.2 The system maintenance and sustainment activities shall ensure data backup capability and capability to recover backed up data

3.2.3 The system maintenance and sustainment shall include cyber and resource monitoring

3.2.4 The system maintenance and sustainment activities shall meet the requirements for Navy Risk Management Framework as required by DoDI 8510.01 and defined by the U.S. Navy Risk Management Framework Process Guide can be found at: https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/851001p.pdf

3.2.5 The system maintenance and sustainment shall include monitoring, controlling, and securely operations of remote telescopes and instrumentation

3.2.6 The system maintenance and sustainment shall provide compute stability of 0.5 nanoseconds

3.2.7 The system maintenance and sustainment shall include time dissemination hardware that meet the requirements in 3.2.1- 3.2.6

3.3 Security Monitoring Hardware Requirements

3.3.1 Security monitoring system shall be mobile with dimensions no greater than 24 x 14 x 9 inches

3.3.2 Security monitoring system shall be Electromagnetic Pulse (EMP) protected

3.3.3 Security monitoring system shall be capable of modeling system architecture

3.3.4 Security monitoring system shall be capable of modeling data, data dissemination and data acquisition traffic

3.3.5 Security monitoring system shall be capable of alerts within 60 seconds of detection

3.3.6 Security monitoring system shall incorporate a Machine Learning Artificial Intelligence (MLAI) framework for monitoring network traffic

3.3.7 Security monitoring system shall be fully integrated with a Security Information Event Management Solution (SIEMS)

3.3.8 Security monitoring system shall incorporate gray-space tools for network traffic analysis

3.3.9 Security monitoring system shall be capable of system and memory forensics

The Government may provide technical guidance to contractors providing these services. As used herein, technical guidance includes the amplification of the specifications of a particular piece of work and the furnishings of relevant information needed for performance, which fills in details, supports possible avenues or methods of approach, or outlines alternate solutions. In no instance will either Navy civilian or military personnel exercise supervision of the employed contractor personnel.

4.0 PERSONNEL QUALIFICATIONS

The Contractor SHALL be required to provide the labor categories identified below that possess the appropriate education requirements for each class.

1) The labor categories required for this contract are: PTA IP Transport Engineer, PTA RF Transport Engineer, Risk Management Framework (RMF) Analyst, Program Manager, SCADA Infrastructure Engineer, Physical Security Engineer, Technical Writer, and Security Operator. The labor categories are defined as

a) Precise Time and Astrometry IP/RF Transport Engineer: Provides technical knowledge, and tool development for the dissemination of time and astrometry data products. Tools and dissemination methods may be IP based, or Radio Frequency based, requiring engineering skillsets in either subject matter. This position will be used to help scientists develop engineering solutions to accurately, reliably, and securely disseminate data products to the DoD and public.

b) Risk Management Framework Analyst: Provides technical knowledge in the subject area of Navy Risk Management Framework. Familiar with NIST 800-171 compliance on which Navy RMF guidelines are based. Technical skills in timing astronomy, and PTA dissemination systems to support RMF artifact development and compliance.

c) Program Manager: provides services related to outlining objectives, planning execution, and managing operations of some of USNOs aerospace, astronomy, physics and engineering programs. Program Specialist may also provide some SME to government scientists and managers as they relate to specific large programs. Program Specialist may assist with program planning and execution, including scheduling and budgeting.

d) SCADA Infrastructure Engineer: Provides technical skills and subject matter expertise in environmental and cyber security to evaluate and perform maintenance on systems that support scientific applications. This position will be used to monitor and test Supervisory Control and Data Acquisition (SCADA) systems supporting scientific applications, to ensure the safety and security of the scientific applications from both a physical and cyber perspective.

e) Physical Security Engineer: Provides technical skills and subject matter expertise in physical security based on NIST 800-171 compliance. This position will be used to assess and monitor the site physical infrastructure. Requires experience with DoD and Navy physical security policy.

f) Technical Writer: Provides written documentation for technical timing, astronomy, and PTA dissemination policy, standard operating procedures, requirements documents, and other technical material required for records management, normal operations, and program management.

g) Security Operator: Provides technical skills and subject matter expertise cyber security operations to evaluate systems status, assess risk, and address incidents. This position will be used to monitor and test Supervisory Control and Data Acquisition (SCADA) systems, IP and RF PTA transport systems to ensure the safety and security of the scientific applications from a cyber perspective.

2) Within each labor category, the contractor must be able to provide qualified employees with Junior, Senior, Master or Principal levels of experience. The Junior, Senior, Master or Principal classifications are defined as:

a) Junior: Contractor with Bachelor’s degree in any field or at least 3 years of experience in relevant field. Masters degrees and Ph-Ds in relevant field with no experience also qualify.

b) Senior: Contractor with 6 years’ experience, or Bachelor’s degree with at least 3 years of experience or Master’s degree or PhD in relevant field with 2 years of experience. For Master’s and Ph-D levels relevant work performed during completion of degree can count as experience.

c) Masters: Contractor with 10 years’ experience or Bachelor’s degree in any field with at least 5 years of experience in relevant field, or Master’s degree or PhD in relevant field with at least 3 years of experience.

d) Principle: Contractor with 15+ years’ experience or Bachelor’s degree in any field with at least 10 years of experience, or Master’s degree or PhD in relevant field with at least 7 years of experience in relevant field.

3) All On-site support shall attain and maintain site IA compliance utilizing Risk Management Framework (RMF) and SECNAV M-5239.2.

5.0 SECURITY

4.1 All contractors under this contract will be required to obtain and uphold a Secret Clearance. Some positions will require up to Top Secret Security Clearances with SCI tickets (TS//SCI clearance). Clearance requirements will be specified in individual task.

4.2 Access to Personally Identifiable Information (PII) will be required and training related to PII will be required and provided by the government.

4.3 USNO security requirements automatically limit employment to U.S citizens.

4.4 Employees will be required to submit a Standard Form 87A (SF-87A) Fingerprint Card, and receive a favorably adjudicated background investigation. Any determination that is "other than favorable," or "undetermined" will render any employee ineligible for access to the USNO.

6.0 TRAVEL

Travel will be reimbursed in accordance with the Joint Travel Regulations (JTR) and Federal Acquisition Regulations (FAR) 31.205-46.

Travel expenses will be cost reimbursable under the Not to Exceed (NTE) Travel CLIN. The Contractor shall request travel funding in writing to the COR. All travel must be approved by the COR at least 30 business days prior to any travel. The request shall contain, at a minimum:

(1) Name(s) of individual(s) traveling

(2) Date, time, and place of proposed travel

(3) Purpose of travel

(4) A breakdown of estimated travel and per-diem charges The costs for travel, subsistence, and lodging shall be reimbursed to the Contractor only to the extent as defined in this paragraph. The costs for travel, subsistence, and lodging shall be reimbursed to the Contractor in accordance with the JTR.

7.0 MATERIALS

The Government will fund the purchase of materials by the contractor, on a Firm Fixed Price (FFP) basis, that are identified in an individual TO. The contractor shall not purchase materials without the prior written approval of the COR. The Government will not pay the contractor for any materials not identified in an individual TO or purchased without the prior written approval of the COR.

7.1 Equipment

1) The contractor shall obtain approval from the COR prior to the purchase of any equipment. Equipment such as laptops, switches, firewalls, servers, aggregators, premise edge transport, out of band system, core distribution and software licenses in performance of this contract are inclusive of any indirect charges including G&A. All equipment requirements related to this PWS shall be accounted for in total, represented in the base contract.

7.2 Monitoring kits

1. All kit requirements related to this PWS shall be accounted for in total, represented as individual in the base contract.

a. Cybersecurity Infrastructure Systems (CIS)-A, CIS-B, CIS-C: Infrastructure monitoring configurations with varying server capacities and network throughput capabilities designed for permanent installation cybersecurity oversight of critical systems

b. Cybersecurity Field Deployable Systems (CFDS)-A, CFDS-B, CFDS-C: Field-deployable configurations optimized for tactical edge operations with enhanced mobility features and rapid deployment capabilities for forward-positioned security monitoring

c. Multi-Classification-Domain-Infrastructure System-20-12-A, -B: Specialized configurations designed for multi-domain security environments requiring compartmentalized processing capabilities and cross-domain threat correlation

8.0 PLACE OF PERFORMANCE

The primary place of performance for contractors working on specific USNO TO will be at USNO, 3450 Massachusetts Avenue NW, Washington DC, 20392-5420. However, the contractor may work at a different sites, to be specified in individual TOs which include but not limited to: Honolulu, HI,, Cerro Tollo, Chile, Albuquerque, NM, Denver, CO and Flagstaff, AZ.

9.0 GOVERNMENT PROPERTY

The following Government items shall be made available for employees who worked on-site at USNO in accordance with FAR 45.000(b)(5): office space and office furnishing together with equipment and supplies necessary for the PWS will be provided. Equipment may include access to such items as computers, department and laboratory instruments, and supplies.

10.0 REPORTS AND DELIVERABLES

Management Reports. The following report shall be required as a minimum:

Monthly Task Detail Report. To include delivery order numbers, work sponsor names and codes, begin/end dates of tasks, name of employees on each task, total hours remaining and hours allotted on each task, and a year to date total of money and hours used thus far on the contract. This report shall be due no later than the 10th of each month.

11.0 COMBATTING TRAFFICKING IN PERSON (CTIP)

The Department of Defense (DOD) has a zero tolerance policy regarding trafficking in persons. FAR Subpart 22.17: Prescribes overall federal regulation implementing 22 U.S.C. 7104 which applies to all acquisitions. Requires government contracts to (a) Prohibit contractors, contractor employees, subcontractors, and subcontractor employees from engaging in trafficking in persons during the period of performance of the contract.

12.0 CONTRACTOR ACCESS TO FEDERALLY CONTROLLED FACILITIES AND/OR UNCLASSIFIED SENSITIVE INFORMATION OR UNCLASSIFIED IT SYSTEMS

Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The Deputy Secretary of Defense Directive-Type Memorandum (DTM) 08-006 - "DoD Implementation of Homeland Security Presidential Directive- 12 (HSPD-12)" dated November 26, 2008 (or its subsequent DoD instruction) directs implementation of HSPD-12. This clause is in accordance with HSPD-12 and its implementing directive.

APPLICABILITY

This clause applies to contractor employees requiring physical access to any area of a federally controlled base, facility or activity and/or requiring access to a DoN or DoD computer/network/system to perform certain unclassified sensitive duties. This clause also applies to contractor employees who access Privacy Act and Protected Health Information, provide support associated with fiduciary duties, or perform duties that have been identified by DON as National Security Position, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance. Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Navy Command's Security Manager upon arrival to the Navy Command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

ACCESS TO DOD IT SYSTEMS

In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity's Command Information Assurance Manager. Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) which is a higher level investigation than the National Agency Check with Law and Credit (NACLC) described below. Due to the privileged system access, a SSBI suitable for High Risk public trusts positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy Command's Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-Ni therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the "supervisor".

The SAAR-N shall be forwarded to the Navy Command's Security Manager at least 30 days prior to the individual's start date. Failure to provide the required documentation at least 30 days prior to the individual's start date may result in delaying the individual's start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. The Contractor's Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

INTERIM ACCESS

The Navy Command' s Security Manager may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified, classified or Top Secret computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor's Security Representative. Within three workdays after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor's Security Representative. The Contractor's Security Representative shall be the primary point of contact on any security matter. The Contractor's Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE DUTIES

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Navy recognizes contractor employees under this contract as Non-Critical Sensitive [ADP/IT-II] when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified by DON as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The NACLC consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

• SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product)

• Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

• Original Signed Release Statements

Failure to provide the required documentation at least 30 days prior to the individual's start date shall result in delaying the individual's start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The Contractor's Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the Navy Command's Security Manager upon arrival to the Navy command and shall out process prior to their departure at the completion of the individual's performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy Command's Information Assurance Manager. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command's Security Manager at least 30 days prior to the individual's start date. Failure to provide the required documentation at least 30 days prior to the individual's start date shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the Navy Command Security Manager. The Navy Command's Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM). Suitability/security issues identified by the Navy may render the contractor employee ineligible for the assignment. An unfavorable determination made by the Navy is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Navy Command's Security Manager will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DON Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) or a hard copy VAR directly from the contractor's Security Representative. Although the contractor will take JPAS "Owning" role over the contractor employee, the Navy Command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT Position Category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee's performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO OR PERFORMING NON-SENSITIVE DUTIES

Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc ...) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

· Must be either a US citizen or a US permanent resident with a minimum of 3 years legal residency in the United States (as required by The Deputy Secretary of Defense DTM 08-006 or its subsequent DoD instruction) and

· Must have a favorably completed National Agency Check with Written Inquiries (NACI) including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the Contractor's Security Representative must submit for all employees each of the following:

• SF-85 Questionnaire for Non-Sensitive Positions

• Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

• Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably completed National Agency Check with Written Inquiries (NACI) or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM

Failure to provide the required documentation at least 30 days prior to the individual's start date may result in delaying the individual's start date.

* Consult with your Command Security Manager and Information Assurance Manager for local policy when IT-III (non-sensitive) access is required for non-US citizens outside the United States.