PWS_ 08 May 2026_updated.docx

Performance Work Statement Insider Threat User Activity Monitoring (UAM) Tool

1.0 Background:

The Secretary of War (SecWar) approved an Operations Security (OPSEC) Campaign directing the Department of War Chief Information Officer (DoW CIO), in conjunction with the Under Secretary of War for Intelligence and Security (USW I&S) and the DoD General Counsel to establish a User Activity Monitoring (UAM) pilot. The goal of the activity is to understand the extent of unauthorized disclosures and exfiltration of sensitive/classified information using DoW networks. The UAM tool comprises the continuous and full-time observation and logging of unclassified computer activity by DoW personnel. Services and Agencies are required to participate and independently resource the DoW designated tool set outlined in the “ENHANCED MONITORING PILOT AT THE PENTAGON RESERVATION CONCEPT OF OPERATIONS (CONOPS), NOV 2020.”

As part of the Marine Corps Insider Threat Program, there is a user monitoring capability and system auditing capability requirement to support UAM on the Marine Corps Enterprise Networks (MCEN) the Non-classified Internet Protocol (IP) Router Network (NIPRNet). The UAM information compiled from these sources, integrated with information from various other sources (e.g., human resources, law enforcement, and counterintelligence) supports analysis and response to counter insider threats on the MCEN.

The Marine Corps Insider Threat Program’s UAM is partially fielded. The platform includes the following capabilities:

(a) User Activity Monitoring (UAM)

(b) Behavioral Analytics Platform (User Behavior)

(c) Case Management System

2.0 Objectives:

2.1 The Contractor shall field, operate, and sustain a comprehensive Insider Threat Monitoring System. The overarching system comprises the following component platforms at varying stages of operational readiness:

2.1.1 User Activity Monitoring:

The UAM solution must be maintained to actively maintain compliance and continue to identify, analyze, and prioritize potential insider threats. Maintain all capability necessary to capture user keystrokes, full content from applications (e.g., email, chat), user screen activity, and tracking file movements (file shadowing) across the enterprise network. All data collected must be linked to a specific user.

2.1.2 Behavioral Analytics Platform:

Deploy and sustain (maintain) a fully functional Behavioral Analytics Platform. The foundations of the Behavioral Analytics Platform have been constructed; however, the system is not currently functional and is behind in obtaining its Security Technical Implementation Guide (STIG). The STIG is currently in remediation due to numerous unresolved findings. Resolution is required to bring the system to MCEN standards, so it is compliant with DoD security mandates.

2.1.3 Case Management System:

The Case Management System requires software maintenance to ensure compliance with DoW security mandates. Additionally, the system requires customization and enhancements to meet Government needs.

3.0 Scope:

The scope of this effort encompasses the fielding, enhancement, and full lifecycle technical support of a Protection Level 4 (PL4) commercial-off-the-shelf (COTS) Insider Threat Monitoring system. This integrated system comprises a User Activity Monitoring (UAM) solution, a Behavioral Analytics platform, a Next-Generation Firewall (NGFW), and a Case Management System in support of the United States Marine Corps (USMC) Insider Threat Program (InTP). The Contractor shall provision all necessary hardware, software, application support, and Cybersecurity/Risk Management Framework (RMF) services required to deploy and sustain these capabilities across the Marine Corps Enterprise Network (MCEN) on the Non-classified Internet Protocol Router Network (NIPRNet). Technical implementation boundaries include continuous 24x7x365 monitoring of up to 200,000 endpoints and support for up to [Insert Number] administrative users.

Exclusions: This scope is strictly limited to the technical deployment, infrastructure sustainment, and secure operation of the UAM and analytic systems. It does not include the operational analysis of the collected data, the execution of insider threat investigations, or law enforcement actions.

4.0 Tasks:

4.1 General System Support (all platforms):

4.1.1 The Contractor shall implement a continuous vulnerability management program for all systems supporting InTP. Upon notification or discovery of vulnerability (via automated scans, vendor alerts, STIG\SRG checks or government notification), the Contractor shall apply patches, updates, or approved mitigation strategies within the following strict timeframes:

4.1.2 The Contractor shall provide comprehensive cybersecurity services to execute and manage the Risk Management Framework (RMF) process for all Insider Threat Program (InTP) systems. The Contractor shall ensure full compliance with Department of War (DoW), United States Marine Corps (USMC), and National Institute of Standards and Technology (NIST) security controls.

4.1.3 The Contractor shall facilitate the system through the complete RMF lifecycle, specifically performing all requirements for the six phases: Categorize, Select, Implement, Assess, Authorize, and Monitor.

4.1.4 The Contractor shall develop, update, and maintain the complete Assessment and Authorization (A&A) package. This includes, but is not limited to, the System Security Plan (SSP), Security Assessment Plan (SAP), Security Assessment Report (SAR), and the Plan of Action and Milestones (POA&M).

4.1.5 The Contractor shall maintain and manage all system data, artifacts, and compliance status within the des ignited DoW tool of record (e.g., Enterprise Mission Assurance Support Service (eMASS)).

4.1.6 The Contractor shall act as the primary technical liaison during independent assessments, providing the Security Control Assessor (SCA) Representative with all necessary system access, compliance evidence, and technical responses required to successfully evaluate all managed platforms.

4.1.7 The Contractor will implement and validate Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs) for all operating systems, applications, and network devices.

4.1.8 The Contractor shall review and analyze security vulnerability scans (e.g., Assured Compliance Assessment Solution (ACAS) / Nessus) across all managed systems. The Contractor shall prioritize remediation efforts based on risk severity and formally document all identified false positives or required risk acceptance/waiver requests with comprehensive technical justifications.

4.1.9 Execute a continuous monitoring strategy to ensure the security posture is maintained throughout the system lifecycle, including annual control assessments and incident response reporting.

4.1.10 The Contractor shall ensure all system infrastructure (ESXi, servers, databases, collectors, switches, NGFW) maintains a 99.9% operational uptime during core mission hours.

4.1.11 The Contractor will provide monthly updates to the Marine Corps eMASS system record to include artifacts, diagrams and supporting documents.

4.1.12 The Contractor shall deliver a Monthly Status Report (MSR) detailing a summary of accomplishments achieved during the reporting period, alongside the status of all open, unresolved, and pending issues. Additionally, the report shall include a labor utilization summary, specifying the labor hours expended to date and the remaining balance of allocated labor hours for the current Period of Performance (PoP).

4.1.13 The Contractor shall develop and deliver formal, role-based training to designated personnel to ensure operational proficiency across all implemented systems. This training shall be continuously updated to reflect the current operational configuration and software baselines of the mission environment. The scope of training shall encompass all hardware and software components, specifically including the User Activity Monitoring (UAM) solution, Behavioral Analytics platform, and the Case Management System.

4.1.14 The Contractor shall create, maintain, and deliver comprehensive user manuals encompassing all platforms, ensuring the documentation provides detailed operational guidance for end-users.

4.2 User Activity Monitoring (O&M):

4.2.1 The contractor shall Maintain the UAM solution to actively ensure compliance and continuously identify, analyze, and prioritize potential insider threats on a 24x7x365 basis across the MCEN (NIPRNet).

4.2.2 The contractor shall Sustain the technical capability to accurately capture user keystrokes, full application content (e.g., email, chat), user screen activity, and file movements (file shadowing).

4.2.3 The contractor shall Ensure all collected data remains reliably linked to specific users across the enterprise network, supporting up to 200,000 endpoint clients.

4.2.4 The contractor shall provide engineering, system administration, and technical support necessary to maintain the UAM infrastructure. The scope encompasses:

(a.) UAM servers, ESXI virtual nodes and endpoint Agent health monitoring and deployment.

(b.) Backend server O&M, database management, and storage optimization. UAM rules set configuration, tuning, and policy management in coordination with cyber analysts.

4.2.5 The contractor shall ensure UAM backend infrastructure (servers, databases, collectors) maintains a 99.9% operational uptime during core mission hours. Monitor and remediate UAM endpoint agents. Ensure 95% or greater of active network endpoints are successfully reporting data to the UAM servers.

4.2.6 The contractor shall implement approved changes to UAM detection policies, triggers, and alerts to reduce false positives and enhance threat detection capabilities.

4.2.7 The contractor shall respond to system outages or data flow disruptions. Acknowledge critical outages within 30 minutes and restore service within 4 hours.

4.3 Behavioral Analytics Platform (User Behavior):

4.3.1 The contractor shall provide data science, cyber analytics, and threat hunting expertise to manage and optimize the User and Entity Behavior Analytics (UEBA) environment. The scope includes:

(c.) Triaging anomalous alerts and escalating credible threats.

(d.) Minimizing false positives through continuous threshold adjustments.

4.3.2 The contractor shall configure behavioral models to establish accurate "normal" baselines for users and peer groups. Adjust risk scoring algorithms to accurately reflect Marine Corps InTP mission priorities.

4.3.3 The contractor shall actively monitor UEBA dashboards for high-risk behavioral anomalies (e.g., unusual data exfiltration, lateral movement, or abnormal access times).

4.3.4 The contractor shall analyze alert data to identify systemic false positives and tune detection logic without compromising true positive detection capabilities.

4.3.5 The contractor shall configure the system to evaluate interactions between people, data, devices, and applications. Enable discovery risk scoring, prioritization, and real-time ad hoc analysis functions.

4.3.6 Upon successful deployment, the contractor shall transition the platform to steady-state sustainment, ensuring continuous vulnerability scanning, patching, and STIG compliance.

4.4 Case Management System:

4.4.1 The contractor shall install and baseline configuration of the software stack. Development of automated data pipelines and API integrations. Creation and tuning of operational workflows (e.g., Alert-to-Case automation). Role-Based Access Control (RBAC) and dashboard customization.

4.4.2 The contractor shall develop, test, and integrate the following system enhancements:

(d.) Incorporate data visualization tools (e.g., entity association charts) (define)

4.4.3 The contractor shall maintain and enhance the document management capabilities to compile threat indicator data. Ensure the system meets all National Insider Threat Task Force (NITTF) and NARA recording and retention requirements.

4.4.4 The contractor shall Sustain centralized repository functions, document linking, and strict document security/audit trails to support up to 150 maximum administrative/analyst users.

4.5 Hardware:

4.5.1 NGFW:

(a.) The Contractor shall design, deploy, configure, and maintain NGFW infrastructure across designated Marine Corps InTP network enclaves, ensuring robust perimeter security, deep packet inspection, and compliance with all Marine Corps, DoD/DoW security mandates.

(b.) The Contractor shall provide dedicated lifecycle support for the NGFW infrastructure, ensuring perimeter defense integrity, traffic visibility, and continuous compliance with Marine Corps, DoW cybersecurity mandates.

4.5.2 The contractor shall maintain all associated components of the monitoring tool. This support includes maintenance (e.g. screening for vulnerabilities, patching, updating, installation of licenses, configuration management, etc.) for all associated infrastructure and services, such as servers, network switches, software applications, storage systems (SAN), firewalls, cybersecurity functions, and all activities required to complete the full Risk Management Framework (RMF) assessment and authorization process. All work shall ensure secure, reliable, and compliant IT operations that meet Federal, DoD, and Marine Corps requirements.

4.5.3 Server provisioning and configuration: Install, configure, licenses and maintain physical and virtual servers.

4.5.4 Backup and recovery operations: Implement and maintain automated backup solutions and disaster recovery procedures.

4.5.5. Performance monitoring: Track cpu, memory, storage, and network utilization to ensure optimal performance.

4.5.6 Rack, cable, and power all components: Servers, switches, firewalls and Unity XT storage hardware.

4.5.7 Configure Unity XT storage processors, drive shelves, and back end connectivity.

4.5.8 Create storage pools, RAID groups, and LUNs based on mission requirements.

4.5.9 Manage and maintain storage Unity XT components to include hard drives, controllers and supporting hardware.

4.5.10 The contractor shall install, configure, managed and support Cisco switches supporting InTP systems.

4.5.11 The contractor shall The contractor shall provide network engineering and administration for Cisco switches. Scope includes: Layer 2/3 configuration (VLANs, VTP, Spanning Tree, OSPF/BGP). Implementation of Port Security and 802.1X (Identity Services Engine/ISE integration). Firmware management and IOS/IOS-XE security patching. Physical installation, cabling (Copper/Fiber), and decommissioning. Troubleshoot and resolve any communications issues between InTP systems and network.

4.5.12 The contractor shall provide the technical personnel, tools, and processes required to perform preventive maintenance, emergency break/fix repairs, and component replacements. The scope covers: Physical rackmount servers, virtual hosts, switches, firewalls, storage SAN arrays and physical cabling (copper/fiber).

4.5.13 The contractor shall diagnose and repair failing hardware components (e.g., dead RAM, failed power supplies, degraded RAID drives, faulty switch optics).

4.5.14 Execute Return Merchandise Authorization (RMA) processes with original equipment manufacturers for warranty replacements.

4.5.15 The contractor shall rack, stack, and cable replacement servers, switches, and firewalls. Ensure proper airflow and cable management standards are met.

4.5.16 Remove End-of-Life (EOL) or irreparably broken hardware. Ensure all non-volatile memory and hard drives are physically destroyed or sanitized.

5.0 Deliverables:

5.1 Timely submission of deliverables is essential to successfully completing this requirement. Schedules for deliverables are specified in the Contract Data Requirements List (CDRLs). All deliverables shall be prepared and submitted according to the format, content, and schedule described in CDRL(s).

All under 4.0

Program Manager /Technical Lead

4.1, 4.2, 4.3, 4.4, 4.5, 4.6

Program Manager /Technical Lead

All under 4.1

In Person

Program Manager /Technical Lead

In-person

4.1.14

Program Manager /Technical Lead

4.1.13

Program Manager /Technical Lead

5.0 Place of Performance

The primary worksite will be at a government facility located in Arlington, VA. Travel will primarily be within the NCR but travel to other Marine Corps bases/stations/installations/organizations outside of the NCR may be required.

6.0 Period of Performance

This requirement consists of a twelve-month base year plus four, twelve-month option years.

6.1 Security Requirement

6.1.1 Capability must be configurable to accept updated criteria on an ad hoc bases.

6.1.2 Capability must be compliant and interoperable with the DoD UAM solution set.

6.1.3 Capability must be compliant with all USMC cyber security policies and standards for implementation on the MCEN (NIPRNet) and obtain an Authority to Operate (ATO) prior to implementation for production.

6.1.4 All contractor personnel are required to possess a TS/SCI clearance, must possess and maintain all training and certification required of a MCEN privileged user, and execute a Non‑Disclosure Agreement (NDA).

6.1.5 All Contractor personnel must possess a final favorable T5 investigation and hold the appropriate DoD 8140 (formerly 8570) cyber workforce certification at the time of award.

6.2 Equipment available for contractor use

The Government shall provide adequate working spaces, computers, telephones, utilities, and janitorial services for the duration of this contract; however, vehicles will not be provided. Personal use of Government Furnished Equipment (GFE) for matters not directly related to the required services is strictly prohibited. The Contractor shall not remove any GFE or supplies from the worksite without the express written permission of the COR.

7.0 On-Site Performance

Contractor personnel working on-site shall follow procedures established at each site for ensuring the security of the building, equipment, materials and personnel who are working in and around facilities. During duty hours, Contractor personnel shall keep doors to the outside of facilities secured. When securing facilities at the end of the duty day or after hours, Contractor personnel shall follow established procedures. The Contractor and its employees shall be subject to all traffic, security, and registration regulations for personnel and vehicles.

8.0 Contractor Identification

Contractor employees must be clearly identifiable while on Government property by wearing appropriate badges. Badges must be clearly visible at all times while on Government property and presented for examination upon request from the Contracting Officer, COR, Military Police, or any other Government Official with a need to see the badge. Contractor personnel and their subcontractors must identify themselves as Contractors or subcontractors during meetings, telephone conversations, in electronic messages, or correspondence related to this Contract. In email correspondence with the Government, is should be clear that the employee is a Contractor employee (i.e., annotate in signature block). Contractor-occupied facilities (on Department of the Navy or other Government installations) such as offices, separate rooms, or cubicles must be clearly identified with Contractor supplied signs, name plates or other identification, showing that these are work areas for Contractor or subcontractor personnel.

9.0 Data, Software And Intellectual Property Rights

All data, regardless of format, created, generated, produced or provided under, or as a result of, this contract shall become the property of the U.S. Government/Marine Corps, not the contractor, subcontractor, or individual author or researcher. This data includes reports, materials, data, information, and all electronic/digital files and other PWS related items. The items described herein, and any other items, are hereinafter referred to individually or collectively as the work or works. The Marine Corps shall have the irrevocable, worldwide, royalty-free right to use, modify, reproduce, perform, display, release, or disclose such research, reports, materials and information, and associated intellectual property, in whole or in part, in any manner, and for any purpose whatsoever, and to have or authorize others to do so. The U.S. Government/Marine Corps shall be the owner of all of these works and all intellectual property rights in or to these works. Therefore, any restricted data rights, information, software, materials and/or other items, including the contractor’s or a third-party’s proprietary data, information, software, materials and/or items must not be used under this contract without the specific written approval by the Contracting Officer prior to start of any work.

10.0 Use of Works

Without the prior written permission of the Contracting Officer, no data, materials, information, or other items (hereinafter singularly or collectively “Items”) created or provided expressly for this contract/PWS shall be used by the contractor for any purpose other than those that are in support of, or for performance under, this PWS. The contractor (including its employees and subcontractors) are obligated to protect from unauthorized use or disclosure all Government confidential or classified material and/or Government-owned proprietary, and/or Personally Identifiable Information or Personal Privacy Items obtained in the course of performance under the Government contract, as long as such data remains proprietary, confidential, sensitive, or classified. Any information obtained in the course of duties, or the performance of services, under this contract including, but not limited to, information that may be made available for use that relates to the technical data, trade secrets, processes, operations, style of work, or apparatus, or to the technical data, statistical data, amount or source of any income, profits, losses, or expenditures of any person, firm, partnership, corporation, or association is included in this clause (and with “Items”). Contract personnel shall not publish, divulge, disclose, or make known Items in any manner, or to any extent not authorized by the Contracting Officer. When the contractor’s need for such Items ends, the Items shall be returned promptly (within ten (10) business days) to the appropriate government program personnel. However, the obligation not to discuss, disclose, release, reproduce or otherwise provide or make available such Items, or any portion thereof, shall continue, even after completion of this contract/order. Any actual or suspected unauthorized use, disclosure, release, or reproduction of any Items or violation of this agreement, of which the company or any employee is or may become aware, will be reported promptly (within one business day) to the contractor’s program manager, who will inform the Contracting Officer within five (5) business days of receiving such report.

11.0 Travel Reimbursement

The Contractor shall be reimbursed for travel outside the local area in accordance with the terms of travel reimbursement set forth below. The local area is defined as travel within a 75-mile radius of the Pentagon.

Contractor Request and Approval of Travel. Any travel under this contract must be specifically requested in writing by the Contractor and approved by the COR, prior to incurring any travel expense. The Contractor shall submit the written request to the COR five days in advance. The travel request shall include as a minimum, the following:

Contract number Date, time, and place of proposed travel Purpose of travel and how it relates to the contract Contractor’s estimated cost of travel with a breakdown of the estimated costs of transportation, lodging, meals, and incidentals; and Name(s) of individual(s) traveling.

The COR shall review and approve/disapprove (as appropriate) all travel requests submitted giving written notice of such approval or disapproval to the Contractor.

Travel Reimbursement. The Contractor shall be reimbursed for the reasonable (COR pre-approved) actual cost of transportation, lodging, meals and incidental expenses. However, actual costs shall be considered reasonable, allowable, and reimbursable only to the extent that they do not exceed on a daily basis the maximum per diem rate in effect at the time of travel as set forth in the DOD Joint Travel Regulations located at https://secureapp2.hqda.pentagon.mil/perdiem/. Actual cost does not include handling charges, general and administrative cost, overhead, profit or any other indirect cost.

The Contractor shall use the allowable Government personnel rates for transportation and lodging. Reimbursement for airfare shall not exceed the lowest customary standard, coach, or equivalent airfare quoted during normal business hours. The Contractor will not be reimbursed for travel expenses unless audited records for transportation contain evidence, such as original receipts, substantiating actual expenses incurred for travel. In no event will reimbursement exceed the published rates of common carriers. Expenses for lodging, meals and incidental expenses shall be reimbursed to the Contractor, provided that the overnight stay was documented as necessary.

The contract includes a not-to-exceed funding limitation for travel costs. When the Contractor expects total funding expended for reimbursable travel to reach 85 percent of the total funds available on the travel CLIN, the Contractor shall notify the CO and the COR and any other Government official identified by the CO. The notice shall state the estimated amount of additional funds required to continue performance for the period specified in the contract. The Contractor shall not exceed or incur costs that exceed the amount of funding stated on the reimbursable travel CLIN.

The Government is not obligated to reimburse the Contractor (for travel that was not pre-approved or) for otherwise reimbursable travel in excess of the funded amount stated on the reimbursable travel CLIN.

The Contractor is not obligated to continue performance of any reimbursable work under this Contract or otherwise incur costs for reimbursable travel in excess of the funded amount stated on the reimbursable travel CLIN unless the CO notifies the Contractor in writing that the funded amount stated under the applicable reimbursable travel CLIN has been increased. In the event notification is made orally, such notification shall be followed up in writing within two working days.

No notice, communication, or representation from any person other than the CO shall affect the Government’s obligation to reimburse the Contractor.

Change orders shall not be considered an authorization to exceed the funded amount stated under the reimbursable travel CLIN unless they contain a statement expressly increasing the funded amount of that reimbursable CLIN by a sufficient amount to cover the change order.

12.0 Contractor Status Meetings

The contractor shall plan and conduct quarterly contract status meetings. The primary purpose of these meetings is to review contract performance status and address contract-related issues.

These meetings are expected to last no longer than 1 hour. At a minimum, the meeting will include appropriate contractor representative(s), the contracting officer, the contracting officer’s representative (COR), and Government technical personnel, as appropriate; however, the contracting officer may choose to include other Government attendees.

This meeting will be held via a phone conference call or Teams. The contractor is responsible for setting up the phone conference facilities or contacting the Government to set up a Teams meeting.

Each meeting will cover the following topics, as appropriate:

Contract Performance Status

· Status of contract deliverables/tasks (updates since last meeting)

· Performance issues encountered or expected (e.g., potential delays)

· Required Government actions (e.g., delivery of Government Furnished Information and/or Property)

· Compliance with staffing / key personnel requirements

· Discussion on contractor performance against QASP metrics Other Items

· CLIN-related issues. For cost and T&M CLINs, address funding status (FAR 52.232-20, FAR 52.232-22). For incrementally funded fixed price CLINs, address funding status (DFARS 252.232-7007).

· Address new or in process modifications, requests for out-of-scope work, requests for equitable adjustment, claims, or disputes

· Clause compliance (e.g., FAR 52.245-1, Government Furnished Property; FAR 52.219-9, Small Business Subcontracting Plan)

· Invoice submission and payment status

· Contractor Performance Assessment Report System (CPARS) status (FAR 42.15)

· Continuous improvement ideas for current contract and/or future contract

DISTRIBUTION: DoW COMMUNITY ONLY

DISTRIBUTION: DoW COMMUNITY ONLY