PWS.pdf

Technical POC Signature / Date

Version: 15 July 2024

PERFORMANCE WORK STATEMENT

FOR

C5ISRT NEXT GENERATION CYBERSECURITY AND INFORMATION ASSURANCE

1.0 SCOPE

The Naval Surface Warfare Center, Panama City Division (NSWC PCD), through its C5ISRT Division, is responsible for the cybersecurity of a large and diverse portfolio of mission-critical systems. This portfolio supports a wide range of stakeholders, including OPNAV N95, PMW 130, PMW 150, PMW 160, PMW 170, PMW 770, PMW 790, PMS 406, PMS 408, PMS 420, PMS 385, PMS 485, PMS 495, USFFC-NECC, USFFC-NSW, NCIS, PAE Mission Systems, PAE Maritime, PEO Ships, Amphibious Assault and Connectors Program, PEO Digital, Office of Naval Research (ONR) Transportation Security Administration (TSA), Air Force, Army, Coast Guard, and Marine Corps.

The complexity and persistent evolution of modern cyber threats necessitate specialized technical expertise to supplement the existing government workforce. The operational landscape demands a strategic evolution beyond traditional, static compliance models toward a dynamic, threat-informed, and resilient Cyber Ready posture. This forward-leaning approach is essential to guaranteeing the confidentiality, integrity, and availability of all designated Department of Defense (DoD) information systems, networks, and data, thereby ensuring mission assurance in the face of sophisticated adversaries. This Performance Work Statement (PWS) outlines the expert contractor support required to meet these critical defense objectives.

The Contractor shall provide all qualified personnel, supervision, and services required to execute a comprehensive, full-lifecycle cybersecurity program. This effort encompasses all C5ISRT systems, networks, applications, and data across all operating environments, including on-premises data centers, cloud platforms, and the tactical edge. The scope requires a proactive "secure-by-design" philosophy, focusing on operational risk management, cyber survivability, and the seamless integration of security into all phases of the system lifecycle.

The services to be performed include, but are not limited to, strategic advisory, policy and risk analysis, security engineering and architecture, threat intelligence, advanced vulnerability management, proactive security operations, compliance auditing, and workforce training. This program supports a wide range of critical systems and initiatives executed for NSWC PCD as well as for the key stakeholders mentioned above.

The work is organized into the following principal performance areas:

Cybersecurity Assurance and Risk Management: Providing expert support for all Assessment and Authorization (A&A) functions and sustaining a risk management program aligned with the Risk Management Framework (RMF) and the strategic principles of the Cybersecurity Risk Management Construct (CSRMC). A primary focus is the execution of all RMF steps with the strategic goal of achieving and maintaining a state of Continuous Authority to Operate (cATO). This includes developing and maintaining all authorization artifacts (e.g., SSP, SAP, SAR, POA&M), managing the system portfolio within eMASS, and providing expert guidance on control implementation, reciprocity, and risk acceptance to government leadership.

Cybersecurity Compliance and Continuous Monitoring: Conducting continuous, threat-informed vulnerability assessments to maintain near real-time awareness of the enterprise security posture. This requires the expert operation of tools such as the Assured Compliance Assessment Solution (ACAS) and Host-Based Security System (HBSS). The Contractor shall analyze scan results, correlate findings with threat intelligence, validate remediation actions, and provide detailed reporting on compliance with all applicable DISA STIGs, IAVM directives, and USCYBERCOM orders. The goal is to move beyond periodic scanning to a state of persistent monitoring and automated compliance verification.

Cybersecurity Sustainment and DevSecOps Implementation: Engineering and delivering robust security solutions to the fleet with a focus on minimizing the operational burden on the warfighter. The Contractor shall embed automated security tools and processes directly into development and deployment pipelines (DevSecOps) to enable the secure and rapid delivery of capabilities. This includes managing patch repositories, developing secure baseline images and deployment scripts, and providing technical support for the delivery of critical updates to fielded NSWC PCD portfolio systems such as JEXC2 FoS and MDAP.

Cybersecurity Engineering and Innovation: Architecting, implementing, and sustaining advanced security solutions that anticipate future threats and align with DoD strategic imperatives. The Contractor shall provide subject matter expertise in the design and implementation of a Zero Trust Architecture (ZTA) solution. This includes researching, prototyping, and integrating innovative technologies such as AI-driven defense mechanisms, Security Orchestration, Automation, and Response (SOAR) platforms, and advanced continuous monitoring tools. The Contractor shall lead the development of technical solutions and architectural changes driven by new cybersecurity requirements, ensuring that security is an enabler of mission objectives.

1.1 Acronym List

Following is a list of acronyms used in this PWS.

Acronym Definition A&A Assessment and Authorization

ACAS Assured Compliance Assessment Solution

AI Artificial Intelligence

ASR Annual Security Review

BIA Business Impact Analysis

CAC Common Access Card cATO Continuous Authority to Operate

CCNA Cisco Certified Network Associate

CDRL Contract Data Requirements List

CE Continuing Education / Computing Environment

CISSP Certified Information Systems Security Professional

CL/CE Continuous Learning/Continuous Education

CMMC Cybersecurity Maturity Model Certification

CONUS Continental United States

COR Contracting Officer's Representative

CORA Cyber / Command Operational Readiness Assessment

CSRMC Cybersecurity Risk Management Construct

CSWF Cybersecurity Workforce

CUI Controlled Unclassified Information

CWF Cyberspace Workforce

DCWF DoD Cyberspace Workforce Framework eMASS Enterprise Mission Assurance Support Service

ESS Endpoint Security System

FAR Federal Acquisition Regulation

GFI Government Furnished Information

GFP Government Furnished Property

HBSS Host-Based Security System

IA Information Assurance

IAM Information Assurance Management

IASE Information Assurance Support Environment

IAT Information Assurance Technical

IAVM Information Assurance Vulnerability Management

ISA Interconnection Security Agreements

ISCM Information Security Continuous Monitoring

IT Information Technology

JAWS JEXC2 Artifact Web Server

JECS Joint Expeditionary Cloud Services

MDE Microsoft Defender Endpoint

ML Machine Learning

MOU/A Memoranda of Understanding/Agreement

NATO North Atlantic Treaty Organization

NMCI Navy and Marine Corps Intranet

OCONUS Outside the Continental United States

ODC Other Direct Cost

ONR Office of Naval Research

PCO Procuring Contracting Officer

PII Personally Identifiable Information

PIT Platform Information Technology

PM Program Manager

POA&M Plan of Action and Milestones

PPSM Ports, Protocols, and Services Management

PRA PIT Risk Approval

QAPP Quality Assurance Program Plan

QMS Quality Management System

RCA Root Cause Analysis

RHSA Red Hat System Administrator

RMF Risk Management Framework

SAC Specialty Area Code

SAP Security Assessment Plan

SAR Security Assessment Report

SCRM Supply Chain Risk Management

SIPRNET Secret Internet Protocol Router Network

SOAR Security Orchestration, Automation, and Response

SOFA Status of Forces Agreements

SRG Security Requirements Guides

SSP System Security Plan

STIG Security Technical Implementation Guides

TAV Technical Assist Visit

TSA Transportation Security Administration

TWMS Total Workforce Management Services

VSE Virtual Secure Enclave

WRC Work Role Code

ZTA Zero Trust Architecture

2.0 APPLICABLE DOCUMENTS

The following documents, of the exact issue shown, form a part of this Performance Work Statement (PWS) to the extent specified herein. In the event of conflict between the documents referenced and the contents of this PWS, the PWS shall take precedence. Second tier and lower references, (i.e., those referenced in the primary references) shall be used for guidance only.

2.1 Military Specifications: None

2.2 Military Standards: None

2.3 Other Documents:

(a) DoD Instruction 8500.01 (“Cybersecurity”) Change 1

(b) DoDI 8510.01 (“Risk Management Framework”)

(c) DoDD 8140.01 and DoD 8570.01-M (Cyberspace and Cybersecurity Workforce Management)

(d) NIST Special Publications (SP 800-37, SP 800-53, SP 800-171, SP 800-172)

(e) Cybersecurity Maturity Model Certification (CMMC) (as applicable to the contractor environment)

(f) Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs)

(g) All applicable Information Assurance Vulnerability Management (IAVM) directives and USCYBERCOM orders (CTOs, WARNORDs, EXORD, OPORD, etc.)

(h) DoD CIO Cybersecurity Risk Management Construct (CSRMC) and its Foundational Tenets

NOTE: Military Specifications, Standards, and Handbooks are available from:

https://assist.dla.mil/online/start/. JEXC2 documents provided with the solicitation. ERP desk guide(s) are available from: https://www.erp.navy.mil/.

3.0 REQUIREMENTS

(a) The Contractor shall assume responsibility for this task order within 45 calendar days after award to include assuming responsibility for any Government Furnished Property (GFP) and hiring personnel. Within ten days of contract award, the Contractor shall provide a transition plan annotating the timeline for acquiring the GFP and hiring personnel that are certified in accordance with this PWS. (CDRL A001).

(b) The Contractor shall ensure that employees shall communicate in and understand the English language and shall be United States (U.S.) citizens prior to being admitted to a Government facility. Contractor employees shall conduct themselves in a proper, efficient, courteous and businesslike manner. The Contractor shall remove from the site any individual whose continued employment is deemed by the Government to be contrary to the public interest or inconsistent with the best interests of National Security.

(c) The Contractor shall ensure all new employees are fully trained and certified to meet functional position requirements. For Government mandatory training (i.e. Safety, Personally Identifiable Information (PII), etc.)

the Contractor shall ensure all Contractor personnel working onsite in a Government facility are registered in the U.S. Navy Total Workforce Management Services (TWMS) website at https://twms.navy.mil/selfservice/login.asp. The Government will identify mandatory training through this website and the Contractor shall monitor and ensure that Contractor employees complete required mandatory training requirements by the required completion dates. The Contractor shall provide the following information for each employee that will be working onsite at a Government facility in the Transition Plan (CDRL A001):

Employees Last Name, First Name (No nicknames); Reporting Date, Contract Number, Job Title and the Government Contracting Officers Representative (COR) Organization Code. The Contractor shall document changes to this list (additions or departures) and training completion tracking information in the task order Contract Status Report.

Any additional onsite training in the support of NSWC PCD specific application problems will be provided by the Government as required. When additional training is required or specifically requested by the Government, the costs associated with attending this training shall be approved by the Procuring Contracting Officer (PCO) via a Technical Instruction (TI) and purchased under the Other Direct Cost (ODC) line items for the task order.

(d) Cyber Information Technology (IT) /Cybersecurity Workforce (CSWF) – the Contractor shall identify any personnel assigned to work on the contract that are considered part of the CSWF as defined in DoD Directive

8140.01 in the Transition Plan (CDRL A001) by providing the information required by paragraph (c) above.

The Contractor shall ensure all CSWF personnel are registered in the U.S. Navy Waypoints website at https://don.csod.com/LMS/catalog/Welcome.aspx. The Government will identify mandatory CSWF training through this website and the Contractor shall monitor and ensure that Contractor employees complete required mandatory training requirements by the required completion dates.

CSWF personnel may be required to complete additional training outside of Waypoints. The Contractor shall document changes to the CSWF list (additions or departures) and provide CSWF training and certification tracking information in the task order Contract Status Report.

(1) Cyberspace Qualifications

Per “DFARS 252.239-7001, Information Assurance Contracting Training and Certification” all personnel performing cyber functions must be trained and qualified. In addition, personnel shall maintain the appropriate security clearance per SECNAV M-5510.30C to perform the tasks associated with their assigned positions.

Note: DFARS uses Information Assurance (lA) which is the old title and acronym; it has been replaced by Cyberspace Workforce (CWF).

All positions with cyber functions, whether primary or as additional/embedded duties, shall have an Information Assurance category and level identified on each TI or applicable matrix in the PWS.

The contractor is required to:

1. Earn and maintain appropriate baseline certification as identified in DOD 8570.01-M for the position and tasking being performed prior to the period of performance.

2. If privileged access is required, the contractor shall complete a privileged access agreement, SECNAV 5239/1, and submit it to the COR. Contractors must obtain the applicable operating system/computing environment training within six months of the CWF Program Manager (PM) signature on the privileged agreement or the account(s) will be suspended. A copy of the certificate of completion shall be provided to the

COR.

Unless expressly provided for in the TI, all responsibility for training that is required for the contractor to maintain a specific expertise, commercial certification, or continuous learning is the sole responsibility of the contractor employee and or the contractor’s employer.

(2) Cyberspace Reporting

The contractor shall provide a list of all personnel assigned to the TI performing cyber functions as a part of the monthly CWF Report. The report shall include employee name, TI#, the applicable Information Assurance category/specialty and level (see PWS or TI), required certifications and fulfillment status.

New hire information for tasking requiring cyber functions shall be submitted to the COR at least 7 days prior to employee beginning performance of any cyber functions. New hire information shall include name, TI#, list of applicable cyber functions category, level, required certifications and fulfillment status to include a copy of the baseline certification documentation. Per DFARS 252.239-7001(c), “Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.” and therefore may not be allowed to charge to the Task Order.

(3) CWF Report (CDRL A002)

The contractor shall provide a list of all CWF personnel assigned to PWS, TIs with a CWF functions as a part of the Monthly CWF Report. The monthly report of the contractor CWF personnel shall be provided to the COR and CWF PM to include, at a minimum:

Person’s name, Contract Number, TI/TO#, Person’s assigned labor category, if applicable, Information Assurance Technical (lAT)/ Information Assurance Management (IAM)/ Information Assurance Support Environment (IASE) category and level

CWF Specialty Area Code (SAC) - optional

CWF Work Role Code (WRC) - optional

Status of person’s individual baseline certification(s)/fulfillment, and renewal date.

Updates for new OS/CE, if applicable.

Continuous Learning/Continuous Education (CL/CE) Status

(e) This requirement shall be principally performed at the Government’s facility located at:

Naval Surface Warfare Center Panama City Division 110 Vernon Avenue Panama City, FL 32407-7001

The Government will provide space for up to 10 Contractor personnel in office or working spaces each with a phone and Navy and Marine Corps Intranet (NMCI) computer with network connection. The Government will also supply the consumables for the stated equipment such as paper, toner cartridges, etc. The specific workspace location(s) will be provided at the time of award. The Contractor shall provide a list of employees who require access to these areas, including standard security clearance information for each person to the COR no later than thirty business days after the date of award. The workspace provided to the Contractor personnel shall be identified by the awardee, with appropriate signage listing the company name and individual Contractor employee name. Contractor management is responsible for establishing work hours for Contractor staff that meets the Government’s requirements for coverage.

When a Government facility is closed or early dismissal of Federal employees is directed due to severe weather, a security threat, or a facility-related problem that prevents personnel from working, on-site Contractor personnel regularly assigned to work at that facility should follow the same reporting or departure directions given to Government personnel. The Contractor shall not direct charge to the contract for time off, but shall follow parent company policies regarding taking leave (administrative or other). Non-essential Contractor personnel, who are not required to remain at or report to the facility, shall follow their parent company reporting policy. Subsequent to an early dismissal and during periods of inclement weather, on-site Contractors should monitor radio and television announcements before departing for work to determine if the facility is closed or operating on a delayed arrival basis.

When Federal employees are excused from work due to a holiday or a special event (that is unrelated to severe weather, a security threat, or a facility-related problem), on-site Contractors may continue working established work hours off-site or take leave in accordance with parent company policy. Those Contractors who take leave shall not direct charge the non-working hours to the Task Order.

Contractors are responsible for predetermining and disclosing their charging practices for early dismissal, delayed openings, or closings in accordance with the Federal Acquisition Regulation (FAR), applicable cost accounting standards, and company policy. Contractors shall follow their disclosed charging practices during the Task Order period of performance, and shall not follow any verbal directions to the contrary. The Contracting Officer will make the determination of cost allowability for time lost due to facility closure in accordance with FAR, applicable Cost Accounting Standards, and the Contractor’s established accounting policy.

(f) Contractor-operated vehicles shall meet the following criteria:

The company name shall be displayed on each of the Contractor's vehicles in a manner and size that is clearly visible. All vehicles shall display a valid state license plate that complies with State Vehicle Code. Vehicles shall meet all other requirement of the State Vehicle Code, such as safety standards, and shall carry proof of insurance and state registration.

The Contractor shall mark all Government Furnished Vehicles “Contractor operated” in one and one-half inch (1 ½”) lettering. The color of the marking shall be distinguishable from the base vehicle color and match other vehicle markings, and in close proximity to the USN number.

Contractor personnel shall not utilize cellular telephones or personal devices while operating Contractor-furnished equipment or vehicles or personal owned vehicles on Government property.

(g) Contract Management

The Contractor shall provide management for administration and technical supervision of Contractor employees in the performance of Task Orders issued under this contract. The management team shall be the Contractor’s primary representative(s) and have the Contractor’s full authority to act on matters pertaining to the performance of services under this Contract. Contractor management shall:

(a) Be responsible for the overall performance of all services required by this Contract.

(b) Have the authority to act and make binding decisions for the Contractor.

(c) Meet with Government personnel designated by the PCO or the COR to discuss immediate problem areas.

(d) Be available during normal working hours

(e) To counter circumstances inferring personal services and to preserve the non-personal nature of the contract, the Contractor shall adhere to the following guidelines in the performance of efforts under the contract:

a. Directly supervise all contract employees assigned to tasks.

b. Refrain from discussing the issues such as skill levels and hours, salaries, cost and funding data, or administrative and personnel matters affecting Contractor employees with NSWC PCD personnel.

c. Ensure close communication and coordination with the COR, reporting problems to the COR as they occur (not waiting for a monthly meeting).

d. Ensure potential Contractor employees are not interviewed by Government officials, that

Contractor employee's individual performance is not discussed with Government officials, other than the COR or PCO, that Contractor employees do not allow Government employees to approve their leave or work scheduling, that Government officials do not terminate Contractor employees, and that Contractor employee's do not receive assistance from Government officials in doing their jobs or assist the Government for areas not covered by this PWS.

e. Do not assign Contractor personnel to work under direct Government supervision.

f. Ensure Contractor employees obtain Common Access Cards (CAC), if appropriate, identifying them as contractors.

g. Use work orders to document and manage the work and to define the details of the assignment and its deliverables; the Government has the right to reject the finished product or result, and this does not constitute personal services.

h. When travel is required for the performance on a task, the Contractor personnel are only to travel as directed by their contract management (such as their Program Manager or equivalent point of contact).

i. The Contractor shall document their processes for ensuring services remain non-personal in nature during Contract performance in the Transition Plan (CDRL A001)

(f) Contractor-operated vehicles shall meet the following criteria:

a. The Contractor may be required to operate mobile equipment such as Government owned pickup.

The Contractor shall, using the guidance of PWS paragraph 2.3 and Government Furnished Information (GFI), provide all labor and materials required to support the following task areas:

3.1 Task Area # 1 – Strategic Risk Management and Continuous Authorization

The Contractor shall provide expert, end-to-end support for the Risk Management Framework (RMF), guiding systems through the formal authorization process and establishing and maintaining the security posture required for a state of Continuous Authority to Operate (cATO). This requires a proactive and strategic approach that goes beyond mere document creation to encompass deep risk analysis, stakeholder engagement, and full lifecycle management.

3.1.1 RMF Strategy, Scoping, and System Categorization

During the Annual Security Review (ASR), the Contractor shall provide the expert analysis required to set the foundation for a successful and defensible authorization prior to RMF package development. This includes, but is not limited to:

(a) Authorization Boundary Definition and Data Identification (ASR): The Contractor shall work with system architects and government leads to precisely define and document the authorization boundary. (CDRL A003) This includes identifying not only all hardware, software, firmware, and connections, but also performing a Data Classification Assessment to identify all types of processed, stored, and transmitted data (e.g., CUI, PII, PHI) which fundamentally drives the security approach.

(b) System Categorization and Impact Analysis (ASR): The Contractor shall guide the process of system categorization in accordance with NIST SP 800-60 and CNSSI 1253. This shall be accompanied by a formal Business Impact Analysis (BIA) to justify the selected impact levels (High, Moderate, or Low) for Confidentiality, Integrity, and Availability. (CDRL A004)

(c) Authorization Path and Reciprocity Strategy (ASR): The Contractor shall provide expert, written recommendations on the most effective authorization path, analyzing options such as a traditional ATO, a Platform Information Technology (PIT) Risk Approval (PRA), or leveraging reciprocity. (CDRL A005) The Contractor shall proactively identify and vet potential reciprocity partners and enterprise service providers to maximize security inheritance and reduce duplicative assessment efforts.

(d) Stakeholder Engagement and Governance Plan (ASR): The Contractor shall develop and maintain a

Stakeholder Governance Plan, formally identifying all key A&A stakeholders (ISSM, ISSO, AO, SCA, PM, etc.) and establishing a clear communications rhythm and expectations to ensure strategic alignment throughout the entire RMF lifecycle. (CDRL A006)

3.1.2 Authoritative RMF Package Development and Maintenance

The Contractor shall develop, assemble, and meticulously maintain all artifacts for a "decision-quality," auditable RMF package, in accordance with all Navy and Echelon II RMF business rules.

(a) Verifiable System Security Plan (SSP) Development: The Contractor shall author a comprehensive SSP with clear, detailed, and verifiable implementation statements for every applicable security control. This includes defining control responsibilities (inherited, common, hybrid, or system-specific) and mapping each statement to specific evidentiary artifacts. (CDRL A007)

(b) Evidence-Based Security Assessment Plan (SAP) Creation: The Contractor shall develop a detailed SAP that not only outlines the assessment scope and methodology but also pre-identifies the specific evidence and test procedures to be used for validating each control, streamlining the formal assessment process.

(CDRL A008)

(c) Risk-Based POA&M Management and Analysis (ASR): The Contractor shall manage the system's POA&M in accordance with established government processes. In addition to the required tracking, the Contractor shall perform risk analysis on open findings, providing the government with a prioritized remediation strategy based on vulnerability severity, threat likelihood, and operational impact. (CDRL A009)

(d) Comprehensive Supporting Artifact Generation: The Contractor shall create and maintain a full suite of supporting artifacts, including but not limited to (CDRL A010):

a. Hardware/Software/Firmware/Ports, Protocols, and Services Management (PPSM) Lists

b. Detailed Network and Data Flow Diagrams that explicitly map data types and security controls.

c. An Information Security Continuous Monitoring (ISCM) Strategy that operationalizes the move towards cATO.

d. Robust Incident Response, Contingency, and Disaster Recovery Plans.

e. All required Memoranda of Understanding/Agreement (MOU/A) and Interconnection Security Agreements (ISA).

f. Supply Chain Risk Management (SCRM) Plan (ASR): A plan that documents the strategy for mitigating risks associated with the system's hardware and software supply chain.

3.1.3 Enterprise Mission Assurance Support Service (eMASS)

The Contractor shall demonstrate an expertise knowledge of eMASS, utilizing it as the single, authoritative system of record for all RMF activities. This includes, but is not limited to:

(a) System Registration and Control Inheritance Validation (ASR): The Contractor shall accurately register systems and implement control inheritance. The Contractor shall also periodically validate that the services inherited from enterprise providers continue to meet the system's security requirements.

(b) "Audit-Ready" Artifact and Evidence Management: The Contractor shall upload, manage, and meticulously organize all required RMF artifacts and assessment evidence within eMASS to ensure the package is always “audit-ready”, facilitating rapid reviews and minimizing delays.

(c) Workflow and POA&M Synchronization: The Contractor shall manage RMF workflows within eMASS and ensure that the official eMASS POA&M record is continuously synchronized with live data from scanning tools and remediation tracking systems.

3.1.4 Security Control Assessment and Validation Support

The Contractor shall provide proactive, expert support throughout the formal security assessment process to ensure a smooth and successful validation. This includes, but is not limited to:

(a) Pre-Assessment Readiness and "Table-Top" Validation (ASR): The Contractor shall conduct internal readiness reviews, including "table-top" walk-throughs and technical validation exercises, to simulate the formal assessment, identify gaps, and ensure the system and team are fully prepared for SCA validation.

(b) Facilitated Assessment Support: During formal assessments, the Contractor shall act as a primary technical facilitator, providing documentation on demand, expertly demonstrating control implementations, and providing clear, concise answers to technical inquiries from the assessment team. (CDRL A011)

(c) Security Assessment Report (SAR) Root Cause Analysis (ASR): Upon receipt of the final SAR, the Contractor shall perform a Root Cause Analysis (RCA) on all findings. This analysis will identify systemic issues (e.g., policy gaps, configuration errors, training needs) and provide recommendations to prevent recurrence, not just remediate the immediate finding. (CDRL A012)

3.2 Task Area # 2 – System Security Engineering & Innovation

The Contractor shall proactively integrate advanced cybersecurity measures into modern systems while hardening legacy systems through targeted vulnerability mitigation and strategic modernization. This includes, but is not limited to:

(a) Ensuring full compliance with mandatory Navy directives (FLTCYBERCOM, NCDOC, and DISA Orders) to consistently achieve mission ready validation during critical assessments like Cyber Operational Readiness Assessment (CORA) and Technical Assist Visit (TAV).

(b) Actively support the transition to a Zero Trust security model by providing technical expertise on identity management, micro-segmentation, and enforcing the principle of least privilege across all systems and data flows.

(c) Research, evaluate, and recommend the integration of Artificial Intelligence (AI) and Machine Learning (ML) tools to enhance threat detection, automate security analytics, and enable predictive defense.

(d) Provide technical support for securing cloud and virtualized platforms, including Joint Expeditionary Cloud Services (JECS), the JEXC2 Artifact Web Server (JAWS), and the Virtual Secure Enclave (VSE) based on Citrix XenApp and XenDesktop.

(e) Develope, configure, and maintain key cyber tools, including ForeScout, eMASSter, EvaluateSTIG, GRYPE, Container scanning tools, TiMRA, VRAM, RedSeal, STIGman, SCAP, and STIG Viewer.

3.3 Task Area # 3 – Proactive Threat and Vulnerability Compliance

The Contractor shall execute a continuous and aggressive vulnerability management program to maintain a continuous state of security compliance and operational readiness. This includes, but is not limited to:

(a) Advanced Scanning and Analysis: Perform continuous vulnerability scanning using the Assured Compliance Assessment Solution (ACAS) and other approved tools. The Contractor shall analyze results, identify false positives, determine operational risk, and provide detailed remediation guidance. (CDRL A013)

(b) Provide critical inputs for system artifacts and Plans of Action & Milestones (POA&Ms), produce and maintain comprehensive system security guides. (CDRL A014)

(c) Conduct proactive, intelligence-driven threat hunting exercises within system logs and network traffic to detect adversary activity that evades traditional signature-based defenses.

(d) Provide remote and onsite warfighter support for Technical Assist Visits (TAV), Cyber Get-Well, and Command Operational Readiness Assessments (CORA).

3.4 Task Area # 4 – System Security Sustainment and Implementation (CDRL A015)

The Contractor shall engineer, implement, and sustain a resilient and modern security architecture, assisting to rapidly and efficiently deploy effective security solutions with minimal operational disruption. This includes, but is not limited to:

(a) Deploy, configure, tune, and maintain a full Endpoint Security suite, including Endpoint Security System (ESS), Microsoft Defender Endpoint (MDE), and other modules, across all applicable endpoints.

(b) Implement, document, and validate all applicable NIST SP 800-53 security controls. This includes the automated and manual application of hundreds of DISA STIG settings across diverse operating systems and applications.

(c) Proactively monitor for, assess, and ensure the timely implementation of all IAVM directives and security patches. The Contractor shall support the packaging and delivery of critical cybersecurity updates to fielded NSWC PCD portfolio systems such as JEXC2 FoS and MDAP.

(d) Remediation and Deficiency Support: Investigate, troubleshoot, and resolve complex software security-related deficiency reports and trouble tickets, collaborating with development teams to ensure vulnerabilities are addressed at the source.

(e) Conduct in-depth research, design, and testing of new security solutions. Deliver validated solutions to downstream systems with a focus on speed and efficiency.

3.5 Task Area # 5 – Cybersecurity Support for Deployable Littoral and Expeditionary Mission Capabilities

The Contractor shall provide cybersecurity support for deployable, reconfigurable, and operationally employed mission capabilities used in support of expeditionary, littoral, waterfront, shore-based, and austere operations.

Mission capabilities may include transportable computing and communications components, mission software, operator and maintainer support equipment, local mission services, and temporary interfaces required to support mission preparation, staging, transport, site establishment, operational employment, redeployment, reconstitution, and restoration.

(a) Provide cybersecurity support for mission capabilities during pre-deployment staging, transport, site establishment, operational employment, redeployment, reconstitution, and restoration to approved cyber security and configuration states.

(b) Maintain cybersecurity accountability and control when mission capability architecture, interfaces, enabled services, communications paths, support equipment, or mission package configurations change based on mission, location, supported unit, or operating condition.

(c) Support mission capabilities assembled, configured, employed, sustained, or reconstituted at temporary shore based waterfront, pier-side, expeditionary, or other non-enduring locations where local services, temporary interfaces, or mission-specific connectivity are established or removed.

(d) Provide cybersecurity support for mission capabilities operating with constrained, intermittent, degraded, or unavailable communications; delayed reach-back; reduced enterprise services; limited maintenance windows; or limited patching opportunities.

(e) Support cybersecurity control, integrity, and configuration management of communications components, mission software, support equipment, local services, and mission-dependent data associated with deployable mission capabilities.

(f) Protect, control, and maintain the integrity and traceability of mission plans, locally stored operational information, transferred files, audit records, operator-generated data, and local services created, modified, stored, or transferred during staging, operational use, redeployment, and restoration.

(g) Provide technical analysis, risk-based recommendations, and decision-support information when operational schedules or mission conditions do not permit full correction, replacement, retest or restoration prior to continued mission use. (CDRL A016)

(h) Coordinate with Government program personnel, operators, communications personnel, engineers, maintainers, logisticians, waterfront support personnel, and cybersecurity authorities to support readiness reviews, mission execution, operational continuity, anomaly response, post-event reconciliation, and restoration.

(i) Review mission-capability configurations, support dependencies, and temporary interfaces prior to operational use and identify cybersecurity impacts associated with changes in supported unit, mission package, transport configuration, communications path, local services, or operating location.

3.6 Task Area # 6 – Cybersecurity Support for subsea, Seabed, Instrumentation, and Technical Event Environments

The Contractor shall provide cybersecurity support for technical events, instrumentation, support-equipment, and analysis environments associated with mission-related systems, payloads, platforms, sensors, and support activities in subsea, seabed, mine warfare, diving and life-support, and other maritime mission areas. These environments may include instrumentation interfaces, data acquisition components, electronics staging areas, support laptops, engineering workstations, software and firmware loads, local repositories, removable media, temporary event configurations, event-generated data, and pose-event analysis products. The support includes, but is not limited to:

(a) Identify, characterize, and maintain cybersecurity control of mission-related technical-event environments that include instrumentation interfaces, data acquisition elements, electronics staging functions, support devices, engineering workstations, local repositories, removable media paths, and temporary event-specific additions.

(b) Provide cybersecurity support for technical-event environments before, during, and after technical events, including readiness review, controlled setup, execution support, troubleshooting, anomaly response, evidence preservation, post-event reconstruction, and restoration of approved cybersecurity and configuration states.

(c) Support the controlled handling, verification, integrity, provenance, and traceability of software loads, firmware loads, approved source media, setup information, local stating devices, and transferred files used to prepare, execute, troubleshoot, assess, or reconstruct technical events.

(d) Support the Government’s ability to maintain confidence in the origin, integrity, chain of custody, configuration-to-result traceability, and usability of event-generated data, engineering data products, analysis outputs, calibration-related information, and associated technical records.

(e) Support technical-event environments in which instrumentation elements, interface components, supported equipment, stating devices, or other mission-related components are reconfigured, substituted, reloaded, recalibrated, or revalidated due to engineering needs, troubleshooting requirements, technical performance conditions or schedule constraints.

(f) Provide technical analysis, cybersecurity recommendations, and decision-support information when the provenance, condition, or completeness of data, support equipment, instrumentation chains, load sources, or configuration history is in question and may affect event execution, continued analysis, fleet support, or follow-on technical activity.

(g) Preserve event evidence, engineering records, data lineage, and configuration traceability sufficient to associate event outputs, data products, records, and analysis results with the applicable configuration state, instrumentation chain, software and firmware load condition, support-equipment condition, and event support conditions in effect when the results were produced.

(h) Develop, maintain, and update event-readiness products, anomaly tracking products, configuration-to-data traceability products, and cybersecurity risk and status products required for Government oversight and technical decision-making. (CDRL A017)

3.7 Personnel Qualifications

(a) All Contractor personnel performing cybersecurity functions shall meet and maintain the qualifications mandated by the DoD Cyberspace Workforce Framework (DCWF). Contractor personnel shall hold active certifications that correspond to the specific DCWF role they are assigned.

(b) All Contractor personnel qualifications shall be managed and tracked in accordance with the latest versions of DoDD 8140.01 ("Cyberspace Workforce Management"), the DoD 8140.03 Cyberspace Workforce Qualification and Management Program manual, and SECNAV Manual M-5239.2 ("Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification"). While DoD 8570.01-M is the legacy standard, personnel must meet the superseding requirements of the 8140 series as it is implemented.

(c) Continuous Professional Development: All personnel are required to maintain their baseline and role-based certifications through continuing education (CE) credits, as required by the respective certifying bodies.

The Contractor shall track and be prepared to report on the status of these CEs.

(d) Required Certifications: All cybersecurity personnel shall hold and maintain active security clearances and role-appropriate certifications. Required certifications may include, but are not limited to:

a. Baseline Cybersecurity: CompTIA Security+,

b. Optional: CompTIA Network+, CompTIA Linux+,

c. Advanced IA: Certified Information Systems Security Professional (CISSP), CompTIA Security X.

d. Technical/OS: Red Hat System Administrator (RHSA), Cisco Certified Network Associate (CCNA), Appropriate Windows Server and/or Workstation

3.8 Contract Status Reporting (CDRL A018)

Report progress in accordance with NAVSEA C-237-W001 Electronic Cost Reporting and Financial Tracking (eCRAFT) System Reporting (NAVSEA) (MAY 2019).

3.9 Travel

The Contractor may be required to travel from the primary performance location both the Continental United States (CONUS) and Outside the Continental United States (OCONUS) when supporting this requirement. Travel will be determined by the Government based on evolving mission requirements.

The number of times the Contractor may be required to travel to each location cited above may vary as program requirements dictate, provided that the total estimated travel cost is not exceeded. All travel requirements will be approved by the Contracting Officer via a TI. Before initiating any travel, the Contractor(s) shall submit a detailed and fully-burdened estimate that includes the number of employees traveling, their expected travel costs for airfare, lodging, per diem, rental car, taxi/mileage and any other costs or actions requiring approval. The travel estimate shall be submitted to the Contracting Officer's Representative (COR) and Contract Specialist. (CDRL A019) Travel cannot occur unless there are sufficient funds on contract to cover the cost of travel. Actuals cost, resulting from the performance of travel requirements, shall be reported as part of the Contractor's monthly status report. The reportable cost shall also be traceable to the Contractor's invoice. The Contractor(s) will be reimbursed for its reasonable actual travel costs in accordance with B-231-H001 Travel Cost (NAVSEA)(OCT 2018) of the SeaPort Multiple Award Contract. Travel expenses are limited by the Department of Defense Joint Travel Regulations.

The Contractor is responsible for:

• Providing medically and physically qualified contingency Contractor personnel for duties, ensuring all employees undergo medical suitability screenings at no cost to the Government, and that civilian Contractors have adequate health care coverage for OCONUS hospital care and medical evacuation.

• Ensuring all OCONUS personnel comply with DSSR and applicable Status of Forces Agreements (SOFA). The Contractor shall provide personnel with the most recent SOFA for their specific country.

• Obtaining all required travel approvals, ensuring personnel have valid passports and visas, adhering to all security protocols, and maintaining emergency evacuation plans for OCONUS personnel.

In addition, the Contractor shall:

• Submit a detailed travel request, including purpose of travel, destination, dates, estimated costs, and personnel traveling, to the COR and PCO for approval at least [Insert Number] business days prior to the planned travel. The request must justify the necessity of the travel and how it supports the SOW's objectives.

• Ensure all traveling personnel possess the required security clearances and access authorizations (FAR 52.204-2, Security Requirements) and comply with all security regulations and directives at all travel locations.

• Ensure personnel receive all required pre-deployment training and briefings prior to OCONUS travel, including:

o Security awareness training o Force protection awareness training o Cultural awareness training specific to the OCONUS location o Health and safety briefings o Travel advisory briefings

• Ensure all personnel traveling OCONUS meet all medical requirements for the destination country and provide proof of compliance to the COR upon request.

• Comply with all applicable U.S. laws and regulations, as well as the laws and regulations of the host country while traveling OCONUS (FAR Subpart 4.4, Safeguarding Classified Information Within Industry).

• Immediately report any security incidents, accidents, or other significant events to the COR and designated security personnel.

• Maintain accurate records of all travel expenses and adhere to all emergency procedures and protocols established for the travel location.

• Complete all compliance training, such as Antiterrorism training and Cyber Security training, and maintain records for Government inspection if needed.

The Government will not cover relocation or repatriation costs for Contractor personnel or dependents prior to 12 months on-site, nor intra-site movements initiated by the Contractor without Government request.

3.10 Purchases

Only items directly used for this Task Order, for work within the scope of the Performance Work Statement, shall be purchased under the Other Direct Cost (ODC) line items. Individual purchases above $5,000 shall be approved by the Contracting Officer via a TI prior to purchase by the Contractor. The purchase request shall be itemized and contain the cost or price analysis performed by the Contractor to determine the reasonableness of the pricing. The request and supporting documentation shall be submitted to the Contracting Officer's Representative (COR) for concurrence prior to being submitted to the Contracting Officer for approval. Information Technology (IT) equipment, or services must be approved by the proper approval authority. All IT requirements, regardless of dollar amount, submitted under this Task Order shall be submitted to the PCO for review and approval prior to purchase.

The definition of information technology is identical to that of the Clinger-Cohen Act, that is, any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information.

Information technology includes computers, ancillary equipment, software, firmware and similar procedures, services (including support services), and related resources.

3.11 Quality Assurance (CDRL A020)

The Contractor shall provide and maintain a Quality Management System (QMS) that meets the requirements of ISO 9001:2015. The Contractor shall submit a Quality Assurance Program Plan (QAPP) to the COR within 30 days after award that documents the quality system procedures, planning, and all other documentation and data that comprise the QMS for Government review and approval. The QAPP shall identify the means by which the Contractor will ensure quality system effectiveness and demonstrate comprehensive management and review of their process data, to identify trends and progress in quality of services and data products provided. The QAPP shall describe what is measured, how often it is tracked, and who reviews and assures that appropriate action is initiated when trends are unfavorable. The Government may perform inspections, validations, verifications and/or evaluations deemed necessary to ascertain conformance and compliance to the requirements and adequacy of the implemented procedures. The Government reserves the right to disapprove the QMS or portions thereof when it fails to meet its contractual requirements. Sub-Suppliers QMS’ should be evaluated to be in alignment with the supplier

QMS.

3.12 Safety Program (CDRL A021)

The Contractor shall implement a Safety Program in accordance with NAVSEA C-223-W001 ACCIDENT REPORTING (NAVSEA) (OCT 2018) and C-223-W002 ON-SITE SAFETY REQUIREMENTS (NAVSEA) (OCT 2018). The Contractor shall submit a Safety Plan for Government approval that addresses as a minimum:

(a) Equipment Operation, Transport, Handling, Assembly and Storage

(b) Equipment Test and checkout

(c) Fall Protection

(d) PPE

(e) Emergency operations

(f) General safety and fire requirements not covered above; and

(g) Such other operations deemed necessary by the Contractor to safely execute the requirements of the Task Order.

The Contractor shall describe in the Safety Plan the techniques and procedures to be used by the Contractor to ensure that the objectives and requirements of the safety program are met in the safety training for engineers, technicians,…