PWS FCI_Redacted.pdf

CUI

Controlled By: DISA Controlled By: BDL3 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: Gordon, Elmer A CIV DISA PEO CYBER (USA) <elmer.a.gordon.civ@mail.mil>

PERFORMANCE WORK STATEMENT (PWS)

Award/Mod Effective

Version Date

Award

Contract Number: To Be Determined (TBD) Task Order Number: TBD Contractor Name TBD Tracking Number: 842571526 Follow-on to Previous Contract and Task Order Number:

HC1084-20-9-0006; HC1084-19-9-0002

1. Contracting Officer’s Representative (COR).

a. Primary COR.

See DITCO Additional Text G1 - Points of Contact

b. Alternate COR.

c. Property Administrator.

2. Contract or Task Order Title.

Full Content Inspection (FCI) Managed Service in support of DISA

3. Background.

DISA is tasked with the mission to operate, secure, and defend the Defense Information System Network (DISN). Within the cyberspace operating environment, both cyber technologies and threats continue to evolve and adapt rapidly presenting both opportunities and challenges. To keep pace with these threats, DISA seeks to increase the ability to inspect, detect, and quickly respond to malicious cyber activity (MCA) at key defensive points including its global Internet Access Points (IAPs).

DISA, in support of the Department of Defense (DoD), has deployed FCI, as a managed cyber security service, to the ten DISA IAP locations with the intent of deploying FCI to non-DISA IAPs in the future. FCI increases the ability to inspect full-session network traffic at the perimeter, prior to reaching the endpoint. FCI enhances the ability to detect MCAs including zero-day threats and allows for a wider range of fast response options and actions to detect activity.

4. Objectives.

Deploy, integrate, operate, and sustain FCI as a managed service, at the DISA IAPs and other government-approved DoD IAPs and networks.

5. Scope.

The scope of this requirement includes procuring, delivering, installing, deinstalling, configuring, providing software, hardware, technical support services, and operational control required to deliver a FCI solution.

FCI includes an on-prem or cloud-based, hardware stack dedicated to DISA network and non- DISA network traffic at the IAP and boundaries. The capability will be delivered as a “managed service” meaning the contractor will provide all assets needed for the managed services to include software, hardware, subscriptions, maintenance, and all services associated with design capabilities, and systems engineering. DISA will also be involved in operating this system to maintain situational awareness and command & control over DISA’s Defensive Cyber Operations (DCO) mission.

Moreover, as a managed service, the vendor will be responsible for all costs associated with life cycle replacement costs for FCI components (hardware, software, et al.), technical refresh, operating system and software updates, and costs to fund break-fix action requirements to repair non-functioning equipment.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 10% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

6. Performance Requirements.

6.1 Task 1 – FCI Managed Service CLIN x001

CUI

6.1.1 Subtask 1 - Program Management Support

**Secret and Secret Internet Protocol Router Network (SIPRNet) accesses are required to support: Provide program support, contract management support services, necessary to manage and oversee all aspects of the contract, task orders and task(s) to include on-site support within DISA to DoD Cyber Defense Command (DCDC). Support will require planning, knowledge, and control of personnel and systems with access to sensitive metrics including maturity, performance, and capabilities of the FCI service and DISA systems. The contractor will be required to develop, review, and deliver various unclassified and classified network architectural diagrams and documentation. Email correspondence, electronic communication, and document review and modification at Secret Level. (Clearance level applies to 6.1.1 – 6.1.5) **

The contractor shall provide general support including drafting agendas, memos, briefings and reports, and participation and facilitation of meetings, establishing conference calls/teams meeting, preparing and tracking meeting minutes, briefing documentation, and action items as identified by the COR / ACOR. The contractor shall use DoD-provided audio/video support and audio teleconferencing; web content editing and graphic support; financial management; provide program management support for all developed processes, documents, and products including configuration management (CM) and engineering review boards; and other associated administrative tasks necessary to support the program. The Contractor shall provide support for capabilities in both the lab (if required) and production environments. The Contractor shall provide support for the planning, set-up, execution, removal and any follow-on activities related to any production activities.

The Contractor shall accomplish CM activities in accordance with Department of Defense Enterprise Management Framework, DODI 8440.01 best practices. CM activities include baseline identification, change control, status accounting, and auditing.

The contractor shall identify risks, resolve problems, and verify effectiveness of corrective actions. Institute and maintain a process that ensures problems and action items discussed with the Government are tracked through resolution and shall provide timely status reporting. Results of Contractor actions taken to improve performance shall be tracked, and lessons learned incorporated into applicable processes. Establish and maintain a documented set of disciplined, mature, and continuously improving processes for administering all contract efforts with an emphasis on cost-efficiency, schedule, performance, responsiveness, and consistently high-quality delivery. The Contractor shall provide a Monthly Service Utilization, Capacity, Outage and Upgrade Status and Forecast Report and resources (i.e., personnel) required for closeout operations prior to contract completion.

The program management support shall be formalized and documented in the contractor provided Task Order Management Plan (TOMP).

Weekly Activity Report (WAR) - The contractor shall provide a WAR detailing program activities performed by the contractor that describes progress/status for the week reported in support of this TO. The WAR will include identification of any issues that require Government intervention for resolution. The WARs at a minimum shall include the following:

CUI

• Major accomplishments

• Deliverables submitted during the reporting period (including associated tasks/subtasks, due dates, and date submitted)

• Planned accomplishments

• Current and outstanding issues

• Project status, schedule, and Plan of Actions & Milestones (POA&M)

• Current Staffing Roster

• DoD 8140.03-M certification status

6.1.2 Subtask 2 – Schedule Management

The Contractor shall provide key milestone and activity information via the provision of a Microsoft Project Schedule to support the Integrated Master Schedule. The contractor shall be prepared to incorporate changes to the schedule based on changing events and/or on funding decisions that affect the activity of the program. The contractor shall analyze deviations from the schedule baseline once it is established, determine impacts to the overall program, and provide program documentation, reports or briefing documentation to the Government. The contractor shall prepare a plan of action and milestones to support schedule management requirements. In addition to master schedule support, the contractor shall maintain a detailed Work Breakdown Structure (WBS) for each task on the TO.

6.1.3 Subtask 3 - After Action Report

After each incident that caused FCI operational impact to customers, the contractor shall provide an After-Action Report, describing actions taken to resolve issues or complete the required efforts, as well as any further action necessary to remedy unresolved issues.

6.1.4 Subtask 4 – PMO Documentation Support

The contractor shall manage, maintain, and update present and future documentation. The contractor shall prepare and finalize all presentations/briefings to ensure compliance with Government standard template requirements. The contractor, with collaboration of the Government, shall review and approve the Documentation Management Plan to ensure documentation, repositories, and ownership are clearly understood. The contractor shall be expected to use and maintain on a weekly basis the DISA SharePoint and/or any other repository system the Government may choose in order to provide online access to program artifacts to include: test plans, implementation plans, diagrams, requirements, white papers, etc., in a format and accessible to the appropriate program stakeholders, authorized by the Government. The Government will provide oversight to the documentation housed on the site to ensure compliance with all security classifications.

6.1.5 Subtask 5 – Operations Support

**Top-Secret, Top-Secret Sensitive Compartmented Information (SCI), SIPRNet, the Joint Worldwide Intelligence Communications System (JWICS) accesses are required to support: To fully-perform FCI duties the Government must allow contractor personnel, specifically, supporting FCI to access Sensitive Compartmented Information Facilities (SCIFs) and to provide necessary training and support in accordance with Section 5.2 of the PWS of the

CUI

contract. Secondly, contractor personnel will be embedded and engaged with other government and contractor personnel that have a Top-Secret clearance working in DISA’s DCO components to include DISA Joint Operations Center (DJOC), DISA Global Field Command (DGFC), and DoD Cyber Defense Command (DCDC). Without a Top-Secret security clearance and SCIF access, contractor personnel cannot completely fulfill their roles and responsibilities detailed in their contract. Secret and SIPRNet accesses are required to support: Email correspondence, electronic communication, and document review and modification at Secret Level.**

6.1.5.1 Subtask 1 – FCI Secured Platform

The contractor shall provide capacity as an ‘on-demand’ service capable of readily adjusting to changes in requirements, including both increases and decreases. The Government will determine the need for additional capacity and/or processor requirements.

The contractor shall provide flexible, highly scalable, solutions that are nondisruptive.

FCI Secured Platform, is a DISA instance of commercial technology. This technology unites the capabilities of legacy Intrusion Prevention Systems (IPS) with the emerging technologies of Network Detection & Response (NDR) and Content Disarm & Reconstruct (CDR). FCI adds to this combination the ability to manipulate network traffic and file content leading to a unique capability offering for DISA. The system is built to operate, in-line, bi-directionally across all ports and protocols within a 40Gbps inbound/outbound IAP network environment with low-latency. Some of the unique features of the capability include:

• Ability to parse and stage network sessions increasing ability to inspect network sessions

• Ability to detect malicious cyber activity with low-false positive rates

• Ability to effectively target adversary TTPs, malware families, and tool

• Ability to perform all operations accurately, in-line with low-latency

FCI will include on-prem or cloud-based hardware stacks dedicated to DISA and non-DISA network traffic at the IAPs and boundaries. The capability will still be delivered “as-a-service” meaning that the provider will continuously operate and maintain the system hardware and software to include all portions of the inspect, detect, and response functions. DISA will also be involved in operating this system to maintain situational awareness and command & control over DISA’s Defensive Cyber Operations mission.

The Contractor shall deliver an FCI capability that provides a secured platform, dashboard portal, and environment that delivers enhanced cyber security protections for all network traffic transversing the DISA IAPs and for all non-DISA IAPs/boundaries that have entered into formal agreement to receive the FCI capability between DISA and the Contractor.

6.1.5.2 Subtask 2 – Deployment of the FCI Capability

CUI

manage the software, service subscriptions and dedicated hardware required to deliver the capability on Government approved infrastructure.

System-Wide Requirements: Core System-wide requirements form the foundation of the FCI Service and provides the primary features and functions.

• FCI shall provide the ability to extend IAP protections for all network sessions occurring at a DISN boundary. The system shall have the ability to inspect and remediate all data types, to include but not limited to Web, Email and DNS traffic. Data types selected for this project shall be at the discretion of the Government.

a) The system shall operate as a full session proxy with secure sockets layer/transport layer security (SSL/TLS) inspection operating within DISA’s Enterprise Break & Inspect (EBI) enclave.

b) The system shall fully parse and stage network session data to sub-object level for inspection across all network ports and protocols.

c) The system shall inspect user file downloads by fully parsing common file types to sub-object level for inspection.

The system shall operate in-line, bi-directionally, across all ports and protocols with low-latency.

h) The system management plane will only be accessible from a closed, private, out-of-band network.

i) The Contractor shall notify the Government prior to implementing major system changes (including authorized service interruptions (ASIs)) that require configuration changes to the Government network. In some instances, an emergency change would be required to occur earlier than the specific time.

j) The Contractor shall aid the Government administrators in developing security policies and management planning recommendations.

k) The Contractor shall provide the necessary test plans, test reports and implementation plans required for submittal and approval to the appropriate change Control Board (CCB) in support of making configuration changes in production.

Cybersecurity: The Government has outlined the following requirements related to how the Contractor must implement the FCI service to ensure the DoDIN is protected against malicious codes, attacks, and unauthorized access.

CUI

• The FCI solution shall detect malicious cyber threats in network traffic traversing between the DISN and the public Internet.

• The FCI solution shall provide an array of customizable response options that can be automatically executed in response to detected malicious cyber activity.

e) Interoperable and must be able to integrate with identity credential and management features and technologies

g) Provide an alert mechanism to notify the appropriate government designated personnel when system capacity, resource utilization, service failures, or service degradation thresholds have been exceeded. The thresholds must be configurable by authorized government designated personnel based on operational needs.

h) Identify system trends (i.e., predictive analytics), conduct incident analysis, and identify emerging threats to the health and welfare of the system as needed.

Operations and Maintenance (O&M): The Contractor shall deliver a complete, active, and operational FCI solution and provide comprehensive O&M support for services thereafter.

a) The Contractor shall be responsible for operations, to include system installation, hardware and software configuration, operational evaluation, resource optimization, and system administration.

b) The Contractor shall be responsible for maintaining the FCI solution, to include system monitoring, diagnostics, preventive maintenance, system capacity and resource utilization analysis, fault analysis, hardware and software repair/replacement, testing, troubleshooting, and sustainment activities.

d) The Contractor shall ensure mitigation reports include a summary of threats detected, threats mitigated, and actions taken and are routed to the correct organizational elements with DISA & DCDC.

e) The Contractor shall provide on-call service desk support 24x7x365 for the FCI solution that have been fielded to the DoD IAP environment.

f) The Contractor will perform problem recognition, research, isolation, resolution, and follow-up steps required.

g) The Contractor will support the development, creation, and management of technical and engineering documentation and considerations (e.g., OV1, SV, CV) for implementing the FCI solution at alternative DoD locations, as requested by the Government.

h) The Contractor shall adhere to and comply with DoD Orders to include but not limited to Operational Orders (OPORDs), DISA Tasking Orders (DTOs), and Cyber Tasking Orders (CTOs).

6.1.5.4 Subtask 4 – Operational Service Support

The Operational Service Support/Management function intended to meet the communication needs of end users and IT staff when encountering service incidents or making service requests.

Service desks allow enterprises to implement strong and effective workflows for support departments, both internal and customer-facing. Trouble ticket systems are the focal point for reporting incidents (i.e., disruptions or potential disruptions in service availability or quality), and for users to make service requests (i.e., feature add-ons, or changes).

CUI

The Contractor will provide operational support in accordance with the Defense Enterprise Service Management Framework (DESMF). DoD uses the DESMF to improve IT Service Management (ITSM) capabilities across the Department. By using DESMF, the Contractor will aim to identify and eliminate redundancies, inefficiencies, and service quality deficiencies.

DESMF provides service management guidance, best practices and improved efficiencies to plan, implement, monitor, and improve IT service management across DoD. The Contractor will:

• Submit monthly recurring reports on the number of trouble tickets, time to resolve, and the resolution status of tickets to include at a minimum:

a) Service desk requests received

b) Number of trouble tickets opened

c) Number of trouble tickets closed

d) Average mean and median time to answer/respond to trouble tickets (e.g., time to answer a phone call, time between trouble ticket opened and the first contact with customer)

e) Average mean time to resolve trouble ticket

f) Number of FCI service desk calls abandoned or dropped (e.g., user hangs up before submitting a ticket)

g) Trouble ticket(s) trend analysis

• Allow government designated personnel to update and check the status of trouble tickets associated with their subscribers.

• Grant government designated personnel the ability to generate trouble ticket reports upon request based on the following selectable characteristics: priority, time of day, network, node, time generated, service/capability and status (open or closed).

• Allow multiple government designated personnel to view their subscriber’s trouble tickets at the same time.

• Grant government designated personnel the ability to change the priority of trouble tickets in accordance with the published Service Management Plan.

• Specify a mechanism for customers to rate the performance of the service desk in resolving their issues, and provide monthly reports to government designated personnel, based on the aggregate results of these surveys.

• Offer the capability to accurately log, group, and categorize incidents.

• Display within the ticketing system the number of incidents, and the average resolution time per known problem(s).

• Provide an alternate means of communication outside of the FCI solution, in the event of a service outage.

• Address incidents within the same classification level (e.g., NIPR incidents stay on

NIPR).

• Offer a service health dashboard accessible via the web.

• Support dynamic assignment, routing, escalation, and de-escalation of trouble tickets from the contractor’s trouble ticket system to the government’s trouble ticket system.

CUI

• Use the following attributes for dynamic ticket assignments: Contact Name, Summary, Impact, Urgency, Incident Type, Reported Source, Assigned Group, Status, Company, Support Tier (e.g., Tier 3).

Emergency Maintenance

The Contractor shall coordinate with the Government to ensure that any emergency or unscheduled maintenance that will affect the Government’s ability to use the proposed FCI service is reported to the Government via the COR in advance, with as much lead time as possible. Information shall be provided that enables Government to effectively assess the planned activity for purposes of understanding which FCI products/services may be affected and for determining appropriate contingency mechanisms. To ensure timely updates subsequent to Government notification, the Contractor shall make arrangements with the Government to ensure that the COR is kept informed of emergency maintenance progress, including notification when the activity is completed, and has proper contact information for the person working the issues.

Planned and Scheduled Maintenance

The Contractor shall make arrangements with the Government to ensure that any Planned Maintenance that will affect the Government’s ability to use the proposed FCI service is reported to the COR in advance, with as much lead time as possible. The Government will also monitor the appropriate Contractor’s web pages (i.e., portals, dashboards, etc.), if available, to maintain an awareness of Scheduled Maintenance affecting operations and will take the appropriate operational steps to minimize impact and accommodate the Scheduled Maintenance.

6.1.5.5 Subtask 5 – Tier II: Government and or Contractor Provided Infrastructure

The Contractor shall provide on-call service desk support 24x7x365 at a Tier II level for the FCI service that has been approved by the FCI PMO and deployed by DISA, DCDC, and other applicable DoD stakeholders. The Contractor shall provide Tier-II support with technical knowledge for handling break/fix, configuration issues, troubleshooting, software installations, and hardware repair. The Contractor shall perform problem recognition, research, isolation, resolution, and follow-up steps required. If Tier-II is unable to resolve or fix a problem, the problem would be sent to tier-III. The Tier-II shall:

• Performs minor incident management and problem management to resolve problems

• Handles tickets initiated by users

• Integrate with DISA ticketing systems or developing a process to ensure that all tickets issues are transferred to the DISA ticketing systems to ensure proper tracking, and reporting

• TTP development for other Tier II entities

• Identify trends to Tier III to justify Program Office/System changes

• Fielding calls and emails from Mission Partner Service Desks

• Routes as necessary to appropriate Tier III Technical Support centers

CUI

• Maintain documentation and files on all help desk actions to determine metrics and other reportable actions.

• Maintain problem management database and help desk system.

• Create help desk tickets in the designated ticket tracking system, provide an initial acknowledgement to the end user validating receipt of the ticket.

• If possible, resolve ticket, communicate resolution to the end user and obtain customer sign-off before closing ticket.

• If unable to resolve, thoroughly document ticket with actions taken in an attempt to resolve and escalate ticket in accordance with applicable processes.

• Receive, triage and route tickets to Tier III help desk accordingly; analyze, log and track issue and problem tickets.

• Compile and organizes data for monthly status reports; provide trend analysis and metrics to the FCI PMO based on gathered data and monthly status reports.

• Provide daily situational awareness via written and executed documentation improvement.

• Ensure compliance with security procedures for data handling, participate in planning sessions for process improvement.

• Provide recommendation to the FCI PMO on issues/problems identified and reported in trend analysis.

• Provide daily supervision and direction to help desk staff that are responsible for phone and in-person support to users.

The Service Desk will be located at a contractor off-site facility for Tier II. The Contractor shall include a detailed account of Service Desk activities in the Activity Report. The Contractor shall maintain the Service Desk Activity Report logs on a daily basis for Tier II calls regarding any customer. The Service Desk Activity Report will be included in the metric status report (MSR).

The report shall include a detailed account of each help-desk call problems, resolution, and ticket number as well as Tier II-III actions and time spent.

The Contractor shall use existing escalation procedures for Service Desk support and provide updates to applicable FCI stakeholders, as identified by government. These escalation procedures include immediate notification of the Government site team lead, and the Contractor Officer Representative/Alternate Contractor Officer Representative (COR/ACOR) when a supported site experiences a critical failure or otherwise reports a problem having an adverse mission impact.

Any deviations from established Service Desk policies and operating procedures must receive prior written approval from the COR/ACOR. The Contractor shall identify and submit to the COR/ACOR for consideration such updates or changes to the policies and procedures as it believes will result in increased customer satisfaction or otherwise result in beneficial process improvements.

The Contractor shall identify common causes of problems and propose to the COR/ACOR such support as it believes will improve mission operations and/or decrease service interruptions for DISA’s customers. The Contractor shall provide a Help Desk report that includes data and trends for the following:

CUI

• Number of tickets escalated to Tier III or to the contractor

• Tickets closed successfully, unsuccessfully, or still outstanding

• Trouble ticket trends requiring closer support/attention/action from FCI PMO

• Trouble tickets that resulted in the need for touch labor or could not be resolved remotely

6.1.5.6 Subtask 6 – Tier III: Government and or Contractor Provided Infrastructure

Tier III support will be responsible for the establishment of Subject Matter Expert (SME) knowledge in all aspects of the FCI system. This includes but not limited to applications, systems, networking, transport, NetOps, and operational documentation. Additionally, having processes enhances and improves Tier III support capability wherein the Contractor shall establish repeatable high-level processes that will enhance, where applicable, those Tier III support responsibilities. Such an example is the proscribed use of system debugs and other tools (software, hardware, feature sets) to determine expected and unexpected behaviors within the FCI environment. The Contractor shall analyze and identify those processes to be documented for Government approval. As part of those processes and SME knowledgebase, the Contractor shall integrate the utilization of contractor reach back (as required) to enhance the knowledgebase and product analysis in support of Tier III responsibilities.

The Contractor shall use the ticketing and other system tools shared with Tiers II-III to provide Tier III level support. The Contractor shall provide 24x7x365 on-call availability for Tier III issues. Support shall include but not limited to 24x7x365 access to the system, participation in off-hour troubleshooting efforts to perform onsite troubleshooting. The Contractor shall be reachable on a 24x7x365 basis to provide Tier III engineering support with a one-hour call back.

6.1.6 Subtask 6 - Integrated Solutions Management

**Secret and SIPRNet accesses are required to support: Development and delivery of FCI training materials to support various environments (e.g., NIPRNet). This requires access to and knowledge of operational system configurations. Including reviewing classified documents, attending classified meetings and demonstrations, and obtaining both classified and unclassified information. Work will involve email, electronic communication, and document review/modification at the Secret level.**

6.1.6.1 Subtask 1 – Training

The Contractor, will provide continual training to DISA & DCDC until conclusion of FCI in production. The Contractor shall develop FCI artifacts to include Standard Operating Procedures (SOPs), TTPs, and online documentation to train users and administrators on the service.

Moreover, the Contractor shall develop training materials to prepare FCI users on the FCI features and functions in preparation for day-to-day operations. The Contractor shall develop various training artifacts that will be utilized to train users on the service.

6.1.6.2 Subtask 2 – Users and Administrators - Classroom/Instructor Led

CUI

The Contractor shall provide in-person, classroom/instructor-led training to users. Training content shall include explaining web portal features, functions, and common tasks associated with FCI services and capabilities. The Contractor shall also provide in-person, classroom/instructor led training to Government designated privileged users to explain advanced concepts, software features, and common administrative functions associated with the configuration and management of FCI services and capabilities.

6.1.6.3 Subtask 3 – Users - Online Instructor-Led Training

The Contractor shall provide live online instructor-led training to users. Training content shall include explaining web portal features, functions, and common tasks associated with FCI services and capabilities. The Contractor shall also provide individual hands-on training to Government designated privileged users to explain advanced concepts, software features, and common administrative functions associated with the configuration and management of FCI services and capabilities.

6.1.7 Subtask 7 – Engineering

** Top-Secret, Top-Secret SCI, SIPRNet, JWICS accesses are required to support: FCI cyber analyst embeds with DJOC, DCDC, and DISA Global will require access to Top Secret communications hosted on JWICS. Access to SCIFs to facilitate discussion at the TS SCI level.

Provide technical/engineering support services including design, implementation, modification, and sustainment for both United States Territories and Possessions, as well as locations outside of the United States Territories and Possessions for the Unclassified and Classified environments. Access to the DISA DCDC laboratories may be required in order to facilitate the engineering and configuration of an accurately simulated pre-production environment. This may include testing, operation, evaluation, and modifications within the simulated DISA test environment. Secret and SIPRNet accesses are required to support: Access to DISA and DCDC may be required in order to facilitate the engineering and configuration of an accurately simulated pre-production environment. This may include testing, operation, evaluation, and modifications within the simulated DISA test environment. This test environment requires knowledge of control, configuration, and access to DISA systems and data at the Secret level. At this time, we estimate that 100% of all personnel working in these areas will require secret clearances.

6.1.7.1 Subtask 1 – General Engineering

This section outlines requirements for technical/engineering support services. Support services may be provided to the FCI PMO directly, or to FCI users and administrators. The Contractor shall provide the full range of engineering support necessary to incorporate new/future technologies into the FCI service/baseline after initial deployment and must have expertise in both traditional IT infrastructure and cloud computing. The Contractor shall provide comprehensive technical/engineering support services to include design, implementation, modification, and sustainment of FCI projects and work activities.

CUI

6.1.7.2 Subtask 2 – Systems Engineering

The Contractor shall employ disciplined systems engineering processes including, but not limited to, requirements development, technical management and control, and system/software design and architecture. In addition, the Contractor shall implement system engineering best practices associated with risk management, configuration management, data management, test and evaluation (T&E), and verification and validation (V&V) throughout the period of performance.

6.1.7.3 Subtask 3 – Architecture and Service/System Design Engineering

The Contractor shall support the design and development of systems and applications and their integration into the overarching enterprise DoD architecture. The Contractor shall provide all required design and development documents, and supporting architectural documentation in compliance with Department of Defense Architectural Framework (DoDAF) Enterprise Architecture guidance, or other frameworks as identified in the tasks.

6.1.7.4 Subtask 4 – Network Engineering

The Contractor shall support routing and switching analysis of enterprise-wide and large-scale networking infrastructure (CAN, MAN, WAN), to include, but not limited to, analyzing circuits, troubleshooting routing protocol configurations, making route optimization recommendations, highlighting traffic congestion points, and ensuring quality of service policies are properly configured. The Contractor shall ensure network components are running the required hardware and software approved by the Government, and validates network systems and transport layers are in compliance with industry standards and protocols. The Contractor shall evaluate network problems, workflows, usage and trends to make organizational and planning recommendations, while developing appropriate corrective action.

6.1.7.5 Subtask 5 – Test Engineering

The Contractor shall develop and provide a dynamic testing environment that will be used to support and validate that the FCI service satisfies the Government’s technical and operational requirements. The Contractor shall establish and maintain an integrated test lab that will support a full range of integration test activities for both the currently fielded system, and future maintenance/modernization releases. The Contractor shall support the following test activities:

in areas which include, but are not limited to, product testing (i.e., regression testing and new capability testing/evergreen); operational scenarios testing (e.g., real world production environment simulation testing) considering system topology, and concept of operations, disaster recovery, clustering, and load balancing; ), stress and longevity testing (e.g., load and throughput, speed of service, and duration); interoperability testing (e.g., protocol translation, discrete systems communication); security testing (e.g., VPN, Firewall, security configuration).

CUI

6.1.7.6 Subtask 6 – A&A

The contractor shall provide expertise, knowledge, understanding, support and implementation of all phases of the RMF and A&A lifecycle in support of FCI. The contractor shall provide security engineering to the Government and execute A&A activities for development, test, and production systems to maintain compliance with DoD 8500 series publication. All personnel supporting A&A, or other information assurance functions, shall have the appropriate Information Assurance Certification in accordance with DoDI 8570.1 or applicable superseded DOD manuals.

The Contractor shall maintain current SOPs in support of obtaining, testing, and coordinating the deployment and implementation of all patches in order to mitigate and/or remediate all assets in the development, test and production environments affected by open findings to include vulnerability and Enterprise Mission Assurance Support Services (eMASS) data entry. The contractor shall coordinate with the Government specified A&A team to mitigate and/or remediate security defects in a timely manner on any open findings on the development, test and production systems. If a defect cannot be remediated in a timely manner, the contractor shall develop a POA&M addressing the timeline for remediation and the observable milestones of progress. In rare circumstances a security defect shall be identified which cannot be fixed, a risk acceptance shall be obtained in accordance with the RMF. The contractor shall provide input in the authoring and shall review and present required documentation.

The contractor shall maintain the Life-cycle Certification and Accreditation (C&A) Plan that addresses the process, procedures, and timing of A&A activities for CIs across the anticipated life-cycle of the product(s). This shall address System Security Sustainment, Software Assurance, interoperability, Federal Information Processing Standards certification and Annual Information Assurance (IA) Compliance Reviews & Exercises.

The Contractor shall assess the entire cybersecurity posture of the FCI service and remediate configuration and operational security issues before they affect the FCI service. The Contractor shall monitor the environment for security events and operational health. The Contractor shall prevent the compromise of the system from cyberattacks, promote cybersecurity hygiene, while ensuring systems/services comply with DoD cybersecurity requirements. The Contractor shall coordinate with designated government personnel to ensure the FCI services are available and optimized through security gateways.

Additionally, the Contractor will perform all required activities to meet the conditions of the ATO to include:

a) The Contractor shall operate and maintain the software, subscription, service subscriptions and hardware within the Government approved infrastructure to include updating, patching, STIG’ing, and vulnerability scanning in accordance with DISA and DoD standards. The Contractor will install and configure hardware and/or software and provide A&A accreditation support.

CUI

6.1.1 Integrated Master

Schedule

Government Determined Format if available otherwise contractor Determined Format

15 business days after tasking

Weekly, after initial IMS submission to Government

6.1.1 Sub-Contractor

Management Plan

Contractor Format 15 business days after Contract Award

One Time; Updated annually as required

6.1.1 Quarterly Program

Reviews

Contractor Format 3 months after TO start date

Quarterly

6.1.1 Kick-Off/Post Award

Meetings/Conferences

Contractor Format 15 Business Days after TO start date

As required

6.1.1 Meeting Minutes &

Action Items

Government Determined Format if available otherwise contractor Determined Format

2 business days after meeting

As required

6.1.1 Integrated Program

Review

Government Determined Format if available;

otherwise, Contractor Determined Format

5 business days after tasking

Frequency determined by Government

6.1.1 Engineering and

Operation Sync Meeting/s

Government Determined Format if available;

otherwise, Contractor Determined Format

5 business days after tasking

Weekly

6.1.2 Program/Briefing

Documentation

Government Determined Format if available;

otherwise, Contractor Determined Format

5 business days after tasking

As required

6.1.2 Plan of Actions &

Milestones

Government Determined Format if available otherwise contractor Determined Format

5 business days after tasking

As required

CUI

6.1.3 After-Action Reports Contractor Format, Government Approved

3 business days after completion of work

As required

6.1.5 Engineering Artifacts, Architecture, DoDAF Artifacts/Diagrams (AV, OV, SV, StdV, CV)

Government Determined Format if available otherwise contractor Determined Format

5 business days after tasking

As Needed

6.1.5 System Design

Document

Government Determined Format if available otherwise contractor Determined Format

10 business days after tasking

One Time; updated as required

6.1.5 Service Management

Plan (To Address:

Access Management, Event Management, System Monitoring, Incident Management, Request Fulfillment, Service Desk Support Network Operations (NetOps))

Contractor Determined / Government Approved Format

20 business days after tasking

Annually; updated as required

6.1.5 Change Management /

Configuration Management Plan

Contractor Determined / Government Approved Format

20 business days after tasking

Annually; updated as required

6.1.5 Incident Response Plan

and Procedures

Contractor Determined / Government Approved Format

20 business days after

Annually; updated as required

6.1.5 System Administrator

Configuration Guides

Contractor Determined / Government Approved Format

20 business days after tasking

One Time; updated as required

6.1.5 System Security Plan

(SSP)

Contractor Determined / Government Approved Format

20 business days after Execution

Annually; updated as required

6.1.5 Threat Hunting Reports Contractor

Determined / Government Approved Format

5 business days after

As required

CUI

6.1.5 Phase In/Phase Out

Transition Plan and Schedule

Contractor Determined Format

60 business days before TO end date

One Time; updated as required by Government

6.1.5 Assured Compliance

Assessment Solution (ACAS) Scans

Government Determined Format

10 business days after

Bi-weekly, as required by Government

6.1.5 A&A Documentation Government

Determined Format

10 business days after tasking

Annually; updated as required

6.1.5 Threat Mitigation and

TIPPER Report

Contractor Determined / Government Approved Format

Immediately upon discovery of a TIPPER event

As needed

6.1.5 Test Plans and Reports Contractor

Determined / Government Approved Format

Periodically updated, as required by Government

6.1.5 Concept of Operations

(CONOPS)

Contractor Determined / Government Approved Format

20 business days after TO start date

Annually; updated as required

6.1.5 Life Cycle Sustainment

Plan (LCS)

Contractor Determined / Government Approved Format

20 business days after TO start date

One Time; updated as required

6.1.5 Service Operations

Annex (SOX)

Contractor Determined / Government Approved Format

Periodically updated, as required by Government

6.1.5 Continuity of

Operations Plan

(COOP)

Contractor Determined / Government Approved Format

20 business days after TO start date

One Time; updated as required

6.1.5 Standard Operation

Procedures (SOPs)

Contractor Determined / Government Approved Format

10 business days after tasking

One Time; Updated annually as required

6.1.5 Tactics, Techniques, and Procedures (TTPs)

Contractor Determined / Government Approved Format

10 business days after TO start date

One Time; Updated annually as required

CUI

6.1.6 Training Strategy/Plan Contractor

Determined / Government Approved Format

One Time; updated

6.1.6 Training for System

Users and Administrators

Contractor Determined / Government Approved Format

6.1.6 Training Material Contractor

Determined / Government Approved Format

6.1.7 Engineering Artifacts

(e.g., Network/System Diagrams)

Contractor Determined Format

Monthly, as required

6.1.7 White Papers, Information Papers and Decisional Briefs

Contractor Determined Format

Monthly, as required

6.1.7 A&A

Documentation

Government Determined Format if available;

otherwise, Contractor Determined Format

Weekly, updated as required

6.1.7 Vulnerability / eMASS

Reports

Government Determined Format if available;

otherwise, Contractor Determined Format

5 business days after tasking

Weekly, updated as required

6.1.7 eMASS Security Control Assessment

Government Determined Format if available;

otherwise, Contractor Determined Format

15 business days after TO start date

One Time, updated as required

6.1.7 ATO Documentation Government

Determined Format if available;

otherwise, Contractor Determined Format

20 business days after TO start date

CUI

6.1.1 The contractor shall provide

personnel with the appropriate KSA to perform general administrative tasks

90% Comprehensive and current record of the key issues/ requirements, appropriate action items and prioritization of the specific actions is tracked

Calculation:

Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness against AQLs.

6.1.4 The contractor shall manage, maintain, and update present and future documentation. The contractor shall prepare and finalize all presentations/briefings to ensure compliance with Government standard template requirements.

90% of the development and maintenance of the Documentation Management Plan accurately details documentation, repositories, and ownership.

90% of PMO required documentation is timely uploaded, maintained, and updated on the Government required repository

Calculation:

Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness

6.1.1 The contractor shall provide

all services necessary to manage and oversee all aspects of the contract

90% of Key performance parameters to monitor work performance, measure results, and ensure delivery of contracted product deliverables shall be

IAW PWS, SMP,

and ID5 requirements.

90% of contract status reporting documentation shall

Calculation:

Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness

CUI

be timely and accurate IAW PWS, SMP, and ID5 requirements.

6.1.5.2 The Contractor shall

develop a plan that supports the Government’s engineering, development, deployment, and sustainment of the FCI Service, which will be hosted at a Government-provided infrastructure.

95% engineering, development, deployment, implementation, integration, sustainment, testing, and cyber security protection plans shall be accurate, timely, and effective IAW applicable ID5 and DISA review and provided engineering standards.

95% Operation Support reports shall be timely, and accurate IAW PWS, SMP, ID5, and PEO Cyber requirements.

Calculation:

Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness

6.1.5.1 – 6.1.5.7 The Contractor shall provide a CM Plan to include the development and performance of all required supporting documentation and services respectively.

95%: Identify at a minimum the standard CM framework components -configuration identification, change control, status accounting, and auditing.

95%: Encompass of all CI’s required and associated with

Calculation:

Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness

CUI

overall the program's change management plan.

6.1.5.4 The Contractor will

provide operational support in accordance with the DESMF.

DoD uses the DESMF to improve IT Service Management (ITSM) capabilities across the Department via the provision of Tier I, II, III 24x7x365 service desk operational support

100% time to incident documentation, response, escalation, and resolution status shall be IAW the Service Management Plan

(SMP), PWS, ID5,

and PEO Cyber requirements.

90% Operational Service Support Reports shall be accurate and timely as required PWS, SMP, ID5, and PEO Cyber requirements.

90% Operation Support Procedural documents are accurate and timely as required PWS, SMP, ID5, and PEO Cyber requirements.

assessment. Deliverables are assessed for accuracy, completeness, and timeliness

6.1.6.1 The Contractor, at the

discretion of the Government, will provide continual training to DISA & DCDC until conclusion of FCI in production. The Contractor shall develop training materials to prepare FCI users on the FCI features and functions in preparation for day-to-day

100% of training delivery shall be timely, accurate, and effective IAW ID5 and DISA review and provided engineering operational standards.

Calculation:

Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness

CUI

operations.

100% of training and procedural documentation shall be timely, accurate, and effective IAW ID5 and DISA review and provided engineering operational standards.

Any required revisions are minimal.

Revisions within five Business Days, Accepted by COR

6.1.7.1 The Contractor shall

provide the full range of engineering support necessary to incorporate new/future technologies into the FCI service/baseline after initial deployment and must have expertise in both traditional IT infrastructure and cloud computing. The Contractor shall provide comprehensive technical/engineering support services to include design, implementation, modification, and sustainment of FCI projects and work activities

95% of the engineering / architecture / network documents and diagrams are accurate and in compliance with ID5 and DISA provided engineering standards.

Any required revisions are minimal.

Revisions within five Business Days, Accepted by COR

Calculation:

Qualitative deliverable assessment. Deliverables are assessed for accuracy, completeness, and timeliness

6.1.7.6 The Contractor shall

establish and maintain an integrated test lab that will support a full range of integration test activities for

95% of the test plans and test report are accurate and in compliance with ID5 and DISA

Calculation:

Qualitative deliverable assessment. Deliverables are assessed for accuracy, CUI both the currently fielded system, and future maintenance/modernization releases.

provided engineering testing standards.

Any required revisions are minimal.

Revisions within five Business Days, Accepted by COR completeness, and timeliness

6.1.7.7 The contractor shall

provide expertise, knowledge, understanding, support and implementation of all phases of the Risk Management Framework (RMF) and A&A lifecycle in support of FCI.

100% Compliance with RMF Standards

100% Maintenance of all operational RMF standards to include but not limited to Interim Authority to Test (IATT), Interim Authority to Operate (IATO), Authority To Operate Conditional (ATO-C), and Authority To Operate (ATO) for the FCI…