PWS Investigative Tool CSM System Draft.docx

IT Division 15

Source Management and Under Cover Modernization Performance Work Statement DRAFT – For AWARD in 09/2025

Table of Contents

BACKGROUND

The Naval Criminal Investigative Service (NCIS) is an organization of approximately 3000 personnel of which 850 serve at Headquarters and the remaining staff serve at offices worldwide. NCIS is the Department of the Navy (DoN) component with primary responsibility for criminal investigation, law enforcement (LE), counter-terrorism (CT), counterintelligence (CI), and physical and personnel security matters. NCIS has the primary investigative and CI jurisdiction within the DoN, and exclusive investigative jurisdiction in non-combat matters involving actual, potential, or suspected criminal, terrorism, sabotage, espionage, and subversive activities. Further, NCIS has primary responsibility for liaison on all criminal investigative, CI, and security matters with Federal, state, local law enforcement, facility security, and intelligence agencies. Reviewing the revised NCIS Charter known as SECNAVINST (Secretary of the Navy Instruction) 5430.107 will provide insight into NCIS roles and responsibilities. Additional information on NCIS can be found at our public website http://www.ncis.navy.mil.

Source Management is an integral capability related to NCIS core mission areas including Criminal Investigations, and Cyber Investigations. Sources are identified and managed by NCIS agents, as well as USMC and USN Criminal Investigators and provide valuable leads and data to forward the NCIS mission to investigate and defeat criminal, terrorists, and foreign intelligence threats while protecting the people, equipment, technology and infrastructure of the United States Navy and Marine Corps.

The vision for the Source Management System is to provide a web-based common solution for NCIS agents worldwide. The solution selected will be installed on the unclassified (NIPR) network.

SCOPE

The scope of this Performance Work Statement (PWS) includes all software licensing, services and written material necessary to install, integrate data and business processes, and configure and sustain both a source management application (CSM), and an Under Cover Management (UC) application (all are COTS solutions known commercially on the GSA schedule). On the NCIS Unclassified network (NIPR), both an installation of CSM and UC will be included. Additionally, on the NCIS Secret network (SIPR), an installation of UC will also be included. Licensing will include the rights to install 3 environments for each application, which are Train, Test, and Production. Written materials in support of the applications, and ongoing production support onsite and/or via remote login, via phone, and email during the period of performance is to be included.

The Government will provide the hardware (servers) and hands-on system administration to work collaboratively with the contractor provided labor necessary to maintain/upgrade/enhance/remediate the software on the networks as Government Furnished Equipment. The primary location of performance is NCIS Headquarters, Russell Knox Building, 27130 Telegraph Road, Quantico, VA 22134. There may be some development and support activities, as well as program management activities that will occur off-site with government concurrence.

The contractor shall provide support for the installation, and tailoring of the application to meet NCIS business requirements. The contractor shall provide documentation for the installation, and operations of the system to include Standard Operating Procedures for the Start/Stop of the application, database, and servers, backup procedures, restore procedures, as well as troubleshooting and escalation procedures for support to be provided by the contractor when required under contract.

Project Management Progress Reports The contractor shall provide no less than bi-weekly progress reports for each task listed under section 4 of this PWS. The progress reports shall detail completed and remaining activities, completion metrics, and areas of concern. Other topics may be included at the government’s discretion or with government consent.

Technical Deliverables Utilizing standard industry methodology and best practices, the contractor shall assist (side by side) government led systems administrators to perform all necessary activities to complete the provisioning of servers, installation, configuration to include both applicable DoD Security Technical Implementation Guides (STIGs), and functional configuration of application related items, such as user interface, data, workflow, and reports.

a. Licensing of Software Products – The contractor shall provide Investigative Tool software license for the installation of 3 environments (Test/Train/Prod) on NIPR for the 3 applications (1 CSM, and 2 UC). The environments will be utilized for testing, training, and production on the network. The government will furnish the license(s) for the server operating system(s), application platform, and database platform.

b. Maintain the application that is written on the Microsoft .Net platform.

c. Deliver software enhancements and defect corrections on a regular schedule as agreed upon with the government throughout the period of performance.

d. Support for DoD Security Technical Implementation Guides (STIGs) – The contractor shall provide support and collaborate with NCIS system administrators in the installation and ongoing maintenance of DoD STIGs.

e. Integration Activities – The contractor shall work closely with NCIS agents and analysts to configure the user interface (UI), workflow(s), approval(s), and reports.

f. Ongoing Maintenance and Support – The contractor shall provide Standard Operating Procedures for communicating with the contractor to report defects, and to request enhancements throughout the period of performance.

Source Management Functional Requirements See Appendix A – Functional Requirements Under Cover Management Functional Requirements See Appendix B – Functional Requirements

Project Closeout The contract shall coordinate and provide a briefing on the project close out activities within thirty (30) days of closeout. Project closeout activities shall include:

a. Final Product Acceptance Checklist

b. Project Artifacts Checklist

c. Lessons Learned

d. Post-Implementation Plan(s)

e. Documented Open Issues Production Maintenance The contractor shall coordinate and provide a knowledge transfer of the following information:

a. The contractor shall document all standard operations procedures to be executed by NCIS IT staff in support of the system.

b. The contractor shall document all service levels to be achieved in the support of the system.

Deliverables All information, records, data, files, documents, and work papers obtained or created in support of this PWS shall become, and remain, the property of the Government and shall be returned or disposed of in accordance with the Contracting Officer’s Representative’s (COR) instructions at the conclusion of this contract.

Deliverables developed under this contract shall be delivered as indicated in Section 4.1, Schedule of Deliverables.

The contractor shall obtain, store, maintain and reproduce the required source code, technical data and applicable documents, plans, regulations, specifications, and other pertinent data as appropriate for fulfilling the tasks described in this PWS. When appropriate procedures exist, the contractor shall acquire the above information directly; however, in instances where the data and/or procedures are to be created, the contractor is expected to follow procedures once they are approved by the Government and made available. The contractor shall obtain these data from both Government and non-Government sources.

The contractor shall provide the Government or other agencies, as approved by the COR, access to any and all program information and data prepared or obtained as part of this contract or in support of any tasking of this PWS.

Section 508 of the Rehabilitation Act requires Federal agencies to make their electronic and IT accessible to people with disabilities. This applies to all Federal agencies when they develop, procure, maintain, or use electronic and IT.

All electronic and information technology (EIT) procured through this effort must meet the applicable accessibility standards specified in 36CFR1194.2, unless an agency exception to this requirement exists.

Government has made the following schedule, however; changes can be made with concurrence with both contractor and Government approval.

Schedule of Deliverables

Acceptance of Project Deliverables The COR will review contractor deliverables in accordance with specifications and standards identified during the contract kick-off meeting, any directives issued by the COR or ACOR during the life of this contract, and the Quality Assurance Surveillance Plan (QASP). Deliverables will be submitted to the COR. The acceptance of deliverables and satisfactory work performance, required herein, shall be based upon the timeliness and accuracy of the deliverables as described in the QASP. Only the Contracting Officer and/or COR that initiated a specific tasking has the authority to accept or reject associated deliverables.

0. Quality The contractor shall provide internal quality assurance IAW via the Quality Assurance Surveillance Plan.

The Government will provide quality assurance surveillance in accordance with the Government QASP.

0. Performance Details Period of Performance The period of performance for the PWS is for a base year, plus four option years.

Place of Performance Approved Contractor Locations- Telework can be authorized on a case by case for the contractor when deliverables are unclassified. If telework authorization is changed/revoked, then the contractor will be required to work at NCIS facilities.

The primary place of performance for this effort shall be either:

Headquarters Naval Criminal Investigative Service Russell-Knox Building 27130 Telegraph Road Quantico, VA 22134 NCIS New York Resident Unit (NENY) 201 Varick Street, #1009 New York, New York 1001407053

Travel Performance under this contract shall require occasional travel by Contractor personnel. The Government will reimburse the Contractor for allowable travel costs incurred by Contractors in performance of the contract and determined to be in accordance with the FAR subpart 31.2. Travel shall be first approved by the COR, and shall be within the specified travel ceiling.

The Contractor will also be required to perform travel to NCIS Headquarters, Quantico, VA.

Reimbursement of travel expenditures

(a) Travel

All contractor personnel required to perform work on any U.S. Navy vessel will have to obtain boarding authorization from the Commanding Officer of the vessel prior to boarding.

(2) Travel Policy. The Government will reimburse the contractor for allowable travel costs incurred by the contractor in performance of the contract and determined to be in accordance with FAR subpart 31.2, subject to the following provisions:

Travel required for tasks assigned under this contract shall be governed in accordance with rules set forth for temporary duty travel in FAR 31.205-46.

(3) Travel. Travel, subsistence, and associated labor charges for travel time are authorized, whenever a task assignment requires work to be accomplished at a temporary alternate worksite.

Travel performed for personal convenience and daily travel to and from work at contractor's facility will not be reimbursed.

(4) Per Diem. Per diem for travel on work assigned under this contract will be reimbursed to employees consistent with company policy, but not to exceed the amount authorized in the Department of Defense Joint Travel Regulations.

(5) Shipboard Stays. Whenever work assignments require temporary duty aboard a government ship, the contractor will be reimbursed at the per diem rates identified in paragraphs C8101.2C or C81181.3B(6) of the DOD Joint Travel Regulations, Volume 2.

(6) Air/Rail Travel. In rendering the services, the contractor shall be reimbursed for the actual costs of transportation incurred by its personnel not to exceed the cost of tourist class rail, or plane fare, to the extent that such transportation is necessary for the performance of the services hereunder and is authorized by the Ordering Officer. Such authorization by the Ordering Officer shall be indicated in the order or in some other suitable written form.

NOTE: To the maximum extent practicable without the impairment of the effectiveness of the mission, transportation shall be tourist class. In the event that only first class travel is available, it will be allowed, provided justification therefore is fully documented and warranted.

(7) Private Automobile. The use of privately owned conveyance within the continental United States by the traveler will be reimbursed to the contractor at the mileage rate allowed by Joint Travel Regulations. Authorization for the use of privately owned conveyance shall be indicated on the order. Distances traveled between points shall be shown in standard highway mileage guides. Any deviations from distance shown in such standard mileage guides shall be explained by the traveler on his expense sheet.

(8) Car Rental. The contractor shall be entitled to reimbursement for car rental, exclusive of mileage charges, as authorized by each order, when the services are required to be performed outside the normal commuting distance from the contractor's facilities. Car rental for TDY teams will be limited to a rate of one car for every four (4) persons on TDY at one site.

Certifications

Contractor staff members performing work under this PWS and performing functions specified in SECNAV M-5239.2, shall be transitioned from the previous Information Assurance Workforce structure to the Cyber IT/Cybersecurity Workforce (Cyber IT/CSWF) structure. The Cyber IT/CSWF is managed by the Cyber IT/CSWF Program Manager (Cyber IT/CSWF PM). Contractor support personnel assigned to perform cyberspace specialty tasks must meet qualification standards established in the DON Cyber IT/CSWF Program requirements of the Information Assurance (IA) categories in the DoD 8570.01-M are the only standard for determining whether IA work is being accomplished and what commercial certifications are required. As DoD and DON guidance is determined for CSWF for contract personnel the contractors will comply with the latest guidance. The current DON guidance is derived from SECNAV M-5239.2 Appendix 4. Contractor positions are expected to be designated Cyber IT/CSWF and at that time the positions will be assigned a specialty code within one of five categories - Security Provision, Operate and Maintain, Protect and Defend, Investigate, Oversee and Govern. Contractor personnel must have a baseline certification prior to reporting but are allowed six months from reporting to acquire specialty code related training. All training is the sole responsibility of the contractor employee and/or contractor employer. Each Authorized, Enhanced and Core User of DON, including contractors, must maintain the appropriate security clearance, have a current user access agreement, have an appointment letter designating Cyber IT/CSWF and if applicable, a Privileged Access Agreement and have completed approved cybersecurity awareness training prior to accessing DON networks. Any deviation or waivers of qualifications must be reviewed on a case by case basis by the Cyber IT/CSWF PM and approved by the Senior Security Officer.

Security Requirements The Contractor shall be a United States Contractor, licensed, chartered, or incorporated in the United States and personnel shall possess a valid DoD SECRET clearance.

A DD254 will be processed to address other security concerns.

Hours Unless otherwise noted or coordinated, onsite Government facility hours are from 0700-1600 local time.

Federal Holidays The Government observes the following Federal Holidays: New Year’s Day, Martin Luther King’s Birthday, George Washington’s Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, and Christmas Day. If the holiday falls on Sunday, it will be observed on the Monday immediately following the holiday. If the holiday falls on Saturday, it will be observed on the immediately preceding Friday.

Points of Contact Contract Specialist:

COR:

TBD

Source Management and Under Cover Modernization PWS

Source Management and Under Cover Modernization PWS

Appendix A – Source Management Functional Requirements Note regarding requirements: The requirements listed are a representative sample at the time the PWS was written. This is a living document in that the list is managed and updated through the Agile Methodology Systems Development Lifecycle utilized throughout the duration of development activities in the execution of the contract.

BR-4

32, FR-33, FR-34, FR-35

Appendix B – Under Cover Management Functional Requirements Note regarding requirements: The requirements listed are a representative sample at the time the PWS was written. This is a living document in that the list is managed and updated through the Agile Methodology Systems Development Lifecycle utilized throughout the duration of development activities in the execution of the contract.

BR-4

32, FR-33, FR-34, FR-35

Appendix C: Acronyms

IAVA

IAW

Information Assurance Vulnerability Alerts In Accordance With

PWS

QASP

Performance Work Statement Quality Assurance Surveillance Plan

STIG

TB

Security Technical Implementation Guide Terabyte

Source Management and Under Cover Modernization PWS 12 image1.png