PWS MSC Cyber 832572693_Draft.pdf

Military Sealift Command Cybersecurity Support Services

CUI

PERFORMANCE WORK STATEMENT (PWS)

Award/Mod Effective Version Date Award To Be Determined (TBD)

Contract Number: TBD Task Order Number: TBD Contractor Name TBD Tracking Number: 832016440 Follow-on to Previous Contract and Task Order Number:

GS-35F-0414U/HC102821F0400

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 – Points of Contact

b. Alternate COR (ACOR). See DITCO Additional Text G1 – Points of Contact

c. See DITCO Additional Tex G1 – Points of Contact

2. Contract or Task Order Title. Military Sealift Command (MSC) Cybersecurity Support Services (CSS)

3. Background. MSC N62 Cybersecurity Division supports the mission of MSC by applying the principles of Department of Defense (DoD) information and technology (IT) management and information technology security.

This includes securing, defending, and preserving the integrity of MSC's Command, Control, Communications, and Computer Systems (C4S) infrastructure and the data residing on it by managing the risks of cybersecurity threats and vulnerabilities. It incorporates security safeguards directed by the Federal Government, DoD, and Department of the Navy (DON), and provides information on security best practices. Instructions and mandates implemented by MSC N62 include Federal Information Security Management Act of 2002 (FISMA), Department of Defense Instruction (DoDI) 8500, DoDI 8510.01, and Secretary of the Navy Instruction 5239.1E.

4. Objectives. The contractor shall provide service support in the areas of cybersecurity operations, risk management and compliance. Specifically, the contractor shall support vulnerability management; cybersecurity site visits to assist civilian and contract mariners with patching and scanning of systems and networks; afloat site, system, and operational technology Assessment and Authorization (A&A) support, mission-based cybersecurity risk assessments; and all elements of cybersecurity compliance inspections.

5. Scope. MSC has a requirement for CSS. MSC requires in-depth knowledge of Navy and DoD cybersecurity directives and procedures. The contractor will require management and technical expertise in cybersecurity operations, risk management, and compliance.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 10% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to Federal Acquisition Regulation (FAR) 52.217-8.

• Performance Area 1 – Cybersecurity Operations Support

• Performance Area 2 – Cybersecurity Assessment, Authorization, and Implementation

• Performance Area 3 – Cybersecurity Compliance

6. Performance Requirements.

6.1 Task 1 - Project Management

CUI

6.1.1 Subtask 1 - Contract Level Management. The contractor shall prepare a Management Plan describing the technical approach, organizational resources and management controls to be employed to meet the cost, performance and schedule requirements throughout contract execution. The plan shall be delivered at the Kickoff Meeting, which shall be scheduled No Later Than (NLT) ten (10) business days after contract award.

6.1.2 Subtask 2 - Task Management. The contractor shall prepare a Task Management Plan ten (10) business days after contract award. This plan shall describe the technical approach, resources, and management controls to be employed to meet cost, performance, and schedule requirements throughout task execution. The plan shall be delivered at the kickoff meeting. The contractor shall maintain a schedule for all assigned activities. The contractor shall provide a weekly report and should include, at a minimum, an executive summary of work completed and associated outcomes and a current schedule for assigned activities, inclusive of the following details:

• Operational need date

• Percent complete

• Anticipated completion date

• Anticipated outcomes

• Issues/Concerns

• Government action required

6.1.3 Subtask 3 - Meeting Support. The contractor shall coordinate the attendance of key personnel at CSS meetings.

Meetings will be scheduled based on Government requirements. The contractor shall provide the status of assigned projects and action items. The contractor shall provide meeting minutes for every meeting attended by assigned contractor personnel. Cybersecurity discussions and action items shall be highlighted and summarized.

6.1.4 Subtask 4 - Performance Measurement. The contractor shall monitor performance standards (by task) and report on performance assessment monthly.

6.1.5 Subtask 5 - Process Improvement. The contractor shall document lessons learned during each project. Lessons learned shall be incorporated into Standard Operating Procedures (SOPs) where appropriate.

6.1.6 Subtask 6 - Quality Assurance. At the Kickoff Meeting, the contractor shall provide a quality assurance approach for task order services and deliverables. The contractor shall provide specific processes to be used to ensure quality services and deliverables are provided within established due dates. The contractor shall review documentation to be reviewed for accuracy and completeness before submitting the documents for Government review.

6.1.7 Subtask 7- Quality Management Plan (QMP). At the Kickoff Meeting, the contractor shall provide an initial draft of a task order QMP To assure quality, the contractor shall incorporate any comments or feedback received from MSC stakeholders into subsequent versions.

6.1.8 Subtask 8 - Weekly Project Status Report. The contractor shall provide Weekly Project Status Reports in the form of a weekly status brief and meeting with the Technical Point of Contact (TPOC) as well as other Government and support contractor personnel deemed appropriate by the TPOC. The contractor shall supply the briefing slides for the Weekly Status Meeting one full business day prior to the scheduled meeting.

6.1.9 Subtask 9 - Monthly Project Status Report (MSR). The contractor shall provide an MSR (first through the last day of the month) that documents task order progress, status, quality assurance and cost reporting. The MSR will also contain the current Performance Assessment for the reporting month. The contractor shall provide an independent internal Quality Assurance (QA) review of the accuracy and completeness of the MSR.

The monthly report should include, at a minimum:

• Summary of the month’s activities, accomplishments and concerns

• Description of tasks performed during the previous reporting period and the personnel that performed the tasks.

CUI

• List of all deliverables submitted during the reporting period

• Highlighted areas of performance (i.e. areas of improvement, areas of excellence).

• Personnel issues, including any planned time off or significant personnel activity (e.g.

additions/removals from contract, corporate visits, personnel gaps, training events).

• Contact information for personnel supporting contract.

• Systemic cybersecurity concerns, associated source requirement, risk assessment, residual risk and mitigation/remediation recommendations.

• Responses and corrective plan for any deficiencies identified in Contract Performance Report or

Contract Discrepancy Report.

• Quality assurance activities

• Cost reporting

The MSR should be delivered using contractor format within 15 calendar days after the end of the previous month and discussed during monthly meetings with the COR.

6.1.10 Subtask 10 - Performance Assessment. The contractor shall conduct an evaluation of the Performance Assessment Deliverable, verifying that project processes are defined and implemented to accurately monitor and report on our ability to meet all pertinent performance standards monthly. The Performance Assessment is delivered monthly as a component of the MSR.

The contractor shall use the Performance Standards checklist, in conjunction with the task order deliverables list, to assess our performance, monthly. The contractor shall track the number and type of occurrences whereby they do not meet the performance standards set forth by this contract. The contractor shall provide independent internal QA review of the accuracy and completeness of the Performance Assessment.

6.1.11 Subtask 11 - Summary Cost Reports (SCR). Not later than the 15th of each month, the contractor shall conduct an evaluation of the Cost Report Deliverable, verifying that project processes are defined and implemented to accurately capture and report costs incurred from the first through the last day of each month.

6.1.12 Subtask 12 - Cybersecurity Workforce. The contractor shall ensure that all staff comply with certification requirements identified in DoD 8570.01-M. The contractor shall prepare a Cybersecurity Workforce (CSWF) report semi-annually that describes the current CSWF level for each contract team member, certification status, and number of hours of training completed for the calendar year. The report should be updated and delivered upon staff replacement as well.

Deliverables:

PWS

Task#

Deliverable Title Format Due Date Distribution/ Copies

Frequency and Remarks

6.1.1 Management Plan Electronic, Microsoft

Office Products

Within 10 Business Days of Award

Contracting Officer (KO) and COR

One Time

6.1.2 Task Management

Plan

Electronic, Microsoft Office Products

Within 10 Business Days of Award, Thursday

COR Weekly

6.1.3 Meeting Minutes Electronic, Microsoft

Office Products

2 Days After Meeting

TPOC As Required

6.1.4 Performance

Measurement Report

Electronic, Microsoft Office Products

15th of Each Month COR Monthly

6.1.5 Lessons Learned

Report

Electronic, Microsoft Office Products

5 Business Days Upon Completion

COR As Required

CUI

PWS

Task#

Deliverable Title Format Due Date Distribution/ Copies

Frequency and Remarks

6.1.6 Quality Assurance

Approach

Electronic, Microsoft Office Products

Kickoff Meeting COR One Time

6.1.7 Quality

Management Plan

Electronic, Microsoft Office Products

Within 10 Business Days of Award

COR One Time

6.1.8 Weekly Project

Status Report

Electronic, Microsoft Office Products

Thursday COR and

TPOC

Weekly

6.1.9 Monthly Project

Status Report

Electronic, Microsoft Office Products

15th of Each Month COR and

TPOC

Monthly

6.1.10 Performance

Assessment

Electronic, Microsoft Office Products

15th of Each Month COR and

TPOC

Monthly

6.1.11 Summary Contract

Cost Report

Electronic, Microsoft Office Products

15th of Each Month COR and

TPOC

Monthly

6.1.12 Cybersecurity

Workforce Report

Electronic, Microsoft Office Products

Semi-Annually and Upon Staff Replacement

COR and

TPOC

As Required

6.2 Task 2. Cybersecurity Operations

6.2.1 Subtask 1. Cybersecurity Incident Support.

6.2.1.1 Ticket Management. The contractor shall be responsible for reviewing and responding to Afloat and Ashore Navy Enterprise Service Desk (NESD) HELIX tickets assigned to N62. The contractor shall analyze and determine the appropriate resolution and recommend for action within one business day. The contractor shall track each HELIX ticket to closure and provide daily and weekly reports that contain HELIX ticket open and close dates, ship or site affected, subject of HELIX ticket, HELIX ticket number, and updates of all activities related to HELIX ticket.

6.2.1.2 Cyber Incident Support. The contractor shall provide support in the areas of Electronic Spillage (ES), Incident Response (IR), for both afloat, and ashore networks. This includes daily and weekly updates and responding to queries from Navy Cyber Defense Operations Command (NCDOC), Command Information Systems Security Manager (ISSM), Afloat ISSMs, Command Security Manager’s Office, and shipboard Communications Department personnel. All communications should be responded to within one business day. Updates shall be made to NCDOC each business day until the NCDOC ticket is closed. The contractor shall provide initial ES/IR forms to Command ISSM, Afloat ISSMs and Ship Communications Department personnel, receive and quality check ES/IR documentation from ship in preparation for distribution to MSC Security Staff and external FLTCYBERCOM/NAVNETWARCOM Staff. The contractor shall track each ES/IR to closure and provide daily and weekly reports that contain ES/IR open and close dates, ship or site affected, subject of ES/IR, ES/IR incident number and updates of all activities related to any related HELIX tickets. They will develop and maintain a SOP to govern the process.

6.2.2 Subtask 2 - Information Assurance Vulnerability Management (IAVM); Patching, Scanning, Data Analysis, and Training. The contractor shall provide patch management services using automated tools or manual methods to push builds and patches to physical or remote servers and workstations. Patch management includes monitoring server and workstation baseline configurations for compliance; adhering to strict configuration, change, and release management procedures; assisting ship Communications Department with training and patching problems; and resolving server baseline incidents and problems associated with patching.

6.2.2.1 Patch Distribution.

• The contractor shall develop and maintain a patch management SOP as a Government deliverable.

• The contractor shall produce Shipboard Management Information System (SMIS) patch disks and other patch disks as required by new MSC IT systems. Patch disks are required for all excepted afloat MSC networks and systems as approved by the TPOC. Patch distribution will be approximately 400

CUI

disks with occasional increases of another 100 disks to meet mission requirements. MSC owns the hardware and software for patch disk creation.

• The contractor shall also deliver an electronic version of the patch disk for electronic distribution to MSC ships, fleet communication support personnel, and the MSC Network Operations Center for use with Microsoft Endpoint Configuration Manager.

• The contractor shall utilize differential patch production by providing a SMIS patch disk set monthly, which only differs from the previous month in that the disk contains only the patches released that month or as directed by the TPOC. In addition, provide cumulative patch disc semi-annually or as directed by the TPOC.

• The contractor shall provide out of band patches, patch support, and emergent updates as prioritized from the TPOC.

• The contractor shall provide a tracking mechanism to monitor the differential patch distribution, implementation, scanning, receipt of scans and upload of scans for each assigned vessel. Once the scan data is received and the format is verified, the contractor shall input the data into the Vulnerability Remediation Asset Manager (VRAM) to capture release to the fleet and tailor the VRAM baseline to identify what system owned vulnerabilities are. If the information is not in the proper format, a new scan from the vessel shall be requested.

• The contractor shall test the patch disk in both the lab and shipboard environment prior to duplication and distribution. A test plan is required five (5) days prior to testing and a test report will be delivered three (3) days after the completion of patch disk testing. Test report should include both before and after Assured Compliance Assessment Solution (ACAS) scans to validate that the patches were successfully applied on the tested systems.

• The contractor shall create and submit MSC Change Requests to update software associations and system documentation for all monthly software updates that are included in MSC patch disk creation.

• The contractor shall create and submit MSC Change Requests for IAVMs identified as program owned.

• The contractor shall acknowledge report, update, and maintain the IAVM baseline in VRAM as approved by the TPOC.

6.2.2.2 Patching.

• The contractor shall obtain and maintain a MSC NESD HELIX account to receive identified cybersecurity patch trouble tickets forwarded from the Tier 1 help desk. In addition, the contractor shall be required to work towards a resolution for all cybersecurity patch trouble tickets and only close with the concurrence of the TPOC.

• The contractor shall conduct analysis on need for remote or on-site assistance with patching. Achieve efficiencies and reduce costs while meeting patching requirements by consolidation, remote management, and sound resource management.

• The contractor shall develop patch repositories accessible to both contractors and Afloat ISSMs for both on-site and remote assistance with patching.

6.2.2.3 Vulnerability Scanning in Support of IAVM Analysis.

• The contractor shall ensure that all network assets utilized by MSC are powered on prior to performing scans. Networks include Afloat Release 2.1 (AR2.1); Afloat Classified Global Operating System Upgrade Project Version 3 (ACGV3); SMIS Mini; Mobile Expeditionary Communications Kit (MECK); Network Management System (NMS); Computer Network Defense – Operating System Environment (CND-OSE), Navigational Aid System (NAVAIDS), Visual Information (VI) and any other afloat IT assets within the MSC Afloat shipboard network. The range of devices per ship per network is between one and 120. There are approximately 100 ships to be scanned each month, each

CUI

ship having between one to eight systems to be scanned. The number of ships may vary depending on the number activated at any given time.

• The contractor shall perform pre-scans of the AR2.1; ACGV3; SMIS Mini; MECK; NMS; CND-OSE;

NAVAIDS; VI and other IT networks to capture the cybersecurity posture of the assets prior to patching.

• The contractor shall perform post-scans of the AR2.1; ACGV3; SMIS Mini; MECK; NMS; CND- OSE; NAVAIDS; VI and other IT networks to capture the cybersecurity posture of the assets post patching.

• The contractor shall perform analysis and provide reports to the afloat ISSM and TPOC.

• The contractor shall troubleshoot and correct ACAS scan errors, and re-scan as required to capture a successful scan to include failed assets, credential issues, and other items related to scan quality or integrity.

6.2.2.4 Data Analysis.

• The contractor shall maintain MSC Afloat structure within VRAM.

• The contractor shall analyze VRAM results to determine fleet vulnerability trends by network and aid in the development of MSC platform specific fixes or mitigations. The contractor shall provide a consolidated report to the TPOC and coordinate MSC Change Request for recommended remediations or actions.

• The contractor shall analyze data from VRAM extracts and status reports to determine the effectiveness of fixes, mitigations, and provide recommendations.

• The contractor shall verify the success of scan and patch efforts during ship visits through post scan report analysis.

• The contractor shall analyze AR2.1; ACGV3; SMIS; MECK; NMS; CND-OSE, NAVAIDS, VI and other IT system configurations in relation to the accepted baseline configurations and identify root cause issues for systems resistant to patching.

• The contractor shall analyze data from Endpoint Security System (ESS) and other situational awareness products to identify trends and actions for systems not within baseline (e.g. Universal Serial Bus (USB) violations, Security Technical Implementation Guide (STIG) configuration issues).

While the number of analysis activities will vary each month, it is estimated that analysis activities will take 40 hours each week.

6.2.3 Subtask 3 - Shipboard Training and Assist Visits.

6.2.3.1 Training and Assist Visits.

• The contractor shall work together with Government personnel, develop ship visit schedules based on requests for assistance, patching compliance, and ship availability. Schedule should be updated on a weekly basis at a minimum and posted to the MSC SharePoint portal or as designated by the TPOC.

• The contractor shall conduct in-briefs with the ship’s Captain/Master and supporting personnel notifying them of the work being conducted for the duration of the visit.

• The contractor shall conduct out-briefs with the ship’s Captain/Master and supporting personnel notifying them of the work conducted during the visit and the cybersecurity posture of their ship.

• The contractor shall coordinate ship visits with TPOC and MSC Program Manager (PM) Liaisons to determine ship availability.

• The contractor shall coordinate with MSC Afloat Teams for scheduling of technician deployments for Continental United States (CONUS) and Outside Continental United States (OCONUS).

• The contractor shall submit Travel Authorization Requests to MSC COR for approval.

CUI

• The contractor shall submit visit requests via Defense Information System for Security (DISS) for each site visit.

• The contractor shall coordinate with shipyards to ensure appropriate access requests and documentation are submitted prior to technicians executing travel so they can access ships as scheduled.

Estimate 150 ship visits per year that require travel, though no less than 8 per month. Estimate 6-8 local ship visits per month. Ship visits may need to be conducted remotely in extenuating circumstances.

6.2.3.2 Patching.

• During ship visits, the contractor shall implement patch management of the AR2.1; ACGV3; SMIS Mini; MECK; NMS; CND-OSE; NAVAIDS; VI and other IT networks in accordance with (IAW) MSC SOPs.

Patch distribution will consist of approximately 400 monthly disks.

6.2.3.3 Scanning in Support of Ship Visits.

• The contractor shall ensure that all the AR2.1; ACGV3; SMIS Mini; MECK; NMS; CND-OSE;

NAVAIDS; VI and other IT assets within the MSC Afloat shipboard network are powered on prior to performing scans. The range of devices per ship is between one and 120.

• The contractor shall perform pre-scans of the AR2.1; ACGV3; SMIS Mini; MECK; NMS; CND-OSE;

NAVAIDS; VI and other IT networks to capture the cybersecurity posture of the assets prior to patching to include with Daily Ship Visit Reports.

• The contractor shall perform post-scans of the AR2.1; ACGV3; SMIS Mini; MECK; NMS; CND- OSE; NAVAIDS; VI and other IT networks to capture the Information Assurance (IA) posture of the assets post patching to include with Daily Ship Visit Reports.

• The contractor shall troubleshoot and correct ACAS scan errors, and re-scan as required in order to capture a successful scan to include failed assets, credential issues, and other items related to scan quality or integrity.

• The contractor shall ensure scan periodicity, assets scanned, and scan integrity are reconciled against ACAS scans.

6.2.3.4 Training. The contractor shall provide shipboard cybersecurity training and assistance to shipboard System Administrators. The goal of training is to increase privileged user knowledge in applying delivered patches, increase cyber hygiene, and become more efficient in executing cybersecurity policies, procedures, and functions independently.

6.2.3.5 Ship Visit Reporting Requirements. The contractor shall provide the following deliverables at the completion of each ship visit:

• Updated VRAM entry to include scan results conducted during visit.

• Daily Update via Task Lead of onboard status to include any issues or concerns.

• Ship Visit Report entered into the Knowledge Management Dashboard.

• Lessons Learned Report entered into the Knowledge Management Dashboard.

6.2.4 Subtask 4 - Knowledge Management.

• The contractor shall develop and maintain a HELIX ticket knowledge management dashboard. The

HELIX ticket knowledge management dashboard will be used to identify weaknesses, determine trends to better utilize security resources, and judge the success or failure of implemented security solutions. The HELIX ticket dashboard will contain all HELIX ticket information contained on the

CUI

daily and weekly HELIX ticket reports and any other information required by the TPOC. The Government should be able to pull queries from the dashboard on an as needed basis for trend analysis.

• The contractor shall develop and maintain an ES/IR ticket knowledge management dashboard to identify weaknesses, determine trends to better utilize security resources, and judge the success or failure of implemented security solutions. The Government should be able to pull queries from the dashboard on an as needed basis for trend analysis.

• The contractor shall develop and maintain a dashboard of all Training and Assist Visits to include information from Daily Ship Visit Reports (DSVRs) to assist with trend analysis and areas of improvement. The Government should be able to pull queries from the dashboard on an as needed basis for trend analysis.

• The contractor shall develop and maintain a dashboard to capture ESS violations and system misconfigurations identified by ESS or other tools to allow for streamlined analysis and reporting. The Government should be able to pull queries from the dashboard on an as needed basis for trend analysis.

6.2.5 Subtask 5 – Reporting.

• On a weekly basis, the contractor shall provide status of open trouble tickets regarding the MSC ships.

• The contractor shall provide status of VRAM uploads and issues with AR2.1; ACGV3; SMIS Mini;

MECK; NMS; CND-OSE; NAVAIDS; VI and other shipboard IT networks scan data.

• The contractor shall generate rejection notifications and provide to the ship and afloat ISSM for unacceptable shipboard scans to include root cause analysis of scan failure.

• The contractor shall compose Fleet Notification Letters for distribution with the MSC Patch Disks including special instructions, notifications, or reporting requirements for AR2.1; ACGV3; SMIS Mini; MECK; NAVAIDS, VI; and other systems as required.

• The contractor shall document comprehensive patch disc test plans and testing reports to annotate actions taken for testing of patch discs on MSC systems prior to duplication approval.

• The contractor shall coordinate communication and efforts across the IAVM Tracking/Reporting and Patching/Scanning Teams to identify specific areas of concern for target ships.

• The contractor shall adapt change reporting mechanisms and processes to ensure reports remain relevant as operational needs change.

Deliverable Title

Format Due Date Distribution/ Copies

Frequency and Remarks

6.2.1.1 NESD

HELIX

Ticket Report

Electronic, Correspondence via Email and HELIX Ticket System

1 Business Day from Receipt

TPOC Daily

6.2.1.1 NESD

HELIX

Ticket Report

Electronic, Microsoft Office Products; and input into Knowledge Management Dashboard

0900 Wednesday TPOC Weekly

6.2.1.2 Incident

Status Report

Electronic, Microsoft Office Products; and input into Knowledge Management Dashboard

0900 Wednesday TPOC Weekly

6.2.2.1 Patch Disk

Test Plan

Electronic, Microsoft Office Products

Required 5 days prior to testing

TPOC Monthly and ad hoc as Required

CUI

PWS

Task#

Deliverable Title

Format Due Date Distribution/ Copies

Frequency and Remarks

6.2.2.1 Patch Disk

Report

Electronic, Microsoft Office Products

Delivered 3 days after the completion of patch disk testing

TPOC Monthly and ad hoc as Required

6.2.2.1 Patch Disk CD/DVD Media Monthly and ad hoc

as required

TPOC/Fleet Monthly and ad hoc as required

6.2.2.1 Patch

Management

SOP

Electronic, Microsoft Office Products

30 days after contract start; reviewed monthly or at TPOC direction as needed

TPOC As Required

6.2.2.2 Patch

Repository

Electronic Monthly and ad hoc as required

TPOC Monthly and ad hoc as required

6.2.2.3 IAVM

Analysis Report

Electronic, Microsoft Office Products

As Required TPOC As Required

6.2.2.4 VRAM Ad

Hoc Reports and Analysis

Electronic, Microsoft Office Products

As Required TPOC As Required

6.2.3.1 Ship Visit

Schedule

Electronic, Microsoft Office Products and Input into Knowledge Management Executive Summary Dashboard

0900 Wednesday TPOC Weekly

6.2.3.5 Daily Ship

Visit Status Report

Provided via portal through task lead

Daily for each day of a ship visit

TPOC As Required.

6.2.3.5 Final Ship

Visit Reports

Input into Knowledge Management Executive Summary Dashboard

Three business days after ship visit

TPOC As Required.

6.2.3.5 Lessons

Learned Report

Input into Knowledge Management Executive Summary Dashboard

Three Business Days After Ship Visit

TPOC As Required

6.3 Task 3. Cybersecurity Risk Management

6.3.1 Subtask 1 - Validation Activities. The contractor is responsible for performing validation of independently developed A&A packages. Validation activities include but are not limited to the following:

6.3.1.1 Site/Ship Validation Testing. The contractor shall conduct on-site (when feasible) and remote Site Validation Testing for MSC ships. Annual security reviews are conducted each year for each site, though validation of all security controls will only occur once every three years. It is estimated that full validation will occur for approximately 40 ships each year. The contractor shall complete all assessments in accordance with (IAW) the Navy Afloat Site Working Group Baseline. The assessments will require completion of all applicable Risk Management Framework (RMF) controls, Traditional Security Checklist, interviews, and applicable STIG and scan reviews.

6.3.1.2 System Validation Testing. The contractor shall complete system validation testing IAW published validation procedures required by DoDI 8510.01. Security validation testing includes a combination of techniques to include, but not limited to, automated scripts, manual technical evaluation, interviews, document reviews, and facility walk-throughs. As a result of the assessment, each test will be marked as compliant or non-compliant. In all cases, the contractor will document the specific criteria that resulted in a compliant/non-compliant value. Automated tools will likely produce this information by default but will require further validation to ensure accuracy. However, when automated tools are not used (e.g. during interviews, control assessments, manual checks, and walk throughs)

CUI

the contractor will be required to produce this information in the required format to address Navy Security Control Assessor requirements. Annual security reviews are conducted each year for each system, though validation of all security controls will only occur once every three years. It is estimated that full validation will occur for approximately 20 systems each year.

6.3.1.3 Navy Control System / Platform IT System Validation Testing. The contractor shall complete Navy Control System and/or platform IT system validation testing IAW published validation procedures required by DoDI

8510.01. Security Validation Testing includes a combination of techniques to include but not limited to automated scripts, manual technical evaluation, interviews, document reviews, facility walk through. Because of the assessment, each test will be marked as compliant or non-compliant. In all cases, the contractor will document the specific criteria that resulted in a compliant/non-compliant value. Automated tools will likely produce this information by default but will require further validation to ensure accuracy. However, when automated tools are not used (e.g., during interviews, security control assessments, manual checks, and walkthroughs) the contractor will be required to produce this information in the required format to address Navy Security Control Assessor requirements.

Annual security reviews are conducted each year for each system, though validation of all security controls will only occur once every three years. It is estimated that full validation will occur for approximately five systems each year.

6.3.1.4 Custom Validation Procedure Development. The contractor is responsible for developing a process and producing custom validation procedures when needed, approximately two times per year. Where published validation procedures are not available due to a unique MSC situation, system, or process; a method to assess the security posture of the given target must be developed. In these unique situations, the contractor shall develop custom validation procedures to address the inherent risks associated with the site/system or process. The validation procedure will correspond to a specific DoD/DON reference, include a test script (automated or manual), expected result and raw risk. Draft validation procedures will be submitted to MSC cyber security leadership and the Navy Security Control Assessor for review and approval before incorporation in the toolkit.

6.3.2 Subtask 2 - A&A Documentation Development. The contractor shall generate the documentation required to meet RMF requirements; submit the documentation to the relevant Authorizing Official; and gain Authority to Operate (ATO) for MSC IT network enclaves, systems and sites.

6.3.2.1 A&A Supporting Documentation. The contractor shall develop documentation for the RMF authorization packages that meet all DoD/ Defense Information Systems Agency (DISA) / DON requirements, explicitly tailored to the associated system. This includes supporting documentation to include but not limited to CYBERSAFE grade assessments, software and hardware lists, topologies, control family plans/policies, contingency plans, incident response plans, IAVM plans, Conditional Authorization Requests, Delay to Disconnect letters, STIGs, scan results, and waivers.

6.3.2.2 Risk Assessments. If required during assessment evaluations, the contractor shall develop risk assessments for specific A&A packages or other Mission Based Cyber Risk Assessment (MBCRA) activities, approximately five per year. The contractor shall be able to identify key stakeholders, develop a test schedule, test battery, and test plan to provide to MSC for the execution to support testing for MBCRAs. A test plan shall be delivered prior to the execution of an MBCRA. MBCRAs should follow the standards prescribed by the IT/Cybersecurity Technical Advisory Board. Risk assessments may also be required to determine the overall security posture of deployed, prototype, and “proof of concept” systems. System assignment or MBCRA participation will be facilitated by the TPOC. An MBCRA report shall be delivered within two (2) weeks of the completed risk assessment.

6.3.2.3 RMF Components and Artifacts. The contractor shall generate RMF components and artifacts required for the various aspects of the A&A process. These components include, but are not limited to, security plan artifacts, topologies, STIG, scan results, and Plans of Action and Milestones (POA&M) entries with applicable mitigations and risk assessment fields thoroughly populated.

6.3.2.4 Maintain Authorizations. The contractor shall be responsible for assisting in maintaining the RMF authorizations of MSC sites and systems. The contractor shall evaluate security posture changes based on any functional changes/upgrades performed throughout the lifecycle of the system(s), accomplished per delivery schedule and for inputting into and tracking via the system or site POA&M. The contractor shall provide Annual

CUI

Security Review (ASR) updates for input into Enterprise Mission Assurance Support Services (eMASS) per delivery schedule and for inputting into and tracking via the system or site POA&M. The contractor shall provide A&A support services to the MSC A&A process by utilizing eMASS (Non-Secure Internet Protocol Router (NIPR)/Secure Internet Protocol Router (SIPR)) to process Analyst and Navy Qualified Validator (NQV) input to the MSC A&A process. The contractor shall update System & Configuration Management documents as required.

6.3.2.5 Knowledge Management. MSC is required to use a number of repositories to track A&A activities of its systems and sites. The contractor shall ensure the data in these repositories is accurate and up to date.

6.3.2.6 eMASS Population. MSC is required to use eMASS as a central repository to support the A&A process. The contractor shall document all matters of enclave/system compliance/non-compliance within their respective eMASS records. The contractor shall ensure any artifacts that have been submitted are included within the applicable eMASS record. The contractor shall import all possible automated scans into eMASS. Where scan import formats are not accepted, the scan data will be added as an artifact within the eMASS record. All scans will be submitted based on the latest Navy Security Control Assessor requirements and guidance.

6.3.3 Subtask 3 - Reporting. The contractor shall respond to data calls associated with FISMA and A&A tasks as required. The contractor shall maintain a repository of the A&A status of each MSC system, and site, detailing the work completed on each A&A package, current step in the authorization process, and status of required waivers.

Deliverable Title Format Due Date Distribution / Copies

Frequency and Remarks

6.3.1 6.3.2

Validation, Assessment and Authorization Documentation per DoDI

8510.01 in support of Site/System/Network Accreditation

Electronic, Microsoft Office Products

As Required TPOC As Required

6.3.2.2 Mission Based Cyber Risk

Assessment Test Plan

Electronic, Microsoft Office Products

2 weeks prior to the start of an MBCRA

TPOC As Required

6.3.2.2 Mission Based Cyber Risk

Assessment Reports

Electronic, Microsoft Office Products

2 weeks following completion of an

MBCRA

TPOC As Required

6.3.2.5 Knowledge Management Electronic, Microsoft Office Products

As Required TPOC As Required

6.4 Task 4 – Cybersecurity Compliance

6.4.1. Subtask 1 - Cyber Readiness Program. The contractor shall support the cyber readiness program through visits to MSC afloat and ashore sites. The contractor shall support the cyber readiness program as a part of scheduled and ad-hoc visits. Cyber readiness visits shall be supported on 25 ships per year and may be incorporated with training and assistance visits described in section 6.2.3 where applicable. Travel will be required to visit ships. Visits shall include:

• In-brief with ship’s master and other stakeholders

• Review of cybersecurity checklists, administration, leadership engagement, and training

• Review of ship/command documentation:

o Cybersecurity Workforce Management and Training o Cybersecurity Policies and Instructions

CUI

o Incident Response and Recovery o Traditional Security o Completion of STIG checklists and scans for appropriate technology areas

• The contractor shall develop a final report and out-brief that identifies a proposed inspection score with specific cybersecurity program deficiencies identified during the ship/site visit and the recommended course of action to resolve.

• The contractor shall provide mitigations for open findings from reviews and shall provide a detailed

POA&M.

6.4.2 Subtask 2 - Administrative Support. The contractor will be responsible for providing a variety of administrative tasks in support of cyber compliance to include:

• Verification and tracking of System Authorization Access Request (SAAR) forms and visit requests for Cyber Compliance contractor personnel

6.4.3 Subtask 3 - Policy Interpretation and Development. The contractor shall develop and update new and existing SOPs when needed as procedures may change according to DoD and DON policies. The contractor shall research and provide amplifying information and/or a specific requirement to facilitate understanding, awareness and compliance. This can include a wide spectrum of activities and services from answering regular queries by phone or email to assisting in the development of documents, fact sheets, frequently asked questions. The contractor shall reference all directives to support new and existing policies.

6.4.4 Subtask 4 - Computer Task Order (CTO) Tracking and Reporting. The contractor shall monitor Naval Messages for new and updated CTOs. Upon receipt of a new or updated CTO, the contractor will perform an in-depth analysis of the effects of the CTO. The contractor will determine affected sites and systems for distribution of the CTO. Information will be used to validate and update the CTO Compliance spreadsheet hosted on the SIPR portal provided to the CTO Compliance Manager and TPOC.

6.4.5 Subtask 5 - Knowledge Management Dashboard. The contractor shall create/maintain a Knowledge Management Dashboard of the shipboard Cybersecurity posture for each ship and shore support facility. This view will have the ability to drill down and expand on the following:

• ESS or current product end point metrics

• Individual ship or system summary of progress for ATO, expirations, and status.

• Ship site Report Card which includes, but is not limited to dates and details of:

• Last network patch/scan, training and assist visit, compliance visit

• Cybersecurity Posture as reported in VRAM

• ATO expiration

• ES/IR historic documentation

• Open/Closed HELIX tickets

• SAAR process with master tracker of:

Total number of users with SAARs on file Total number of Privileged Users

Dashboard should have the ability to create reports. Reports include but are not limited to:

• Afloat Cyber Readiness Dashboard which includes, but is not limited to the following:

• Weighted cybersecurity score

• Scan periodicity compliance

• % Assets available to scan

• % Successful scan attempts

• % Antivirus compliant status

• Average vulnerabilities per asset (Site owned)

CUI

• Average vulnerabilities per asset (System owned)

6.4.6 Subtask 6 - Ship Policy Repository. The contractor shall create/maintain a repository that contains the latest cybersecurity-related SOPs and policies to support Technical Assist Visits (TAV) and compliance inspections. SOPs and policies include but are not limited to:

• MSC cybersecurity instructions

• ACAS scanning

• Patching process for each MSC afloat network

• Continuity of Operations

• ES

• IR

6.4.7 Subtask 7 – Reporting. The contractor shall maintain and publish Cyber Compliance metrics to include but not limited to endpoint security product data and CTO compliance on the MSC SIPR web portal.

Deliverable Title

Format Due Date Distribution/ Copies

Frequency and Remarks

6.4.1 Final Report Electronic, Microsoft

Office Products

5 business days after completion of ship visit

TPOC As Required

6.4.1 STIG results Electronic, Microsoft

Office Products

As Required TPOC As Required

6.4.3 Standard

Operating Procedures

Electronic, Microsoft Office Products

As Required TPOC As Required

6.4.4 CTO Status

Report

Electronic, Microsoft Office Products

0900 Wednesday TPOC Weekly

6.4.4 CTO Tracking Electronic, Microsoft

Office Products

As required TPOC As Required

6.4.5 Afloat Cyber

Readiness Dashboard

Electronic, Microsoft Office Products

1400 Thursday TPOC Weekly

7. Performance Standards.

Performance Standard Acceptable Quality Level (AQL) Methods of Calculation Task 1 – Project Management

Make schedule milestones 95% of the time--meeting milestone percentage calculated by dividing the number of “made schedule” events (met milestones) by the total number of scheduled milestones for the period

Routine inspection of deliverable products and services

Task 2 – Cyber-security Operations

Achieve and maintain 100% of employees with significant security responsibilities receive specialized training annually (by 31 August). Training will depend on specific responsibilities, though it may include ACAS, ESS, Exchange, DNS, VRAM, and OS specific training.

Personnel should have the ability to maintain DoD 8570.01-M training and certification requirements.

Routine inspection of deliverable products and services

Task 2 – Cyber-security Operations

All deliverables delivered on or before required due date with no more than one revision per deliverable

Routine inspection of deliverable products and services

CUI

Performance Standard Acceptable Quality Level (AQL) Methods of Calculation Task 3 - Cybersecurity Risk Management

All deliverables delivered on or before required due date with no more than one revision per deliverable

Routine inspection of deliverable products and services

Task 4 - Cybersecurity Compliance

All deliverables delivered on or before required due date with no more than one revision per deliverable

Routine inspection of deliverable products and services

Task 5 - Knowledge Management

All deliverables delivered on or before required due date with no more than one revision per deliverable

Routine inspection of deliverable products and services

8. Incentives. The COR and TPOC will create an annual report on contractor performance (via the Contractor Performance Assessment Reporting System (CPARS) or other annual report). Both positive and negative performance will be documented in CPARS, as appropriate, and will be taken into consideration for follow-on work.

For each item that does not meet acceptable levels, the Government will issue a Performance Assessment Report (PAR)/Contract Discrepancy Report. PARs will be forwarded to the KO with a copy sent to the contractor. The contractor shall reply in writing within five business days of receipt identifying how future occurrences of the problem will be prevented.

9. Place of Performance. The place of performance for this effort is primarily at the contractor site. Frequent meetings at Government sites in the Norfolk, VA metropolitan area are expected, and are considered routine local travel.

All tasks may require travel to other MSC, Navy, and United States Transportation Command (USTRANSCOM) or DoD installations to include but not limited to the following:

• MSC Network Operations Center, Pensacola FL

• MSC Headquarters, Norfolk VA

• MSC Ship Support Unit (SSU), San Diego CA

• MSC SSU Japan

• MSC SSU Singapore

• MSC SSU Bahrain

• MSC SSU Guam

• Military Sealift Command Office (MSCO) Pearl Harbor, HI

• MSCO Diego Garcia

• MSC SSU Naples

• Pacific Region Network Operations Center, Wahiawa, HI

• Unified Atlantic Region Network Operations Center, Norfolk, VA

• USTRANSCOM (HQ), Scott AFB IL

• Contractor Facilities

Additional travel within CONUS or OCONUS (if applicable) may be required to support the requirements of this PWS. Travel requirements for personnel will vary. Ship visits will likely require one person, while travel for inspection will consist of multiple personnel. Underway support may be needed depending on ship availability and urgency of the requirement. The number of ships visited per site is dependent on ship availability. OCONUS site visits vary depending on who is in port. All travel shall be approved by the COR prior to commencement and shall be in accordance with FAR subpart 31.205-46 and the Joint Travel Regulation. The Government will not reimburse the contractor for routine local travel or for parking fees, nor will the Government pay profit or fee on travel expenses.

Alternate Place of Performance - Contingency Only. As determined by the COR, contractor employees may be required to work at an alternate place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, Government closure due to inclement weather.). Additionally, the contractor may be required to account

CUI

for the whereabouts of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed Government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the greatest extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, the KO or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

10. Period of Performance. The period of performance is for one-year with four (4) one-year options. As directed by the COR, the contractor shall continue performance in emergency or mission essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

11. Security Requirements. This section shall be considered a supplement to block 13 of the Government provided DD 254, Contract Classification Specification. The following security requirements shall apply to this effort.

References:

a. DoD Instruction 5200.48, Controlled Unclassified Information (CUI)

b. DoDM 5200.01, Vol 1-4 Information Security Program, 24 February 2012

c. DoDM 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

d. DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), February 2006

Incorporating Change 02 May 2016

11.1 Physical Security.

Security policies and procedures for safeguarding information will be IAW NISPOM, DoD, DON, and MSC security documents and directives, and shall be followed by the contractor. Work performed as part of executing this requirement will be at the Controlled Unclassified Information (CUI), CONFIDENTIAL, and SECRET levels. As required, MSC shall provide the contractor with access to all areas necessary to support contract performance.

At the direction of MSC, upon completion or termination of the contract, all classified material/information furnished will be returned to direct custody of the designated ISSM or destroyed in accordance with applicable instructions. Upon completion or termination of the contract, all materials will be returned to MSC in accordance with applicable instructions.

This effort may require access to United States (U.S.) Government classified information and facilities. As required, the contractor shall provide personnel that have a current U.S. Government SECRET security clearance where necessary. A DD Form 254 is required, see DoD Contract Security Classification Specification (DD Form 254), Attachment J-8.

Prior to contract award, contractors must have a facility clearance up to SECRET as required by the highest clearance held by any person on the contract. An interim facility clearance prior to contract award is also acceptable.

Security requirements are described in DD Form 254 Section J, Attachment J-8. Blocks 6 and 7 of that form will be finalized following award. At a minimum, all personnel (includes contractor and sub-contractor) working with classified information and on U.S. Government facilities will require a SECRET Clearance.

11.2 Personnel Security.

As described above,…