PWS - N0018920QQ000 METOC Cybersecurity 7-23-20.docx

UNCLASSIFIED

PERFORMANCE WORK STATEMENT

METEOROLOGY AND OCEANOGRAPHY ENTERPRISE

INFRASTRUCTURE AND CYBERSECURITY SUPPORT SERVICES

1. INTRODUCTION

Work under this contract is to be accomplished for the Naval Information Forces (NAVIFOR) Suffolk, VA and the Naval Meteorology and Oceanography Command (NAVMETOCCOM), Stennis Space Center, MS, and its Echelon IV organizations: Naval Oceanographic Office (NAVOCEANO) and Naval Oceanography Operations Command (NAVOCEANOPSCOM), Stennis Space Center, MS; Fleet Numerical Meteorology and Oceanography Center (FLENUMMETOCCEN), Monterey, CA; U.S. Naval Observatory (USNAVOBSY), Washington DC; USNAVOBSY, Flagstaff, AZ; USNAVOBSY Alternate Master Clock, Colorado Springs, CO; Fleet Weather Center (FLEWEACEN), San Diego, CA; Fleet Weather Center (FLEWEACEN), Norfolk, VA; and their respective Echelon V subordinate sites.

2. BACKGROUND

NAVMETOCCOM, with its subordinate organizations, is responsible for the direction of the Naval Oceanography Program (NOP), which provides operational oceanography; meteorology; precise time and astrometry; and Geospatial Information and Services (GI&S) to the operating forces of the Navy and Cyber (DoD). NAVMETOCCOM activities are responsible for compiling, processing, assessing, and analyzing oceanographic, atmospheric, and other types of environmental data, which have a critical impact on naval operations. Execution of the NOP mission requires highly specialized technical support personnel with significant and well versed experience in field support and the overall NAVMETOCCOM IT program. This contract will include approximately 32 systems; about six of these systems are application-only systems with each systems having its own accreditation package. The ACAT level is classified as a project as opposed to an ACAT program at a specific level. The network name, size and details, when put together, will be an OPSEC issue and not available for public release. Also, the sizes change over time.

3. SCOPE

The purpose of this contract is to provide a full range of Information Technology (IT) support services and infrastructure support to NAVMETOCCOM, Stennis Space Center, MS, and its Echelon IV organizations.

This shall include support to activities such as:

· Infrastructure, IT System Administration, Network/Communications, and Cross Domain Solutions

· Cybersecurity

· IT Configuration Management (CM)

· IT Customer Interface Management (CIM)

· IT Requirements Managements

· IT Life Cycle Support

· IT Engineering Support

· IT Integration and Sustainment

4. OBJECTIVES

The Contractor shall support the NAVMETOCCOM & NAVIFOR enterprise by conducting operational and technical requirements analyses; preparing operational concepts; analyzing risk; and developing algorithms, processes, and recommendations on solutions to collect, process, manage, and transmit Meteorology, Oceanographic data, and Geospatial Information & Services (GI&S).

The Contractor shall also provide technical support and systems engineering to facilitate migration of associated systems, within the guidelines of the DoD Corporate Information Management initiative to achieve interoperability and to establish the Defense Information Systems Agency (DISA) Technical Architecture Framework for Information Management compliant processing architecture. The Contractor shall support government personnel in ensuring that software design, development, and maintenance activities comply with federal, DoD, DON, and Commander, Naval Meteorology and Oceanography Command (COMNAVMETOCCOM) policies including, Information Assurance and net centricity.

Deliverables must comply with applicable DISA Secure Technical Implementation Guides (STIGs) and DISA Application Security and Development STIGs (reference: DODI 8500.01, Cybersecurity). Control: ECSC-1, Subject: Security Configuration Compliance, Requirement: For Enclaves and AIS applications, all DoD security configuration or implementation guides have been applied.

The contractor shall provide technical support for the following IT Programs:

a) The Primary Oceanographic Prediction System (POPS) is an ACAT IA Program of Record (PoR), which now includes all former IT Programs within the NAVMETOCCOM Enterprise, including POPS-Meteorology (formerly just POPS), Oceanographic Information System (OIS), Meteorology and Oceanography Systems (METOCSYS), and the Precise Time and Astrometry (PTA) Systems work at the Naval Observatory.

b) The POPS for Oceanography (Oceans) is an operational information system within DoD providing automated support for oceanographic data collection, processing, analysis, product generation, and distribution. POPS - Oceans products provide critical direct operational support to all mission areas of the fleet and other forces that operate on, under, over, or near the world’s oceans. Formerly known as the Oceanographic Information System (OIS), POPS-Oceans is the primary IT domain at NAVOCEANO and is the enabler for oceanographic information and predictions in support of Antisubmarine Warfare (ASW), Naval Special Warfare (NSW), Mine Warfare (MIW), and submarine/ship navigation. The OIS program involves automated Information Resource / Information Management support for multi-disciplinary ocean surveys, assigned scientific and technical projects, and oceanographic product generation and distribution at NAVOCEANO and its subordinate commands, the Naval Ice Center (NAVICECEN) and Fleet Survey Team (FST). Also at NAVOCEANO is the Surf Eagle (SE) program tasked to produce and disseminate oceanographic/littoral and riverine environmental intelligence, analysis, and special products primarily in support of Intelligence, Surveillance, and Reconnaissance (ISR).

c) The POPS-Meteorology (Met), located at FLENUMMETOCCEN at Monterey, CA provides the key production engine enabling global METOC support of the fleet. POPS-Met operates within a 24/7 reach back operations center supporting global fleet operations with weather and ocean prediction products and war fighting applications that are critical to fleet safety and war fighting effectiveness. POPS-Met provides the technology and infrastructure to sustain global operations ashore and afloat by providing timely, relevant, 24/7 METOC data and products to the fleet, DoD, joint, allied, and coalition warfighters at all classification levels. POPS-Met acquires and sustains the operation of high-performance computing (HPC) environments to provide most of the assured METOC forecast products and services for Tier 1 of the Battlespace on Demand, which originate directly from the METOC models, satellite processing software, and applications. Tier 1 also provides input to many of the Battlespace on Demand Tier 2 and Tier 3 Products. Ongoing technology refreshment is required to meet the growing demand for these products, particularly in response to greater emphasis on preparation for and response to regional conflicts, and the greater data volume from the National Polar-orbiting Partnership (NPP) and future remotely sensed environmental data sources. The required technology refreshment includes enhancements of the POPS-Met hardware and software, models suite, observational data ingest capability, data distribution capability, and reach back customer support. Together, these enhancements will provide the Fleet with more accurate and responsive environmental support across all three Tiers of Battlespace on Demand. POPS-Met supports DoD’s principle operational processing center for numerical METOC analysis and prediction.

d) The METOC Operational Mission Information Technology (MOMIT) – Naval Oceanography Operations (NOO) provides portfolio management and tactical communications and information processing capability to NAVMETOCCOM operational subordinate commands located at Stennis Space Center MS, Norfolk, VA, San Diego, CA, Pearl Harbor, HI, Yokosuka, Japan, and Manama, Bahrain, including subordinate detachments, components, and deployable teams operating worldwide. MOMIT NOO provides Naval oceanographers and meteorologists with the capability to conduct on-scene sensing, ingest, processing, display, and dissemination of time critical environmental analysis products to support mission effectiveness and safety of personnel, platforms, installations, and operations. This includes design, installation, cybersecurity accreditation, and sustainment of the Naval Oceanography Operations Command Systems Integration Environment (SIE) located at Stennis Space Center MS, and Integrated Unclassified Systems (IUS) and Integrated Classified System (ICS) located at Fleet Weather Center Norfolk, VA, Fleet Weather Center San Diego, CA, Joint Typhoon Warning Center Pearl Harbor, HI, and Naval Oceanography ASW Center Yokosuka, Japan. The MOMIT NOO program segment also manages Navy METOC-wide systems and applications including Cross-Domain Solutions, Flight Weather Briefer, METOC Chat, Remote Environmental Conditions Observation Network (RECON), and other POR and non-POR technology solutions.

The combined programs maintain NAVIFOR, NAVMETOCCOM, USNAVOBSY, FLENUMMETOCCEN, NAVOCEANO, NAVICECEN, FST, NAVOCEANOPSCOM, and the echelon IV activities’ scientific IT systems in support of established METOC requirements and coordinates the modernization of these assets to ensure efficient operations and any infusion of new technology.

5. FUNCTIONAL AREAS

Work to be performed will primarily be divided into two functional areas. Detailed tasking will be provided and further defined at the task order level. The following tasking for each functional area is generalized below:

5.1 Functional Area #1: Infrastructure Support, IT System Administration, Communications, Cross Domain Solution (CDS) Solutions, DoD/DON Infrastructure Compliance

FA# 1 – Tasks:

a) Provide Infrastructure Architecture support for driving policy, integration and sustainment of IT, communications, and equipment.

b) Navy Enterprise Networks (NEN), the Navy/Marine Corps Intranet (NMCI), OCONUS Navy Enterprise Network (ONENET), and the Next Generation Enterprise Network (NGEN), in maintaining enterprise-wide asset management and configuration controls using current Navy Enterprise Asset Management Tools such as NMCI Enterprise Tool (NET), Integrated Solution Framework (ISF)-Tools, eMarketPlace, Requirements Award Process Tool (RAPT), and Service Request eForm (SReF).

c) Develop network topology diagrams and perform network asset discovery and configuration management using Navy Enterprise asset management tools. Current tools include the DON Application and Database Management System (DADMS), Enterprise Architecture Framework (EAF), CMPRO, and Bel-Manage.

d) Analyze and provide reports on bandwidth usage on NAVMETOCCOM network segments and recommend strategies for optimization.

e) Assist in systems engineering efforts for system consolidation initiatives and general system administration.

f) Monitor and provide reports on operational IT systems and network performance and recommend solutions for improvements.

g) Assist in Information System Security design, installation, monitoring, and testing to meet system and DoD/DON Cybersecurity requirements.

h) Provide reports that recommend hardware, software, and network security configurations to meet system and DoD/DON CS requirements.

i) Provide, implement, and support common configuration management practices and procedures necessary to ensure a high degree of configuration identification, status accounting, change control and auditing for NAVMETOCCOM Information Systems. Support will ensure that best practices for configuration management are implemented and current accurate records are maintained identifying the baselines for NAVMETOCCOM IT assets. Current tools used to support this effort include the DON Application and Database Management System (DADMS) and the EAF.

j) Draft and maintain IT requirements documents and diagrams, support and manage IT requirements, elicitation, development, analysis, and validation of Enterprise Change Request (ECR), and provide Application Portfolio Management for the METOC Systems IT assets.

k) Elicit and document functional and user requirements for oceanographic and atmospheric modeling to generate artifacts including workflows, Concepts of Operations (CONOPS), System/Software Requirements Specification (SRS), Unified Modeling Language (UML) diagrams, use cases, and other documentation, as needed.

l) Provide technical services to users and maintenance technicians on operational system details to improve operational efficiencies.

m) Provide hardware, software, and system integration support for deployments of system and software modifications, including the development and execution of site surveys (environmental and technical), implementation plans and installation plans.

n) Conduct technical studies and design system for NAVMETOCCOM’s communications circuits leveraging current Navy Enterprise management tools such as Telecommunications Inventory and Billing Information (TIBI), DISA Direct Order Entry (DDOE), Telecommunication Certification Office Support System (TCOSS), and DISA’s World Wide On-Line System (WWOLS).

o) Provide project management, process improvement and quality management support and guidance for business functions including project launches, post-mortems, metrics collection and analysis, and capacity management.

p) Conduct research and prepare responses for Navy enterprise data calls that relate to NAVMETOCCOM infrastructures and architectures and for Enterprise databases and systems, including DON Application and Database Management System (DADMS), DoD IT Repository – DON (DITPR-DON), Maintenance and Material Management (3M) and the Defense Priorities and Allocations System (DPAS).

q) Provide expertise in the architecture, design, implementation, system deployment, sustainment, maintenance, configuration, and transition of applications to the Navy Enterprise Networks (NEN), including Navy Marine Corps Intranet (NMCI), Outside the Continental US (OCONUS) Navy Enterprise – Network (ONE-NET), Consolidated Afloat Networks Enterprise Services (CANES), Next Generation Enterprise Network (NGEN), and Joint Regional Security Stack (JRSS), and other C4ISR or Community of Practice (CoP) systems or networks.

r) Provide system and software support to maintain and sustain the Cross Doman Solution (CDS) system. The contractor will provide support to maintain and sustain the scripts associated with data examination and transfer, the hardware, OS and will implement patches and upgrades, conducting CS activities, and network activities.

s) Provide Cyberspace IT/CSWF certified (Level II/III or equivalent) system administration support to Naval Oceanographic Enterprise (NOe) systems to include the configuration of operating systems and associated METOC application software to Defense Information System Agency (DISA)/DoD standards according to the latest STIG, Active Directory and Group Policy for Windows operating systems, and UNIX/LINUX computers to operate on DoD networks. The contractor will execute Security scans and mitigate issues across all operating systems, image systems to create baselines, and design/operate networks infrastructure (routers, switches, and other network devices) to current DoD and commercial standards. Work includes advanced administration of LINUX on supercomputers using large capacity file systems (i.e. GPFS), with complicated 24x7 operational runs; Government Off-the-Shelf (GOTS), Commercial Off-the-Shelf (COTS), and open source software; and petabytes of data.

t) Provide technical research and documentation support for engineering and IT solutions associated with Enterprise Change Requests (ECR), Customer Service Request (CSR), and centrally managed projects. The solutions must be compliant with DoD Navy Cyber Security standards. Documentation can include white papers, Functional Solutions Analysis (FSAs), Execution Plans, Executive Briefs and point papers that detail recommended IT solutions, or METOC applications required to address emergent requirements.

u) Perform Life Cycle Support (LCS) functions, which includes providing program and project management support of installed Navy and Marine Corps systems deployed worldwide. Contract support requirements include: support of the METOC Enterprise Casualty Process to include daily analysis of Customer Service Requests (CSRs) to determine appropriate corrective actions; support of handling and shipping of materials; monitoring activity and performance of the 24/7 helpdesk; support configuration, performance, and cost tracking for the 32 systems that comprise the NAVMETOC IT program.

v) Provide system engineering support for existing capability modernization. This support will include Linux, Microsoft windows, Geographic Information Systems (GIS) and scripting tasks. This support will also include providing distance support services for fielded METOC systems.

w) Provide Help Desk management capability for routine management of incident, trouble tickets, licensing and hardware/software inventory.

x) Provide Cyberspace IT/CSWF Level II/III or equivalent certified system administration support for the Naval Oceanographic Office (NAVOCEANO) DoDIN Node. This support will include installation, configuration and security of application servers, web servers, database servers and COTS software. This support will also include operating system administration, such as Red Hat Enterprise Linux, Microsoft Windows, and scripting tasks.

y) Conduct solution formulation efforts to analyze customer requirements to develop and present Analysis of Alternatives (AoA), conduct Cost Benefit Analysis (CBA), and/or provide Courses of Action (CoA).

z) Work with Navy Cloud brokers and METOC civilian Subject Matter Experts (SMEs) to develop cloud engineering solutions for new and/or transitioning METOC capabilities to Navy approved operational and/or developmental cloud environments. Once Navy/DoD cloud instances have been created by cloud providers, provide systems engineering, analysis and administration services to transition METOC capabilities from legacy or Navy enterprise networks to targeted cloud instances. Provide operational system administration sustainment and cybersecurity compliance testing/configuration services for applications transitioning to and currently operating in approved Navy cloud enclaves. Provide cyber security compliance testing, system engineering, integration and configuration management services in support of Risk Management Framework Accreditation efforts. Contractor will provide system engineering, systems integration and configuration management services in support of making the application fully-operational in the cloud environment. Application operational testing results run before the application transitions to the cloud should be the same after application transitions to the cloud.

5.2 Functional Area #2: Cybersecurity / Information Assurance Support Services

FA# 2 – Tasks:

a) Provide Assessment and Authorization (A&A) and Security Test and Evaluation (ST&E) support of IT components (i.e. systems, networks, circuits, hardware, and software) which comprise the METOC IT enterprise. Supplement mission with a mobile team of Cyberspace IT/CSWF certified (Level II/III or equivalent) experts to perform technical CS support requirements needed to attain and maintain site IA compliance utilizing Risk Management Framework (RMF) and SECNAV M-5239.2.

b) Explore, recommend, and document new concepts, tools, and technical methodologies to secure open architectures and protect interoperable solutions. Prepare white papers and presentation documentation to articulate solutions to CS problems.

c) Support NAVIFOR and NAVMETOCCOM in the preparation/maintenance of security authorization documentation prepared in accordance with applicable DoD and DON policy/guidelines.

d) Prepare/maintain CS documentation such as: Risk Management Framework (RMF), Top Secret/Secret and Below Information and System/Network Accreditation Test Plan, diagrams, reports and procedures.

e) Provide CS support/recommendations, participate in CS working groups/IPTs, and attend/prepare/present pre-approved by the Government CS briefs in project meetings/conferences to assure information availability, integrity, and confidentiality is attained/maintained throughout the METOC local and global IT enterprise. These will be conducted in the presence of the Government employees and only on pre-approved data topics, typically the health status of the RMF process, updates on achieved milestones.

f) Provide advance level Intrusion Detection System (IDS) monitoring, analysis, and incident response to information security alert events. Provide technical CS expertise to assess software code or products for vulnerabilities, validate accuracy of STIG implementation/patch compliance, analyze scan results, monitor/validate/report effectiveness of mitigation efforts, etc.

g) Support NAVIFOR and NAVMETOCCOM in accomplishing CS best practices applicable to all components of the METOC IT enterprise in accordance with DoD/DON policy/guidelines and the eight (8) Common Body of Knowledge (CBK) CS domains (Security and Risk Management; Asset Security; Security Engineering; Communications and Network Security; Identity and Access Management; Security Assessment and Testing; Security Operations; Software Development Security).

h) Participates in CS-related working groups between command level CS personnel, NETWARCOM Operational Delegated Approval Authority (ODAA) staff, NCDOC, and NAVMETOCCOM site CS personnel to support CS strategies and standards.

i) Research, summarize, and apply DoD/DON CS policy releases to support COMNAVIFOR and NAVMETOCCOM in the creation and maintenance of CS policies and Standard Operating Procedures (SOPs), including the CSM Guidebook releases to NAVMETOCCOM site CS personnel.

j) Assist with the coordination, collection, validation, and assembly of data input required to respond to CS data calls, CTOs, IAVAs, and similar DoD/DON CS-related taskers. Support involves the preparation of methods and usage of electronic repositories to build and maintain a CS knowledge base of data responses to analyze trends, propose CS process adjustments, and recommend CS solutions to mitigate CS vulnerabilities.

k) Conduct research of current DoD/DON CS policies and guidance, FISMA-related implementing guidance such as NIST and industry best practices. Assess, attain, and maintain certification portfolios for designated CSWF members.

l) Conducts research to provide answers to command-level CS questions and implements methods to facilitate and broaden CS awareness throughout the METOC enterprise, including collaboration techniques to educate our partners of CS compliance issues/potential solutions to interoperate securely and compliantly.

m) Provide analytical support in response to newly promulgated guidance to determine the impact on CS operational requirements, prepare/recommend resulting revisions to existing CS policy and guidance, and create/present CS-related briefs to inform managerial and technical personnel of significant CS impacts/effects.

n) Provide ISSM (Cyberspace IT/CSWF Level II/III or equivalent) onsite assistance at METOC operation centers (NAVOCEANO – Stennis Space Center, MS, USNAVOBSY - Washington, DC; FLENUMMETOCCEN - Monterey, CA) in a CSM support role.

6. OTHER DIRECT COSTS (ODCs)

Other than travel, ODCs include material, equipment, software and limited subcontracting for specialized services. The contractor may be required to obtain limited materials such as printing materials, books, media, and other miscellaneous items required to perform the individual tasks while onsite for both Functional Areas # 1 and #2 or incur limited expenses in performance under the contract. The government will fund ODCs that are identified within the individual task order. ODCs shall require prior approval by the Government COR with notification to the PCO. Any expenditure for ODC’s without the approval of the Government COR and the PCO may not be reimbursed.

7. SECURITY REQUIREMENTS

The highest level of classification authorized on this contract and all task orders is SECRET. A DD-254 is required for this contract. Performance of work will require access to classified data and computer resources within Navy facilities controlled workspaces. Contractor will not be authorized receipt and storage of classified information at contractor’s facility.

7.1. All contract personnel shall comply with the directives and policies established in Department of Defense (DoD) 5220.22-M “National Industrial Security Program, Operating Manual”, Secretary of the Navy (SECNAV) Instruction 5510.30C “Personnel Security Program”, and SECNAVINST 5510.36B “Department of the Navy (DoN) Information Security Policy”.

7.2. All contractors will be required to obtain and maintain a SECRET clearance.

7.2.1. Most contractors will require Information Technology (IT) non-critical sensitive information access based on a Tier 3 (T3) background investigation as defined in SECNAVINST 5510.30C. Some contract personnel will require critical sensitive information access based on a Tier 5 (T5) background investigation as defined in SECNAVINST 5510.30C for root level system administration access to U.S. Government IT systems.

7.3. All contract personnel shall complete applicable Information Assurance (IA) training, sign non-disclosure agreements, and complete System Authorization Access Request Navy (SAAR-N) forms before accessing any Navy Information Technology resources. All training and documentations shall be forwarded to the COR immediately upon assignment. Failure to provide the required documentation shall result in delaying the individual’s start date.

7.4. The contractor shall ensure the required security training, security application paperwork, and system access requests for all new employees are submitted to Navy Command in sufficient time such the required facility and system access credentials can be provided by the Navy facility prior to the contractor reporting to the facility.

7.5. All contract personnel shall in-process with the Navy Command’s Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

8. APPLICABLE DOCUMENTS/STANDARDS:

DOD Operational Guidelines for Computer System and Network Administration, Policies and Procedures, DoD Web Site Administration Policies and Procedures, and Specifications, standards and handbooks, guidance documents-DODI instructions, OPNAVINST’s DISA Secure Technical Implementation Guides (STIGs). Reference: DODI 8500.2, IA Control: ECSC-1, Subject: Security Configuration Compliance, Requirement: For Enclaves and AIS applications

CYBERSECURITY - The Contractor shall comply with all federal, DOD, and Department of the Navy (DON) Information Assurance (IA) policies. The contractor will be responsible for maintaining system IA accreditation, with government assistance where required.

· Chairman Joint Chiefs of Staff Instruction (CJCSI) 6211.02D, “Defense Information System Network (DISN): Policy Responsibilities and Processes,” 24 January 2012

· Chairman Joint Chiefs of Staff Manual (CJCSM) 6510.01 CH-3, “Defense in Depth: Information Assurance (IA) and Computer Network Defense (CND)”, 25 Mar 2003

· DON DCIO Navy Cloud First Policy, 01 February 2017

· DON CIO Memo - Memo on the acquisition and use of Commercial Cloud Computing Services, 15 May 2015 DTM-08-003 Next Generation

· NCDSMO Doc ID: NCDSMO-R-00008-001_02, "Cross Domain Solution (CDS)

· Design and Implementation Requirements - 2018 Raise the Bar (RTB) Baseline Release", 4 Apr 2019

· CJCS Notice 6510, Communications Security (COMSEC) Security Modernization Plan

· CJCSI 6510.01-fD, “Information Assurance and Support to Computer Network Defense,” 09 Feb 2011

· CNO N614/HQMC C4--Navy-Marine Corps Unclassified Trusted Network Protection (UTNProtect) Policy, Version 1.0, 31 October 2002

· CJCSI 6211.02C, Defense Information System network (IDSN): Policy and Responsibilities, 9 Jul 08

· CNSS Instruction 4009, “National Information Assurance Glossary,” 24 April 2010

· CNSS Policy No. 10, “National Policy Governing Use of Approved Security Containers in Information System Security Applications,” 21 July 1999

· CNSS Policy No. 15, “National Information Assurance Policy on the Use of Public Standards for the Secure Sharing of Information among National Security System,” October 2012

· DoD Directive (DODD) 8100.1, “Global Information Grid Overarching Policy,” 19 September 2002

· DODD 3020.26, “Department of Defense Continuity Programs,” 14 Feb 2018

· DODD 4630.5, “Interoperability and Supportability of Information Technology (IT) and National Security Systems (NSS),” 05 May 2004

· DODD 5000.1, “The Defense Acquisition System,” 12 May 2003

· DODD 5160.54, “Critical Asset Assurance Protection,” 20 January 1998

· DODD 5230.11, “Disclosure of Classified Military Information to Foreign Governments and International Organizations,” 16 June 1992

· DODD 8140.01, “Cyberspace Workforce Management,” 31 Jul 2017

· DODD 8190.3, “Smart Card Technology,” 31 Aug 2002

· DODD 8320.2, “Data Sharing in a Net-Centric DOD,” 2 Dec 2004

· DODD C-5200.5, “Communications Security (COMSEC),” 21 Apr 2000

· DODD O-8530.1, “Computer Network Defense (CND),” 8 Jan 2001

· DoD Instruction (DODI) 4630.8, “Procedures for Interoperability and Supportability of IT and NSS,” 30 Jun 2004

· DODI 5000.02, “Operation of the Defense Acquisition System,” 07 January 2015

· DODI 5200.02, “DoD Personnel Security Program,” 11 May 2018

· DODI 8100.02, “Use of Commercial Wireless Devices, Services, and Technologies in the DOD Global Information Grid (GIG),” 23 April 2007

· DODI 8100.3, “DoD Voice Networks,” 16 Jan 2004

· DODI 8500.01, “Cybersecurity,” 14 Mar 2014

· DODI 8520.02, “Public Key Infrastructure (PKI) and Public Key (PK) Enabling,” 24 May 2011

· DODI 8540.01, "Cross Domain (CD) Policy", May 8, 2015

· DODI 8551.1, “Ports, Protocols, and Services Management (PPSM),” 13 Aug 2004

· DODI 8580.1 “Information Assurance in the Defense Acquisition System, 9 Jul 2004

· DODI O-8530.1, “Support to CND,” 08 January 2001

· DON CIO Guidance on Information Management/IT Inherently Governmental Functions,” Nov 2001

· DON IA Publication Series

· Executive Order 12333, “United States Intelligence Activities”

· Executive Order 12958, as amended, “Classified National Security Information”

· Federal Information Security Management Act of 2002, Title III of E-Government Act of 2002 (PL 107-347)

· Homeland Security Presidential Directive (HSPD-7), “Critical Infrastructure Identification, Prioritization, and Protection, 17 Dec 2003

· National Security Telecommunications and Information Systems Security Policy (NSTISSP) No.11, “National Policy Governing the Acquisition of IA and IA-enabled IT Products,” Jan 2000

· NAVSO 5239-03--Designated Approving Authority (DAA) Guidebook

· NAVSO 5239-1--Introduction to Information Systems Security

· Navy-Marine Corps Unclassified Trusted Network Protect (UTN-Protect) Policy, 4 Aug 2004

· NSTISSAM TEMPEST/2-95, RED/BLACK Installation Guidelines, 12 Dec 95, with Amendment of 3 February 2000

· NSTISSD 500, Information Systems Security Education, Training and Awareness,” 25 Feb 1993

· NSTISSI 4011, “National Training Standard for Information System Security Professionals,” 20 June 1994

· NSTISSI No. 7003, Protected Distribution Systems (PDS), 13 Dec 1996

· OMB Circular A-130, “Management of Federal Information Resources,” 28 Nov 2000

· OMB Memo M-00-07, “Incorporating and Funding Security in Information Systems Investments,” 28 Feb 2000

· OPNAVINST 2201.2, “Navy and Marine Corps Computer Network Response,” 3 Mar 1988

· OPNAVINST 2201.3 CH-1, “COMSEC Monitoring of Navy and Marine Corps Telecommunications and AISs”, 27 Jan 1999

· OPNAVINST 5239.1C “Navy Information Assurance (IA) Program,” 20 AUG 08

· OPNAVINST C5510.93F/MCO C5510.19 Navy Marine Corps Implementation of National Policy on the Control of Compromising Emanations, 10 Jan 2002

· Privacy Act of 1974

· SECNAVINST 3501.1, “Department of the Navy (DON) Critical Infrastructure Protection (CIP),” 16 Jun 2002

· SECNAVINST 5211.5D, “DON Privacy Act Program,” 17 July 1992

· SECNAVINST 5239.3A “Department of the Navy Information Systems Security (INFOSEC) Program,” 20 Dec 2004

· SECNAVINST 5510.30A; CH-1, “DON Personnel Security Program Regulation”, 19 Jun 2000

· SECNAVINST 5510.36, “DON Information Security Program Regulation,” 17 Mar 1999

· SECNAVINST 5720.47, “DON Policy for Content of Publicly Accessible WW Sites”, 24 Oct 2003

· SECNAVINST 3501.1A, “DON Critical Infrastructure Protection (CIP)”

· “DON Information Technology Policy Guidance for FY 2010”

· COMNAVMETOCCOM Infrastructure Architecture Resource Management

· NAVMETOCCOMINST 3030.5 COMNAVMETOCCOM Continuity of Operations Plan

· COMNAVEMTOCCOM Naval Oceanography Program Requirements Management

· Embedded REL User Enclave Technical Implementation Instructions v3.0, 20 Nov 07

· Defense Information Systems Agency (DISA SIPRNET Global Information Grid (GIG) Interconnection Approval Process (GIAP) Connection Requirements, Oct 06

· COMNAVNETWARCOM ltr 5239 Ser ODAA/1705, Navy ODAA Guidance Memorandum 02-07; Guidance for a Comprehensive Plan of Action and Milestones (POA&M), 14 Jun 07

· DON CIO Washington DC 291600z Feb 08 DON Contingency Plans and Testing Guidance

· USN/USMC IA Pub 5239-22, Sep 08, Information Assurance Protected Distribution System (PDS) Publication

· DON CIO Washington DC 181430Z May 09 Department of the Navy Privacy Impact Assessment (PIA) Guidance

· DoD CIO Memo, Encryption of Sensitive Unclassified Data at Rest (DAR) ON Mobile Computing Devices and Removable Storage Medial, 3 Jul 07

· Department of Defense (DoD) 5220.22-M “National Industrial Security Program, Operating Manual”

· Secretary of the Navy (SECNAV) Instruction 5510.30C “Personnel Security Program”

· SECNAVINST 5510.36B “Department of the Navy (DoN) Information Security Policy”.

9. MONTHLY STATUS REPORTS

A monthly status report shall be submitted to the COR for each task order not later than the 10th of the following month for each task order. The submitted invoice and monthly task summary report must be in agreement.

Each monthly status report will contain:

· Current status and progress to include tasks that were performed, issues and concerns, and future work planned;

· Deliverable(s) that were made and those that are planned for next reporting period;

· Overall status of validation and evaluation progress and resource expenditures in a timeline format;

· Current quality assurance verification testing results (in brief)

· Problem area identification

· Monthly resource expenditure spreadsheet (Contract Funds Status Report) that includes a breakdown by project. Project breakdown shall be listed by labor categories with number of hours expended per labor category.

10. DELIVERABLES

Individual task orders will specify the deliverable items related to the tasking, due dates, and frequency.

11. PLACE OF PERFORMANCE

Government Site Locations - The primary place of performance shall be at Stennis Space Center, MS. Other locations include Suffolk, VA; Norfolk, VA; San Diego, CA; Pearl Harbor, HI; Washington D.C.; Monterey, CA; Flagstaff, AZ, AMC Colorado Springs, CO; Yokosuka, Japan; Bahrain and Rota, Spain. Travel and specific full-time equivalent (FTE) requirements will be specified in individual tasks orders.

Due to the length of the contract, the distribution of work between locations may change.

Contractor Site Location: There may be a small amount of work that can be performed at the Contractor’s site, i.e. reports, data consolidation, data analysis, etc. All work to be completed from the Contractor’s site must be reviewed and approved, on a case-by-case basis, prior to performance, by the appropriate on-site Government representative. Remote work must be addressed (identify tasks in PWS/SOW).

12. TRAVEL

Travel will be based on a fixed-price basis at the task order level. When required, the contractor may be expected to travel on short notice. Travel locations could be worldwide as referenced above in Section 12.

All travel must be pre-approved in writing by the Technical Assistant and/or COR prior to the actual travel and all travel must be funded in the task order prior to any travel. No travel shall occur outside of the period of performance dates of the task order.

All contractor personnel providing continuing support on a world-wide basis shall be required to have a valid passport on hand at all times. Additionally, travel to attend special training, meetings or conferences may be required as determined by the COR. The contractor shall include all trip reports in the Monthly Status Report for all travel performed and meetings attended during the reporting period.

Work defined to be performed at a Government Site Location (key location) requires local, on-site staff unless otherwise approved in advance by the COR and/or PCO. This contract does not cover the weekly or bi-weekly cost of flying contractor personnel back home regularly.

GOVERNMENT PROVIDED RESOURCES/GOVERNMENT FURNISHED ITEMS:

a) For performance at Government site: Government shall furnish work space, furnishings, telephone service, document reproduction capability, computer resources including access to terminals, printers, software, data, communication networks, etc. The Government shall provide initial guidance, technical information, subject matter orientation, and documentation such as reference manuals and appropriate publications.

b) Temporary Government Workspace: The Government may provide temporary work space for tasks that require more than two weeks at a specific site to complete. This will vary at sites/activities. These spaces may be no more than a desk in a small room. Copying capability will be at the discretion of the specific activity where the task is performed. The Contractor shall be responsible for all other facilities, equipment, and supplies required for the performance of tasks.

c) The Contractor shall be furnished documentation, task working papers, project descriptions, program briefing material and other pertinent information, and other documentation or material required to support performance of the effort in this contract. Information will be provided to the Contractor within a reasonable time commensurate with schedules and target completion dates for assigned tasks and activities.

UNCLASSIFIED