PWS Part 6 .docx

6.1 Task Area 1: Contract and TO Management

6.1.1 Task Order Management- Firm fixed price (FFP), O&M.

The contractor shall provide a Task Order Management Plan (TOMP) and control process to ensure management visibility and effective coordination from TO startup through the cost-effective delivery of high quality services, contract transition and closeout, and shall adhere to all DoD, DISA, and other customer directives. The TOMP shall include all elements and processes to be used for successful execution of this TO to include Transition-In, Startup, Schedule Management, Subcontractor Management, Quality Control, Financial Control, Issue Escalation, Risk Management, Transition-Out, and Closeout. A draft TOMP shall be submitted with the contractor’s proposal and a final version 30 calendar days after TO award.

6.1.2 Monthly Status Report (MSR) – FFP, O&M.

The contractor shall submit an MSR that addresses adherence to the Best Management Practices, in a format mutually agreed upon with the Government. The MSR shall describe tasks, progress, quality, risks, customer feedback, any potential problems, accomplishments, and issues from the reporting period of the MSR for each of the exercised task areas against the IMS. At a minimum, this data shall include:

· A brief description of activities and deliverables performed during the reporting month by Task Area. This description shall include problem definition and recommendations for program resolution. Particular attention shall be given to risk management and cyber security activities.

· Rolling 90-Day Action plan

· Brief description of issues, challenges, or problems identified during the reporting period.

· Description of the outcome of any trips, technical visit, and related results for the reporting period.

· Identification of key personnel and personnel reassignments including personnel added or removed from the TOs and all subtasks they will or did support.

· The contractor shall provide an updated Government Furnished Equipment (GFE) list

· The contractor shall provide a monthly financial and cost-based reports and activity-based cost report which covers all tasks under this effort. These monthly reports will record the progress, issues, and cost expenditures for the reporting period.

· Cost-reimbursement estimates and the status of invoicing. Evaluation of contract line-item numbers of ceilings, obligations, and projected demand.

· Self-assessment of performance with respect to the PWS Acceptable Quality Levels (AQL).

· Organizational report to include an overarching organization personnel hierarchy, and a subsequent page with an employee/personnel listing to show name, email, and phone number aligned to Labor Category and Prime vs Sub-contractor (when applicable).

· The contractor shall proactively identify and prioritize risks and alternative COAs sufficiently in advance to permit Government intervention and action before a risk becomes an issue, as well as identify best practices and lessons learned.

· Process improvement recommendations – this can be related to the specific projects or just overall business improvements

6.1.3 Monthly Contract Status Meeting (CSM)

The contractor shall hold monthly contract status meetings. The contractor shall conduct each CSM with a coordinated agenda, briefing materials, document minutes of the CSMs and provide information regarding TO status, e.g., work progress, price and/or cost of travel/materials, schedule data, projected tasks with completion status and areas of concern. CSMs shall provide for interchanges between the Government Staff (to include PKI Portfolio staff, the KO, the COR, and the contractor. The CSMs shall provide a forum to address performance, technical, and programmatic topics of the TO.

6.1.4 Integrated Master Schedule (IMS) – FFP, O&M.

The contractor shall develop a single Integrated Master Schedule (IMS) to include each exercised task area that contains all of the technical and functional activities required to complete the tasking and deliver the first IMS within 14 calendar days of contract award and updated each week thereafter to reflect the execution and completion of scheduled events. Specifically, this should also capture PKI milestones including but not limited to certificate expirations and software license expirations.

The contractor shall deliver an IMS with at least three levels of definition sufficient to allow for tracking the completion of scheduled events, duration, and inter-relationships between events. The IMS will be baselined, through deliverable acceptance, within the first 30 days of award and changes cannot be made to baselines without concurrence from the TO COR (or alternate COR) in conjunction with other PKI Program Management Leads. Any anticipated changes to the IMS shall be communicated within 24 hours of the identification of the change. This notification shall include identified impact factors and potential recovery mechanisms.

The contractor shall attend and be able to talk to the full IMS scope in a weekly IMS meeting to include risks to the schedule, recommended adjustments to the schedule as well as any external factors that have occurred that impacted the schedule. The contractor shall provide meeting minutes from these meetings to include line changes, impact of change, and government acceptance date of the change.

6.1.5 Asset Management/Inventory Support

The contractor shall maintain, upgrade, and manage the existing infrastructure relationship management tool being utilized by the PKI Portfolio, which at this time is Plant IRM.

The contractor shall create and maintain records of all Government property accountable to the contract, including Government-furnished and contractor-acquired property. The records shall contain the following information and be provided to meet asset control inventory requirements.

The contractor shall track PKI Portfolio deployed assets, software, and firmware to provide government with analysis and roadmap to upgrade or tech refresh infrastructure. The contractor shall support semi-annual inventory reconciliation and documentation of all required inventory fields.

The contract shall assist with property data calls and abide by all DFAS and property accountability policies.

6.1.5.1 Logistics

Contractor shall be responsible for receiving, storing, inventorying, distributing shipping and managing the DISA DOD PKI Portfolio’s equipment that is in storage, operations, and test. Contractor shall have accounts with Vendor’s to ship Government equipment when required. Contractor shall maintain a database for accounting and managing all equipment for managing inventory to include hardware, software, and licenses. The contractor shall work with the Government Property Custodians and managers with performing inventories of all equipment. Contractor shall be responsible for storing, managing, receiving and distributing the government’s equipment at an offsite location that they will acquire and manage within twenty-five mile proximity of the DISA Ft. Meade, Maryland Headquarters.

6.1.6 Purchasing Support (FFP)

The contractor shall procure hardware and/or software as necessary to support implementations, testing and pilots of the PKI Portfolio. The contractor shall procure the necessary equipment for the deployment of the new Root and Subordinate CAs in the development lab, Operations and Maintenance (O&M) lab, and the operational Root subordinate CA operational sites. The contractor shall work with the Contracting Officer Representative (COR) to define a Bill of Materials (BOM) for needed hardware and/or software. Once the COR has provided concurrence with the BOM, the contractor shall submit the purchase request for COR approval.

After receiving COR approval, the contractor shall procure the needed hardware and/or software. The contractor shall coordinate delivery of the needed hardware and/or software with the COR. The contractor may not have to perform all or any of these steps as determined by the COR. In some cases, the contractor shall procure equipment for delivery directly to another organization. The contractor shall track all open orders and report status in the monthly MSR report.

6.1.7 Recurring Meeting Support and Participation

The Contractor shall be required to attend recurring meetings in support of the PKI Portfolio. These meetings will fall into 2 categories: participant and meeting support. Currently the PKI Portfolio has 4-6 weekly recurring meetings that will need participation. Additionally, there are 2-3 monthly meetings and 2-3 quarterly meetings that are also expected to be supported.

When participating in meetings, the contractor is expected to act in a professional manor while providing meeting notes/minutes for all meetings. When the contract is providing meeting support, the contractor will need to prepare the meeting agenda, briefing materials, coordinate participants and venue (in person or virtual) prior to the meeting and provide minutes with action item tracking after the meetings.

6.1.7.1 DoD PKI Certificate Policy Management Working Group (CPMWG)

The contractor shall support the DoD PKI Certificate Policy Management Working Group (CPMWG) by providing support to the DISA PKI PMO voting member on policy changes presented at the CPMWG. Moreover, the contractor shall coordinate, and document all proposed updates to any Certificate Policy (CP) and/or Certificate Practice Statement (CPS) and/or Registration Practice Statement (RPS) through the CPMWG if the DISA PKI PMO is the originating entity of the proposed policy change. The contractor shall attend the monthly CPMWG meetings.

6.1.7.2 Configuration Change Board (CCB)

The Configuration Change Board (CCB) is a weekly meeting (1 hour per week) where all upcoming changes to the PKI environment are discussed and made known to government, stake holders, and Combatant Command Support Agency (CCSA) within the PKI community. The contractor shall support the CCB chair during the weekly CCB Sync meeting to ensure all on-going efforts are coordinated with the labs and production sites ahead of time and maintain, open, and close Change Requests (CRs) in support of the Operations Manager. The contractor shall gather, prepare, and distribute all necessary documentation to include the CR Deployment Plan, which is a comprehensive list of change requests scheduled for implementation that week, prior to the CCB meeting, The contractor shall distribute CCB meeting notes with an approved CR deployment list once the meeting concludes, and support any follow-on CCB correspondence from the PKI community.

6.1.7.3 Technical Interchange Meeting (TIM)

Technical Interchange Meetings (TIMs) take place so that customers, operators, stakeholders and other PKI PMO staff can learn about the core mission of the DoD PKI and discuss upcoming development activities in support of that mission. TIMs will be held quarterly for the DoD PKI community lasting two - three hours. The contractor shall produce minutes including synopses of attendees, technical discussions, and lists of open/closed action items. Topics presented and discussed at the TIM will be focused on current challenges facing the DoD PKI community or forth-coming capabilities within DoD PKI. The contractor shall coordinate the date, place and agenda for the TIM as directed by Government.

6.1.8 Transition In Tasking

The contractor shall prepare, provide, and execute a phase-in transition plan that describes management controls, techniques, and procedures to ensure all required personnel are available and on-site, ready to perform, 15 calendar days after the Period of Performance (PoP) start date. The transition period shall be day 1 through day 14 of the PoP. Personnel for the first 14 calendar days of the base year shall be limited to what the offeror requires to facilitate the phase in transition plan. At a minimum, the plan shall include executable milestones and actions for each day of the Transition In period that ensure all staffing is available to support the PWS. The plan shall detail how the offeror will maintain daily oversight of their staff. The plan shall identify procedures and corporate policies that support the attrition and sustainment of a qualified workforce.

6.1.9 Transition Out Tasking

The Transition Out Plan task shall facilitate the accomplishment of a seamless transition from the incumbent to an incoming contractor/Government personnel at the expiration of the TO. The contractor shall cooperate to facilitate an orderly changeover to the follow-on service provider. The contractor shall provide a Transition-Out Plan 45 days prior to expiration of the TO. The contractor shall identify how it will coordinate with the incoming contractor and/or Government personnel to transfer knowledge regarding the following:

· Provide familiarization training and documentation to any follow-on service provider.

· Transition of service operations outlined in the PWS to any follow-on service provider. The plan shall address the transfer of system configuration, load balancing configurations and processes, and other network infrastructure supporting documentation. The plan shall address the orderly transition of responsibility between service providers while ensuring continuity of operations (COOP).

· Inventories and locations of all documentation (program management documents, technical drawings, configuration data [including warranty and maintenance] implementation plans, and COOP). The plan shall address current retention schemes and access for follow-on service provider.

· Provide a status of all ongoing technical initiatives and support a smooth transition of all engineering efforts to follow-on service provider.

· Transition milestones and communications. The plan shall address the milestones required to successfully transition the effort to a follow-on service provider. The plan shall also include a reporting plan to address milestone progress updates.

· The contractor shall conduct a joint inventory with government personnel of all government furnished property (GFP). The contractor shall deliver to the government COR a final inventory of all GFP no later than (NLT) 90 business days before the end of TO performance.

6.2 PKI Portfolio Integration and Implementation

The contractor shall provide integration services to connect users to the networks and provide technical assistance to ensure operational status of users after the connection process. This includes user systems integration, network component installations and de-installations, and the management information services required to support those tasks.

The contractor shall provide webmaster and web management services for each network. This support may be required to be executed on either NIPRNet, SIPRNet or other network websites. At the time of TO award, the contractor shall be able to, and be eligible to request, with Government process assistance, SIPRNet connectivity at the Government site.

6.2.1 - New Enhancements for Integration and Implementation The contractor shall be responsible for review and analysis of new enhancements or new system documentation. The contractor shall generate documentation in support of new enhancements. The contractor shall be responsible for creating, maintaining, and updating to reflect new releases for all system, network, and security documentation per DoD requirements. The contractor shall format the documentation in accordance with the DoD Architecture Framework. Documentation is Government Furnished Information (GFI) and the contractor shall not claim it as their proprietary document. The contractor shall maintain the documents on a DISA owned repository such as the DoD Enterprise Portal Service or the current authorized repository as directed by the government.

The contractor shall coordinate all PKI O&M test lab issues, ensuring completion of initial O&M and final JITC testing of all PKI CRs and deployment into the production PKI enclaves.

The contractor shall provide installation, implementation and project planning support for program requirements and tech refresh projects to include installing network/computer equipment, review and critique of implementation plans, working with PKI support staff to install network/computer equipment, providing PKI hands-on support for capacity services TO server implementations, and the installation of communications infrastructure and servers.

The contractor shall provide a weekly spreadsheet showing details of all CR’s and RTS’s through the deployment process through installation at each deployed site.

6.3 PKI Portfolio Sustainment

The sustainment activities for the PKI Portfolio is multifaceted, supporting PKI adoption tools, developing and maintaining documentation, and consulting on technical issues with DoD, mission partners, and commercial industry supporting DoD.

The PKE team has a suite of existing testing and administrator support tools written in a variety of languages. The current support tools are updated monthly, and there are about 30 updates that occur a year across all the tools. The tools are to be posted (made available) to customers on a web platform as directed by the government. The current list of support tools are:

· MailCryptkey

· CertAdmin

· CRLAutoCache

· Keyed Bulk Revoker (KeBlR)

· InstallRoot (Windows and Mobile Versions)

· certLoader Scripts

· MiniCRLFetch

· Federal Bridge Certification Authority (FBCA) Cross Certificate Removal Tool - Trust Anchor Constraints Tool (TACT)

· PKI Copy and Paste (PCP)

· PKI Interoperability Test Tool (PITT)

· WBBR

· KEBL

6.3.1 – Out-of-Band Management The contractor shall establish Out of Band Management Networks point to point for remote management of the PKI Portfolio Systems and Capabilities as well as for Active Monitoring of the Health of the PKI and RCVS resources located at DCF-Mechanicsburg, DCF-Oklahoma, JITC AZ and DISA Ft. Meade.

The Network will consist of using NSA Certified Type 1 Encryption Devices. Currently this requirement is using a 10 G KG250 TACLANES.

· The OOB Networks will have to be in place before the Health Monitoring Tools can go into operations.

· The OOB a will also have to be included in the overall PKI Accreditation.

· The OOB shall support Remote Management of the PKI and RCVS capabilities.

· NIPR/SIPR and or ISP Circuits should be considered for optional transport mechanisms.

The contractor shall engineer and manage an out of band network for PKI and RCVS.

Engineering, design, operations and maintenance of an OOB new to the PKI Architecture which requires nodes to mesh into Mech and OKC OOB.

6.3.2 – Enhanced Monitoring Provide Government approved Monitoring Tools to include Network Performance Monitor, Application Performance Monitor, Server Performance Monitor, Net Flow Traffic Analyzer, IP Address Mapping, Syslog Server, Network Configuration Manager, User Device Tracker, Network Topology Mapper and Log Analyzer (or its replacements).

· Monitoring tools will also have to be included in the overall PKI Accreditation.

· Monitoring Platform uses Windows Server and SQL Server. An HBSS ePO may also need to be stood up to support these Window devices.

The contractor shall engineer and manage a Windows Domain to support the PKI Monitoring - implementation. This will include:

· Engineering, installation, operations and maintenance of a new virtualization architecture consisting of two HP physical host servers at each site with VMware ESXi hypervisors and VSphere management software

· Engineering, design, operations and maintenance of a Windows domain new to the PKI Architecture which requires multiple domain controller servers and Windows domain administration functions (Active Directory OU configuration and management, security groups, GPOs, replication, etc.)

· Installation, operations, updating, and maintenance of multiple Windows servers and Windows Software new to the PKI Architecture - including Windows Server 2016, MS SQL, ePO, and WSUS.

6.3.3 – Log aggregation and Security Management System Contractor shall recommend the tool to procure and implement an Enterprise Security Management Solution that collect and correlate data at an enterprise scale. It shall combine an open architecture for security data, real time correlation and an provide data analytics. Capability shall provide threat detection, analytics data collection and distribution.

The solution shall include a log management solution that is optimized for extremely high event throughput, efficient long-term storage and rapid data analysis. The solution shall be able to allow the retrieval of unmodified data on demand for forensic analysis. The solution shall be hardened, dedicated and support enterprise requirements.

The solution shall provide aggregation and correlation of all syslog and audit events from the DOD PKI Portfolio of capabilities. It shall be able to receive and forward both syslog and log file events crated by a wide variety of hardware and software network products.

Realtime monitoring and correlation shall be provided as part of the solution.

6.4 Tier I, II, and III Support

The contractor shall provide on-site support in response to email requests during normal business hours (9 a.m. to 5 p.m. Eastern Standard Time). The contractor shall provide an initial response within 4 hours of receiving a request for support. The PKI Support team shall be able to research and elevate questions to Tier III engineers and the Government when circumstances require it. Responses shall meet the quality expectations of the Government. The number and type of requests shall be reported in the Monthly Status Report (MSR).

· Typically manages around 50-100 tickets per week with 5-10 issues per week requiring escalation for additional technical engagement and analysis across the contract team and government.

· Serve as the programs Lead TIER II/III liaison to facilitate tracking and resolution of issues and correcting degradation with respective DCF, developer, and program office staff Surveys will be included with every closed ticket regardless of escalation tier in order to gain useable feedback and visibility into effectiveness of the resolution process.

6.4.1 – Tier I The contractor shall provide Tier I support to the DoD and Federal Agency Communities in the form of technical consultation, security analysis and configuration support for the acceptance and use of DoD PKI certificates and existing DoD approved PKI certificates within DoD networks and information systems. The DoD Community is defined as the combatant commands, services, and agencies (CC/S/A). Support may be required either for ongoing operations or for planned implementations. This can range from a basic support question such as “how to send an encrypted email” all the way up to a request for on-site support for a DoD Enterprise Program to assist with designing the security architecture to accept and validate ECAs, DoD PKI, and DoD-approved PKI certificates. PKI Operational Enablement escalation path to Tier II & Tier III.

6.4.2 – Tier II The Contractor shall establish and operate an PKI Tier II help desk to resolve issues elevated from Tier 1. The Contractor shall investigate elevated issues by confirming the validity of the problem and seeking known solutions related to these more complex issues. The Contractor will collect information such as the name of the program or application that has failed or any database related details (e.g., table, view, or package name) or API names. This information shall be readily available to Tier III, if the issue is further escalated to that level. The Contractor will manage all support tickets assigned to Knowledge Management (KM).

6.4.3 – Tier III The contractor shall provide Tier III technical support to DCF Operators for all infrastructure issues regarding the PKI Portfolio. The contractor shall also provide on-call support to resolve PKI Portfolio Tier III issues.

The contractor Tier III support shall be available at any time, to assist in resolving infrastructure issues with PKI technologies. The contractor shall create, document, test, and install shell scripts, and/or DISA approved programs/applications that will provide automation of duties to manage the system most effectively in accordance to the CM process.

The contractor shall provide the COR and PKI Portfolio an email notification of any issues including degradation, outage, or any factor that impacts operational status of the PKI Portfolio. Notification format shall include a problem description, time and date of issue and discovery, impact, and troubleshooting measures. The notification shall also indicate whether the issue is a recurring problem or a new issue. The contractor shall provide the COR and PKI Portfolio an after-action report (AAR) when issues including degradation, outage, or any factor that impacts operational status of the PKI Portfolio occur. The AAR shall include all details that pertain to the event to include time and date of issue start and resolution, systems and users impacted, and issue resolution time/date.

6.5 PKI Portfolio Program Support

6.5.1 – PKI Portfolio Support

Standard work for all Portfolio Items

6.5.2 – External Certification Authority (ECA) Programmatic support DoD Instruction 8520.02, “PKI and Public Key Enabling” dated May 24, 2011, directs the DoD PKI PMO to maintain the DoD ECA program in accordance with (IAW) the ECA x.509 CP to support the issuance of DoD-approved certificates to industry partners and other external entities and organizations.

The contractor shall support all DISA Areas of Responsibility described in the ECA CP as well as field and respond to business and policy questions from the ECA user community and ECA vendors. The contractor shall work closely with the Federal PKI, and specifically the Federal Bridge, on proposed cross-certificate changes to ensure DoD PKI can successfully validate ECA certificates through cross certificate trust. The contractor shall provide support for the review and documentation of ECA PKI capabilities and their use and make recommendations on ECA vendor documentation and procedures to include ECA agreements. The contractor shall maintain the ECA web presence on DISA’s cyber.mil and public.cyber.mil web pages and/or other website as approved by the Government. The contractor shall provide website maintenance and provide a status report of all the ECA support tickets addressed. The contractor shall maintain and update the Authorized DoD Employee List and other list or documents. The contractor shall assist the government in locating and arranging meetings with Authorized DoD Employees (ADE) for Foreign Nationals who require ECA credentials.

6.5.3 - Mobility The contractor shall support all DISA Areas of Responsibility in the management of mobile devices and derived credential issuance through Purebred on all platforms.

The mobile operating environments currently includes Windows, Apple iOS, Samsung Knox, and Google Android. The mobile device capabilities vary from well documented Application Programming Interfaces (APIs) for accessing cryptographic providers and key stores to low level programming. The contractor shall analyze upcoming changes to mobile OS and Mobile Device Management (MDM) solutions and provide a report on the impact to the existing DoD PKI infrastructure, along with a planned resolution for each issue identified.

The contractor shall maintain the existing code, as well as making updates to support changing DoD mission requirements such as deployment on SIPR and a second site (COOP).

The contractor shall develop documentation for each OS platform build which include admin and user guides, and standard operating procedures (SOPs) for Purebred Maintenance.

The contractor shall develop a test and implementation plan that supports all deployments of Purebred into the test, and operational environments on all Purebred supported hardware platforms.

The contractor shall deliver a report containing test results before each major architecture or software upgrade or inclusion of new features in the app. The contractor shall demo enhancements and/ or new features in Purebred to the government and/or customers as directed by the government.

The contractor shall develop training materials for Purebred Agents. The contractor shall update the training materials to ensure that they correspond to the deployed Purebred version.

The contractor shall work closely with the government to maintain the Purebred web presence on DISA’s cyber.mil and public.cyber.mil web pages and/or other website as approved by the Government. The contractor shall stand up and maintain a Certificate Authority (CA) in the test lab and in production dedicated to Purebred and maintain a CA tech refresh cycle to ensure that Purebred derived certificate lifecycle validity period remains at three (3) years.

6.5.4 – Network Management The contractor shall monitor the quality of network communications and information processing. The contractor shall perform network configuration management per industry best practices to identify, control, collect data for, and provide data to, networks for the purposes of status accounting and auditing. The contractor shall detect, isolate, and correct problems in, or abnormal operation of, the network or network components. This includes performing tasks on the network or researching and analyzing information about the network provided to the PKI Portfolio.

The contractor shall support the propagation of DISA/DoD PKI systems and technology to other DoD Partner environments and locations. This will include network engineering tasks, systems drawings, site surveys, equipment procurements, communications design, and network installation, as well as ad hoc briefing and meeting participation. This shall also include supporting system capability demonstrations, evaluations, and exercise support.

The contractor shall perform support functions for the centralized management of Global Cryptographic Keying Material PKI networks at applicable locations. Support includes ability to write, review and analyze communications security (COMSEC) message traffic and documents to ensure they are in accordance with current joint COMSEC management procedures.

6.5.5 – Onsite Infrastructure support The contractor shall provide Operations Management onsite support at Ft. Meade, Maryland, Oklahoma City, Oklahoma, and Mechanicsburg, Pennsylvania for Operations with deployment, integration, and operation of PKI Portfolio capabilities. Contractor support shall:

· Ensure baseline configuration is maintained to site deployed PKI systems

· Implement approved change requests released by CCB in CR/RTS or approved by the PKI Portfolio

· Ensure all changes that are made to site deployed PKI Portfolio’s systems are recorded and implemented via Remedy (https://remedy.dodpke.us/) Ticketing System (RTS) or approved by the Operations section of the PMO

· Provide information and guidance to DCF staff about CP/CPS compliance

· Immediately notify PKI Portfolio Operations of any outage and/or degradation of operating status for PKI systems

· Support system and application troubleshooting, tuning, management, implementation, operations, and decommissioning

· Provide the PMO requested reports to include logistical, operational, and process reporting

· Compile aggregated daily check reports and provide daily operational status checks to validate operational availability reports to PKI Portfolio

· Provide implementation and integration support for deployment of new capability, tracking Service Request Form from submission to project deployment completion

· Serve as TO representative for dissemination of operational tasks

· Work to analyze PKI Portfolio Systems monitoring and logging architectures to identify deficiencies and propose enhancement in the form of CRs and Implementation Plans. In the follow-on option years, part of this analysis will lead to development of a “Continuous-Use” Monitoring capability to provide web-based status and trend information to PKI Portfolio customers on system and sub-system uptime and usage.

· Engage with ISSO to review weekly audit log discrepancies and work with the nominated site staff and PKI Portfolio to develop POAM for mitigation or resolution

· Track site certificate validity (issued internal/external certificates and Delegated Trust Model (DTM) certificates) and ensure rekey/update activities occur to ensure no service interruption.

· Validate Certificate Revocation Lists (CRL’s) are updating per applicable Public Key Infrastructure (PKI) Certificate Practice Statement (CPS).

· Monitor all services and offerings of the PKI environment through deployed application tools. Eg, Solar Winds, Splunk, Nagios.

· Generate, update, and disseminate SOP/TTP through specified platform.

· Onsite personnel shall schedule and implement JITC-released CR's according to authorized maintenance windows for PKI. The contractor shall schedule all updates outside of peak operating hours and implement on no more than one node at a time to avoid capability degradation.

· Support additional PKI Portfolio requirements

6.5.5.1 – Defense Computation Facility (DCF) Support The contractor shall maintain onsite support at specified PKI enclave locations that will assist DCF Operators with operations of all PKI Portfolio systems. The onsite support shall have expertise with Redhat Enterprise Linux, Red Hat Directory Server, Red Hat Certificate System, Red Hat Directory Services, directory Access Control Lists, Directory synchronization tools, PKI, network communication, encryption to include Hardware Security Module (HSM), Extensible Markup Language, Java code development, X.500 directories, Hypertext Transfer Protocol (HTTP), HTTP Secure, Lightweight Directory Access Protocol, Active Directory, Cisco IOS, F5 BigIP Local Traffic Management (LTM)/Global Traffic Management (GTM) iRules, fundamental troubleshooting skills, enterprise level directory administration tools, and other closely related Directory services technologies.

The contractor shall support Change Request (CR) generation for the current operational systems at the DCFs to ensure the PKI operates 24 hours per day, 7 days per week (24/7) and meets operational availability parameters. PKI operational availability is defined as the time that the PKI is prepared to respond to requests to register subscribers; generate new, renewed or re-keyed certificates; process revocation requests; generate CRLs; provide certificate status checking; and respond to key recovery requests. The contractor shall also track, facilitate, and work to resolve any trouble tickets opened by the program team on vendor’s products and/or code developed, including testing bug fixes provided by the vendor, providing feedback to the vendor, engaging appropriate stakeholders in troubleshooting sessions and providing resolutions to the customers. The contractor shall track and facilitate any trouble tickets opened by the DISA Global Service Desk (GSD) in support of the PKI program including providing getting feedback from the customers, engaging appropriate stakeholders in troubleshooting sessions and providing resolution to the customers. The contractor shall provide weekly status of the resolution of those trouble tickets to the COR in a format that supports the configuration management process and shall be documented in the Management Plan. The contractor shall ensure that all changes to the system comply with the CPSs where applicable. Specific areas considered within the realm of this review to include the following:

· Data Distribution Service Processes and Interfaces

· Directory and Data Storage Components

· Customer Usage and NetOps End-to-End Monitoring

· DCF Site-to-Site Data Integrity, Parity, and replication

· Delegated Trust Model updates

· Key/Rekey actions

· Certificate renewals

· Enclave monitoring tools

· Assured Compliance Assessment Solution (ACAS)

· Host Based Security System (HBSS)

· Satellite

· Puppet

· Ansible

· Red Hat IDM

6.5.6 – Support The contractor shall ensure certificate(s), Delegated Trust Model (DTM), F5 DS account passwords and CRL’s have not expired on PKI Portfolio systems on a frequent basis. For CRL’s, the contractor shall ensure they update and are posted in accordance with the CP/CPS. The contractor shall provide OS and Validation Authority updates as released

6.5.7 – RA Support The contractor shall provide on-site PKI support as directed by the Government to assist in technical advice, security analysis and configuration support.

The contractor shall administer, maintain, sustain, and update RPS/CPS compliant RA workstation on NIPRNet, SIPRNet, GIPRNet or other DISA approved Networks at DISA HQs. The contractor shall be responsible for identifying escalated privilege individuals within the team that will serve the additional duties of RA/LRA/KRA on NIPRNet and RA/LRA/KRA/Registration Authority Operations (RAO) on SIPRNet and other future networks based on PKI Requirements. The contractor shall train escalated privilege individuals IAW the PKI Program policy guidance and be responsible for the following:

· Maintain qualifications that meet the CPS requirements

· Support tickets from customers in procedures required to be followed when obtaining digital certificates from the organization CA

· Provide SME support, as necessary, to ensure the organization is functioning effectively

· Conduct annual review of CC/S/A/PA’s provisioned RA/LRA/KRA/RAOs and coordinate changes

· Support and coordinate additions of newly trained RA/LRA/KRA/RAOs with approved nomination letters

· Conduct daily checks of deployed PKI capability and provide daily status update to PKI PMO With PKI PMO concurrence, the contractor shall support RA/KRA/LRA/RAO services if a suitable DoD and Federal community component escalated privilege user is not available. This support is infrequent but shall be made available as an option of last resort to the DoD and Federal Community. All efforts shall be made to handle all requests by the appropriate DoD or Federal Registration Authority office.

All RA, KRA, LRA and RAO activities shall be included in the MSR.

6.5.8 – PKI Portfolio Lab Sustainment The contractor shall maintain the PKI Lab at Ft. Meade, Maryland. The lab will consist of GFE purchased by the Government. The contractor shall ensure that the systems are up to date with current versions and patches. The contractor will have access to the Remedy (https://remedy.dodpke.us/) asset management systems or record that provides configuration management for the Development, Test and Staging Laboratories. The contractor shall be responsible for providing status updates to Remedy (https://remedy.dodpke.us/) asset management of record systems for the PKI Labs.

6.5.9 – Development Lab Support The contractor shall be responsible for the transition of the current development lab into a development lab environment at a third-party site (like Equinix in Virginia) located within the National Capital Region to support the execution of the contract and operation of the transitioned lab thereafter. The contractor shall provide enough space to host up to 16 racks with the maximum height not to exceed standard rack elevations of 48Us. The development lab environment should have the necessary power and cooling to support up to 16 HP DL 580s, 20 HP DL 380s, 16 4500X Cisco Switches, 6 5585 Cisco Firewalls, 2 F5 Big IP appliances, 12 Dell R720s, 6 Thales 6000+ HSMs, 2 Cisco 5555 Firewalls, 8 Cisco Switches, and 6 management personal computer workstations. The contractor shall have the ability to support an additional 16 racks of similar equipment for redesign or technical refresh efforts.

The lab shall be accessible to the Government for inventory purposes, to monitor or review technical tasks under this contract during normal business hours 0800-1700EST. The contractor shall ensure that the lab is remotely accessible to support external testing of systems. The contractor shall provide an inventory of the equipment located within the development lab every quarter.

6.5.10 – Support Security Enhancements The contractor shall reconfigure the rules and settings for the Web Application Firewall (WAF) to protect against new threats and to support CA deployments. The goal of this task is to reach a set of application protocol whitelists which constrain client traffic to the permissible set of client input. The protections are supplied using an Apache Hyper Text Transfer Protocol Daemon (HTTPD) instance and mod_security. The contractor shall provide an initial User Guide detailing the start and stop procedures for the WAF and update the procedures annually. The contractor shall provide documentation to support the IA accreditation to include the STIG checklists and CR documentation for DoD PKI ATO.

The goal for user restriction is to use SELinux targeted policy as a technical control and enforce separation of duties as defined in DoD PKI policy. The contractor shall modify the text and configuration target files for SELinux to constrain permissions for users and processes on PKI systems. The contractor shall perform the initial effort to isolate user groups to restrict users to only the necessary portions of the file systems and system resources to perform their duties. The contractor shall perform a follow up effort to constrain processes to only the necessary portions of the file systems and system resources for correct functionality. Annually, the contractor shall update the SELinux target files to account for any changes that were made to DoD PKI Policy.

After the completion of each effort, the contractor shall deliver the SELinux target file documentation.

6.5.11 – Review and Patch the RedHat Certificate System source code for defects The contractor shall review the Red Hat Certificate System source code, as released officially by Red Hat and as available from the Dogtag open-source project, for defects related to functionality and security. The contractor shall provide a report with a summary of components and files reviewed along with the issues identified and proposed patches.

6.5.12 – Notification of issuance events to users The contractor shall analyze the existing DoD PKI Infrastructure and develop a new Software Design Description capability in accordance with DID DI-IPSC-81435A that will notify PKI subscribers and Registration Authorities (RAs) of issuance events. For PKI subscribers, notification occurs using available contact data already registered with DoD PKI or obtained from DoD Enterprise Global Address List servers. The capability will provide the subscriber with notifications for all credentials issued asserting the subscribers name, with date and time of issuance and responsible issuer. For RAs, notification occurs monthly of all certificates issued during the month by the identified RA.

Once the new design is approved by the Government, the contractor shall develop and document CRs needed to modify the new and existing software baselines and hardware configurations to support the combined system.

The contractor shall develop System Integration Tests for the combined system in accordance with DID DI-IPSC-41438A to be delivered to the Government according to the IMS.

The contractor shall configure the new and existing network appliances, software, and systems to initiate the capability on the DoD PKI Infrastructure.

The contractor shall execute the System Integration Tests, document the results, and deliver a test report to the Government in accordance with DID DI-IPSC-81440A within 15 days after test execution.

The contractor shall provide documentation to support the IA accreditation to include the STIG checklists and CR documentation for DoD PKI ATO.

The contractor shall support the transition of the PKI subscribers and RA notification capability from development to operational sustainment for up to 60 days to correct any errors identified during the transition and provides system design documents and user manuals.

6.5.13 – Maintenance of Existing Custom Software The contractor shall support the following programming languages at a minimum: Objective-C, C++, C#, Java, VB.NET and Python. The contractor shall also have hands-on experience with Windows PowerShell, Linux and UNIX shell scripting.

The contractor shall update the source code for previously developed GOTS software to include PKE tools to incorporate additional capabilities that result from the deployment of new CA certificates/trust anchors, changes in PKI policies, and support of new standards.

The contractor shall maintain and version control all previously developed GOTS software to include PKE tools' source code in the Government-approved enterprise code management tool.

The contractor shall trace all changes or updates to the source code and other artifacts to requirements or defects. The contractor shall ensure that the Government has access to current and historical versions of the software baseline. The contractor shall leverage best practices in revision control to efficiently manage trunks, branches, merges, and Tags on code submitted in the code management system.

The contractor shall update and maintain the PKE Administration Guides, Application User Guides, and other documentation and artifacts previously developed for existing PKE products.

The contractor shall update and maintain documentation and artifacts required for Risk Management Framework (RMF) activities using the approved processes. The contractor shall provide personnel to support the collection, creation and maintenance of artifacts for vendor components for Government RMF. Where possible, the contractor shall coordinate with the Government and other DoD entities to collect and augment existing Certification artifacts for reuse. The contractor shall upload and maintain C&A artifacts in the approved Government portals.

The contractor shall clearly communicate the level of effort required to update and test the software with project schedules and test plans. The contractor shall perform regression testing prior to acceptance of the software by the government team.

To ensure that the software will be or has been developed using secure coding practices in a manner that minimizes security flaws within the software, the contractor shall follow the National Institute of Standards and Technology (NIST) 800-53, Recommended Security Controls for Federal Information Systems and the DISA ID Directorate guidance. Prior to the execution of a software development work request the contractor shall provide the Government a copy of the contractor’s secure coding best practices policy.

The contractor shall deliver the GOTS Software to include PKE Application Source Code to the Government with all files in a manner indicated by the government or delivered in a ZIP file. Upon delivery of the software source code to PKI Portfolio, the contractor shall certify to the Government that the contractor complied with the Policy in the performance of its obligations under the delivery order. The contractor shall also make the code is intended to be customer-face available on the cyber.mil and/or public.cyber.mil or other similar platforms that are utilized by the PKI Portfolio and/or where PKI Portfolio has presence. All documents will be reviewed by the Government prior to publication and distribution. For public facing code, the contractor shall comply with existing review processes for publicly releasing documents at DISA

6.6 Documentation

6.6.1 – Implementation Documentation The results of PKI Portfolio engineering work, to include the results of the evaluation of COTS software and hardware, are communicated to the DoD community through information papers, reference guides, and other documentation. The information papers are often used to inform decision makers of technical issues, risks and recommendations as related to the PKI Portfolio. The reference guides are used by System and Network Administrators to implement recommended configurations of COTS hardware and software solutions to interoperate with the PKI Portfolio of projects. Implementation documentation is also provided to end users and developers and system integrators.

The contractor shall maintain detailed Implementation Documentation to include, but not limited to: End Users Guides, Quick Reference Guides, and Administrator Documentation. The contractor shall be responsible for updating existing technical manuals, and for the development of new manuals as additional COTS products or PK-enabled tools are developed and approved for use as directed by the COR. Since these manuals are vendor specific, the manuals will change as the vendor’s product evolves.

The contractor shall include results from any testing initiatives in the Implementation Documentation that is developed. Documentation is a critical deliverable of the PKI Portfolio. It aids the support effort of PKI Portfolio and is the primary mechanism for sharing information with the DoD community for interfacing with the PKI Portfolio. The contractor shall ensure the Implementation Documentation is clear and concise and written for the intended audience by an experienced technical writer. The contractor shall also make the documentation that is intended to be customer-face available on the cyber.mil and/or public.cyber.mil or other similar platforms that are utilized by the PKI Portfolio and/or where PKI Portfolio has a presence. For public facing code, the contractor shall comply with existing review processes for publicly releasing documents at DISA.

The contractor shall track the progress of each Implementation Documentation effort and deliver a Implementation Status report to the government that includes the completed documentation since the previous month and the estimated completion date for all incomplete documents.