PWS PHNSY IT AND CYBERSECURITY.pdf

Enclosure 2c, PWS Page 1 of 120 Pages

1May2020/Version 15

FAR 52.215-3 Request for Information or Solicitation for Planning Purposes (Oct 1997)

(a) The Government does not intend to award a contract on the basis of this solicitation or to otherwise pay for the information solicited except as an allowable cost under other contracts as provided in subsection 31.205-18, Bid and proposal costs, of the Federal Acquisition Regulation.

(b) Although "proposal" and "offeror " are used in this Request for Information , your re-sponse will be treated as information only. It shall not be used as a proposal.

(c) This solicitation is issued for the purpose of: obtain information, to include feedback on PWS and pricing information, for planning purposes.

(End of provision)

PERFORMANCE WORK STATEMENT (PWS)

Award/Mod Effective Version Date Award Date of Award

Contract Number:

Task Order Number:

Contractor Name Tracking Number:

Follow-on to Previous Contract and Task Order Number:

N00178-14-D-8039/N3225318F3000

1. Contracting Officer’s Representative (COR).

a. Primary COR.

Name:

Organization:

Department of Defense Activity Address Code (DODAAC):

Address:

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR.

https://www.acquisition.gov/far/part-31#FAR_31_205_18

Page 2 of 120 Pages

DODAAC:

Address:

Phone Number:

c. Property Administrator

DODAAC:

Address:

Phone Number:

2. Contract or Task Order Title. PHNSY&IMF Code 109 Information Technology (IT) and Cybersecurity Contractor Support.

3. Background. The purpose of this IT and Cybersecurity services contract is to provide the Government with IT and cybersecurity support capabilities in compliance with Department of Defense (DoD), Department of Navy (DoN), Naval Sea Systems Command (NAVSEA), and Department of Energy (DoE) regulatory requirements.

4. Objectives: As part of its mission, the Pearl Harbor Naval Shipyard and Intermediate Maintenance Facility (PHNSY&IMF) provides critical network, data, and cybersecurity enhanced services to the Pacific Area of Opera-tions (PAC AO). The PHNSY&IMF Information Technology and Cybersecurity department, otherwise referred to as Code 109, supports this mission through the delivery of IT and cybersecurity services in compliance with DoD, DoN, DoE (to include the Atomic Energy Act of 1954, 42 U.S.C. §§ 2011-2021, 2022-2286i, 2296a-2297h-13), and USCYBERCOM security standards and mandates to protect the confidentiality, integrity, and availability of Gov-ernment information systems and networks.

5. Scope. The Contractor shall provide professional IT and Cybersecurity services, including any general sup-port tasks as further defined in this Performance Work Statement (PWS).

Performance of services occur at the PHNSY&IMF located at Joint Base Pearl Harbor Hickam Hawaii, but also in-clude on-site support at PHNSY&IMF’s Area of Responsibility (AOR) on Naval Base Guam. Work requirement may include work within INDOPACOM AOR as required. At PHNSY&IMF the contractor personnel will have fre-quent access to all spaces including but not limited to Code 109’s Controlled Nuclear Information Area. The Gov-ernment may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 20% of the contractor’s total proposed cost/price for the base and all option peri-ods, excluding any six-month extension of services pursuant to FAR 52.217-8.

6. Performance Requirements. Contractor’s performance requirements and tasks for each functional area are detailed in the following subsections. Definitions of terms and acronyms used within the PWS can be found in At-tachment A.

6.1 PROGRAM MANAGEMENT SUPPORT

Program management support includes the management and oversight of all activities performed by Contractor’s personnel and its subcontractors to ensure Contractor’s services are performed on time and satisfy the requirements identified in the PWS.

Page 3 of 120 Pages

The Contractor shall have an on-site Program Manager (PM) and an alternate by name, who will serve as the pri-mary interface and point-of-contact (POC) to the Government Contracting Officer Representative (COR) and Code

109. The Contractor PM shall possess the authority to act for Contractor on all matters relating to the daily opera-tions of the contract; the alternate PM serves when the PM is absent. The PM or alternate PM shall be on-site and available to Government during the daily business hours.

Program management support also includes the facilitation of communications between the Government and Con-tractor’s personnel to ensure tasks are clear and activities are performed in accordance with the requirements con-tained in this PWS.

6.1.1 Key Personnel:

Project Manager: The contractor shall provide a project manager who will be on-site and shall be responsible for the performance of the work. An alternate shall act for the contractor when the project manager is absent. The project manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily opera-tion of this contract. The project manager or alternate shall be available on-site between 6:30 a.m. to 3:00 p.m., Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons and available after hours if any issues arise.

Section 6.1 tasks performed by the PM include, management and supervision, direction, administration, quality as-surance, and leadership within the Contractor’s personnel for execution of each task in support of the PWS require-ments. The PM shall apply industry best practices and proven methodologies in project management to ensure all activities and tasks under this PWS are identified, documented, tracked, and accomplished.

Master Oracle Database Consultant (two positions): Mastery level experience managing multiple application Oracle databases and all required interfaces to and from non-standardized, local applications to support a heavy industrial industry or maintenance mission. Leverages specialized knowledge of Government Off the Shelf (GOTS) naval ship maintenance applications and information systems to design and implement optimized enterprise database solutions.

These solutions must provide for the high availability in Oracle database operations of mission critical and mission essential ship maintenance systems typically deployed in a Naval Shipyard. Extensive knowledge of Network Attached Storage (NAS) systems and possess the ability to manage these systems to efficiently store and manipulate data for the application databases listed below. Extensive knowledge in the following applications is required:

• Corporate Shipyard Application Suite (CSAS)/Maritime Systems Environment (MSE) Applications:

• Naval Maintenance Suite (NMS).

• Advanced Industrial Management (AIM).

• Advanced Industrial Management Express (AIMXP).

• Material Requirements Reporting & Tracking (MRQT).

• Project Scheduling and Sequencing (PSS).

• Execution Priority (EP).

• Automated Training Management System (ATMS).

• Navy Workload and Performance System (NWPS).

• Strategic Planning and Forecasting (SPF).

• Performance Measurement and Control (PMC).

• Quality Performance System (QPS).

• Material Access Technology (MATMF).

• Query Database (QDB).

• Supplemental Administration (SAEM).

• Supervisors Desk (SUPDESK).

Page 4 of 120 Pages

• Shipyard Automated Budget Reporting System (SABRS).

• Pre and Post Payroll Processes (PPPP).

• Shipyard Cost Financial Management System (COST).

• Medical Exam Scheduling (MES).

• Non-CSAS/MSE Shipyard Mission Essential Applications (SYME)

• Enterprise Facilities and Equipment Management System (eFEM).

• Automated Radiological Control Management Information System (ARCMIS).

• Advanced Technical Drawing System (ATIS).

• Laboratory Information Management System (LIMS).

Master Financial and Material Business Objects Consultant: Mastery level experience in developing customized fi-nancial and logistics adhoc reporting using Business Objects to support a heavy industrial industry, maintenance mission or financial institution. This includes possessing extensive functional knowledge of all financial and mate-rial transactions derived from Government-Off-the-Shelf (GOTS) naval ship maintenance applications and infor-mation systems to support all specialized data mining operations from MS SQL or Oracle application databases used in the enterprise. Extensive knowledge in the following applications is required:

• Corporate Shipyard Application Suite (CSAS)/Maritime Systems Environment (MSE) Applications:

• Naval Maintenance Suite (NMS).

• Advanced Industrial Management (AIM).

• Advanced Industrial Management Express (AIMXP).

• Material Requirements Reporting & Tracking (MRQT).

• Project Scheduling and Sequencing (PSS).

• Execution Priority (EP).

• Automated Training Management System (ATMS).

• Navy Workload and Performance System (NWPS).

• Strategic Planning and Forecasting (SPF).

• Performance Measurement and Control (PMC).

• Quality Performance System (QPS).

• Material Access Technology (MATMF).

• Query Database (QDB).

• Supplemental Administration (SAEM).

• Supervisors Desk (SUPDESK).

• Shipyard Automated Budget Reporting System (SABRS).

• Pre and Post Payroll Processes (PPPP).

• Shipyard Cost Financial Management System (COST).

• Medical Exam Scheduling (MES).

VMware/Citrix Consultant: Minimum 5 years of VMware ESXI administrator experience to include installation, setup, and maintenance of a VMware vSphere ESXi 5.5/6.0 environments running vCenter and minimum 5 years of Windows Server Administration. Leverages specialized knowledge of Government-Off-the-Shelf (GOTS) naval ship maintenance applications and information systems to design and implement optimized enterprise virtualization solutions. These solutions must provide for the high availability of operations of mission critical and mission essen-tial ship maintenance systems typically deployed in a Naval Shipyard.

Page 5 of 120 Pages

Network Storage Consultant: Minimum 5 years of NetApp Network Attached Storage administration. Leverages specialized knowledge of Government policies and procedures to meet data protection and retention requirements in support of mission critical and mission essential ship maintenance systems typically deployed in a Naval Shipyard.

Backup Consultant: Minimum 5 years of experience with Data Backup Administration using Veritas NetBackup software and minimum 5 years of *NIX Server Administration. Leverages specialized knowledge of Government policies and procedures to meet data protection and retention requirements in support of mission critical and mission essential ship maintenance systems typically deployed in a Naval Shipyard.

Senior Software Engineer (APEX)

• Minimum 10 years designing, developing, and maintaining C#.NET web applications.

• Must have extensive experience (5 years or more) in designing, developing, and maintaining SQL data-bases in SQL Server 2012 R2 or higher.

• Must have extensive experience (5 years or more) in designing, developing, and maintaining SQL data-bases in Oracle 11g or higher.

• Must have extensive experience (5 years or more) designing, developing, and maintaining Oracle APEX applications.

• Must have experience working with corporate data from the following applications: AIM, AIMxp, ATMS, COST, PMC, PSS, QDB, and SupDesk.

Navy Qualified Validator

• DoD 8570.01-M IAM/IAT Level III

• College degree in a technical or managerial related discipline

• High School Diploma or HS equivalency certificate plus seven (7) years of experience

• Completion of Navy Validator Course CBT-NQV-100 Series and ILT-NQV-201 Series

• DISA eMASS Training (Instructor-led session)

• DISA Assured Compliance Assessment Solution (ACAS) Training; or Tenable Compliance Auditing

Training; or Tenable Nessus Advanced Capabilities Training. (Instructor-led session)

• Greater than five (5)* years practical experience in a Cybersecurity, Engineering, T&E or A&A (formerly

C&A) related field Navy A&A: Experience independently performing the NQV Level III activities defined in Appendix (A) (of the NQV Memo, Enclosure 1) and successfully completing all required validator tasks for one or more Security Authorization Packages through the SCA within the past year (or equivalent direct DoD RMF A&A experience as approved by the IA TA)

• Test & Evaluation: Experience in allocating assigned security controls into assessment objectives and pro-cedures, developing and executing Security Assessment Plans by selecting and tailoring appropriate assess-ment methods, depth and coverage, and applying sequencing to reduce duplication of effort and provide cost effective assessment solutions (or equivalent direct DoD RMF A&A experience as approved by the IA

TA).

6.1.2 Deliverables

PWS

Task#

Deliverable Title

Format Due Date Distribution /Copies

Frequency and Remarks

6.1 Project Kickoff

Report.

Electronic Starting after date of award

Customer, Primary

COR

one time

6.1 Monthly Brief-

ing Status Re-port

Electronic Starting after date of award

Customer, Primary

COR

Monthly

Page 6 of 120 Pages

6.1 Weekly Per-

sonnel Status report

Electronic Starting after date of award

Customer, Primary

COR

weekly

6.1 Trip Reports Electronic 10 days after

travel

Customer, Primary

COR

After travel

6.1 Transition Out

Plan

Electronic 120 days or sooner prior to contract comple-tion end date

Customer, Primary

COR

One time

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

Weekly Personnel Status Reports:

The Contractor PM shall develop and provide weekly personnel status reports by close of business (COB) every Wednesday via electronic mail to the COR and TPOC (CDRL B003). The weekly personnel status report provides a comprehensive list, including but not limited to, all contractor personnel gains, losses, start dates, departure dates, and staffing status to include security clearance updates, and upcoming leave. Summary of contractor personnel gains, losses, and staffing status (e.g. security clearance, upcoming leave).

Management Reports: Monthly Status Reports (MSR):

• The Contractor PM shall develop and provide a MSR by the tenth (10th) business day of each month via electronic mail to the CO, COR, and TPOCs (CDRL B002). The MSR summarizes by task area, the man-agement and technical work conducted during the month. The Contractor shall provide at a minimum, the status of activities during the reporting period to include: Service Integration and Management (SIAM) re-quest numbers (total for month, period of performance, open and closed tickets)

• Risks and risk mitigation techniques

• Milestones and deliverables completed

• Deliverables submitted during the month

• Deliverables awaiting Government approval

• Recommendations for change, modifications, or improvements in task or processes

• Projected activities for the upcoming month

• Subcontractor performance (if applicable)

Meetings held with Government representatives, as applicable to include subject, attendees, and the outcome.

6.2 GENERAL REQUIREMENTS

6.2.1 Work Environment

PHNSY&IMF maintains clean and safe office and work areas.

The following housekeeping actions are necessary to support a clean and safe work environment in Code 109 work-spaces. Contractor shall maintain a clean and safe work environment using the appropriate Shipyard-supplied cleaner in accordance with shipyard health and safety guidelines. Empty the common area (i.e., lunch/break rooms) trash receptacles to ensure that food/perishables do not remain in the receptacles overnight and over the weekend.

6.2.2 Data Call Support

Page 7 of 120 Pages

External and internal agencies often request information and data from Code 109. These requests are referred to as “data calls.” Contractor support for data calls requires querying, aggregating, and summarizing data.

Contractor will provide data, information, reports, in support of all data calls, using provided systems and tools as further defined and described in each functional area. There is an average of 50 data calls each calendar year.

6.2.3 Metrics Support

Code 109 generates several metrics and associated reports. Contractor support for metrics requires querying, aggre-gating, and summarizing data. Contractor will provide metrics and associated reports as further defined in each func-tional task area.

Table 6.2.3.1 Metrics gathered and required in Section 6.4 Information Assurance task areas:

Item Metric Frequency 1 NAVSEA IT Health Metrics Monthly 2 CO Cybersecurity Report Monthly 3 NOSCC Monthly Metrics Monthly 4 NAVSEA Cyber Security Compliance As-sessment (CSCA) Quarterly

5 Vulnerability Management Weekly 6 Splunk Monthly 7 Access and Account Management Monthly

6.2.4 Documentation

Code 109 codifies processes, requirements, and guidelines in various types of documents, such as, the ITACS Man-ual, Standard Operating Procedures (SOP), Desk Guides, Standard Forms (SF), Policy, PHNSY&IMF Forms, Re-ports, and Checklists. Contractor will provide documentation as further defined in each functional task area.

Table 6.2.4.1 Create and update applicable documents in these areas referenced under Section 6.4 Information As-surance task areas:

System / Application / Functional Area Frequency HBSS As needed with a minimum of Annual ACAS As needed with a minimum of Annual Traditional Security As needed with a minimum of Annual Solarwinds As needed with a minimum of Annual Varonis As needed with a minimum of Annual Bluecoat As needed with a minimum of Annual Splunk As needed with a minimum of Annual Red Seal As needed with a minimum of Annual Vulnerability Management As needed with a minimum of Annual Incident Response / Incident Management As needed with a minimum of Annual Defense Global Operations (DGO) As needed with a minimum of Annual Defense Cyber Operations (DCO) As needed with a minimum of Annual Emergency Management As needed with a minimum of Annual Assessment & Authorization As needed with a minimum of Annual Validate and Verify / Audits As needed with a minimum of Annual Technical Security Evaluation As needed with a minimum of Annual Configuration Management As needed with a minimum of Annual Platform Information Technology As needed with a minimum of Annual Electronic and Information Technology (E&IT) As needed with a minimum of Annual Team Learning Sessions (TLS) As needed with a minimum of Annual PHNSY&IMF Cybersecurity Program As needed with a minimum of Annual

Page 8 of 120 Pages

IT Gram As needed with a minimum of Monthly CSWF Annual

6.2.5 Meetings

Contractor will attend all functional meetings, recurring and ADHOC specified under each functional task area.

Contractor employees shall identify themselves as Contractor personnel by introducing themselves or being intro-duced as Contractor personnel and displaying distinguishable badges or other visible identification for meetings with Government personnel.

Table 6.2.5.1 Meetings required in Section 6.4 Information Assurance task areas:

Item Name Frequency 1 ASI / SecCM Technical Review

Board Weekly

2 SecCM Cyber Review Board Weekly 3 Branch Meeting Weekly 4 Divisional Meeting ADHOC 5 Functional Area Meeting Weekly, Bi-Weekly, ADHOC 6 VM Meeting Weekly 7 All Hands Meeting ADHOC 8 ACIO Briefing 3 times a week 9 ACIO Cyber Threat Intel Briefing Bi-Weekly

10 NOSCC Monthly Metrics Monthly 11 Facilities Meeting Weekly 12 A&A&I Biweekly 13 E&IT Working Group Weekly

6.2.6 Call-Back Options

For all Unauthorized Service Interruption, acceptable Service Level Agreement (SLA) response times for PHNSY&IMF systems are listed in the Performance Standards for each functional task area.

Under Section 6.4 Information Assurance, acceptable SLA response times for PHNS&IMF systems, applications, and functions; including HBSS, ACAS, Splunk, IT Service Performance Monitoring Application, RedSeal, Varonis, and Incident Response for PHNSY&IMF locations (JBPHH, Guam,) are listed in Table 6.2.6.1 and further detailed in Section 6.4 Performance Standards.

Table 6.2.6.1

System Shift Coverage Times (Sunday through Saturday)

Response Time

SECNET

PHNSY&IMF, 1st Shift, 0530-1600

HST

30 minutes

PHNSY&IMF, 2nd/3rd Shift/Week-ends, 1600-0530 HST

Telephone: 30 minutes On-site: 120 minutes

SYLAN

PHNSY&IMF, 1st Shift, 0530-1600

HST

30 minutes

PHNSY&IMF, 2nd/3rd Shift/Week-ends, 1600-0530 HST

Telephone: 30 minutes On-site: 120 minutes

GMAS

PHNSY&IMF, 1st Shift, 0530-1600

HST

30 minutes

PHNSY&IMF, 2nd/3rd Shift/Week-ends, 1600-0530 HST

Telephone: 30 minutes On-site: 120 minutes

Page 9 of 120 Pages

6.2.7 Procurement Research

Contractor will perform, at least annually, market research, including coordinating with vendors for price quotations, for service and license renewals, and expansions/additions. This includes validating and evaluating licenses and their associated coverage (e.g., installation counts).

Table 6.2.7.1 Systems, Applications, Networks for research under Section 6.4 Information Assurance when re-quested:

Item Name Approximate Number of Items/Assets.

1 HBSS 500 (Servers and End Devices) 2 ACAS 15 (Servers and scanners) 3 ACAS Endpoints 2700 (Servers and End Devices) 4 Splunk Application 9 (Servers) 5 Splunk Endpoints 2700 (Servers and End Devices) 6 Varonis 2 (Server) 7 Blue Coat 2 (Appliance) 8 RedSeal 4 (Server) 9 IT Service Performance Monitoring

Application 1 (Server)

6.3 TECHNICAL SUPPORT

6.3.1 Windows Server Administration

Contractor will perform system administration operations on all Windows server systems to maintain a functional and secure operating environment for each network in compliance with Government policies and regulations.

Refer to Attachment B, Section 6.3.1 for information on the service environment.

Functional Servers:

• Maintain service levels of system availability and uptime as defined in the Performance Standards. A sys-tem outage does not equal an adequate service level.

• Maintain availability, confidentiality, and integrity of server systems.

• Manage systems resources including performance, capacity, availability, serviceability, and recoverability.

• Troubleshoot and repair system outages to maintain applicable Service Levels.

• Communicate status of outages to PHNSY&IMF (e.g., system-down notifications, status reports on ex-pected restoration, system-up notifications).

• Perform daily checks for servers per established DoN, NAVSEA, Shipyard and local SOPs/desk guides.

• Develop, generate, maintain, and contribute to documentation (e.g., procedures, instructions) that pertain to and are applicable to managed systems.

Sub-Tasks Included:

6.3.1.1 Troubleshoot and repair system outages to maintain service levels indicated in the perfor-mance standards.

6.3.1.2 Respond to trouble calls of outages during 1st shift, 2nd shift, and 3rd shift.

6.3.1.3 Notify Government on the status of system outages. Status notifications include system-down notifications, status reports on expected restoration, and system-up notifications.

6.3.1.4 Build, maintain, troubleshoot, and repair Windows server hardware and software.

6.3.1.5 Manage server account access to systems, equipment, and file shares.

6.3.1.6 Maintain structure of rights for accounts, groups, and file shares.

6.3.1.7 Maintain domain system policies to administratively enforce application and security settings for users and computers.

Page 10 of 120 Pages

6.3.1.8 Maintain, monitor, and provide performance tuning (e.g. CPU, memory, load-balancing).

6.3.1.9 Monitor and manage use of disk space, permissions, and network connections.

6.3.1.10 Resolve hardware/software interface and interoperability problems.

6.3.1.11 Provide technical support for Windows server related issues.

6.3.1.12 Perform backup and recovery actions per established DoN, NAVSEA, Shipyard and local guidance.

6.3.1.13 Create and maintain server backups for disaster recovery.

6.3.1.14 Develop and update disaster recovery documentation on when requested.

6.3.1.15 Develop and maintain Systems Administration SOPs.

6.3.1.16 Develop and maintain configuration documentation of systems and equipment.

6.3.1.17 Maintain the environment of the computer data center(s) (temperature, humidity, cleanli-ness,).

6.3.1.18 Support change and configuration management.

6.3.1.19 Coordinate, collaborate, and work with other branches and stakeholders to complete tasks.

6.3.1.20 Coordinate, collaborate, and work with others in identifying processes that can be automated to save man-hours, be more efficient, and have more consistent results.

6.3.1.21 Assist /Mentor other System Administrators (SAs) (Contractor/Government upon request).

6.3.1.22 Coordinate, collaborate, and work with others in capturing metrics to assist Government on visibility of the server environment.

Secure Servers:

• Maintain compliant, secure systems for each network through the availability, confidentiality, and integrity of server systems. Meet all cybersecurity deadlines for compliance, which includes the tasks below.

• Protect Naval Nuclear Propulsion Information (NNPI) and other Confidential Data as stated in OPNAV Instruction N9210.3 series.

• Vulnerability Management (e.g. patches, security technical implementation guidelines (STIGs), monitor and evaluate ACAS reports, TASKORDS).

• Maintain server compliance to PHNSY&IMF, and higher level, configuration requirements

Sub-Tasks Included:

6.3.1.23 Maintain server compliance with local and higher-level configuration requirements.

6.3.1.24 Create and document auditable records of configurations, including configuration changes and updates.

6.3.1.25 Complete daily checks on each server, which includes event logs, log files, and audit logs.

Create and maintain auditable records of periodic checks.

6.3.1.26 Apply vulnerability management requirements, which includes patches, (STIGs), and the re-view of vulnerability reports.

6.3.1.27 Manage the installation and integration of system fixes, updates, and enhancements.

6.3.1.28 Implement physical and data security per established DoN, NAVSEA, Shipyard and local guidance.

6.3.1.29 Review, plan, test, and implement applicable STIGs on technologies under AOR.

6.3.1.30 Review, plan, test, and implement fixes per vulnerabilities identified in security scan tools

(e.g. ACAS)

6.3.1.31 Coordinate, collaborate, and work with other branches to create and maintain vulnerability documentation per established DoN, NAVSEA, Shipyard and local guidance (e.g. plan of ac-tion and milestones, mitigation statements, accreditation and authorization packages).

6.3.1.32 Complete reports including monthly CO Cybersecurity Report, NOSCC monthly metrics, and NAVSEA 04 IT Metrics.

6.3.1.33 Monitor and analyze audit logs, report any irregularities per established DoN, NAVSEA, Shipyard and local guidance.

6.3.1.34 Complete IT-specific project management tasks when project identified. This includes partici-pating on project teams responsible for system hardware and application software implemen-tation and upgrades; determining project scope and additional staff resources required to com-

Page 11 of 120 Pages plete projects; preparing project-specific work plans and time lines; monitoring project mile-stones; and reporting project progress to Government management. Work closely with other technical staff, vendors, and contacts from other Government agencies to ensure timely and efficient completion of assigned IT projects.

6.3.1.35 Communicate effectively with all department levels to ensure project success, and user needs identified and met.

6.3.1.36 Participate in and provide technical evaluations in various meetings, groups, committees on the following:

6.3.1.37 Communicate and confer on existing procedures and systems in process analysis;

• Determine cost/benefit and complexities of new processes and projects;

• Prepare for testing;

• Discuss the roll-out of new projects and software upgrades,

• Discuss other applicable issues.

6.3.1.38 May participate in computer audits and perform testing for disaster recovery process to ensure a secure processing environment that protects the integrity and availability of information.

6.3.1.39 Conduct initial market research to facilitate vendor quotes for direct Government technical point of contact (TPOC) evaluation and acceptance.

6.3.1.40 Analyze new technologies and system enhancements. Prepare project proposals and budgets for TPOC review and approval.

6.3.1.41 Assist with data calls and metrics within time frame and frequency requested by Government, including the CO Cybersecurity Report, NOSCC monthly metrics, and NAVSEA 04I IT met-rics.

6.3.1.42 Attend all meetings required by Government.

Performance Measures:

Performance Standard Acceptable Quality Level (AQL) Method of Calculation Server availability and up-time maintained.

95% system uptime Server logs uptime calculation.

Cybersecurity deadlines for compliance are met.

95% of cybersecurity deadlines met. Cybersecurity deadlines will be checked per month.

Records for completed peri-odic checks.

95% of all daily checks have a rec-ord.

Daily checks will be checked for a record weekly.

Auditable records of config-urations and configuration changes and updates.

95% of configurations and configu-ration changes have an audit record.

Configurations and configuration changes will be checked for an audit rec-ord per year.

1st shift trouble call re-sponse

Response to trouble call provided within 30 minutes of call receipt.

Response time will be checked for each trouble call.

2nd and 3rd shift trouble call response

Response to trouble call provided from 120 minutes of call receipt.

Response time will be checked for each trouble call.

Documentation completed and updated (SOP or other format).

Completed at least 95% of all docu-mented requirements.

Completed documentation will be re-viewed monthly.

Deliverables:

Task#

Deliverable Title

Format Due Date Distribution /Copies

Frequency and Remarks

Page 12 of 120 Pages

6.3.1 Status Outage

Communica-tion

Electronic 15 minutes of discovery of out-age

Primary COR For each out-age

6.3.1 1st shift trouble call response

Electronic 30 min after re-ceipt of call

Customer, Primary

COR

Required af-ter every trouble call

6.3.1 2nd and 3rd shift trouble call re-sponse

Electronic 30 min after re-ceipt of call

Customer, Primary

COR

Required af-ter every trouble call

6.3.1 Daily Checks Contractor-Govern-

ment Mutually Agreed Format

End of Shift TPOC Daily

6.3.1 Vulnerability

Management

Contractor-Govern-ment Mutually Agreed Format

7 days after dis-covery of vulner-ability

Vulnerability Man-agement team, im-mediate team members

For each dis-covered vul-nerability

6.3.1 STIG Compli-

ance

Contractor-Govern-ment Mutually Agreed Format

30 days after new/updated STIG is pub-lished

Immediate team members, Primary

COR

Quarterly or when new STIG pub-lished

6.3.1 Create

Standard Oper-ating Proce-dures

Contractor-Govern-ment Mutually Agreed Format

30 days after new process estab-lished

Immediate team members, Primary

COR

For each new process

6.3.1 Maintain

Standard Oper-ating Proce-dures

Contractor-Govern-ment Mutually Agreed Format

365 days after SOP estab-lished/last up-dated

Immediate team members, Primary

COR

Annually at minimum

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1

6.3.2 Unix Server Administration

Contractor will perform system administration operations on all Unix server systems to maintain a functional and secure operating environment for each network in compliance with Government policies and regulations.

Refer to Attachment B, Section 6.3.2 for information on the service environment.

Functional Servers:

• Maintain service levels of system availability and uptime defined in the Performance Standards. A system outage does not equal an adequate service level.

• Maintain availability, confidentiality, and integrity of server systems.

• Manage systems resources including performance, capacity, availability, serviceability, and recoverability.

• Troubleshoot and repair system outages to maintain applicable Service Levels.

• Communicate status of outages to PHNSY&IMF (e.g., system down notifications, status reports on ex-pected restoration, system up notifications).

• Perform daily checks for servers per established DoN, NAVSEA, Shipyard and local SOPs/desk guides.

• Develop, generate, maintain, and contribute to documentation (e.g., procedures, instructions) that pertain to and are applicable to managed systems.

Page 13 of 120 Pages

6.3.2.1 Troubleshoot and repair system outages to maintain service levels indicated in the perfor-mance standards.

6.3.2.2 Respond to trouble calls of outages during 1st shift, 2nd shift, and 3rd shift.

6.3.2.3 Notify Government on the status of system outages. Status notifications include system-down notifications, status reports on expected restoration, and system-up notifications.

6.3.2.4 Build, maintain, troubleshoot, and repair Unix server hardware and software.

6.3.2.5 Manage server account access to systems, equipment, and file shares.

6.3.2.6 Maintain structure of rights for accounts, groups, and file shares.

6.3.2.7 Maintain domain system policies to administratively enforce application and security settings for users and computers.

6.3.2.8 Maintain, monitor, and provide performance tuning (e.g. CPU, memory, load-balancing).

6.3.2.9 Monitor and manage use of disk space, permissions, and network connections.

6.3.2.10 Resolve hardware/software interface and interoperability problems.

6.3.2.11 Provide technical support for Unix server related issues.

6.3.2.12 Perform backup and recovery actions per established DoN, NAVSEA, Shipyard and local guidance.

6.3.2.13 Create and maintain server backups for disaster recovery.

6.3.2.14 Develop and update disaster recovery documentation when requested.

6.3.2.15 Develop and maintain Systems Administration SOPs.

6.3.2.16 Develop and maintain configuration documentation of systems and equipment.

6.3.2.17 Maintain the environment of the computer data center(s) (temperature, humidity, cleanliness).

6.3.2.18 Support change and configuration management.

6.3.2.19 Coordinate, collaborate, and work with other branches and stakeholders to complete tasks.

6.3.2.20 Coordinate, collaborate, and work with others in identifying processes that can be automated to save man-hours, be more efficient, and have more consistent results.

6.3.2.21 Assist/Mentor other SAs (Contractor/Government when requested).

6.3.2.22 Coordinate, collaborate, and work with others in capturing metrics to assist Government on visibility of the server environment.

Secure Servers:

• Maintain compliant, secure systems for each network through the availability, confidentiality, and integrity of server systems. Meet all cybersecurity deadlines for compliance, which includes the tasks below.

• Protect NNPI and other Confidential Data as stated in OPNAV Instruction N9210.3 series.

• Vulnerability Management (e.g. patches, STIGs, monitor and evaluate ACAS reports, TASKORDS).

• Maintain server compliance to PHNSY&IMF, and higher level, configuration requirements.

6.3.2.23 Maintain server compliance with local and higher-level configuration requirements. Create and document auditable records of configurations, including configuration changes and up-dates.

6.3.2.24 Complete daily checks on each server, which includes event logs, log files, and audit logs.

Create and maintain auditable records of periodic checks.

6.3.2.25 Manage the installation and integration of system fixes, updates, and enhancements.

6.3.2.26 Implement physical and data security per established DoN, NAVSEA, Shipyard and local guidance.

6.3.2.27 Review, plan, test, and implement applicable STIGs on technologies under AOR.

6.3.2.28 Review, plan, test, and implement fixes per vulnerabilities identified in security scan tools

(e.g. ACAS)

6.3.2.29 Coordinate, collaborate, and work with other branches to create and maintain vulnerability documentation per established DoN, NAVSEA, Shipyard and local guidance (e.g. plan of ac-tion and milestones, mitigation statements, accreditation and authorization packages).

6.3.2.30 Complete reports including, but monthly CO Cybersecurity Report, NOSCC monthly metrics, and NAVSEA 04 IT Metrics.

Page 14 of 120 Pages

6.3.2.31 Monitor and analyze audit logs, report any irregularities per established DoN, NAVSEA, Shipyard and local guidance.

General Secure and Functional Server Tasks:

6.3.2.32 Complete IT-specific project management tasks when project identified. This includes partici-pating on project teams responsible for system hardware and application software implemen-tation and upgrades; determining project scope and additional staff resources required to com-plete projects; preparing project-specific work plans and timelines; monitoring project mile-stones; and reporting project progress to Government management. Work closely with other technical staff, vendors, and contacts from other Government agencies to ensure timely and efficient completion of assigned IT projects.

6.3.2.33 Communicate effectively with all department levels to ensure project success, and user needs identified and met.

6.3.2.34 Participate in and provide technical evaluations in various meetings, groups, committees on the following:

• Communicate and confer on existing procedures and systems in process analysis;

• Determine cost/benefit and complexities of new processes and projects;

• Prepare for testing;

• Discuss the roll-out of new projects and software upgrades,

• Discuss other applicable issues.

6.3.2.35 May participate in computer audits and perform testing for disaster recovery process to ensure a secure processing environment that protects the integrity and availability of information.

6.3.2.36 Conduct initial market research to facilitate vendor quotes for direct Government TPOC eval-uation and acceptance.

6.3.2.37 Analyze new technologies and system enhancements. Prepare project proposals and budgets for TPOC review and approval.

6.3.2.38 Assist with data calls and metrics within time frame and frequency requested by Government, including the CO Cybersecurity Report, NOSCC monthly metrics, and NAVSEA 04I IT met-rics.

6.3.2.39 Attend all meetings required by Government.

Performance Measures:

Performance Standard Acceptable Quality Level (AQL) Method of Calculation Server availability and uptime maintained.

95% Uptime Server log uptime calculation.

Cybersecurity deadlines for compliance are met.

95% of cybersecurity deadlines met. Cybersecurity deadlines will be checked per month.

Records for completed daily checks.

95% of all daily checks have a record. Daily checks will be checked for a rec-ord weekly.

Auditable records of configu-rations and configuration changes and updates.

95% of configurations and configura-tion changes have an audit record.

Configurations and configuration changes will be checked for an audit record per year.

1st shift trouble call response Response to trouble call provided within 30 minutes of discovery.

2nd and 3rd shift trouble call response

Response to trouble call provided from 120 minutes of discovery of notifica-tion.

Page 15 of 120 Pages

Documentation completed and updated (SOP or other for-mat).

Completed at least 95% of all docu-mented requirements.

Completed documentation will be re-viewed monthly.

Task#

Deliverable Title

Format Due Date Distribution /Copies

Frequency and Remarks

6.3.2 Status Outage

Communica-tion

Electronic 15 minutes of discovery of out-age

Primary COR For each dis-covered out-age

6.3.2 1st shift trouble call response

Electronic 30 min after re-ceipt of call

Customer, Primary

COR

Required af-ter every trouble call

6.3.2 2nd and 3rd shift trouble call re-sponse

Electronic 30 min after re-ceipt of call

Customer, Primary

COR

Required af-ter every trouble call

6.3.2 Daily Checks Contractor-Govern-

ment Mutually Agreed Format

End of Shift N/A Daily

6.3.2 Vulnerability

Management

Contractor-Govern-ment Mutually Agreed Format

7 days after dis-covery of vulner-ability

Vulnerability Man-agement team, im-mediate team members

For each dis-covered vul-nerability

6.3.2 STIG Compli-

ance

Contractor-Govern-ment Mutually Agreed Format

30 days after new/updated STIG is pub-lished

Immediate team members, Primary

COR

Quarterly or when new STIG pub-lished

6.3.2 Create

Standard Oper-ating Proce-dures

Contractor-Govern-ment Mutually Agreed Format

30 days after new process estab-lished

Immediate team members, Primary

COR

For each new process

6.3.2 Maintain

Standard Oper-ating Proce-dures

Contractor-Govern-ment Mutually Agreed Format

365 days after SOP estab-lished/last up-dated

Immediate team members, Primary

COR

Annually at a minimum

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1

6.3.3 Storage and Backup Administration

Contractor will perform system administration operations on all Network Attached Storage (NAS) systems and tape libraries to maintain a functional and secure operating environment for each network in compliance with Govern-ment policies and regulations.

Refer to Attachment B, Section 6.3.3 for information on the service environment.

Functional System:

• Maintain service levels of system availability and uptime, as defined in the Performance Standards. A sys-tem outage does not equal an adequate service level.

• Maintain availability, confidentiality, and integrity of NAS systems and tape libraries.

• Manage systems resources including performance, capacity, availability, serviceability, and recoverability.

• Troubleshoot and repair system outages to maintain applicable Service Levels.

• Perform data backup, recovery, and off-site task actions for all servers and applications.

Page 16 of 120 Pages

• Communicate status of outages to PHNSY&IMF (e.g., system-down notifications, status reports on ex-pected restoration, system-up notifications).

• Perform daily checks for servers per established DoN, NAVSEA, Shipyard and local SOPs/desk guides.

• Develop, generate, maintain, and contribute to documentation (e.g., procedures, instructions) that pertain to and are applicable to managed systems.

6.3.3.1 Troubleshoot and repair system outages to maintain adequate service level.

6.3.3.2 Respond to trouble calls of outages during 1st shift, 2nd shift, and 3rd shift.

6.3.3.3 Notify Government on the status of system outages. Status notifications include system-down notifications, status reports on expected restoration, and system-up notifications.

6.3.3.4 Build, maintain, troubleshoot, and repair NAS systems and tape library hardware and soft-ware.

6.3.3.5 Manage NAS systems and tape library account access to systems, equipment, and file shares.

6.3.3.6 Maintain structure of rights for accounts, groups, and file shares.

6.3.3.7 Maintain system policies to administratively enforce application and security settings for us-ers and file shares.

6.3.3.8 Maintain, monitor, and provide performance tuning (e.g. CPU, memory, load-balancing).

6.3.3.9 Monitor and manage use of disk space, permissions, and network connections.

6.3.3.10 Resolve hardware/software interface and interoperability problems.

6.3.3.11 Provide technical support for NAS systems and tape library related issues.

6.3.3.12 Perform data and tape backup and recovery actions per established DoN, NAVSEA, Shipyard and local guidance.

6.3.3.13 Create and maintain system back-ups on a daily, weekly, monthly, and annual basis per estab-lished DoN, NAVSEA, Shipyard and local guidance.

6.3.3.14 Coordinate, collaborate, and work with designated personnel to send backup tapes per estab-lished DoN, NAVSEA, Shipyard and local guidance.

6.3.3.15 Develop and update disaster recovery documentation when requested.

6.3.3.16 Develop and maintain NAS Administration Standard Operating Procedures.

6.3.3.17 Develop and maintain Tape Library Standard Operating Procedures

6.3.3.18 Develop and maintain configuration documentation of systems and equipment.

6.3.3.19 Develop and maintain documentation of disaster recovery scenarios per DoN, NAVSEA, Shipyard and local guidance.

6.3.3.20 Maintain the environment of the computer data center(s) (temperature, humidity, cleanliness).

6.3.3.21 Support change and configuration management.

6.3.3.22 Coordinate, collaborate, and work with other branches and stakeholders to complete tasks.

6.3.3.23 Coordinate, collaborate, and work with others in identifying processes that can be automated to save man-hours, be more efficient, and have more consistent results.

6.3.3.24 Assist/Mentor other admins (Contractor/Government when requested).

6.3.3.25 Coordinate, collaborate, and work with others in capturing metrics to assist Government on visibility of the NAS environment.

Secure System:

• Maintain compliant, secure systems for each network through the availability, confidentiality, and integrity of storage systems. Meet all cybersecurity deadlines for compliance, which includes the tasks below.

• Protect NNPI and other Confidential Data as stated in OPNAV Instruction N9210.3 series.

• Ensure systems availability, functionality, integrity, and efficiency.

6.3.3.26 Validate successful completion of backups in compliance with local policy and configuration requirements. Maintain auditable records or logs of backup events.

Page 17 of 120 Pages

6.3.3.27 Validate successful delivery of off-site media in compliance with local policy and configura-tion requirements. Maintain auditable records or logs of backup events.

6.3.3.28 Maintain server compliance with local and higher-level configuration requirements. Create and document auditable records of configurations, including configuration changes and up-dates.

6.3.3.29 Complete daily checks on each storage system, which includes event logs, log files, and audit logs. Create and maintain auditable records of periodic checks.

6.3.3.30 Apply vulnerability management requirements, which includes patches, STIGs, and the re-view of vulnerability reports.

6.3.3.31 Manage the installation and integration of system fixes, updates, and enhancements.

6.3.3.32 Implement physical and data security per established DoN, NAVSEA, Shipyard and local guidance.

6.3.3.33 Review, plan, test, and implement applicable STIGs on technologies under AOR.

6.3.3.34 Review, plan, test, and implement fixes per vulnerabilities identified in security scan tools

(e.g. ACAS)

6.3.3.35 Coordinate, collaborate, and work with other branches to create and maintain vulnerability documentation per established DoN, NAVSEA, Shipyard and local guidance (e.g. plan of ac-tion and milestones, mitigation statements, accreditation and authorization packages).

6.3.3.36 Complete reports including monthly CO Cybersecurity Report, NOSCC monthly metrics, and NAVSEA 04 IT Metrics.

6.3.3.37 Monitor and analyze audit logs, report any irregularities per established DoN, NAVSEA, General Storage and Backup Administration Tasks:

6.3.3.38 Complete IT-specific project management tasks when project identified. This includes partici-pating on project teams responsible for system hardware and application software implemen-tation and upgrades; determining project scope and additional staff resources required to com-plete projects; preparing project-specific work plans and timelines; monitoring project mile-stones; and reporting project progress to Government management. Work closely with other technical staff, vendors, and contacts from other Government agencies to ensure timely and efficient completion of assigned IT projects.

6.3.3.39 Communicate effectively with all department levels to ensure project success, and user needs identified and met.

6.3.3.40 Participate in and provide technical evaluations in various meetings, groups, and/or commit-tees on the following:

• Communicate and confer on existing procedures and systems in process analysis;

• Determine cost/benefit and complexities of new processes and projects;

• Prepare for testing;

• Discuss the roll-out of new projects and software upgrades, and/or

• Discuss other applicable issues.

6.3.3.41 May participate in computer audits and perform testing for disaster recovery process to ensure a secure processing environment that protects the integrity and availability of information.

6.3.3.42 Conduct initial market research to facilitate vendor quotes for direct Government TPOC eval-uation and acceptance.

6.3.3.43 Analyze new technologies and system enhancements. Prepare project proposals and budgets for TPOC review and approval.

6.3.3.44 Assist with data calls and metrics within time frame and frequency requested by Government, including

6.3.3.45 the CO Cybersecurity Report, NOSCC monthly metrics, and NAVSEA 04I IT metrics.

6.3.3.46 Attend all meetings required by Government.

Performance Measures:

Performance Standard Acceptable Quality Level (AQL) Method of Calculation

Page 18 of 120 Pages

System availability and uptime maintained.

95% system uptime System logs uptime calculation.

Cybersecurity deadlines for compli-ance are met.

95% of cybersecurity deadlines met.

Cybersecurity deadlines will be checked per month.

Records for completed daily checks. 95% of all daily checks have a record. Daily checks will be checked for a record weekly.

Auditable records of configurations and configuration changes and up-dates.

95% of configurations and configura-tion changes have an audit record.

Configurations and configuration changes will be checked for an au-dit record per year.

Auditable records of backup events. 95% of backup events have an audit record.

Backup events will be checked for an auditable record per month.

Response time will be checked for each trouble call.

2nd and 3rd shift trouble call re-sponse

Response to trouble call provided from 120 minutes of discovery of no-tification.

Response time will be checked for each trouble call.

Documentation completed and up-dated (SOP or other format).

Completed at least 95% of all docu-mented requirements.

Completed documentation will be reviewed monthly.

Task#

Deliverable Title

Format Due Date Distribution /Copies

Frequency and Remarks

6.3.3 Status Outage

Communica-tion

Electronic 15 minutes of discovery of out-age

Primary COR For each dis-covered out-age

6.3.3 1st shift trouble call response

Electronic 30 min after re-ceipt of call

Customer, Primary

COR

Required af-ter every trouble call

6.3.3 2nd and 3rd shift…