RIC ESS and GFMS Maint and Sust PWS (06152022).pdf

Performance Work Statement (PWS) Electronic Security System (ESS) and Global Facilities Management System (GFMS)

Maintenance Support at Defense Supply Center Richmond (DSCR)

1.0 BACKGROUND

The Defense Logistics Agency (DLA) is a United States (U.S.) Department of Defense (DoD) agency providing worldwide logistics support to the missions of the Military Departments and the Combatant Commands.

In support of these missions, DLA Installation Management (DM) maintains a presence at each DLA locations for the life, health, and safety systems including Electronic Security Systems (ESS). DM serves as the functional proponent for all ESS requirements, policy, and procedures.

In support of DM, DLA Information Operations Enterprise Capabilities Portfolio (J62B) executes program and technology management responsibility for ESS. ESS encompasses Intrusion Detection Systems (IDS), Access Control Systems (ACS), Closed Circuit Television (CCTV) systems, Electronic Key Control (EKC) Systems, intercoms and other alert type systems for DLA facilities, personnel, and property resources, providing Enterprise-wide policy, program, and worldwide operational support for DLA’s Integrated Electronic Security System (ESS).

2.0 SCOPE

This Performance Work Statement (PWS) outlines requirements for the operations and maintenance sustainment support of the application software, hardware, and cyber compliance support for the following DSCR ESS components: LENEL OnGuard, PELCO CCTV, and Key System Inc Global Facilities Management System (GFMS). ESS consists of several systems which may include ACS, IDS, internal and external CCTV systems, Video Surveillance System (VSS), Network Video Recording (NVR) devices, interior and exterior IDS, Data Transmission Media (DTM) systems (a means to communicate information internally and externally to DoD sites), intercom and/or provision of local or regional dispatch centers (also known as security command centers). In addition to the ESS, DLA has a requirement to support Electronic Key Control (EKC) systems. These ESS and EKC systems include various subcomponents that will be maintained in coordination with the Installation Management personnel, such as: card readers, intercom devices, security controllers, streamers, security cameras, sensors, central monitoring equipment, duress alarms and key containers.

Specifically, for this effort the Contractor will provide DODI 8140.01/8570,01 type cyber security support with certified personnel for software/firmware, CCTV Network Video Recorder hardware (HW), and technical services for Lenel Electronic Security System (ACS/IDS), Global Facilities Management System (GFMS), and Closed-Circuit TV systems (CCTV).

Currently, a base-wide technical refresh of panels and cameras is occurring, which requires support to approximately 30 buildings. The work effort also includes decommissioning support for any legacy software, hardware, or appliances for deprecated Honeywell ESS system. The work effort includes upgrades, migrations, enhancements of systems required for compliancy. The work effort includes cybersecurity documentation required to authorize use of the systems on approved DLA networks.

This PWS contains task requirements for Sustainment, Maintenance, and Cybersecurity support of the ESS application software (LENEL OnGuard, PELCO Video Xpert Suite, Key Systems GFMS). As part of this Sustainment effort, the vendor will be expected to plan and complete required hardware and software upgrades of the various ESS applications (ACS/IDS, EKC, & CCTV) during the lifecycle of this contract to maintain current supported software versions, and their respective license requirements.

Contractor shall support requirements analysis, support system upgrades including design, build, configure, test, migrate including any required data migrations.

The Contractor must plan, execute, and support a network migration of the GMFS application/system within the base year of the contract award.

The PWS needs to be all inclusive requirements for final implementation of a complete Lenel ESS with follow on maintenance and sustainment for the entire site.

The Contractor must support a localized, standalone (non-domain/networked) LENEL OnGuard server/workstation instance for a high security area located on the installation. The Contractor must provide Sustainment, Maintenance, and Cybersecurity support for this localized HW/SW. Support of this standalone instance will include but will not be limited to the following: compliance scanning, patch installation, STIG implementation, validation reporting, software/OS support, and hardware support. Since this localized instance is off network, all support efforts must be manually completed via local device access methods that must comply with installation and facility security requirements. The Contractor will coordinate with the site and J6 POCs to plan, execute, and support a migration during the base year of performance of this instance into a separated partition on the existing installation wide LENEL system that is compliant with all relevant Physical, Information, and Cyber Security requirements. As part of this migration planning effort, The Contractor will coordinate and obtain any and all required cybersecurity approvals of OnGuard v8.0.X for the site/installation software, etc.

3.0 TASK REQUIRMENTS

The Contractor shall adhere to the following requirements and definitions for all Tasks within this PWS:

1. The Contractor shall submit an Accident Prevention Plan to the Contracting Officers Representative (COR). No work shall start prior to COR receiving the approved accident prevention plan.

2. The Contractor shall turn over any equipment or material removed through this task to the Government at the completion of work, or after COR approval, properly dispose of in accordance with regulations and/or local codes.

3. The Contractor shall maintain a separate set of drawings, elementary diagrams, and wiring diagrams of the system to be used for As-Built Drawings and shall keep this set accurately and neatly up to date with all changes and additions throughout the contract. As-Built Drawings shall be developed and maintained by the Contractor and depict actual conditions. As-Built Drawings are to be submitted to the COR in original Auto Computer Aided Design (AutoCAD) and Adobe Portable Document Format (PDF) format and shall not be overlays. A complete As- Built Drawing will be submitted to the Government within 14 calendar days of completed work (as required).

4. The Contractor will provide a monthly status report which shall include, but not limited to:

a) Contract number

b) Brief task description

c) Review of project plans including work accomplished during the reporting period and/or significant events

d) Project progress

e) Problem areas

f) Anticipated activity for the next reporting period

g) Project Schedule/Plan

5. The Contractor will provide a monthly 8570 Report Spreadsheet utilizing the template and included the required information.

6. The Contractor shall follow all applicable National Electrical Code (NEC), Unified Facilities Criteria (UFC), United Technologies Corporation (UTC), National Fire Protection Association (NFPA), and Security Standards.

7. The Contractor will follow all Security Technical Implementation Guides (STIGs), Data Encryption standards, Intelligence Community Directive (ICD)/ Intelligence Community Standard (ICS) 705, DLA Physical Security Manual and DLA building codes.

8. The Contractor shall obtain written COR approval if any digital or physical media is required.

All video, still photos, digital photos, all usernames, passwords, and any other documentation obtained and developed during the execution of this contract shall be turned over to the Government with all digital and hard copy files and associated negatives at the completion of this project. Digital photographs shall be submitted to the Government on Compact Disk (CD) in Joint Photographic Experts Group (JPG) format, and the Contractor shall delete all associated files from their records.

9. Provide an Incident Response Plan for DLA/COR approval.

10. All work relating to incidents and will be managed and tracked through the ServiceNow ITSM ticketing system. The Contractor shall provide service ticket support. As instructed by the COR, the Contractor may be required to participate in meetings and conference calls with users, the functional community and the PMO to discuss requirements and trouble tickets; review and analyze production trouble tickets; and recommend and implement fixes as directed by the Government. Service tickets are used for all work including break/fix production issues, project support and development, research, planning, onboarding, and technical efforts such as upgrades, migrations, or technical refreshes. Problems or potential problems discovered in basic maintenance are resolved by various service ticket types including Incidents, (Break Fix), General Work Orders (GWO), Project Work Orders (PWO), Break/Fix CRQs and normal project CRQs. Service tickets will be created by the Government and/or may be initiated as requested by the Contractor’s Project Manager.

3.1 TASK 1 – PROJECT MANAGEMENT

The Contractor shall provide sufficient management to ensure that these tasks are performed efficiently, accurately, on time, and in compliance with the requirements of this document. The Contractor shall support the following:

3.1.1 PROJECT MANAGER

The Contractor shall provide a Contract Project Manager who shall be responsible for the performance of the work. The Contractor shall provide project management support for all items detailed in this PWS. This support includes providing planning, direction, coordination, and control necessary for effective and efficient accomplishment of all requirements. The Contractor shall be the senior subject matter expert and monitor, control and report status, cost, schedule, and performance; coordinate with Contracting Officer (KO), Contracting Officer Representative (COR), Technical Point of Contact (TPOC), Project Management Office (PMO), users and other representatives. The Contractor shall attend meetings and provide other support as needed. The Contract Project Manager or alternate shall have full authority to act for the Contractor on all contract matters relating to the operations of this contract. The Contract Project Manager or alternate shall be available Monday through Friday, excluding Federal holidays, between the hours of 0700- and 1600-hours local time and within four hours after normal working hours (emergent repairs) upon request of the KO or COR to meet on the installation as required to discuss problem areas.

3.1.2 WORK EFFORT

The Contractor shall manage the total work effort associated with the PWS herein to assure fully adequate and timely completion of all Tasks. Included in this function are a full range of management duties including, but not limited to, planning, developing, and implementing project plans, scheduling, report preparation, communication and coordinating with stakeholders, escalation procedures, establishing and maintaining records, monitoring, and quality control. The Contractor shall provide an adequate staff of personnel with the necessary management expertise to assure the performance of the work in accordance with sound and efficient management practices. Currently, a base wide technical refresh of panels and camera’s is occurring which requires support to ~ 30 buildings. The work effort includes upgrades, migrations, enhancements of systems required for compliancy. The work effort includes cybersecurity documentation required to authorize use of the systems on approved DLA networks.

3.1.3 WORK CONTROL

The Contractor shall implement all necessary work control procedures to ensure timely accomplishment of work requirements, as well as to permit tracking of work in progress. The Contractor shall plan and schedule work to assure material, labor and equipment of all contracted items are available to complete work requirements within the specified time limits and in conformance with the quality standards established herein.

3.1.4 CONFIGURATION MANAGEMENT

The Contractor shall develop and execute a written configuration management plan that addresses product management and version control for software (changes), hardware, business processes documentation and all other control items and recreate all baseline deliveries from any point in time.

The Contractor shall evaluate all changes to the approved system requirements baseline for risk to security, and for schedule and cost impact, provide evaluations in writing and with sufficient detail to allow for review and approval by the Configuration Control governance structure as required.

3.1.5 WORK SCHEDULE

The Contractor shall schedule and arrange work to cause the least interference with the normal occurrence of Government business and mission. In those cases where some interference may be essentially unavoidable, the Contractor shall make every effort to minimize the impact of the interference, inconvenience, equipment downtime, interrupted service, customer discomfort, Non-scheduled visits will be coordinated with the COR at least five (5) working days in advance and notify the COR if the work being performed may cause interference. Notification shall include the type of work to be done and the estimated completion date. The Contractor shall reschedule any work that the Contracting Officer deems necessary to avoid unacceptable disruptions in the Government's business.

The Contractor will have technical personnel available at least three (3) days a week per workweek for consultation and technical support of the ESS systems and operations.

The Contractor shall have adequate procedures for receiving and responding to service calls 24 hours per day, seven days a week, including weekends and holidays. A single local or toll-free telephone number shall be provided by the Contractor for receipt of all service calls. All telephone calls shall be answered within 30 minutes by an individual fully familiar with the Contractor's work, control procedures, and the terms and conditions of this contract. Service calls shall be considered received by the Contractor at the time and date the telephone call is placed, or email is sent by the COR. The Contractor shall respond immediately and must be on the job site and working within four

(4) hours after receipt of a service call. The Contractor shall work continuously without interruption and shall resolve the issue before departing the job site.

3.1.6 WORK RECORDS/REPORTS

The Contractor shall maintain management, maintenance, repair records, and reports as set forth herein.

All records and copies of reports shall be turned over to the COR within seven (7) calendar days after contract completion.

3.1.7 STAFFING

The Contractor shall continuously maintain an adequate staff with expertise to assure work is scheduled and completed in accordance with these specifications. The Contractor shall maintain a certified work force to complete work in accordance with the time and quality standards specified.

3.1.8 PROJECT SCHEDULE/PLAN

The Contractor shall create, maintain, and submit project plan(s) and schedule(s) within 5 business days after award, at the Kickoff meeting and will be updated weekly until the final inspection is completed.

Microsoft Project r is the preferred software and schedules should contain actual and baseline start and finish dates, % complete for tasks, task durations, resources assigned to task, and logically identify the critical path with predecessors and/or successors.

3.1.9 MEETINGS

Contractor shall lead a post award Kickoff meeting prior to the initiation of work, this meeting will be held with the Contractor, KO, Contract Specialist (KS), COR, TPOC, PMO, On-Site Representative (OSR), J6 Representative and any other individuals designated by the Government to discuss overview of Contractor’s plans, manage scope, schedule, and resources. The Contractor will discuss with stakeholders their plan and clarify any expectations and details of contract execution and resulting delivery order. General conditions, project schedule/plan, work schedules, coordination, security, safety, deliverables, permits and other matters pertinent to work accomplishments shall be discussed in this meeting. Contractor shall attend any meetings requested/required to ensure the project is successful.

3.1.10 PHASE IN TRAINING

A phase-in period shall be established to allow the Contractor sufficient time to integrate personnel and transition into duties required to perform the requirements of the contract and ensure employees who will require access to the Installation and Government Information Technology (IT) systems obtain a Common Access Card (CAC) In Accordance With (IAW) this PWS.

1. The phase-in period shall begin at the effective date of the contract and shall not exceed one (1) month, at which time full performance shall commence.

2. The Contractor shall ensure that all Contractor personnel are ready to begin working on the first day of full performance including having all accesses, permissions, roles, and privileged accounts to support the systems.

3. During the phase-in period, Contractor personnel shall complete security and safety training on site. Training will be scheduled through the site and will at a minimum include the following classes. Estimated in class time is 3 hours.

a) Active Shooter Briefing

b) Safety Briefing

c) Shelter in Place/Evacuation Awareness Briefing

4. During the one month phased-in period to ensure all Contractor personnel know and understand regulations and policy pertaining to physical, information, operations and personnel security, the Contractor shall provide security and antiterrorism training to all employees in accordance with applicable DOD regulatory requirements. At a minimum, security training requirements as required by the DLA Issuances and other applicable DOD guidance will be completed annually for the following on-line training: Estimated in class time is 8 hours.

a) Cyber Awareness Challenge

b) Antiterrorism (AT) Level 1

c) Operations Security (OPSEC)

d) Counterintelligence Awareness Training

e) Personally, Identifiable Information Awareness

f) Trafficking in Persons

The security training is web-based, and access will be provided by the Government. The Contractor shall ensure Contractor personnel have taken the required security training to meet DoD guidance and that the personnel continue to maintain their certifications.

3.1.11 TRANSITION SUPPORT

In the event the current Contractor is not awarded the follow-on task order, the Optional Transition Support CLIN may be exercised. For a period of up to 90 days before the end of the Contract, the current Contractor shall provide knowledge transfer and training to any follow-on provider to include all the necessary documentation, orientation, collaboration, and training to facilitate the comprehensive understanding and execution of tasks, processes, procedures, schedules, and deliverables in a timely and orderly fashion. All transition activities shall be coordinated with and approved by the COR. This option may be invoked at least 90 days before the end of a base or option period. The support services provided under this contract are critical to the DLA mission. It is vital that to ensure continuation of services without interruption or dramatic effort be provided. To maintain continuity of services the following requirements will be provided by the incumbent Contractor as the period of performance for the contract is met.

1. The current Contractor will continue to perform all services as prescribed within the PWS and existing Task Orders without reduction of manpower, quality of services and interruption to customers

2. The current Contractor shall provide a transition plan to include risks and costs associated with the transition of Contractor support to the new Contractor within 15 business days of task order award start date. The transition plan shall address impacts to operations due to relocation, deployment, and breakdown. The current incumbent shall:

a) Provide transition services associated with the consolidation or divesture of DoD and/or DLA workload or uninterrupted operations

b) Assist DLA in planning, preparing, and implementing any transition or change services

c) Provide approved changes to DLA equipment, software, processes, and overall environment to support such consolidation or relocation

d) Consider economies of scale and other synergies between the acquired operations of

DLA

e) Provide transition cost analysis, propose schedules, and document risks associated with such transition.

3. The Contractor shall provide a written Transition Plan for the transition of services from the incumbent Contractor to the transition Contractor to perform all Task Order services required.

The Transition Plan shall be provided withing 15 days of the Governments request and shall describe all training requirements/personnel that will be provided by the Contractor to execute the transfer of knowledge as well as processes and schedule. During the transition phase the Contractor shall provide weekly transition progress reports. The Contractor shall submit all written plans, updates, and progress reports electronically to the Government.

3.2 TASK 2 – SUSTAINMENT AND MAINTENANCE

The Government’s overall functional and technical requirements for operational sustainment and maintenance support for DLA ESS systems are listed in this section.

Specifically, the Contractor shall provide the equipment, spares, and hardware for CCTV NVR HW support, and the personnel software/firmware required for all Information Technology sustainment of the ESS applications including support to version upgrades, enhancements, and migrations required for ESS systems and subsystems. All required Cyber updates and patches shall be done through Preventative Maintenance. All required Information Assurance Vulnerability Alert (IAVMs), Cyber Task Order (CTO), Assured Compliance Assessment Solution (ACAS) scan remediations or any other cyber requirements to include documentation shall be done through Corrective Maintenance.

The Contractor shall provide application sustainment and maintenance support for DLA ESS and EKC systems to ensure they remain operational IAW the Government’s requirements. The Contractor shall support all ESS hardware and associated infrastructure as detailed in the PWS. For the legacy ESS software, the Contractor shall be responsible for providing all technical support/software maintenance and, if available, documentation for this software until the Contractor completes the upgrades to supported versions.

3.2.1 SUSTAINMENT PLAN

The Contractor shall develop and implement a Sustainment Plan for all ESS/EKC solution and/or existing solutions to ensure that the systems and equipment meet the Government’s operational requirements. The Sustainment Plan shall include the periodic maintenance, repair, replacement, and overhaul of existing systems, hardware, and software inclusive of Information Assurance Vulnerability Alerts (IAVA Patching) as well as a vulnerability management plan. The Contractor shall provide the Sustainment Plan which includes the PM schedule to the COR for approval within 30 days of contract award. The Sustainment Plan shall include the Contractor’s approach to:

1. Position qualified and certified personnel, test equipment, and other pertinent information needed to quickly diagnose and make repairs.

2. Plan, perform, and document system confidence tests, periodic inspections, and preventive maintenance

3. Identify critical system operations and implement strategies to prevent potential failures or administrative downtime from creating a critical system outage.

4. Provide after-hours support response times within 4 hours for tickets/issues

5. Since these applications are health and safety systems, they require high uptime ~ 99.6%, 24/7, 365 and the Contractor should maintain and support as such.

6. Analyze fault histories and fault trends to proactively predict and mitigate repetitive issues.

7. Respond to and take corrective action to resolve vulnerabilities identified by the Contractor or the Government. Lead the efforts to resolve the vulnerabilities associated with the ESS applications, servers, clients, or equipment, coordinate resolution with appropriate DLA Technical Reps that support OS, hardware, etc. as required.

8. Provide ongoing training for Government personnel as requested in support of the existing ESS.

9. As a software upgrade becomes available, the Contractor shall develop a plan for the upgrade and present that plan to the COR for approval. The COR will present this plan to the J6 Technical Point of Contact (TPOC) for routing for J62 approval. Once approved, the Contractor shall execute their plan to install the upgrade(s) and return the ESS system(s) to an operational state.

3.2.2 CONFIGURATION AUDIT

A configuration audit is an inventory of all existing hardware, software, drawings, and technical documentation and is a function of configuration management. The Contractor shall perform a configuration audit of base wide ESS/EKC systems and provide this information to the Government using standard DoD Architecture Framework formats e.g., System Views (SV), Operational Views (OV), etc. within 90 days of award and perform updates as required by cybersecurity. The Contractor shall report the updates they complete in the status reports.

3.3 TASK 3 – HARDWARE PROCUREMENT, INSTALLATION AND

CONFIGURATION

3.3.1 PROCUREMENT

The Contractor will be responsible to procure all materials and equipment required for fulfillment of task items within 30 calendar days of award of contract. The Contractor shall install all procured equipment projected in Table 3.3.1. All materials and equipment for this project shall be new, not refurbished, and shall be submitted in the Hardware/Software Inventory Report to the COR and approval by the Government Information System Security Manager (DLA ISSM) prior to procurement to ensure it can be supported and complies with the National Defense Authorization Act (NDAA). The Contractor shall be responsible to ensure all equipment can be configured/programmed to make the security system of this contract operational.

TABLE 3.3.1 Projected List of Materials Description Part Number Estimated Counts

NVR Appliance HW (replacements/expansions)

As approved by the COR *must be compatible 10-12 each

Hard Disk Drives (replacements/expansions)

As approved by the COR *must be compatible 50-60 each

Add misc. for cabling, connectors, batteries

As approved by the COR *must be compatible As required

3.3.2 INSTALLATION AND CONFIGURATION

When installs are required as part of maintenance and sustainment, then the Contractor shall furnish all labor needed to support the installation, configuration, cybersecurity, testing, and other related support required for this PWS effort. Upon completion of work, Contractor shall turn over a complete and fully operational integrated system as described in this PWS. The Contractor shall procure, install, configure, integrate, and test all devices. All items purchased must have approval by the DLA ISSM prior to procurement to ensure it can be supported and complies with the NDAA. If any device/equipment fails after the Contractor has commenced work on that device/equipment necessary corrections shall be performed to this equipment in a timely manner or replaced. Responsibility for repair costs due to negligence or abuse of Government equipment shall be the responsibility of the Contractor.

1. The Contractor shall install and configure NVR/DVR appliance hardware, software, client workstation software/monitors and all other items required to deliver a fully operational

CCTV/VSS.

2. The Contractor shall work with the COR and other DLA Representatives to coordinate for network connectivity, IP addresses, firewall rules/access and other related support.

3. The Contractor shall provide an Operational Test Plan for the CCTV/VSS. The Contractor shall test all CCTV/VSS components and interconnections to ensure proper configuration and operation. The Contractor shall ensure the Government Representative witnesses the Operational Testing and the Contractor shall provide a Test Acceptance Report to the Government for signature.

4. Cybersecurity Support for all ESS/EKC application systems (ACS/IDS/CCTV/EKC). The Contractor shall complete the security scanning, STIG compliance processes including repeating scan, STIG, scan until vulnerabilities are remediated or accepted in a Plan of Action and Milestones (POAM) provided by the Contractor. The Contractor will provide all associated documentation to obtain a favorable Risk Management Framework (RMF), or other accreditation assessment determined by the DLA ISSM. The Contractors shall complete the assessments identified by the DLA ISSM and those may include but are not limited to the DVR/NVR hardware, Operating System (OS) and application software; workstation hardware, OS, and application software; and other items. See Section 3.5 for additional information.

3.4 TASK 4 – NETWORK AND INFRASTRUCTURE SUPPORT

The Contractor shall support network and infrastructure requirements including:

3.4.1 SYSTEM NETWORK REQUIREMENTS

The Contractor shall support the following system network requirements including, but not limited to:

1. All network components and applications shall be compatible with all applicable Defense

Information System Agency (DISA) Security Technical Implementation Guides (STIGs). Any STIG exceptions must be identified as part of the Contractor’s proposal. Exceptions incurring risk found unacceptable to the DLA Authorizing Official (AO) are not permitted.

2. All network components and applications shall be Internet Protocol (IP)v4 and IPv6 compatible.

3. All wiring and cabling shall be in Electric Metal Tubing (EMT) type conduit.

4. All network components shall be connected using copper 10/100/1000 or fiber optic Small Form

Factor Pluggable (SFP)-based Gigabit Ethernet ports.

5. Network components shall allow configuration of Institute of Electrical and Electronics

Engineers (IEEE) 802.1x or port security for authentication.

6. Web servers, human-machine interface (HMI) and controller systems must be on separate

Virtual Local Area Network (VLAN)s.

7. Any external network connections must be permanently disconnected.

8. The Contractor shall provide a complete list of all ports, protocols, and services (PPS) required for any computer system running control system applications or required to interface the control system applications. The listing shall include all ports and services required for normal operation as well as any other ports and services required for emergency operation. The listing shall also include an explanation or cross reference to justify why each service is necessary for operation.

9. The Contractor shall identify any system enabled or disabled.

10. All wireless communications shall meet applicable STIG requirements.

11. The Contractor shall provide Bill of Materials (BOM) and other network documentation to the

COR in support of these requirements

3.4.2 INFORMATION TECHNOLOGY INFRASTRUCTURE REQUIREMENTS

The Contractor shall support the following IT technology infrastructure requirements to include, but not limited to:

1. DLA shall furnish all server and laptop/workstation hardware if required for ACS/IDS/EKC systems. Any requirement for the Contractor to provide their own server or laptop/workstation hardware for the CCTV NVR appliances shall be documented in the proposal. Contractor supplied systems must meet DoD STIG requirements, with any exceptions noted in their proposal.

2. The system shall be capable of operating on DLA’s approved operating systems, virtual environments, and databases listed below:

a) Workstations/laptops shall operate on Windows 10 (or higher versions approved by DLA), with minimum system requirements not to exceed: processor: Intel i5 -6200u @

2.3 GHZ, 2 Cores, RAM: 8GB, Hard Drive: 256 GB.

b) Windows Server 2016 Operating System (OS) (or higher versions approved by DLA).

c) For virtualized appliances or virtualized servers, the system shall be capable of running on VMware ESXi hosts v6.5.0 or VMware vSphere v6.5.0 virtual server environment (or higher versions).

d) Database shall operate using SQL Server 2016 or Oracle Database v19c (12.2.0.3) (or higher versions).

e) System must be capable of operating with McAfee ePolicy Orchestrator enabled.

3. Any removable flash media required for system operation must be reviewed and accepted by the

DLA Flash Media Approval Program.

4. In some instances (such as video surveillance) where there is a requirement for a large amount of storage, the preferred solution will be available as an appliance that includes compute/storage in one physical appliance that meets DoD, National Institute of Standards and Technology (NIST) and Under Secretary General (USG) regulatory and cybersecurity policy requirements.

5. The appliance will not be used as a combined server and shall be sized adequately to store video feed data as specified elsewhere in the solicitation.

6. The Contractor shall be responsible for configuration and deployment.

7. The Contractor shall be responsible for all software maintenance activities for the appliance including but not limited to, firmware updates, OS patching, software patches etc. for the duration of the contract period.

8. The Contractor will be responsible for all physical maintenance activities for the appliance including but not limited to, replacement of defective components such as hard drives (to be destroyed onsite), motherboards, daughter cards etc. for the duration of the contract period.

9. System(s) shall operate using a Contractor fully supported operating system (OS), software, and firmware throughout the duration of the contract. All operating systems, software, and firmware shall be upgraded prior to the Contractor’s end of mainstream support for the OS, software, or firmware. The preference is for a virtualized solution. The solution must be upgradeable and remain compliant to cyber security specifications during the lifecycle of the solution.

3.5 TASK 5 - CYBERSECURITY REQUIREMENTS

3.5.1 THE CONTRACTOR SHALL PROVIDE THE FOLLOWING CYBERSECURITY

SUPPORT INCLUDING, BUT NOT LIMITED TO THE FOLLOWING:

1. The Contractor shall not permit user credentials to be transmitted in clear text. Encryption shall at a minimum meet Advanced Encryption Standard (AES) 256 and comply with Federal Information Processing Standard (FIPS) 140-2. If this is not technically feasible, the Contractor shall provide the strongest encryption method commensurate with the technology platform and response time constraints and document the encryption used. The Contractor shall not allow multiple concurrent logins, applications to retain login information between sessions, provide any auto-fill functionality during login, or allow anonymous logins. The Contractor shall provide user account-based logout and timeout settings.

2. The Contractor shall not permit user credentials to be transmitted in clear text. Encryption shall at a minimum meet AES 256 and comply with Publications FIPS 140-2. If this is not technically feasible, the Contractor shall provide the strongest encryption method commensurate with the technology platform and response time constraints and document the encryption used. The Contractor shall not allow multiple concurrent logins, applications to retain login information between sessions, provide any auto-fill functionality during login, or allow anonymous logins.

The Contractor shall provide user account-based logout and timeout settings.

3. The Contractor shall provide cybersecurity that is in accordance with current policies, procedures, and statutes, to include (but not limited to) the following (most current):

a) The Federal Information Security Management Act (FISMA)

b) Committee on National Security Systems, Policy No. 11

c) Federal Information Processing Standards

d) Defense Information Systems Agency (DISA) Secure Technical Implementation Guides

(STIGs)

e) DOD Instruction 8510.01, Risk Management Framework (RMF) for DOD Information

Technology (IT)

f) DOD Directive 8140.01, Cyberspace Workforce Management

g) IA policies and DOD Directive 8500.1, Information Assurance

h) Global Information Grid (GIG) Concept of Operations (CONOPS)

4. Heartbeat Signals. The Contractor shall identify heartbeat signals or protocols and recommend whether any should be included in network monitoring. The Contractor shall provide packet definitions of the heartbeat signals and examples of the heartbeat traffic if the signals are included in the network monitoring.

5. Disabling, Removing, or Modifying Well-Known or Guest Accounts. The Contractor shall recommend which accounts need to be active and those that can be disabled, removed, or modified. The DLA KO or COR shall approve in writing the Contractor’s recommendation. The Contractor shall disable, remove, or modify all the accounts pursuant to the approved recommendation. The Contractor shall disable or remove all default and guest accounts. Once changed, new accounts will not be published except that new account information and passwords will be provided by the Contractor via protected media. At delivery, the Contractor shall disable, remove, or modify all Contractor-owned accounts or negotiate account ownership with the DLA KO and COR. Contractor updates shall not re-enable or re-install any of these accounts.

6. Session Management. The Contractor shall not permit user credentials to be transmitted in clear text. Encryption shall at a minimum meet Advanced Encryption Standard (AES) 256 and comply with Federal Information Processing Standards (FIPS) 140-2. If this is not technically feasible, the Contractor shall provide the strongest encryption method commensurate with the technology platform and response time constraints and document the encryption used. The Contractor shall not allow multiple concurrent logins, applications to retain login information between sessions, provide any auto-fill functionality during login, or allow anonymous logins. The Contractor shall provide user account-based logout and timeout settings.

7. Password/Authentication Policy and Management. The Contractor shall implement two-factor authentication using DoD Common Access Card where technically feasible, with exceptions noted in the proposal. The Contractor shall provide a configurable account password management system that allows for selection of password length, frequency of change, setting of required password complexity, number of login attempts, inactive session logout, screen lock by application, and denial of repeated or recycled use of the same password. The Contractor shall not store passwords electronically or in Contractor-supplied hardcopy documentation in clear text unless the media is physically protected.

8. End Devices. The Contractor shall provide physical and cyber security features for end devices (i.e., the source or destination of network traffic) including, but not limited to, authentication, encryption, access control, event and communication logging, monitoring, and alarming to protect the device and configuration computer from unauthorized modification or use. The Contractor shall clearly identify the physical and cyber security features and provide the methodology for maintaining the features including the methods to change settings from the Contractor-configured or manufacturer default conditions. The Contractor shall verify that the addition of security features does not adversely affect connectivity, latency, bandwidth, response time, and throughput. The Contractor shall remove or disable all software components that are not required for the operation and maintenance of the device prior to delivery. The Contractor shall provide documentation on what is removed and/or disabled. The Contractor shall provide, within a pre-negotiated period, appropriate software, and service updates and/or workarounds to mitigate all vulnerabilities associated with the product and to maintain the established level of system security.

9. Physical Access of Cyber Components. The Contractor shall provide a detailed plan for physical security mechanisms appropriate for the type of devices being installed (enclosures, etc.).

10. System Security Plan. The Contractor shall provide a System Security Plan with the following artifacts, as required:

a) Enterprise Configuration Management Plan

b) System Supplemental Implementation Guide

c) System Configuration Control Working Group Charter

d) Continuity of Operation Plan (COOP) or Contingency and Business Continuity Plan

(BCP)

e) COOP Exercise Evidence

f) Logical and Data Flow Diagrams

g) Disaster Recovery Plan (DRP)

h) Formal Agreement (e.g., Service Level Agreement (SLA), Memorandum of

Understanding/Association (MOU/MOA), Letter of Agreement LOA))

i) Security Personnel Appointment Memorandum(s)

j) Hardware Inventory Report

k) Software Inventory Report

l) Incident Response Plan (IRP)

m) System Key Management Standard Operating Procedure (SOP)

n) System Media Protection and Sanitization SOP

o) System Access Control and Account Creation SOP

p) System Audit and Accountability SOP

q) System Maintenance SOP

r) System Security Concept of Operations

s) System Design Document

t) Ports, Protocols, and Services

3.5.2 CYBERSECURITY STRENGTH REQUIREMENTS

1. The Contractor shall adhere to all existing authorities and policies of the Director of National

Intelligence regarding the protection of sensitive compartmented information (SCI), as directed by Executive Order 12333 and other laws and regulations.

2. The Contractor shall satisfy the RMF requirements of subchapter II & III of chapter 35 of Title 44, United States Code (U.S.C.), also known as the “Federal Information Security Management Act (FISMA) of 2014”

3. The Contractor shall enable DLA to meet the standards required by the Office of Management and Budget (OMB) and the Secretary of Commerce, pursuant to FISMA and section 11331 of Title 40, U.S.C.

a) FIPS 199 / FIPS 200 / FIPS 201/ Committee on National Security Systems Instruction (CNSSI) 1253 Security Categorization: The Contractor shall participate in categorization discussions with the DLA program manager / User Technical and the DLA ISSM, and as requested to support security categorization.

b) The Contractor shall in coordination with the prescribed System Owner (SO) and Authorizing Official (AO) support categorization IAW FIPS 199, FIPS 200, FIPS 201 and CNSSI 1253 of the CS and document the results of the security categorization in the security plan.

c) The Contractor shall ensure that a written subsection of the security plan covers FIPS 199 / FIPS 200 / FIPS 201 CNSSI 1253 Security Categorization and Threat Assessment. DLA and or the SO will provide a C-I-A concurrence memorandum from SO respective AO agreeing with their determination of controls (Confidentiality, Integrity, and Availability with any overlays and tailoring).

3.5.3 COMPLETION OF SYSTEM HARDENING (SCAN/FIX/SCAN) TESTING AND

ANALYSIS

It is expected that the system delivered to the Government will have the ability to be hardened in accordance with current DOD, DLA, and Defense Information Systems Agency (DISA) standards. This includes automated and manual STIG application, Assured Compliance Assessment Solution (ACAS) scanning, and any other hardening efforts required to make the system ready to connect to a DOD network. When issues are found (High, Medium, Low Impact Levels) the Contractor shall fix those issues and rescan the system to ensure all issues have been fixed and/or properly and acceptably mitigated. High impact level findings that cannot be fixed are to be reported to the Government COR immediately along with a valid reason the vulnerability cannot be fixed and a mitigation plan to fix the vulnerability with the date to be fixed. Once the Contractor has completed their in-house hardening efforts, the scan/fix/scan process is performed before the DLA Information Systems Security Manager (DLA ISSM) review and provides a certification recommendation to the Authorizing Official (AO).

The goal is for the system to have a cybersecurity posture before the DLA ISSM assesses the system.

The scan/fix/scan process should find and fix all issues before the DLA ISSM’s assessment. It is expected that the scan/fix/scan process will occur prior to or once the system has been connected to its designated end-state network with scanning being conducted by the DLA. The Contractor shall work with the Government to remediate any findings that exist with the system after it is connected to the production network.

Upon connection to the production network, the Contractor is expected to maintain the current approved settings. The Contractor is expected to notify the Government of any known published system patches and OS updates that will negatively impact the cybersecurity posture of the system. Any identified issues should be documented in advance to the COR with a valid reason the system patch or OS update cannot be applied and a mitigation plan to fix the pending vulnerability with the date to be fixed.

3.5.4 CYBERSECURITY ASSURANCE REQUIREMENTS

1. The Contractor shall design, develop, and integrate Cyber Security (CS) solutions supporting the

Department of Defense and all other applicable Government agencies. This will be achieved through abiding by all applicable CS regulations and directives to ensure a favorable Assessment and Authorization (A&A) / Assessment and Incorporate (A&I) decision (an Authority to Operate (ATO)) as well as obtaining an Authority to Connect (ATC) to all requisite Government networks as required per specific task requirements. The Contractor shall mitigate risk identified through the RMF authorization process down to a level acceptable to the DLA Authorizing Official.

a) Coding for Security. The Contractor shall provide documentation of development practices and standards applied to Government approved Contractor-written control system software, including firmware, used to ensure a high level of defense against unauthorized access.

2. All control systems shall be considered low-moderate-low (Confidentiality-Integrity- Availability) for the SSP unless otherwise notified in writing. The solution shall comply with the security control requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r4, “Security and Privacy Controls for Federal Information Systems and Organizations” and NIST 800-82r2, “Guide to Industrial Control Systems (ICS) Security”. The Contractor shall provide details of any alternative but equally effective security measures used to compensate for the inability to satisfy a derived security requirement (mitigation to control compliance findings). Guidance on the applicability and enforcement of controls by Purdue Enterprise Reference Architecture (PERA) level can be found in the United Facilities Criteria (UFC) 4-010-06, Cybersecurity of Facilities-Related Control Systems.

a) The NIST SP 800-82r2 overlay for Industrial Control Systems (ICSs) shall be used as appropriate for the system.

3.5.5 ACQUISITION PHASE: MATERIEL SOLUTION ANALYSIS (MSA)

The Contractor shall support MSA for any new system not currently categorized and assessed for network accreditation including, but not limited to the following Risk Management Framework (RMF) steps:

1. RMF Step 1 – Categorize System

a) The Contractor shall assess cybersecurity risk per criteria in Analysis of Alternatives

(AoA) study plan and cybersecurity capability requirements from the Initial Capabilities Document (ICD) in collaboration with the DLA Information System Security Manager (DLA ISSM) and incorporate the cybersecurity risk assessment into the AoA Study Plan for sponsor approval.

2. RMF Step 2 – Select Security Controls

a) The Contractor shall select security control baseline including overlays in collaboration with the DLA ISSM and PM for DLA Authorizing Official (AO) approval.

b) The Contractor shall ensure that initial security controls baseline traces to the preliminary system performance specifications that comprise the preliminary functional baseline. The approving authority for this action is this the PM.

c) The Contractor shall conduct Trusted Systems and Networks (TSN) Analysis focused on mission level, including Criticality Analysis (CA) to identify critical functions, Threat Assessment (TA), Vulnerability Assessment (VA), TSN Risk Assessment, and countermeasure selection and document in the Program Protection Plan (PPP). The approving authority for this action is this the PM.

The Contractor shall develop and update mission criticality analysis(-es), vulnerability assessment(s), risk assessments(s), and identification and counter measurement implementation(s) for Mission-Critical Functions, the failure of which would result in either Level I (Catastrophic) or Level II (Critical) compromise of mission capability.

d) Adapting the MIL-STD-882 (System Safety) definitions of criticality to mission criticality, the Contractor shall define the following criticality levels:

Level I (Catastrophic) protection failure that results in total compromise of mission capability Level II (Critical) protection failure that results in unacceptable compromise of mission capability or significant mission degradation Level III (Marginal) protection failure that results in partial compromise of mission capability or partial mission degradation Level IV (Negligible) protection failure that results in little or no compromise of mission capability.

e) For each Level I and Level II Mission-Critical Function identified by the Contractor in the criticality analysis, the Contractor shall identify the associated logic-bearing system components (e.g., hardware, firmware, and software) that implement, protect, or…