Sources Sought Notice - Draft PWS.docx

Performance Work Statement (PWS)

Cyber Operational Test & Evaluation (OT&E) Support For

OPERATIONAL TEST AND EVALUATION FORCE (OPTEVFOR) 01D

6 May 2025

1. SCOPE

This Performance Work Statement (PWS) covers technical and management support services to the Operational Test and Evaluation Force (OPTEVFOR) cybersecurity support competency division (01D). The scope of this PWS includes but is not limited to support documentation, template development, toolset development management, test execution, future capabilities research and development, cybersecurity infrastructure design, build and management, Risk Management Framework (RMF) support, and Department of Defense (DoD) Certified Assessment Team (DCAT) requirements per DoDI 8585.01.

The CONTRACTOR shall provide support for the cyber OT&E mission by developing and editing complex technical documents to include, Test and Evaluation Masters Plans (TEMP), TEMP input letters, TEMP comment letters, Integrated Evaluation Frameworks (IEF), test plans, and final reports.

The CONTRACTOR shall develop and review a variety of other test-related documents, such as forwarding letters, letters of observation, modeling and simulation accreditation letters, letters of instruction, and any other documents supporting the Cyber OT&E mission.

The CONTRACTOR shall conduct cyber OT&E under OPTEVFOR authorities and guidelines. The CONTRACTOR coordinates with Operational Test Directors (OTD) to develop test objectives and execute the tests.

The CONTRACTOR shall design as needed to support SUT, install, and maintain the OPTEVFOR cyber OT&E infrastructure to include the requisite hardware, software, toolsets, and DoD Information Network (DoDIN) support services. The CONTRACTOR will also be responsible for the management and setup of cyber range nodes for exercise, training, and risk reduction events. The CONTRACTOR shall administer the infrastructure, including network and system security, patch management, reviewing system logs, monitoring system activities, maintaining user access administration, generate backup and recovery planning, maintaining physical security of all associated Hardware, and disabling unnecessary services.

The CONTRACTOR shall maintain and comply with all DoD, Department of the Navy (DON) cybersecurity policies and guidance as applicable, such as Secure Technical Implementation Guides (STIG), and Tasking Order (TASKORD).

The CONTRACTOR shall create and update RMF/Assessment and Authorization (A&A) artifacts, as well as assess cybersecurity compliance requirements to support RMF and to obtain Authority to Operate (ATO) for OPTEVFOR 01D cyber infrastructure.

The CONTRACTOR shall create and update red team certification and accreditation (C&A) artifacts to support certification and sustainment of OPTEVFOR’s DCAT.

2. PLACE OF PERFORMANCE

Work performed in accordance with this PWS shall be primarily at the following location unless designated otherwise to support mission accomplishment:

OPTEVFOR

7970 Diven Street Norfolk, VA 23505 The CONTRACTOR will not perform permanent work at any other location unless the Contracting Officer’s Representative (COR) authorizes that work in writing.

WEEKEND AND HOLIDAY WORK

Due to the complexity of test and the dynamic schedules of test assets, there may be times in which the CONTRACTOR will be required to work during weekends or holidays in support of test requirements. These requirements are primarily due to unplanned test asset availability. However, there may be times where mission requirements drive a need to travel to/from test sites and/or work through weekend/holiday dates. Whenever the CONTRACTOR is required to perform work outside of normal working hours, there will be Contract Line Item Number (CLIN) established within the contract (i.e., the “surge CLIN”) to afford billing those additional services towards that may not have been forecast in the labor CLIN. The use of the surge CLIN shall only be authorized by the COR and/or Technical Point of Contact (TPOC) prior to any work being performed.

PERIOD OF PERFORMANCE

The period of performance associated with this PWS shall be for a twelve-month base period, with four (4) twelve (12) month option periods, and one (1) six-month option period to be exercised at the discretion of the Government.

***Wage Determination 2015-4341 Revision No. 30 Dated 4/25/2025 is incorporated into this contract***

3. SECURITY REQUIREMENTS

The scope of work requires a minimum access to SECRET with higher access to TOP SECRET (TS) information for specified CONTRACTOR personnel, and TOP SECRET/SENSITIVE COMPARTMENTED INFORMATION (ELIGIBILITY FOR TS/SCI) access for Contractor personnel deemed necessary for successful execution. The specific security level required is specified for each labor category within the section – “POSITION DESCRIPTIONS, QUALIFICATIONS & TASKS”. All CONTRACTOR personnel must have the necessary clearances (eligibility) as proposed and must maintain the level of security required for the life of the contract. CONTRACTOR personnel shall have the appropriate security clearance as of the first day of the period of performance. All CONTRACTOR personnel designated to perform shall be United States citizens (no exceptions).

The offeror shall provide proof/verification that it possesses a current TS facilities clearance at time of proposal submission.

This contract will also require access to information subject to Alternative Compensatory Control Measures (ACCM) and will be identified within the DD254 in support of this contract.

SECURITY

The CONTRACTOR shall be responsible for adhering to all DoD, DON and OPTEVFOR instructions, guidance, orders, directives, and supplements relative to performing tasks set forth in this PWS. The CONTRACTOR shall not disclose and must safeguard procurement sensitive information, computer systems and data, data covered under The Privacy Act of 1974, and government personnel products that are obtained or generated in the performance of this contract. This includes dissemination of protocols and papers not generally available through the public literature. Neither the CONTRACTOR nor any of its contract service providers shall disclose or cause to disseminate any information concerning operations of military activities. Such action(s) could result in violation of the contract and possible legal actions.

Access will be granted to government facilities as required in support of the tasking. CONTRACTOR personnel performing work under this contract must meet all requirements for gaining access to US Government installations. The CONTRACTOR shall conform to all DoD, DON, and local (base/installation) security instructions; refer to CONTRACTOR Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information.

All work is to be performed in accordance with DoD and Navy Operations Security requirements and in accordance with the DD 254 associated with this contract and all attachments.

The CONTRACTOR personnel are required to have a valid Common Access Card (CAC) to access the building and will follow OPTEVFOR policies and procedures for displaying appropriate credentials while in the building. Badges will be displayed, above the waist, clipped to the collar or pocket of the outer garment, or suspended on a lanyard or clip where it can be easily and clearly seen while in the building.

The CONTRACTOR shall comply with all applicable federal, state, and local laws and ensure performance is secure while protecting material, equipment, and supplies from damage and loss. Government security personnel shall have the express right to inspect for security violations at any time during the term of the contract.

PRIVACY ACT COMPLIANCE

The CONTRACTOR may be in contact with data and information subject to the Privacy Act (Title 5 of the U.S. Code Section 552a). The CONTRACTOR shall ensure that its employees assigned to this effort understand and adhere to the requirements of the Privacy Act and to DoD and DON regulations that implement the Privacy Act. DON policy and procedures implementing the Privacy Act are detailed in SECNAVINST 5211.5F (DON Privacy Program). The CONTRACTOR shall identify and safeguard data, information and reports accordingly. In addition, the CONTRACTOR shall ensure that CONTRACTOR personnel assigned to the contract are trained on properly identifying and handling data and information subject to the Privacy Act prior to commencing work.

NON-DISCLOSURE AGREEMENT

CONTRACTOR personnel may be asked to sign a government-provided nondisclosure agreement substantially similar to the following to support OPTEVFOR Test and Evaluation:

a) I acknowledge I have been assigned to the project/program within the scope of this contract.

b) I understand that I may be given access to information which is proprietary and/or procurement sensitive and belonging to the Navy Contractors or their suppliers. I have been briefed and am knowledgeable regarding the requirement of Subsection 27(a) of the Office of Federal Procurement Policy Act (also known as the Procurement Integrity Act) regarding unauthorized disclosure of Contractor information. In addition, I understand that all information is for Government use only and may be used only in the performance of work requirements necessary to carry out my duties under this Project/Program. I also understand the requirements this contract are “Unclassified”.

c) I understand that unauthorized disclosure of sensitive or confidential information as it relates to this project/program could damage the integrity of this procurement/project and that the transmission or revelation of such information to unauthorized persons could subject me to prosecution under the Procurement Integrity Act, 41 U.S.C. Sections 2010-2017 or under other applicable laws.

d) I do agree that I will not divulge, publish, or reveal by word, conduct, or any other means, such information or knowledge, except as necessary to do so in the performance of my official duties related to this project/program and in accordance with U.S. laws, unless specifically authorized in writing by an authorized representative of the United States Government.

e) I understand that the information I receive will be given only to persons specifically granted access to the project information and may not be further divulged without specific prior written approval from an authorized individual.

AUTOMATIC DIGITAL PROCESSING (ADP) REQUIREMENTS

The Government will provide in support of this contract, the necessary computer, workstation/system access for on-site work. Those offerors assigned as off-site will not be assigned government furnished ADP assets. Additionally, the offerors assigned ADP Government Furnished Equipment (GFE) will be held accountable to respond to the governments ADP inventory requirements conducted semi-annually to ensure 100% accountability of all ADP assets. Any offeror not adhering to this call for inventory of ADP assets may be directed to forfeit their ADP GFE at no additional cost to the government, IAW FAR 52.245-1. The CONTRACTOR shall be responsible for safeguarding all government equipment, information, and property provided for CONTRACTOR use. At the close of each work period, government facilities, equipment, and materials shall be secured.

The government issued CAC serves as the primary method of identification for the CONTRACTOR personnel, as well as providing the basis of Public Key Infrastructure (PKI) access to the OPTEVFOR networks, and numerous Navy web sites, which may also require PKI access. The COR shall assist in providing the CONTRACTOR the appropriate documentation for obtaining CACs. The CONTRACTOR shall be responsible for obtaining any government issued identification cards from former employees or employees whose access has been terminated and to turn those items over to the COR upon termination of employment or access.

4. GENERAL/ADMINISTRATIVE MATTERS

STAFFING

The CONTRACTOR shall provide fully qualified personnel (per the PWS ISO the awarded contract) on the first day of the period of performance.

All contract personnel attending meetings, answering government telephones, and working in other situations where their CONTRACTOR status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by the CONTRACTOR under the coverage of an awarded contract shall NOT incorporate their company logo/symbols or company acknowledgement wording. The Contractor is required, to clearly indicate on email title blocks their company name and that they are CONTRACTOR personnel.

DATA RIGHTS

It is the government’s intent to retain unlimited rights to all software, documentation, and data produced in performance under the awarded contract.

U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports are maintained by the CONTRACTOR, but remain the property of the U.S. Government. These files/results must be surrendered to the COR immediately upon request.

GOVERNMENT QUALITY ASSURANCE SURVEILLANCE

The government shall evaluate the CONTRACTOR’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do in order to ensure that the CONTRACTOR is performing in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

ALLEGED COMPLAINTS LODGED AGAINST CONTRACTOR PERSONNEL

In the event a complaint is made regarding the conduct or ability of CONTRACTOR personnel, the individual making the complaint WILL contact the OPTEVFOR COR immediately. The COR will notify the appropriate personnel. The contract overarching Project Manager (PM) and COR will cooperate in investigating complaints made against CONTRACTOR personnel. If the results of the investigation prove the complaint(s) to be valid, the COR will brief the Contracting Officer (KO) with a recommended course of action. The CONTRACTOR may have a maximum of three (3) working days to propose a corrective plan for resolving the matter and preventing future similar occurrences. This plan shall be submitted in writing to the KO and COR. In the event that the Government deems the corrective plan insufficient for resolution of the problem, a written response to the CONTRACTOR via the COR shall be provided within three (3) working days.

OFFICE SPACE

The Government will provide office space, desk(s), chair(s), and common office supplies. In addition to office/cubical space, each CONTRACTOR personnel shall be provided with access to Government computers and telephones for official use only, but not cellular phones. Under no circumstances will CONTRACTOR-provided personal computers be connected to any DoD network. CONTRACTOR personnel shall comply with all DoD and Navy internet usage and cybersecurity policies.

STATEMENT OF NON-PERSONAL SERVICE

This is not a personal services contract. The Contractor/sub-Contractor should be well educated in respect to “personal services”. No one (government employee, including military) may task the Contractor to perform work that is not listed in the contract, nor does the Contractor take direction in the performance of their task from anyone other than their corporate manager and/or prime Contractor, as appropriate. CONTRACTOR personnel performing services under this PWS will be controlled and supervised at all times by CONTRACTOR management personnel. CONTRACTOR management shall ensure that CONTRACTOR personnel properly comply with the performance work standards outlined in the PWS. CONTRACTOR personnel shall perform their duties independent of, and without the supervision of, any Government official.

The tasks, duties, and responsibilities set forth in this contract shall not be interpreted or implemented in any manner that results in any CONTRACTOR personnel creating or modifying federal policy, obligating the appropriated funds of the U. S. Government, overseeing the work of federal employees, providing direct personal services to any federal employee, or otherwise violating the prohibitions set forth in Parts 7.5 and 37.1 of the Federal Acquisition Regulation (FAR) https://www.acquisition.gov/far . The government shall control access to the facilities and shall perform the inspection and acceptance of completed work.

CONTRACTING OFFICER AND REPRESENTATIVE

Only a duly appointed Procuring Contracting Officer (PCO), and no other government personnel, is authorized to change the specifications, terms and conditions under this contract. The OPTEVFOR Contracting Officer’s Representative (COR) is responsible for technical management of this contract, and will serve as the Contracting Officer’s Primary Point of Contact. The COR shall oversee execution of this PWS and resolve any potential issues. The COR is responsible for: liaising with OPTEVFOR personnel and Contractor personnel on site; contractual advice, recommendations and clarification regarding the statement of work; delivery of this PWS placed under this contract; providing an independent government estimate of the effort described in the statement of work; quality assurance of services performed and acceptance of the services or deliverables; government furnished property; security requirements aboard government installations; providing the PCO or his/her designated Ordering Officer with appropriate funds for issuance of the delivery; and the certification of invoice for payment.

TRAINING REQUIREMENTS

The government may have training requirements that involves the safety (i.e. Fire, Bomb Evacuation) and security (i.e. Active Shooter, Security of Building) of personnel while at OPTEVFOR as well as an offsite Informational Data Opportunity (IDO) (involving travel) (i.e. Summits, Symposiums/Seminar’s etc.) that could be deemed advantageous by 01D TPOC to the overall cyber OT&E mission. The two categories, training and IDO, will be hosted by government personnel for completion during normal working hours. IDOs may present their availability on a limited notification. Both categories may require the attendance of CONTRACTOR personnel supporting 01D. The 01D TPOC and COR will provide the request of the respective required training list to the PM and completion will be tracked and reported by the same.

DOD CYBER WORKFORCE FRAMEWORK (DCWF) REQUIREMENTS

The CONTRACTOR will be performing cyber work as defined in DoDD 8140.01 and will adhere to qualification standards and requirements in DoDM 8140.03 series. All personnel assigned to a position described in the section “POSITION DESCRIPTIONS, QUALIFICATIONS & TASKS” that is designated as a DCWF work role must meet the minimum criteria for certification, training, or educational options aligned to the DCWF Qualification and Management Program (DoDM 8140.03 series). Additional DCWF information, to include work role foundational qualification matrices, can be found on the DoD Cyber Exchange (https://cyber.mil/wid/dod8140/qualifications-matrices/).

DCWF work roles contain “core” and “additional” Knowledge, Skills, Attributes, and Tasks (KSATs) that can be individually selected based off organizational needs. Applicable KSATs for work roles can be viewed on the DoD Cyber Exchange (https://cyber.mil/wid/dcwf/workforce-elements/). Section 5.0 lists the KSATs associated with the work roles assigned to the positions in this PWS. Some core KSATs are common among all work roles in the DCWF and are annotated by a “*” within the individual work role KSAT listings on the DoD Cyber Exchange website. Those KSATs are not included in this PWS for the purpose of brevity but are required to be met for each DCWF designated position.

In the absence of a foundational qualification matrix mapped to DCWF work roles and proficiency levels, alternative foundational qualifications based on documented experience may be accepted by the Government. Alternative foundational qualifications may also be used in instances where a candidate for a position possesses knowledge and skills (i.e., experience) associated to the intended DCWF work role assignment. The CONTRACTOR may request alternative foundational qualifications by the Government and shall provide appropriate documentation for review and acceptance per DoDM 8140.03 series.

OPTEVFOR RED TEAM CODE OF CONDUCT

Per DoDI 8585.01, a DCAT is a focused group of personnel (GOV/MIL/CTR) organized and authorized to support a wide variety of execution services to support a service’s training, assessments, test and evaluation, inspections, and other cyber risk determination requirements. OPTEVFOR Red Team is authorized as a DCAT by Fleet Cyber Command/Commander 10th Fleet Navy Authorizing Official. OPTEVFOR demands a high degree of ethical standards and conduct from any OPTEVFOR Red Team member, and supporting CONTRACTOR, to execute a test or other operation on any US Navy system. As such, all members of the OPTEVFOR Red Team (GOV/MIL/CTR) are asked to sign a code of conduct prior to being assigned to any operation or test event. The code of conduct can be found on the OPTEVFOR 01D SharePoint Online (SPO) site (https://flankspeed.sharepoint-mil.us/sites/OPTEVFOR). Positions that are required to sign a code of conduct are annotated in the section “POSITION DESCRIPTIONS, QUALIFICATIONS & TASKS”.

5. POSITION DESCRIPTIONS, QUALIFICATIONS & TASKS

Support listed in the scope of work above will be provided via fulfillment of the positions described below. The total amount of positions below represents the amount of work for this requirement if it were to be fully staffed. Staffing levels shall not drop below 50% for the reasons specified in the section “CONTINUITY OF QUALIFIED PERSONNEL”.

The Level of Effort (LOE) for each position is described below. The information in the “work location” column indicates where the position will primarily be performing work. Positions indicating Head Quarters (HQ) will be performed at OPTEVFOR and System Under Test (SUT), will be required to perform work at and away from OPTEVFOR at a designated location per the cyber OT&E execution calendar.

The tasks listed below are OPTEVFOR HQ specific tasks related to supporting the cyber OT&E mission. Tasks are related to the overall planning, execution, reporting of cyber OT&E efforts and other general support such as advanced capability development, DCAT authorization and sustainment, infrastructure management and other duties as assigned.

Template and Resource Requirements: Templates, guidebooks, standard operation procedures, associated with the individual work products and deliverables in the tasks below can be found on the OPTEVFOR 01D SharePoint Online site and is required to be used as the source location for these documents when they are being initiated to support any O1D deliverable.

Table 5.1 – Contract personnel categories

Important Note: For vacancies in positions designated as Key Personnel, they must be filled no later than 15 business days from the date of vacancy. All other positional vacancies must be filled no later than 25 business days. The counter starts on the first day after the former Key Personnel or other positional vacancies occurred.

Historical Information – Personnel

Below, addresses the labor categories and the type of work that may be required during the period of performance; however, it is unknown to the exact level of effort that will be required. Therefore, the following historical information is provided to address the number of personnel the government has used annually, in the past, to successfully perform the required services. This information does not represent the government’s current need, but is to inform Contractors as to the amount of support that could be required.

POSITION 1 – PROGRAM MANAGER (Key Personnel) This position is not designated as DCWF but is designated as key personnel. CONTRACTOR shall manage CONTRACTOR personnel hiring strategy, policy enforcement, emergency planning, security awareness, and/or other resources. CONTRACTOR shall coordinate the efforts of sub-CONTRACTORs including compliance with all government requirements and regulations. Position security clearance requirement is ELIGIBILITY FOR TS/SCI.

QUALIFICATIONS

· Project Management Professional certification OR minimum 5 years-experience managing projects in the field of DoD cybersecurity or Navy OT&E programs

· Minimum 3 years of experience in financial analysis and management

· Minimum 3 years of proficiency in Microsoft (MS) office products

· Minimum 3 years of experience briefing senior leadership

· Experience managing a workforce of 25+ people

TASKS

· Provide administrative support for centralized preparation of all contract related deliverables.

· Provide financial management support for centralized tracking, analysis and reporting all contract related funding, costs, travel and expenditures required the execution of this contract.

· Preparation of monthly status/progress report for contract tasks.

· Preparation of monthly contract financial reports.

· Preparation of technical reports as required by specific projects.

· Provide contract tracking deliverables to the OPTEVFOR COR and Technical Point of Contact (TPOC) monthly.

· Ensure all tasks for each labor category under this contract are being accomplished and that the proper support is being given.

· Ensure all TTPs/SOPs and exceptions are properly maintained.

· Provide additional tasking as needed.

POSITION 2 – SCHEDULES MANAGER (Key Personnel) This position is not designated as DCWF but is designated as key personnel. CONTRACTOR shall oversee and manage cyber OT&E support scheduling and is responsible to ensure scheduling requests adhere to established government policies and regulations and ensure updates to the operations schedule is posted in a timely and accurate manner. CONTRACTOR shall participate in or lead development of standard operating procedures, best practices, template inputs, and briefs associated with current and future cyber OT&E operations. Position security clearance requirement is SECRET.

QUALIFICATIONS

· Minimum 5 years of experience in operations management or scheduling

· Experience with quality assurance principles and processes

· Experience with MS SharePoint, MS Project, and other MS Office products

· Proficient computer skills with an emphasis on workflow and spreadsheet competency

· Ability to perform detail-oriented work and able to apply quality assurance/quality control towards end product.

· Excellent written and oral communications skills

TASKS

· Create and maintain OPTEVFOR 01D operations schedule as well as activities related to monitoring and assisting with tracking actions related to an overall schedule of OPTEVFOR 01D operations supported events and meetings. Details include but are not limited too and are to be worked inclusively with government personnel:

· Coordination of change and cancellation of test execution requests with the government

· Coordination of support requests for test planning meetings and other meetings requiring OPTEVFOR 01D operations support

· Coordination of scheduling command cyber training with OPTEVFOR support competencies and warfare divisions

· Assign team members to each test execution event

· Verify team members 60 days prior to test execution

· Verify team member support to weekly OPTEVFOR warfare division cyber meetings

· Update the OPTEVFOR 01D execution calendar

· Update OPTEVFOR 01D leadership brief on scheduling and test execution calendar changes

· Notify all team members of schedule/assignment changes/additions

· Determine length of pre-test preparation and anticipated post-test support

· Identify areas of concern such as size of team and execution length with government

· Coordinate and collaborate with stakeholders as needed to ensure all scheduled operations support data is accurate and current.

· Provide the OPTEVFOR 01D operations schedule, as needed by the government, within the government format as agreed upon.

· Track Post Test Iterative Process (PTIP) milestones to include Preliminary Data Analysis Working Group, Data Scoring Board (PDAWG), 01D Review Board, DOT&E Attachment B & C data delivery, Critical Operational Issue (COI) Evaluation Working Group (CEWG), System Evaluation Review Board (SERB), Executive-SERB (E-SERB), etc.

· Track test planning milestones to include checkpoints, concept of test briefs, test plan review boards, document signatures, etc.

· Provide Contractor Scope of Test estimates and associated funding status to OPTEVFOR 01D Current Operations and Future Operations Officers

· Assist with OPTEVFOR workflows, as applicable

POSITION 3 – NETWORK ENGINEER

This position is designated as an intermediate level Network Operations Specialist (work role: 441) under DCWF and is not designated as key personnel. CONTRACTOR shall plan, design, install, configure, test, operate, maintain, and manage network components including hardware, software, and operating systems that permit information sharing across the full spectrum of transmission using all media in support of OPTEVFOR’s Information Technology (IT) infrastructure supporting cyber OT&E. Systems include (but are not limited to) NIPR/SIPR networks, exploitation toolsets, circuits, and business systems. CONTRACTOR shall support the security of information and information systems according to DoD and DON policies and guidance. The CONTRACTOR shall administer and maintain designated IT infrastructure, including network and system security, patch management, reviewing system logs, monitoring system activities, maintaining user access administration, generate backup and recovery planning, maintaining physical security, and disabling unnecessary services. Additionally, the CONTRACTOR shall create and update certification and accreditation artifacts, as well as assess cybersecurity compliance requirements to support RMF of systems assigned to 01D. CONTRACTOR shall provide vulnerability analysis and detailed trend reports which drive architecture design, tailored network defense response options and perform forensic analysis to maintain the Navy defensive posture and initiatives. Position security clearance requirement is ELIGIBILITY FOR TS/SCI.

QUALIFICATIONS

· A BS degree in Information Technology, Cybersecurity, Data Science, Information Systems, or Computer Science, from an Accreditation Board for Engineering and Technology (ABET) accredited or Certified Association Executive (CAE) designated institution OR minimum of 5 years’ experience with technical proficiency in network infrastructure and security design and configuration of routers, switches, firewalls, and load balancers.

· Minimum of 3 years’ experience in RMF security testing.

· Proficiency with automation tools to include but not limited to Python, Perl, or shell scripting languages.

TASKS

· Provide network engineering and administration of multi classification networks in support of OPTEVFOR Cyber OT&E mission.

· Establish virtual environments tailored to support scheduled cyber OT&E events in timely manner; test and validate virtual environment prior to test execution and provide troubleshooting support during test execution.

· As required, design, install and upgrade, the cyber-attack lab, analysis lab, training lab, toolset and flyaway kits to support OPTEVFOR cyber OT&E mission.

· Administer and maintain the cyber test infrastructure, including installing patches, hardening systems, reviewing system logs, monitoring system activity, maintaining physical security of all associated hardware, and disabling unnecessary service.

· Design, implement, and administer enclaves supporting penetration test team with implementation of computer network security, military system specifications, and DoD cybersecurity in accordance with Information Assurance Vulnerability (i.e. IAVA, IAVB) notices, STIG, Tasking Orders, Warning Orders, Fragmentary Orders, and security architecture policies.

· Apply virtual hosting and server technology into network architectures.

· Configure network infrastructure to support test team user environments used for testing as well as on- keyboard training evolutions.

· Support the planning/engineering and acquisition of hardware and software.

· Brief government O1D leadership weekly.

DCWF KSATs

· Knowledge of the organization’s enterprise information security architecture system.

· Knowledge of network access, identity, and access management (e.g., PKI).

· Knowledge of network design processes, including security and operational objectives.

· Knowledge of network security architecture concepts, including topology, protocols, and principles (e.g., defense-in-depth).

· Knowledge of cybersecurity principles and organizational requirements (e.g., confidentiality, integrity, availability, authentication, non-repudiation).

· Knowledge of cybersecurity methods, such as firewalls, demilitarized zones, and encryption.

· Knowledge of network protocols and traffic flow (e.g., Open Systems Interconnection model).

· Ability to build and integrate architecture and frameworks.

· Analyze user needs and requirements to plan and document architecture.

· Plan implementation strategies to align enterprise components.

· Skill in designing and integrating hardware and software solutions.

· Skill in implementing and testing network infrastructure contingency and recovery plans.

· Integrate new systems into existing network architecture.

· Knowledge of network equipment (e.g., hubs, routers, switches) and their capabilities and applications.

· Ability to operate network equipment and Local Area Network (LAN) / Wide Area Network (WAN) pathways.

· Ability to monitor system performance, availability, and traffic flows.

· Skill in using network management tools (e.g., Simple Network Management Protocol) to analyze network traffic patterns.

· Knowledge of common attack vectors on the network layer and Virtual Private Network (VPN) security.

· Knowledge of symmetric key rotation techniques and concepts.

· Knowledge of configuration management techniques.

· Knowledge of security risk assessments and authorization per RMF processes.

· Provide input to RMF documentation and activities.

· Document and update architecture and related activities.

· Provide advice on project costs, design concepts, or design changes.

· Knowledge of communication methods and principles supporting network infrastructure.

· Skill in installing, configuring, and troubleshooting LAN and WAN components.

· Skill in sub-netting.

· Implement new system design procedures, test procedures, and quality standards.

POSITION 4 – RISK MANAGEMENT FRAMEWORK (RMF) ANALYST

This position is designated as an intermediate level Security Architect (work role: 652) under DCWF and is not designated as key personnel. CONTRACTOR designs enterprise and systems security throughout the development lifecycle; translates technology and environmental conditions (e.g., law and regulation) into security designs and processes. CONTRACTOR assists in comprehensive assessments of the management, operational, and technical security controls and control enhancements employed within or inherited by an information technology (IT) system to determine the overall effectiveness of the controls. CONTRACTOR shall provide project management, subject matter expertise, and hands-on support in all matters of OPTEVFOR cyber OT&E test infrastructure and toolset certification and accreditation efforts in accordance with DoD and DON policies and guidance. Position security clearance requirement is ELIGIBILITY FOR TS/SCI.

QUALIFICATIONS

· Minimum 5 years’ experience designing enterprise and systems security throughout the development lifecycle.

· Minimum 3 years’ experience conducting thorough assessments of management, operational, and technical security controls within IT systems

· Minimum 3 years’ experience providing project management, subject matter expertise, and hands-on experience for systems certification and accreditation efforts in accordance with applicable DOD and DON policies and guidance.

TASKS

· Create, review, update, and validate cybersecurity Standard Operations Procedures (SOPs) as required.

· Review and maintain an inventory of authorized software (software custodian).

· Review and maintain an inventory of government furnished devices and media.

· Ensure configurations on laptops and servers are validated prior to being deployed (as required)

· Audit and validate configurations of network devices based on STIGs, or defining and implementing compensating controls of such STIGs as required to ensure mission execution.

· Maintain and update all RMF and A&A documentation to ensure relevancy and alignment with OPTEVFOR cyber OT&E mission assets to include required revisions and updates in eMASS.

· Conduct comprehensive annual RMF package reviews to ensure continued compliance of the cyber OT&E mission toolset, networks, and/or systems.

· Ensure traceability is maintained throughout the RMF submission process (e.g., A&A plan, Plan Of Action and Milestones (POA&M), Security Assessment Report (SAR), topology, software, ports protocols and services, test plan).

· Maintain network and system documentation in DoD Information Technology Portfolio Repository-DON / DADMS.

· Maintain documentation and registration of network ports, protocols, and services.

· Maintain circuit registrations in Global Interconnection Approval Process System (GIAP) and Systems/Network Approval Process (SNAP).

· Maintain and report on the status (weekly) of all outstanding A&A items and supporting documentation.

· As a member of the Configuration Control Board (CCB), ensure CCB approved changes are timely and accurately reflected in the A&A documentation.

· Support compliance validation of current and future directives (e.g.: IAVs, STIGs, TASKORD/CTOs).

· Provide recommendations for corrective action of any non-compliant security controls.

· Execute DISA STIG validations for systems in conjunction with RMF/A&A package reviews annually in accordance with eh DoD Instruction 8510 series, Risk Management Framework for DoD systems..

· Provide security expertise to ensure security controls are implemented and the resulting documentation and artifacts are current.

· Prepare reports on scanning results and configuration management observations monthly.

· Document assessment activities and results in sufficient detail to enable external review of all assessment processes, activities, results, and conclusions.

· Conduct and document a semi-annual tabletop exercise Twice in a calendar year.

· Produce test plans, draft after actions and other documents for review and comment.

· Review and/or revise Business Impact Analysis (BIA) to include business process, IT dependency, and physical security assessments annually.

· Review and analyze IT contingency / disaster recovery plans for NIST and DoN compliance, and produce checklists for IT systems.

· Assist with exercise and/or training and documentation of IT contingency plan and execution Able to work alone or in a small group to resolve tasks independently with minimal supervision.

· Adhere to guidance outlined in RMF Process Guide https://portal.secnav.navy.mil/orgs/OPNAV/N2N6/DDCION/N2N6BC4/RMF/SitePages/Home.aspx

DCWF KSATs

· Knowledge of the organization’s enterprise information security architecture system.

· Ability to design and integrate security architectures and frameworks.

· Skill in translating technology and environmental conditions (e.g., laws, regulations) into security designs and processes.

· Knowledge of integrating organizational goals into security architecture.

· Ability to apply network security architecture concepts including topology, protocols, components, and principles (e.g., defense-in-depth).

· Skill in designing multi-level security and cross-domain solutions.

· Knowledge of cybersecurity-enabled software products and how they fit into security designs.

· Perform comprehensive assessments of management, operational, and technical security controls and enhancements.

· Document and address information security, cybersecurity architecture, and systems security engineering requirements throughout the acquisition lifecycle.

· Evaluate security architectures and designs to determine their adequacy.

· Develop and integrate cybersecurity designs for systems and networks with multilevel security requirements up to TS/SCI.

· Define and document the impact of new systems or interfaces on the security posture of the environment.

· Develop as needed, security compliance processes and/or audits for external services (e.g., cloud service providers).

· Provide project management and subject matter expertise in OPTEVFOR Cyber OT&E test infrastructure and toolset certification and accreditation efforts.

· Employ secure configuration management processes and ensure systems and architectures align with cybersecurity guidelines.

· Provide advice on project costs, design concepts, and design changes.

· Skill in applying cybersecurity methods such as firewalls, demilitarized zones, and encryption.

· Knowledge of IT architectural concepts, including baseline and target architectures.

· Knowledge of key telecommunications concepts and principles.

· Knowledge of network systems management principles and tools.

· Knowledge of Cloud-based knowledge management technologies related to security and administration.

· Skill in using PKI encryption and digital signatures.

· Document and update architecture and related activities.

· Translate proposed capabilities into technical requirements and security requirements into application design elements.

· Provide input to the Risk Management Framework process and related documentation.

· Knowledge of Personally Identifiable Information (PII) data security standards and program protection planning.

· Knowledge of local specialized system requirements (e.g., critical infrastructure) and network security principles.

· Ability to optimize systems to meet enterprise performance requirements.

· Skill in using design methods and developing data management capabilities.

POSITION 5 – FULLY QUALIFIED VALIDATOR (Key Personnel) This position is designated as key personnel and an advanced level Security Control Assessor (work role: 612) under DCWF. CONTRACTOR shall conduct independent comprehensive assessments of the management, operational, and technical security controls and control enhancements employed within or inherited by an information technology (IT) system to determine the overall effectiveness of the controls. CONTRACTOR shall provide cybersecurity support, analysis, documentation, and validation services for OPTEVFOR IT systems. CONTRACTOR serves independently as a Navy Qualified Validator (NQV), performing validation activities under the RMF process using Navy Security Control Assessor approved processes and applies knowledge of DoD or DoN network architectures and policy toward assessment and identification of vulnerabilities as a means of improving operational security posture in accordance with the Risk Management Framework Process Guide series .CONTRACTOR shall apply Navy Assessment & Authorization (A&A) guidance and policy to achieving/maintaining program objectives on time/schedule and guidance regarding vulnerability remediation and determination of risk posture. Position security clearance requirement is ELIGIBILITY FOR TS/SCI.

QUALIFICATIONS

· Minimum 8 years’ experience as an NQV.

· Proficiency in Enterprise Mission Assurance Support Service (eMASS) and DoD Application and Database Management System (DADMS), along with a thorough understanding of National Institute of Standards and Technology (NIST) controls.

TASKS

· Responsible for conducting Validation and Risk Assessment (RA) activities in support of the customer (Validation Security Assessment Testing, System Risk Documentation, System Audits, Security Hardware and Software Testing).

· Responsible for creating and providing all RMF appropriate artifacts and documentation necessary to plan and execute a thorough test of systems, document the system risks and report on the identified risks as necessary

· Develop and maintain System Security Plans (SSP), Contingency Plans, Privacy Impact Assessments, Certification Reports, Accreditation Reports, POA&Ms, and other A&A documentation.

· Initiate and prepare A&A RMF packages; ensures existing A&A packages are maintained in a compliant status; verifies and validates A&A package requirements and configuration modifications are performed and tested.

· Actively work with the designated (OPTEVFOR) Information Systems Security Manager (ISSM) to provide final security assessment support and guidance.

· Required to conduct periodic auditing of RMF artifacts to ensure proper adherence to DoD instruction, Navy requirements, and the NIST Special Publication 800 series standards and industry best practices.

· Responsible for enhancing the overall quality of RMF packages for the purpose of receiving an ATO from the Navy Authorizing Official (NAO) or Authorizing Official Designated Representative (AODR).

· Required to engage with the system Information Systems Security Engineer (ISSE) and ISSE support staff throughout the RMF process.

· Responsible for validation events for all OPTEVFOR cyber OT&E infrastructure and toolset.

· Maintain thorough and current knowledge of RMF and A&A process and standards.

· Work closely with system owners, technical leads, cybersecurity staff, and other stakeholders to manage cybersecurity requirements.

· Integration and implementation of computer system security solutions.

· Execute and conduct analysis of network and system Assured Compliance Assessment Solution (ACAS) vulnerability scans (or other DoD approved tools) to validate appropriate implementation of security controls in accordance with NIST, DoD and DoN publications.

· Coordinate technical meetings, prioritize topics, and identify objectives in support of package development.

· Exercise strong customer service and excellent communication skills in a fast-paced environment.

· Adhere to guidance outlined in RMF Process Guide

DCWF KSATs

· Knowledge of cyber defense and vulnerability assessment tools, including open-source tools, and their capabilities.

· Knowledge of organization’s evaluation and validation requirements.

· Knowledge of cybersecurity principles used to manage risks related to the use, processing, storage, and transmission of information or data.

· Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins.

· Knowledge of IT security principles and methods (e.g., firewalls, demilitarized zones, encryption).

· Knowledge of current industry methods for evaluating, implementing, and disseminating IT security assessment, monitoring, detection, and remediation tools and procedures utilizing standards-based concepts.

· Knowledge of risk management processes and methods for assessing and mitigating risk.

· Skill in determining how a security system should work, including its resilience and dependability capabilities.

· Skill in discerning protection needs (i.e., security controls) of information systems and networks.

· Draft statements of preliminary or residual security risks for system operation.

· Maintain information systems assurance and accreditation materials.

· Monitor and evaluate a system’s compliance with IT security, resilience, and dependability requirements.

· Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., defense-in-depth).

· Skill in conducting vulnerability scans and recognizing vulnerabilities in information systems and networks.

· Knowledge of cryptography and cryptographic key management concepts.

· Knowledge of embedded systems.

· Knowledge of security risk assessments and authorization per RMF processes.

· Knowledge of new and emerging IT and cybersecurity technologies.

· Knowledge of structured analysis principles and methods.

· Knowledge of systems diagnostic tools and fault identification techniques.

· Knowledge of the organization’s enterprise IT goals and objectives.

· Skill in applying confidentiality, integrity, and availability principles.

· Skill in identifying measures or indicators of system performance and actions needed to improve performance.

· Conduct Privacy Impact Assessments for security controls protecting PII.

· Perform validation steps, comparing actual results with expected results to identify impact and risks.

· Plan and conduct security authorization reviews and assurance case development for system and network installations.

· Provide technical evaluations of software applications, systems, or networks, documenting security posture, capabilities, and vulnerabilities.

· Recommend new or revised security, resilience, and dependability measures based on review results.

· Review security and privacy assessment plans.

· Review authorization and assurance documents to ensure risk is within acceptable limits.

· Verify implementation of security postures as stated, document deviations, and recommend corrective actions.

· Verify currency of software application/network/system accreditation and assurance documentation.

· Develop security compliance processes and/or audits for external services (e.g., cloud service providers).

· Knowledge of core business/mission processes.

· Knowledge of PII data security standards.

· Knowledge of applicable laws and regulations relevant to security and privacy.

· Knowledge of local specialized…