Sources Sought PWS Draft_05162024.pdf

Enclosure 4a, PWS Page 1 of 93 Pages

2015/Version 9

PERFORMANCE WORK STATEMENT (PWS)

Award/Mod Effective Version Date Award

Contract Number: TBD Task Order Number: TBD Contractor Name TBD Tracking Number: TBD Follow-on to Previous Contract and Task Order Number:

GS-35F-419CA / HC102819F0653 and

HC102820D0001 / HC102822F0003

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator. See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order (TO) Title. Technical Assessment and Support Services.

3. Background. This effort will provide contractor support for Defense Information Systems Agency (DISA) Enterprise Integration and Innovation (EII) Risk Management Executive (RME) and the Office of the Chief Information Officer (IO) missions. This requirement is a continuation of tasks from previous task order HC102819F0653 and previous contract/task order HC102820D0001/HC102822F0003, which are being consolidated because of an agency re-organization.

This requirement supports DISA with Cybersecurity Assessments and Authorization (A&A), Risk Management, Information Assurance (IA) Support, and Risk Adjudication and Connection services. Fulfilling this responsibility includes developing an integrated Department of Defense (DoD)-wide protection and operational restoration capability to counter security threats to, incidents within, and attacks on DoD information technology within the DoD Information Network (DoDIN). Fulfilling this responsibility includes developing an integrated DoD-wide protection and operational restoration capability to counter security threats to, incidents within, and attacks on DoD information technology within the DoD Information Network (DoDIN). To accomplish this, DISA must advise and assist users and operators of the DoDIN. This advice and assistance includes conducting reviews of enterprises, enclaves, networks, systems, and applications; A&A support; independent evaluation based on national and DoD-level Cybersecurity/IA and Cybersecurity Service requirements; the procedures and practices as they are implemented by the combatant commands (COCOMs), including their sub-unified commands, joint task forces, component commands, and supporting organizations and agencies, to ensure their adequacy; to provide a measurement and training tool to determine the defending forces readiness; and to provide a basis for planning and programming needed improvements.

Another component is to provide IA and Cybersecurity to include assessments, compliance validations, IA training, cybersecurity policy, and Federal Information System Management Act (FISMA)/cybersecurity scorecard. As such, the mission is to assure DISA’s information systems, assets, and enclaves possess the necessary security measures to ensure their availability, protection, integrity, authentication, confidentiality, and non-repudiation to include monitoring, detection, discovery, and reaction capabilities of internal and external adversaries; and ensure a trained and effective IA workforce.

Page 2 of 93 Pages

DISA provides support to DoD component sponsors/mission owners through the pre-screening, assessment, validation, authorization, and continuous monitoring of Cloud Service Offerings (CSOs). DISA ensures that the Cloud Service Provider (CSP) and CSO meet the DoD Cloud security requirements outlined in the DoD Cloud Computing Security Requirements Guide for a DoD Provisional Authorization (PA). DISA also serves as technical reviewers on the Federal Risk and Authorization Management Program (FedRAMP). DISA serves as a member of the Joint Authorization Board (JAB) which allows for CSPs to obtain cloud authorizations through an agency or through the JAB. Members of the JAB consist of DoD, Department of Homeland Security (DHS) and General Services Administration (GSA).

Ports, Protocols, and Service Management (PPSM), Defense Security/Cybersecurity Authorization Working Group (DSAWG), and the Connection Approval Office (CAO) perform risk management functions through enforcement actions that govern the use, configuration, and management of applications, protocols, and services, along with their associated ports; Risk Management Framework (RMF) compliance verification through the common Defense Information Systems Network (DISN) connection approval process, Cross Domain risk analyses, enclave scanning analysis, and development/acceptance of risk mitigation strategies with United States (U.S.) Cyber Command (USCYBERCOM), the DoD Community, the principal accrediting authorities, and the Intelligence Community (IC).

Configuration management functions support risk management/reduction capability through the maintenance of two classified and two unclassified databases that enable global configuration registration, tracking, and compliance monitoring. DISA serves as a Cross Domain Support Element (CDSE) voting member representative across the DoD Cross Domain Governance Boards (Cross Domain Technical Advisory Board (CDTAB), DSAWG, and Information Security Risk Management Committee (ISRMC)), where it provides Cross Domain risk analysis, ensures and reports on Cross Domain system compliance and provides Cross Domain subject matter expertise.

Serving in this capacity, the CDSE is also responsible for processing DISA Cross Domain Enterprise Services, point-to-point and DoD Cloud Cross Domain authorizations.

DISA provides security policy, guidance, and direction to the DoD and the North Atlantic Treaty Organization (NATO). In accomplishing this mission, contractors have access to information systems that store NATO and coalition information, and representatives from DISA’s international team assesses and ensures security compatibility and interoperability among the U.S. DoD security requirements, processes, and products with the member nations and organizations of the NATO, the Partnership for Peace initiative, and coalition-based initiatives.

This assistance ensures a consistent and compliant path leading to the certification and accreditation of computers, systems, and networks, by providing and developing information system security strategies, design, security guidance, and measures that validate and enforce that minimum security requirements and standards of the DoD and international bodies, i.e., NATO, have been met.

4. Objectives: Provide technical support for EII organizations to identify, assess, and prioritize computing risks to the enterprise, establish strategies to address risk, assure and secure the Agency’s systems, networks, programs, and data in the face of internal and external threats while appropriately balancing risk opportunity and cost.

The overarching objectives of this TO are to:

• Ensure a consistent and compliant path leading to the authorization of computers, systems, and networks by providing and developing information system cyber security strategies, design and evaluation guidance, and measures that validate and ensure that the security requirements and standards of this common body have been met.

• Assure DISA’s information infrastructure and DoD’s cloud information infrastructure are properly configured, protected, and monitored against vulnerabilities or threats.

• Protect, defend, and secure DISA’s information infrastructure to ensure data assets and information are visible, accessible, understandable, and trusted by all authorized users even in the face of a cyberattack. To reduce risk to the Defense Information Systems Network (DISN) by providing enhanced IA and security through balanced risk management.

The contractor shall comply with and adhere to the following appropriate national, federal, DoD, DISA, and other approved architectures, policies, programs, standards, and guidelines as outlined in the following directives:

(1) Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, “Cyber Incident Handling Program”

(2) CJCSM 6510.02, “Information Assurance Vulnerability Management (IAVM) Program”

Page 3 of 93 Pages

(3) CJCSM 6510.03, “DoD Cyber Red Team Certification and Accreditation”

(4) DoD Security Requirements Guide, “DoD Cloud Computing Security Requirements Guide”

(5) DoD 8140.01-M, “Information Assurance Workforce Improvement Program”

(6) DoD Directive (DoDD) 8500.01, “Cybersecurity”

(7) DoDD 8000.01, “Management of Department of Defense Information Enterprise”

(8) DoDD 8500.01E, “Information Assurance”

(9) DoD Instruction (DoDI) 8510.01, “Risk Management Framework (RMF) for DoD Information Technology

(IT)”

(10) DoD O-8530.1-M, “DoD Computer Network Defense (CND) Service Provider Certification and

Accreditation Program”

(11) DoD 5220.22-M, “National Industrial Security Program Operating Manual” (NISPOM)

(12) Institute of Electrical and Electronics Engineers (IEEE) 802.11, Wireless Standards ISs Security

Requirement, including (but are not limited to) Information Assurance Vulnerability Alerts (IAVAs), IAVMs, vendor security patches, Security Technical Implementation Guides (STIGs), and Communication Task Orders (CTOs)

(13) Joint DoD Intelligence Information System (DoDIIS)/Cryptologic Sensitive Compartmented Information (SCI) Information Systems Security Standards (ISSS)

(14) NIST Special Publication (SP) 800-14, “Generally Accepted Principles and Practices for Securing Information Technology (IT) Systems”

(15) NIST SP 800-37, “Guide for Applying the RMF to Federal Information Systems”

(16) NIST SP 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations”

(17) Office of Management and Budget (OMB) Circular A-130, Appendix III, “Security and Federal Automated

Information Resources”

(18) Security Readiness Review (SRR) Scripts

(19) STIGs

(20) Strategic Command Directive (SD) 527-1, “DoD Information Operations Condition (INFOCON) System

Procedures”

(21) Subchapter III of Chapter 35 of Title 44, United States Code (also known as the “Federal Information

Security Modernization Act of 2014”)

(22) Committee on National Security Systems Instruction (CNSSI) No. 1253, “Security Categorization and

Control Selection for National Security Systems”

(23) CNSSI No. 4009, “Committee on National Security Systems (CNSS) Glossary”

(24) RMF Knowledge Service

5. Scope. This TO will provide contractor support for the EII technical support organization and missions. The EII performs a wide variety of technical support services and functions, which are required to meet the mission. The contractor shall provide technical support for DISA, and DoD mission partners (MPs) to include the COCOM Services, DoD Agencies, and other Federal Government organizations to enhance overall DoDIN and cloud readiness and security. In addition, this TO delineates contractor support in assuring that U.S., DoD, and the intelligence sharing capabilities with the NATO and coalition information systems and technology are secure and meet applicable A&A requirements. Contractor support shall provide technical security expertise in planning, preparing, oversight, and executing DISA’s risk management/cybersecurity programs to ensure DISA’s information infrastructure and systems are compliant with all mandated DoD, NIST, OMB, Chairman of the Joint Chiefs of Staff, DoD Chief Information Officer (CIO) Cybersecurity Scorecard, U.S. Strategic Command (USSTRATCOM), USCYBERCOM, CNSSI and DISA Operational orders, directives, instructions, standards, and requirements. The contractor shall apply these mandates, regulations, and directives and analyze DISA’s information infrastructure or systems to determine and mitigate any security discrepancies, risks, vulnerabilities, or non-compliance.

The scope and key components of this mission is IA and cybersecurity, to include:

• Assessments and compliance validations of DISA, DoD MPs, and other supported entities.

• A&A/Security Control Assessor-Representative (SCA-R) Services.

• Cybersecurity policy and FISMA/cybersecurity scorecard.

• Development, execution, and oversight of DISA’s IA and cybersecurity functions as directed by the DISA

Authorization Official (AO).

Page 4 of 93 Pages

• Assure DISA’s information systems, assets, and enclaves possess the necessary security measures to ensure their availability, protection, integrity, authentication, confidentiality, and non-repudiation.

• Monitoring, detection, discovery, and reaction capabilities of internal and external adversaries.

• Ensure a trained and effective IA workforce.

• Cybersecurity assessors, audits, and inspections of cybersecurity operations and readiness for the DoD at

COCOMs, sub-unified commands, joint task forces, component commands, and supporting organizations, agencies, DISA, federal partners, cleared defense contractor sites, and other organizations which process DoD information or connect to the DoDIN.

• Through the assessments and inspections, evaluate systems and Defensive Cyberspace Operations (DCO) using cyber threat emulation tactics and performance-based testing and assessment methodologies.

• PPSM Services.

• Information System Security Officer (ISSO) / Information System Security Manager (ISSM) Services.

• Cyber Program Management Office (CPMO) Services.

• Continuous Monitoring (ConMon) Services.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 40% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

ENCORE III Performance Areas

• Performance Area 7 - Information and Knowledge Management

• Performance Area 13 – Cyber Security Assessment, Authorization, and Implementation

• Performance Area 18 – IT Support Services

6. Performance Requirements.

6.1 Task 1 – TO Level Management.

6.1.1 Subtask 1 – TO Administration. The contractor shall manage and perform all the activities related to this TO. The contractor shall provide the technical and functional activities needed for the program management of this PWS. The contractor shall establish processes and assign appropriate resources to effectively administer the requirement. The contractor shall respond to Government requests for contractual actions as identified in the PWS.

The contractor shall have a Program Manager (PM) as the single point of contact (POC) to the COR. The contractor shall complete productivity and management processes such as quality assurance, progress/status reporting, and program reviews. The contractor shall provide the centralized administrative, clerical, and documentation preparation in support of the tasks in this contract. The contractor shall provide and manage the resources needed to execute the tasks and produce the deliverables of this PWS. The contractor shall be responsible for providing, managing, and overseeing its personnel in the performance of the requirements of the PWS.

The contractor shall perform clerical duties including IA certification documentation, Visit Access Requests, Synchronized Pre-deployment & Operational Tracker Packages, Invitational Travel Orders, Assessor Certification Program (ACP) Applications/Waivers, in accordance with (IAW) the ACP Concept of Operations (CONOPS), and Process Guide tracking. The contractor shall maintain active accounts to the tools and systems required to perform risk assessments.

The contractor shall be responsible for providing the Government accurate and timely status regarding the tasks and the performance on this PWS.

6.1.1.1 Subcontract Management. The contractor shall be responsible for any subcontract management to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement. The prime contractor shall ensure there are no Organizational Conflict of Interest

Page 5 of 93 Pages

(OCI) considerations. Contractors shall add subcontractors to their team after notification to and approval from the Contracting Officer (KO) and the COR.

6.1.2 Subtask 2 – Kickoff Meeting and Technical Interchange Meeting (TIM). The contractor shall attend a Government hosted kickoff meeting within 30 calendar days prior to the start of contract performance, but no later than (NLT) three (3) business days before the start of contract performance. The kickoff meeting will be held for Government division level management introductions and preliminary COR on-boarding procedures. The contractor shall host a TIM NLT 15 business days after the contract performance start date to ensure a common understanding between the contractor and the Government PMs on the contract requirements. During the TIM, the contractor shall describe the technical approach, the organizational resources, and management controls that will be utilized to meet the performance objectives, provide appropriate IA certification documentation, and schedule requirements through the contract period of performance (PoP). The TIM will also provide a venue for the Contractor to ask any clarifying questions about the work required.

PWS

Task#

Deliverable Title Format Due Date Distribution/ Copies

Frequency and Remarks

6.1.2 Kick-Off Meeting PowerPoint

slides; DoD365 Microsoft (MS) Teams meeting

Within 30 calendar days prior to the start of contract performance but NLT 3 business days before the start of contract performance

Standard Distribution*

Once at start of base year

6.1.2 TIM PowerPoint

slides; DoD365 MS Teams meeting

NLT 15 business days after the contract performance start date

Standard Distribution*

Once at the start of base year

6.1.2 Kick-off and TIM

meeting notes and action items

Contractor-defined format

NLT 5 business days after the meetings

Standard Distribution*

Once for each meeting

*Standard Distribution is the deliverable being uploaded into a Government-provided SharePoint list; Instructions and training on the use of this deliverable’s portal will be provided upon contract award.

6.1.3 Subtask 3 – TO Management, Transition Strategy, and Transition Plan. The contractor shall prepare a TO Management Plan describing the technical approach, organizational resources, and management controls to be employed to meet the performance and schedule requirements throughout TO execution.

Deliverable Title Format Due Date Distribution/ Copies

Frequency and Remarks

6.1.3 TO Management

Plan

Contractor determined format

20 business days after TO start date and 20 business days after the PoP start date on each option year

Standard Distribution*

Once at the start of base and each option year

*Standard Distribution is the deliverable being uploaded into a Government-provided SharePoint list; Instructions and

6.1.3.1 Transition-In (Phase-In). The transition-in period shall begin with the execution of the TO and continue for up to 140 calendar days. The contractor shall submit a transition-in plan, which contains a reasonable, realistic approach for assuming full contractual responsibility without disruption or degradation of performance during the start-up period. At a minimum, the transition-in plan shall be inclusive of the transition of the documentation, operating procedures, and other resources, including devices, equipment, software, and systems under DISA’s responsibility as related to this PWS from the incumbent contractor or the Government. The plan shall also address knowledge transfer, shadowing, training program for contractor personnel, and a date for accepting responsibilities for each division of work requirements in the PWS. The contractor shall execute its transition plan and work closely with the incumbent contractor and the Government to assure uninterrupted TO support. Transition-in activities shall

Page 6 of 93 Pages also include contractor attendance at program reviews, participation in working groups, briefings, on-site communications, and full disclosure of technical, cost, and programmatic information.

The contractor shall ensure all key personnel start performance on the first day of the TO PoP. Fifty (50) percent total staffing must be complete within two weeks of the start of the PoP and 100 percent within 30 days. Key personnel (paragraph 6.1.6) shall meet all qualifications, requirements, and be available for TO performance on the first day of the TO PoP.

The contractor shall work professionally with the outgoing contractor to achieve a successful and timely transition.

The contractor shall transition all services without interruption or degradation of service levels. The contractor shall verify system and facility access with the Government.

Deliverable Title Format Due Date Distribution/ Copies

Frequency and Remarks

6.1.3.1 Draft and Final

Transition-In Plan

Contractor determined format

Draft with quote; Final within three business days of award

Standard Distribution*

Draft – once Final – once

*Standard Distribution is the deliverable being uploaded into a Government-provided SharePoint list; Instructions and

6.1.3.2 Transition-Out. The contractor shall develop and deliver to the Government a final transition-out plan NLT 90 calendar days prior to PoP end date allowing up to 30 calendar days for an orderly transition to any potential new contractor to ensure that the level and quality of services are maintained. At a minimum, the transition-out plan shall be inclusive of the transition of the documentation, operating procedures, and other resources, including devices, equipment, software, and systems under DISA’s responsibility as related to this PWS to any incoming contractor or the Government. This plan shall also include a training program to be conducted with the incoming contractor, and a date for transferring responsibilities for each division of work described in the plan.

The contractor shall execute its transition plan and work closely with the follow-on contractor and the Government to assure uninterrupted TO support. Transition-out activities shall also include contractor attendance at program reviews, participation in working groups, briefings, on-site communications, and full disclosure of technical, cost, and programmatic information.

The outgoing contractor shall be fully responsible for performance during the 30 calendar day transition-in period and be shadowed by the incoming contractor. On the final day of the task order, full responsibility shall be transitioned to the incoming contractor.

6.1.4 Subtask 4 – Monthly Status Report (MSR) and Monthly Contractor Personnel Report. On the 15th calendar day of each month, the contractor shall provide a written MSR which covers the following from the previous month (first day of the previous calendar month through the last day of the previous calendar month):

• Meetings held and major outcomes of each.

• Assessments/trips completed.

• Major accomplishments of each task and subtask.

• Any deliverable required to be reported in the MSR.

• Government Furnished Property accountability/inventory.

The contractor shall also provide a Monthly Contractor Personnel Report, which shall identify all personnel on the contract. This report shall include contractor personnel names, onboarding date, offboarding date, Common Access Card expiration date, task(s) supported, 8140 qualification and certification status (with expiration dates), Government Furnished Property (GFP) assigned (including serial numbers and warranty expiration dates), Non- Disclosure Agreement (NDA) status, and ACP certification status.

Page 7 of 93 Pages

Deliverable Title Format Due Date Distribution/Cop ies

Frequency and Remarks

6.1.4 MSR Contractor-

Determined, Government-approved format

15th of each month, covering the full prior month

Standard Distribution*

Monthly

6.1.4 Monthly

Contractor Personnel Report

Government specified format

3rd calendar day of each month, covering the prior month

Standard Distribution*

Monthly

*Standard Distribution is the deliverable being uploaded into a Government-provided SharePoint list; Instructions and

6.1.5 Subtask 5 – Quarterly Progress Reviews (QPRs). The contractor shall conduct a formal quarterly progress review (QPR) within 90 calendar days of TO PoP start date and quarterly thereafter. QPRs shall be attended by the contractor’s TO PM, as well as the technical task leaders and appropriate members of the technical team. Other attendees will include the appointed Government COR and Government PMs and leaders. The QPR shall take place either in person or via teleconference or a combination of both. The purpose of these meetings shall be to discuss progress, request assistance, and deal with issues raised during the execution of the task. The contractor shall provide a read ahead copy of QPR briefing to be provided not less than five business days prior to the briefing.

The contractor shall include the following in the QPR:

• Accomplishments, milestone achievements, and outstanding issues during the QPR PoP

• Deliverables provided during the 90-day period of the QPR

• TO financials and invoice history

The contractor shall document the discussion and any outstanding action items identified during the QPR in QPR meeting notes.

Deliverable Title Format Due Date Distribution/ Copies

Frequency and Remarks

6.1.5 QPR briefing read

ahead slides

Government specified format

NLT five business days prior to the QPR briefing

Standard Distribution*

Quarterly

6.1.5 QPR briefing and

briefing slides

Government specified format

Once each quarter based on a mutually agreed date/time

Standard Distribution*

Quarterly

6.1.5 QPR meeting

minute notes

Government specified format

Five business days after each QPR

Standard Distribution*

Quarterly

*Standard Distribution is the deliverable being uploaded into a Government-provided SharePoint list; Instructions and

6.1.6 Subtask 6 – Key Personnel. The contractor shall provide qualified key and non-key personnel to satisfy all requirements specified in this PWS.

The Government identifies the positions detailed in the table below as primary key personnel. Primary Key personnel onboarded to a position/task area shall work in the designated task area. All primary key personnel shall meet the minimum qualifications IAW the designated task area at the time of onboarding to the contract/task order.

The COR will review resumes to ensure compliance with the requirements identified below for each position and provide their recommendation to the Contracting Officer (KO), IAW Additional DITCO Text H3, Key Personnel.

Task Number Position Title Role/Qualifications

6.1 Task Order Management Program Manager Education Requirement:

Page 8 of 93 Pages

-Bachelor’s degree in IT-related field (required) -Master’s degree in IT-related field (preferred)

Years of Experience:

-10 or more years IT program management experience -5 or more years IT program management experience in DoD environment (preferred)

Certification Requirements:

-Project Management Professional (PMP) certification.

-Information Technology Infrastructure Library (ITIL) Foundations certification.

-DoD 8570 Information Assurance Management (IAM) Level II certification.

This will change to a DoD 8140 equivalent once a DISA 8140 policy is released.

Clearance Requirements:

Top Secret, SCI eligible

Experience Requirements:

-Demonstrates advanced knowledge in planning, directing, and managing projects/operations in an organization similar in size to this acquisition.

-Demonstrates experience with researching and fielding new and innovative technologies.

-Demonstrates experience in procurement of IT hardware and software.

-Demonstrates experience in task order management and leadership, including performance management of employees, training, completing required reports.

-Demonstrates excellent communication, analytical, project management, and supervisory skills.

-Demonstrates experience in formulating and enforcing work standards, assigning contractor schedules, reviewing work discrepancies, supervising contractor personnel, and communication policies, purposes, and goals of the organization to subordinates.

6.2 Cybersecurity/ Cyber

Assessments

Compliance and Projects Lead

Education Requirement:

-N/A

Years of Experience:

-7 or more years’ relevant experience

Certification Requirements:

-DoD 8570 IAM/Information Assurance Technical (IAT) Level II certification. This

Page 9 of 93 Pages will change to a DoD 8140 equivalent once a DISA 8140 policy is released.

Clearance Requirements:

-Secret

Experience Requirements:

-Determines enterprise IA and security standards.

-Develops and implements IA/security standards and procedures.

-Coordinates, develops, and evaluates security programs for an organization.

-Recommends IA/security solutions to support customers’ requirements.

-Identifies, reports, and resolves security violations.

-Establishes and satisfies IA and security requirements based upon the analysis of user, policy, regulatory, and resource demands.

-Supports customers at the highest levels in the development and implementation of doctrine and policies.

Scheduler and Assessments Lead

Education Requirement:

Bachelor’s degree (IT-related field preferred)

Years of Experience:

- 10 or more years IT program/project management experience leading audits and inspections

- 5 or more years IT program management experience leading audits and inspections in DoD/Federal environment (preferred)

Certification Requirements:

DoD 8570 IAM/IAT Level III certification.

This will change to a DoD 8140 equivalent once a DISA 8140 policy is released.

Clearance Requirements:

Top Secret, SCI eligible

Experience Requirements:

-Demonstrates successful track record for delivering large/complex projects on time and within budget -Demonstrates expert level experience with the planning, coordinating, scheduling, resourcing, tracking, documenting, executing, and analyzing audits and inspections within an organization.

-Demonstrates experience with applying compliance standards to large and complex IT environments.

-Demonstrates ability to evaluate the design and effectiveness of controls and standards to

Page 10 of 93 Pages ensure compliancy IAW the applicable audits and inspections for an organization.

-Demonstrates expert level understanding of vulnerabilities/weaknesses across complex IT environments and ability to understand applicability of security standards across technologies.

-Demonstrates experience with communicating and coordinating at a functional and senior Government level.

-Demonstrates experience with data analysis and developing work products to enable Government risk-based decisions.

-Demonstrated experience with the development and execution of knowledge management best practices and the automation of knowledge management frameworks to enhance processes and procedures related to the management of a project.

–Demonstrates experience with the development and coordination of guidance and work products related to issues tracking management, plan of actions and milestones, and ensuring transparency of vulnerabilities within an organization.

6.3 SCAR/Validator Support SCA-R Team Lead

(x3) Chambersburg, Ft.

Meade, Pentagon sites.

Education Requirement:

- Bachelor's degree (IT-related field preferred)

Years of Experience:

- 12+ years in experience in Cybersecurity area

- 5 to 8 years Certification and Accreditation/A&A

- 3 to 5 years Security Control Assessor/Validator Experience

- 5 years of project management work experience

Certification Requirements:

-PMP (preferred) -DoD 8570 IAM/IAT Level III certification.

This will change to a DoD 8140 equivalent once a DISA 8140 policy is released.

Clearance Requirements:

Top Secret clearance, SCI eligible

Experience Requirements:

- Demonstrated leadership skills/Previous lead position

- Customer service skills

- Project Management skills

- Proficient with RMF process, NIST SP 800-

37, NIST SP 800-53, CNSSI 1253

6.5 ConMon/PPSM ConMon Lead and PPSM

Lead (1 each)

Education Requirement:

Bachelor’s degree (IT-related field preferred)

Page 11 of 93 Pages

Years of Experience:

- 6 or more years leading ConMon/PPSM Programs

- 5 or more years IT program management experience leading audits and inspections in DoD or Federal Government environment

Certification Requirements:

DoD 8570 IAM/IAT Level III certification.

This will change to a DoD 8140 equivalent once a DISA 8140 policy is released.

Clearance Requirements:

Top Secret, SCI eligible

Experience Requirements:

- Demonstrates successful track record for delivering large/complex projects on time and within budget within DoD Organizations

- Demonstrates experience with the planning, coordinating, scheduling, resourcing, tracking, documenting, executing and analyzing audits and inspections within an organization.

-Demonstrates experience with applying compliance standards to large and complex IT environments.

-Demonstrates ability to evaluate the design and effectiveness of controls and standards to ensure compliancy IAW the applicable audits and inspections for an organization.

-Demonstrates expert level understanding of vulnerabilities/weaknesses across complex IT environments and ability to understand applicability of security standards across technologies.

-Demonstrates experience with communicating and coordinating at a functional and senior Government level.

-Demonstrates experience with data analysis and developing work products to enable government risk-based decisions.

-Demonstrated experience with the development and execution of knowledge management best practices and the automation of knowledge management frameworks to enhance processes and procedures related to the management of a project.

–Demonstrates experience with the development and coordination of guidance and work products related to issues tracking management, plan of actions and milestones, and ensuring transparency of vulnerabilities within an organization.

Page 12 of 93 Pages

6.21 Task 21. Cloud

Cybersecurity Architecture SME Support

Cloud Cybersecurity Architecture SME

Education Requirement:

Bachelor’s degree (IT-related field preferred)

Years of Experience:

- 5 or more years of cloud architecture or cloud enterprise experience

Certification Requirements:

DoD 8570 IAM/IAT Level III certification.

This will change to a DoD 8140 equivalent once a DISA 8140 policy is released.

Clearance Requirements:

Top Secret, SCI eligible

Experience Requirements:

-Demonstrate technical knowledge and experience with cloud assessment methodologies, architectures, risks, vulnerabilities, and threats.

-Demonstrate experience in applying and evaluating the RMF to cloud-based providers and their offerings -Demonstrate knowledge of and experience with FedRAMP and DoD Information Assurance policies, NIST 800 series, CNSS 1253, CNSSP 32, and the DoD 8500 series.

-Demonstrate knowledge of and experience in the DoD Cloud Computing Security Requirements Guide (CC SRG) and FedRAMP Assessment and Authorization guidance.

-Demonstrate the ability to apply the appropriate FedRAMP and DoD-approved architectures, programs, standards, and guidelines.

-Demonstrate the ability to understand and articulate systems, applications, and services, and be able to identify system functions and relationships that support the goals and objections of the current and future Cloud efforts throughout the enterprise.

6.11.1 Policy Analysis RE4 Policy SME Education Requirement:

Bachelor’s degree in IT-related field required or above

Years of Experience:

10 or more years’ relevant experience

Certification Requirements:

DoD 8570 IAM/IAT Level III certification.

This will change to a DoD 8140 equivalent once a DISA 8140 policy is released Clearance Requirements:

Page 13 of 93 Pages

Top Secret, SCI eligible

Experience Requirements:

-Demonstrate knowledge and experience with functional area expertise in National and DoD IT policy -Demonstrate the ability to translate and articulate IA policies and capable of interpreting new requirements for connection processes.

-Demonstrate the ability to provide policy expertise to ensure RE4 SOPs, guides, and other documentation are congruent with Federal, DoD, IC, and Agency policy guidance.

-Demonstrate the ability to integrate additional DISN services, future capabilities (i.e. Enterprise Cloud Services, Risk Management Framework, etc.), and connection processes into RE4 processes and documentation.

-Demonstrate the ability to develop and update briefings, white papers, CONOPS, Contingency Operations Plans, and other documents to support RE4 mission functions

6.11.2 Cybersecurity Architecture

Analysis

Cybersecurity Architecture

SME

Education Requirement:

Bachelor’s degree in IT-related field required or above

Years of Experience:

10 or more years’ relevant experience

Certification Requirements:

DoD 8570 IAM/IAT Level III certification.

This will change to a DoD 8140 equivalent once a DISA 8140 policy is released.

Clearance Requirements:

Top Secret, SCI eligible

Experience Requirements:

-Demonstrates knowledge and experience with functional area expertise in National and DoD IT policy -Demonstrate the ability to design architecture to include the software, hardware, and communications to support the total requirements as well as provide for present and future cross-functional requirements and interfaces.

-Demonstrate the ability to identify, assess, and present options for meeting the functional and technical requirements including hardware and software updates or upgrades.

Page 14 of 93 Pages

-Demonstrate the ability to develop high level system design diagrams. Ensures these systems are compatible and in compliance with the standards for open systems architectures, the Open Systems Interconnection (OSI) and International Standards Organization (ISO) reference models, and profiles of standards - such as Institute of Electrical and Electronic Engineers (IEEE) Open Systems Environment (OSE) reference model - as they apply to the implementation and specification of Information Management (IM) solution of the application platform, across the application program interface (API), and the external environment/software application. Ensures that the common operating environment is compliant.

-Demonstrate the ability to evaluate analytically and systematically problems of work flows, organization and planning and develops appropriate corrective action.

6.12 Task 12. Connection

Approval Support

Connection Approval Lead Education Requirement:

Bachelor’s degree or higher in IT-related field required

Years of Experience:

5 or more years’ relevant experience

Certification Requirements:

DoD 8570 IAM/IAT Level III certification.

This will change to a DoD 8140 equivalent once a DISA 8140 policy is released.

Clearance Requirements:

Top Secret, SCI eligible

Experience Requirements:

-Demonstrates knowledge and experience with functional area expertise in National and DoD IT policy -Demonstrate knowledge and experience with establishing and maintaining a process for evaluating software and associated documentation -Demonstrate expert level knowledge of determining the resources required for quality control -Demonstrate the ability to maintain the level of quality throughout the software life cycle -Demonstrate the ability to conduct formal and informal reviews at pre-determined points throughout the development lifecycle -Demonstrate the ability to provide daily supervision and direction to support staff

Page 15 of 93 Pages

6.13 Task 13. DoD Ports, Protocols, and Services Management Support and Vulnerability Assessment

Ports, Protocols, and Services Management Support and Vulnerability Assessment Lead

Education Requirement:

Bachelor’s degree or higher in IT-related field required

Years of Experience:

5 or more years’ relevant experience

Certification Requirements:

DoD 8570 IAM/IAT Level III certification.

This will change to a DoD 8140 equivalent once a DISA 8140 policy is released.

Clearance Requirements:

Top Secret, SCI eligible

Experience Requirements -Demonstrates expertise in National and DoD IT policy.

-Demonstrate expert level knowledge and experience with participating in risk assessment during the Certification and Accreditation process -Demonstrate ability to design, develop, implement, and integrate information assurance architecture, system, or system component for use within data center, network, and enclave environments -Demonstrate experience with ensuring that the architecture and design of DoD information systems are functional and secure.

RE Cross Domain Solutions Lead

Leadership; knows how to lead the team.

Technical acumen. This person will be the continuity of the team. Meets with senior leaders regularly. Leadership skills.

Leadership expertise and technical expertise (architecture), strategic thinking, bigger picture, cross-domain pieces.

6.2 Task 2 – Cybersecurity/Cybersecurity Assessments. A cybersecurity assessment specifically evaluates security/cyber readiness as it relates to cybersecurity, information systems, traditional and physical controls, operational readiness, mission impact, overarching risk, and the ability of the various responsible organizations to properly protect DoD information resources and assets from attack and/or compromise. The cybersecurity assessment process consists of several components: Enclave, Network, System, Traditional/Physical, and Application authorization recommendations (new, reauthorization, and continuous authorization) as well as change requests. The contractor personnel providing support to the cybersecurity assessments are herein referred to as “assessors” in the PWS. The assessors shall follow policies and process guidelines for each assessment type as appropriate. The assessors shall support multiple facets of the assessment process to ensure that security expertise is properly represented in the development and execution of a cyber assessment. Contractor SCA-Rs will function as a team lead over assessors during an assessment.

RE5 is tasked with conducting A&A visits in support of the DISA AO as well as AOs who subscribe to RE5’s assessment services. The A&A is a comprehensive assessment and/or evaluation process of information system policies, technical/non-technical security components and controls, documentation, supplemental safeguards, policies, and vulnerabilities. The process establishes the extent to which a particular design and implementation

Page 16 of 93 Pages meet a set of specified security requirements defined by the DoD, Government guidelines, and federal mandates into a formal authorization package. RE5 supports ISSMs/PMs/ISSOs through the pre-screening, assessment, validation, and authorization process. The RE5 assessment Team ensures that the system/program being deployed onto a DoD network (on prem/or cloud environment) meets DoD information systems security requirements outlined in the DoDI 8510.01, RMF assessment policies and procedures.

COCOMs and external organizations may request A&A support and/or authorization recommendations to provide to their AO to make authorization decisions. RE5 also conducts site assistance visits (SAVs), which is an on-site assessment of compliance and validation with mandated IA, Orders, Directives, and Policies (ODPs), A&A, or other focus areas either as a standalone effort or in preparation for a scheduled inspection or evaluation. All on-site reviews for A&A and SAVs require a team lead and several technical subject matter experts (SME) as assessors.

Assessments shall be conducted remotely from the National Capital Region, Letterkenny Army Depot, Chambersburg, PA, Ft. Meade, MD, on site at CONUS, OCONUS, and locations of subscribing customers. The contractor shall assign ACP certified assessors to conduct cybersecurity assessments.

When assigning assessors to assessments, the contractor shall give consideration to keeping travel costs minimal.

RE5 employs the below definitions of travel types.

Travel Type Definition Local Travel that incurs mileage but no per diem or lodging costs. Preference will be given to filling trips with local resources prior to filling them with resources that incur lodging and per diem.

Regional Travel that typically utilizes an automobile to the temporary duty (TDY) site and incurs per diem and lodging costs. Given that assessor support may occur from many locations, preference will be given to filling trips with resources within driving distance prior to filling them with resources that incur airline costs.

CONUS Requires continental US air travel to the TDY site plus per diem and lodging costs.

OCONUS Requires travel outside the continental US air travel to the TDY site plus per diem and lodging costs.

Remote An assessment that does not require presence at a specific site other than the Home of Record.

Remote reviews of unclassified systems can potentially be conducted from contractor locations, alternate work sites, or at one of the Government places of performance (Letterkenny Army Depot, Fort Meade, the Pentagon, and the Mark Center). Remote reviews of classified systems will be conducted from one of the Government places of performance: Letterkenny Army Depot, Fort Meade, the Pentagon, and the Mark Center.

6.2.1 Subtask 1. System Assessments. This subtask incorporates authorization assessments, SAVs, and compliance validations of DISA, DoD, and other MP enclaves, systems, applications, and systems that are deployed for and throughout the DoD Enterprise including Commercial Cloud. The assessments and analysis of results are performed to provide an authorization recommendation including a statement of residual risk for the AO and Security Control Assessor (SCA). This subtask addresses assessors, who support as a technical member of the assessment team. These team members support SCA-Rs acting as the team lead.

The STIG library maintained at https://public.cyber.mil contains the majority of requirements and technologies that will be assessed during an assessment.

The contractor shall conduct: 40 SAVs and 450 A&A visits in the base year. The Government anticipates a yearly mission growth rate of 10% per year over the course of the period of performance of this task order. See Table 1 for number of SAVs and A&A Visits required to be conducted by the contractor in each year.

Table 1 https://public.cyber.mil/

Page 17 of 93 Pages

SAVs A&A Visits Base Year 40 450 Option Year 1 44 495 Option Year 2 48 545 Option Year 3 53 600 Option Year 4 58 660

6.2.1.1 Additional SAVs/A&A Visits (FFP) (OPTIONAL CLINs): The Government reserves the right to exercise optional CLINs for growth throughout the agency and assuming new customer requirements. When an increase of 25 additional trips is required, the Government will exercise these optional quantities. No more than 100 additional trips may be exercised per contract year. The optional quantities can be used for both SAV and A&A.

Assessors assigned to this task can expect to travel 85% of the time.

For each system, network, or capability, the assessors shall perform the following:

• Meet with Team Lead on logistics, test plan, and scope; perform applicable vulnerability assessments (reviews/scans); capture the results using STIG Viewer or other designated tool, enter all test results into the designated repository (Enterprise Mission Assurance Support Service (eMASS) or similar tool); and provide security vulnerability analysis of the test results to include indicating and removing non-applicable checks, addressing all not reviewed checks, recommending appropriate mitigations whenever possible, as well as providing guidance and recommendations.

• Perform security assessments to identify security gaps in architecture. Use the results to make recommendations.

• Perform security assessments and validate Cybersecurity Controls, Tactics, Techniques, and Procedures (TTP), applicable STIG/Security Requirement Guide (SRG) library, product deployment guides, RMF controls, DoD Policy, NIST Publications, USCYBERCOM directives and orders, National Security Memorandums, research on product/capability vendor guides, best practices guide, and checklists developed based on system architecture.

• Provide analysis of assessment results, and risk/residual risk information to the SCA-R for inclusion in the assessment briefing slides and authorization recommendation.

Further requirements for the assessors:

• Assessors shall be certified via the Assessor Certification Program (ACP) IAW the ACP CONOPS before conducting any assessments.

• Assessors must be certified in a minimum of two technologies and RMF Control Validation.

• The contractor shall maintain active accounts to the tools and systems required to perform risk assessments.

• During assessments, assessors are required to participate in daily hot washes, to its entirety, to review the results of the day’s assessment. These results shall be provided to the SCA-R.

• Assessors are also required to participate in the in-brief and out-brief of each assessment.

Deliverable Title Format Due Date

Distribution/Copie s

Frequency and Remarks

6.2.1 Status of

completion of assessment activities

Included in the Monthly Status Report

Monthly on the 15th

Standard Distribution*

Monthly Information to note in MSR includes:

Trip Participants, Number of Assets/Technologies reviewed, Issues/Concerns from the trip

*Standard Distribution is the deliverable being uploaded into a Government-provided SharePoint list; Instructions and training on the use of this deliverable’s portal will be provided upon contract award.

Page 18 of 93 Pages

6.2.2 Subtask 2. Assessor Introduction Training. The contractor shall develop and maintain an Assessor Introduction Training (AIT) course to cover the tools and competencies necessary to be an assessor.

The AIT is a training course that could last up to eight (8) hours and is designed to introduce newly onboarded contractor personnel to the assessment process. This training shall be delivered within a week of new contractor personnel being onboarded to the contract. The frequency of the training delivery is dependent on the contractor’s personnel turnover rate.

The contractor shall teach the AIT course to all assessors performing assessments in support of this task order, and this must be achieved prior to achieving ACP certification.

The contractor shall use…