Attachment 1 PWS .docx

SP3300-12-R-0030

Attachment 1

PERFORMANCE WORK STATEMENT (PWS)

FOR

ENCLAVE BORDER PROTECTION SUPPORT SERVICES

AT

DLA INFORMATION OPERATIONS AT NEW CUMBERLAND, PENNSLYVANIA

INTRODUCTION

The Defense Logistics Agency (DLA) is a United States (U.S.) Department of Defense (DoD) agency that provides worldwide logistics support for the missions of the Military Departments and the Unified Combatant Commands under conditions of peace and war.

DLA Information Operations at New Cumberland, PA performs Information Assurance (IA) Program Management, Local Area Network (LAN) Enclave Border Protection, and Engineering/Technical support for all of the DLA Distribution sites located globally. DLA Information Operations at New Cumberland, PA is required to provide daily IA operational and technical support, policy, and strategic planning for DLA Distribution.

DLA Information Operations at New Cumberland, PA has a requirement for a Contractor to provide onsite and remote support to LAN Enclave Boundary Defense systems and programs, which include Network Access Controls, Checkpoint Firewalls (FW), and Intrusion Detection Systems (IDS) on Solaris, IPSO, IBM, and other platforms. The Contractual support is also required for entering and maintaining network asset status using the DISA Vulnerability Management System (VMS), verifying that devices are configured in accordance with Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), Information Operations Condition (INFOCON) response planning and testing, Computer Emergency Response/Readiness Team (CERT) distribution and monitoring, and participation in DLA Information Operations wide Information Assurance Planning workgroups.

Historically, approximately 10,000 man hours per year have been required to perform support requirements.

General Conditions and Requirements A. This Section provides general information relating to the conditions of operation and general requirements relating to the Enclave Border Protection support services performed by DLA Information Operations at New Cumberland, PA.

SCOPE OF WORK

A. The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items/services (other than those designated as Government-Furnished per Section 4, Government-Furnished Property (GFP), Systems, Training and Support Services) necessary to perform Enclave Border Protection Support Services as defined in this PWS.

B. The scope of this contract is to provide comprehensive support for the operations and maintenance of the systems and programs that comprise the Enclave Boundary Defense for DLA Information Operations at New Cumberland, PA information systems. The Contractor shall provide support services to define security requirements, identify the appropriate configuration for each unique DLA environment, transfer of knowledge to Government employees, and perform tasks associated with the day-to-day operations and maintenance on installed Enclave Boundary Defense systems and applications, for DLA Distribution operation locations supported by DLA Information Operations at New Cumberland, PA. Classified material shall be handled in accordance with DoD Manual 5200.01 “DoD Information Security Program” and the DLA Information Security Handbook. Sensitive material shall be handled in accordance with applicable DoD and DLA policies that will be provided, upon request, to the Contractor.

C. This is a non-personal services contract to provide network support services. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government. The Government and the Contractor understand that the services to be provided under this contract by the Contractor are non-personal services and that no employer-employee relationship exists between the Government and the Contractor. The Government may provide technical direction which will assist the Contractor in accomplishing the PWS; however, the Government will not control the methods used by the Contractor to perform the service requirements set forth in the PWS.

D. All contract personnel attending meetings, answering Government telephones, and working in other situations where their Contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of the members of the public that they are Government officials. All Contractor employees shall wear ID badges conspicuously on his or her outer clothing above the waste at all times and shall identify themselves as Contractors while in the work place and at meetings.

General Operating Conditions This Section provides general information relating to the conditions of operation and general requirements relating to the Enclave Border Protection support services performed by DLA Information Operations at New Cumberland, PA.

Place of Performance A. Work will be accomplished primarily at DLA Information Operations at New Cumberland located on the DLA Distribution Susquehanna, Pennsylvania installation in New Cumberland, PA 17070.

B. Contractor employees may be required to travel to any site supported by DLA Information Operations at New Cumberland as deemed necessary. Historically, travel has been required between approximately 4-6 weeks per year. The Government will reimburse the Contractor for travel costs allowed under FAR Part 31.205-46, Travel Costs.

period of performance A. The period of performance for this contract action will be for a one (1) year base period with four (4) one-year option periods.

Federal Holidays Federal holidays generally observed by government personnel include:

Observed Federal Holidays

B. In the event an Executive Order issued by the President of the United States declares Agencies of the Federal Government closed for a regularly scheduled workday, the Contracting Officer (KO) or COR will determine and advise the contractor on whether services are required for that day.

Current Duty Hours and Access to the Host Installation The Contractor shall perform services required under this PWS Monday through Saturday from 0530-1830 except Federal holidays and base closures.

On-call after hours work shall be required on a rotating schedule. Historically, after hours/emergency support has been required approximately 200 hours per year. Support shall be provided via telephone, on-site, or remotely using government furnished equipment (GFE), as deemed necessary.

Due to changing traffic requirements brought on by construction, changing missions, and security concerns within the host installation, access to the host installation is subject to change, sometimes with little or no warning. Inbound and outbound traffic restrictions exist.

key personnel Team Lead. The Contractor shall designate a Team Lead, at no additional cost to the Government, who shall be on site for the duration of the Contract. In the performance of these duties, the Team Lead shall possess the basic knowledge and skills required to plan, control, manage, and shall be responsible for the successful completion of the work and shall be qualified to be the Contractor’s on-site supervisor and POC for Government representatives. The Team Lead shall be able to provide overall supervision for Contractor employees to include, but not limited to, planning and managing the project professionally, ensuring that work is scheduled properly to obtain maximum use of resources; ensuring that accurate and timely reports are provided. Has the authority to resolve problems, allocate resources, manage personnel, and monitor operation performance taking direction from the Government to ensure complete satisfaction.

The Contractor shall provide the name, telephone number (to include mobile telephone and pager, as applicable) and e-mail address of the Team Lead in writing. In the event of the replacement of the Team Lead, the Contractor shall notify the KO or COR, in writing, of such replacement. The name, telephone number (to include mobile telephone and pager, as applicable) and e-mail address of the replacement Team Lead shall be provided to the KO or COR at least 15 calendar days prior to a planned replacement and within 24 hours following an unplanned replacement.

personnel qualifications and certifications Contractor personnel must be proficient in reading and capable of communicating effectively in English.

The Contractor shall implement a continuing recruiting program such that the Contractor can respond to urgent and phased surge and mobilization requirements. Personnel assigned to or utilized by the Contractor in the performance of this contract shall, as a minimum, meet the experience, educational, or other background requirements set forth below and shall be fully capable of performing in an efficient, reliable, and professional manner. If the KO or COR questions the qualifications or competence of any person performing under the contract, the burden of proof that the person is qualified as prescribed herein shall be upon the Contractor.

The Contractor shall be responsible for obtaining all necessary licenses and certifications and for complying with all applicable Federal, State, and local laws. The Contractor shall maintain updated copies of any applicable licenses and certifications for all employees and make them available to the Government upon request.

Contractor employees that operate motor vehicles to include, but not limited to, government automobiles, light and medium trucks and MHE, shall maintain a valid state driver’s license with all class and commodity endorsements required by Public Law 99-570 and state law for the type of vehicle operated.

Enclave Border Protection Skills:

Working knowledge of Firewall 1 on an IPSO platform.

CCSA certification or any approved certification demonstrating working knowledge and understanding of industry standard network environments to include firewall and security hardware/software.

ISC2 Security Certification – Certified Information System Security Professional (CISSP) or any approved certification demonstrating working knowledge of Information Assurance Best Practices.

Knowledge of ADP/TELCOM equipment installation, removal, configuration, and operation.

Knowledge of industry standard Incident Ticket Tracking systems for inputting incident tickets and creating work orders.

Demonstrated knowledge and accomplishment in monitoring and analyzing Firewall, IDS and System logs.

In depth knowledge of Local and Wide Area Network (LAN & WAN) operations.

Knowledge of and ability to troubleshoot Microsoft Windows platform, UNIX/Solaris, and CISCO and Enterasys routers and switches.

Understanding and knowledge of Ethernet and Fiber Distributed Data Interface (FDDI) protocols.

Comprehensive knowledge of DoD and DLA security regulations, guidelines and policies, to include, but not limited to, Information Assurance (IA) standards.

Ability to formulate Security policy and manage Security configuration.

Working knowledge of Network Access Control (NAC), to include, but not limited to, user/system authentication and network security enforcement (802.1x MAC-based Authentication, Port Web Authentication, and Convergence End Point).

Working knowledge of WAN Optimization (WANOps), to include but not limited to: configuration and daily monitoring.

Working knowledge of the installation, configuration and day-to-day sustainment of network equipment, to include but not limited to: switch, router and other network appliances.

Security A. The Homeland Security Presidential Directive 12 (HSPD-12) dated 27 August 2004 has established criteria for contractors who require a Common Access Card (CAC) for either physical access to a U.S. Government controlled installation or access to government information technology (IT) systems. The Government requires Personnel Security Investigations (PSI) to establish that applicants or incumbents either employed by the Government or working for the Government under contract are suitable for the job and/or are eligible for a public trust position. These positions have been designated as IT-I and require a Secret clearance. Contractors shall be required to provide appropriate background investigation for IT-I with Secret clearance as required in accordance with DoD 5220.22-M, “National Industrial Security Program Operating Manual” (NISPOM) and DoD 5200.2-R. The appropriate background investigation for IT-I with Secret clearance is a Single Scope Background Investigation (SSBI). The contractor shall forward their employee clearance information to:

DLA Intelligence Office ATTN: Personnel Security Officer 2001 Mission Drive New Cumberland, PA 17070

B. All personnel employed by the Contractor in the performance of this contract, or any representative of the Contractor entering a U.S. Government installation, shall abide by all security regulations and policies of the installation including access badges, parking, access to controlled or restricted areas, classified information, controlled unclassified information, data and IT resources.

C. DLA reserves the right to direct the removal of an employee, whose actions, while assigned to this contract, clearly conflict with the interests of the Government, regardless of prior clearance or adjudication status. DLA also reserves the right to direct the removal of an employee for misconduct, security violations, or performance reasons. The reason for removal shall be fully documented in writing by the Contracting Officer. When and if such removal occurs, the contractor shall assign qualified personnel to any vacancy(s) thus created within 10 working days. This action does not relieve the contractor from total performance of the contract tasks specified herein.

D. Contractor shall return all government issued identification, access badges, and vehicle passes to the KO or COR upon termination of service.

E. The provisions outlined above apply to the prime contractor and any subcontractors the prime contractor may employ during the course of this contract. No contractor personnel performing sensitive duties shall be allowed to commence work on this effort until his or her trustworthiness has been favorably adjudicated.

F. Not later than 15 calendar days prior to contract full performance start date, the Contractor shall provide the KO or COR a roster of all key personnel, to include those requiring access to restricted or controlled access areas. The roster shall include each employee’s full name, Social Security number, identification card number (if assigned), branch or section (if applicable), and security clearance (level of clearance and last investigation date, if applicable). The Contractor shall provide additions to rosters and an updated roster to the KO or COR at least five working days prior to the date of required access. The Contractor shall make all modifications to the rosters and provide an update to the KO or COR within 12 hours for employees whose employment has been terminated and for employees who no longer require access to restricted or controlled access areas.

DoD Common Access Card (CAC)/Access Identification Badge (ID Badge)/Electronic Key Card Every Contractor employee shall obtain and possess a DoD Common Access Card (CAC) and an Access ID Badge as required. Upon favorable review and initiation of the PSI to establish the suitability of an employee for the job and the approval for temporary AIS access pending final adjudication of the PSI, the Contractor shall submit to the COR a request for the DoD CAC and ID Badge.

The Contractor shall safeguard CAC and ID Badges furnished to them. Contractor employees shall not share CAC and ID Badges. Each Contractor employee shall wear the ID Badge conspicuously on his or her outer clothing above the waist at all times while working on the installation. Personnel may be challenged and removed from the work area or denied access to the host installation if the ID Badge is not worn.

In the event that a Contractor employee damages or loses his or her CAC and ID Badge, the Contractor shall report the lost or damaged CAC and ID Badge within two (2) working hours of damage or loss to the COR who will arrange for a replacement CAC or ID Badge. The Government will issue the Contractor employee a temporary ID Badge to be used for an eight to ten (8-10) working day waiting period until a new permanent ID Badge is issued. The Contractor shall return all government-furnished CAC or ID Badges to the Government either within one (1) working day of the completion of the contract or upon termination of an individual’s employment, whichever comes first. Contractor personnel failing to return their Government CAC or ID Badge are subject to criminal charges under USC Title 18, Chapter 1, Section 499 and 701.

The COR will provide and maintain electronic key cards for the security access system. The electronic key card allows access to specific controlled areas of the facilities. The COR will approve and provide the electronic key cards to the Contractor for access to the facilities.

Information System Security Upon favorable review and initiation of the PSI to establish the suitability of an employee for the job and the approval for temporary AIS access pending final adjudication, but not less than fourteen (14) working days prior to the employee’s start date, the Contractor shall request Information Technology (IT) eligibility for an employee requiring access and passwords to the government-furnished data systems. All positions involving computer activities require a minimum IT II category eligibility. The Contractor shall submit a Contractor Investigative Request (CIR) and a DD Form 2875 for temporary IT II eligibility, with final IT II eligibility contingent upon receiving a favorably adjudicated background investigation.

All Contractor personnel provided with access to government-furnished computers and systems shall observe local AIS security policies and procedures as provided by the COR. The Contractor shall notify the COR within twelve hours when, for reasons of personnel resignation, reassignment, termination, or completion of portions of the contract, Contractor personnel no longer require access to government systems.

The Contractor shall observe all copyright agreements. In the interest of protecting government systems from computer viruses, the Contractor shall not use public domain software nor shall Contractor personnel download software from public bulletin boards or Internet websites. The Contractor shall use only commercial off-the-shelf (COTS), Contractor-developed, or government-furnished software in performance of the contract requirements. Should the introduction of a computer virus or malicious destruction of computer software, stored information, or hardware result from the use of public domain software or from software taken from a public bulletin board or Internet website, the Contractor shall be required to repair the damage and incur all costs at no expense to the Government and without impact on delivery schedules.

Contact of a Suspicious Nature Contractor personnel who have been contacted under suspicious circumstances shall report that contact immediately, either verbally or in writing, to their supervisor who shall report it within two (2) hours to the COR for action. Key contacts for reporting purposes are defined as:

1. Contact with an individual (regardless of nationality) that suggests to the Contractor employee that an intelligence gathering or terrorist organization may have targeted him or her for possible intelligence exploitation.

2. A request by anyone (regardless of nationality) for illegal or unauthorized access to classified or unclassified sensitive information.

3. Contact with a known or suspected intelligence officer from any country.

4. Contact with a foreign diplomatic establishment, whether in the U.S. or abroad, for personal or official reasons. Certain Contractor personnel in positions designated as “sensitive” by the Government may also be required to inform their chain of command in advance of the nature and reason for contacting a foreign diplomatic establishment or travel to countries on the State Department list whose interests may be adverse to the United States.

Additionally, Contractor personnel who have information about activities pertaining to espionage, terrorism, unauthorized technology transfer, sabotage, sedition, subversion, spying, treason, unauthorized release of classified or unclassified controlled information, or unauthorized intrusions into automated information systems shall report that information immediately to the COR for action.

Safeguarding Information The Contractor shall not allow access or disclosure of classified information or information regarding the operations of DLA Distribution to any government agency, non-government agency, or individual unless specifically authorized by the COR. The Contractor shall provide documents and files requested by such parties to the COR within one hour of receipt of the authorized request. All files are the property of the Government and the Contractor shall turn all files over to the COR at the completion or termination of this contract.

The Contractor may be required to access data and information that is proprietary to a government agency or contractor or that is of such nature that its dissemination and use other than as specified in this contract would be adverse to the interests of the Government or others. The Contractor and its personnel shall not divulge or release data or information developed or obtained under performance of this contract except to government personnel who are authorized to receive the information or upon written approval of the COR. The Contractor shall not use, disclose, or reproduce proprietary data that bears a restrictive legend other than as specified in this contract.

Disclosure of information regarding operations and services of DLA Distribution to persons not entitled to receive it, or failure to safeguard any classified information that may come into the Contractor’s control in connection with work under this contract, may subject the Contractor, its agent, or its employees to criminal liability under USC Title 18, Crimes and Criminal Procedure, Part I, Crimes, Chapter 37, Espionage and Censorship, Sections 793, Gathering, Transmitting or Losing Defense Information, and Section 798, Disclosure of Classified Information. Neither the Contractor nor its employees shall disclose or cause to be disseminated any information concerning the operations of the activity which could result in, or increase the likelihood of, the possibility of a breach of the Distribution Center’s security or interrupt the continuity of the Center’s operation.

Potential Operational Constraints Force Protection Conditions (FPCONs) may affect access to the host installations and Distribution Centers. The FPCON is established by the host installation or higher national command authorities, and the Installation Commander is responsible for implementing the proper response to progressive levels of terrorist threats. FPCONs are normally displayed at most entrance gates, building entrances and office entrances. The Contractor shall adhere to and operate IAW any restrictions imposed as a result of a FPCON. Measures implemented under the various levels of terrorist threat may impact the Contractor’s normal operational approach to distribution services. The Contractor shall ensure that distribution services are sustained during heightened security measures.

Environmental, safety, and occupational health (esoh) The Contractor shall formulate and maintain a written safety and health plan and make available to the Government upon request. The written plan shall include the details of the Contractor’s responsibilities, method of program implementation, and how hazards and deficiencies shall be identified and corrected. It shall detail Contractor personnel responsibilities for: protection of Government property and safety of others, personnel responsibilities for reporting all mishaps, and establish procedures for reporting to correcting unsafe conditions, hazards, or practices. The Contractor shall have a central POC for safety and health related issues. The POC shall be identified in writing to the KO or COR.

The Contractor shall ensure employees have safety education when engaged in activities involving Government facilities, personnel, or equipment.

The Contractor shall notify the KO or COR immediately after the occurrence of all accidents and incidents resulting in either personal injury, loss of life, impact to the environment or property damage to a government facility or equipment. The Contractor shall submit a completed copy of DLA Form 1591 and supplemental information within four (4) working days of the accident or incidents.

The Contractor shall require their personnel to wear personal protection equipment (PPE) (i.e. safety shoes or safety boots, hearing protection, eye protection, gloves, safety harnesses) during the performance of this contract in accordance with OSHA standards. The Government will not be responsible for furnishing or paying for the cost of PPE.

The Contractor shall comply with all federal, state, and local environmental laws to include but not limited to Resource Conservation and Recovery Act (RCRA), Safe Water Drinking Act (SWDA), the Clean Air Act (CAA), and Federal Facilities Compliance Act (FFCA).

PHASE-IN PERIOD

The phase-in period shall begin at time of contract award and shall not exceed one (1) month, at which time full performance shall commence.

Within five (5) calendar days from the date of contract award, the Contractor shall complete all required hiring actions for the Team Lead. Within 20 calendar days of the date of contract award, the Contractor shall complete all hiring actions for personnel required to perform the requirements of the Contract and complete any associated training and certification requirements. The Contractor shall ensure that all new employees are trained and ready to begin working on the first day of full performance.

Preparedness Exercises As directed by the KO or COR, the Contractor shall participate in preparedness exercises relating to security disaster preparedness and response, wartime response, and emergency and environmental and similar preparedness exercises.

The Contractor shall participate in emergency and recall notification and personnel accountability exercises. The Contractor shall establish emergency notification and recall and personnel accountability procedures in accordance with DoDI 3001.02, Personnel Accountability in Conjunction with Natural or Manmade Disasters, and test those procedures twice a year when directed by the KO or COR. During the exercise, the Contractor shall determine the status and whereabouts of assigned personnel, report the status of each Contractor employee to the KO or COR within established timelines, and continue to report periodic status until further direction by the KO or COR. The Contractor shall follow their personnel accountability procedures in the event of a real emergency as directed by the KO or COR.

2.9 Certification and Acceptance

A. The KO or COR is designated as the point of final inspection and acceptance by the Government of all items and services required by the contract.

Definitions and Acronyms DoD Dictionary The DoD Dictionary of definitions and terms is available on the Internet at: http://www.dtic.mil/doctrine/dod_dictionary/.

Government-Furnished Property (GFP), systems, training and support Services General Information The Government will provide access to resources and information to include Government transactional data systems required in the performance of this PWS.

The Government will furnish on-site training for Contractor personnel on the Government data systems to be used in performance of this PWS.

The Government will provide on-site office space with furniture, to include, but not limited to, desktop computer and network printer, office supplies and desk telephone. Office space will be provided in Building 54 at the DLA Distribution Susquehanna, Pennsylvania installation.

At no cost to the Contractor, the Government will furnish the services to be used exclusively to perform the requirements of this contract that include custodial services, refuse and recycling collection, government forms, emergency medical services, police and fire protection, telephone and utilities.

The Government will provide all materials; equipment or supplies (i.e. lift equipment, tools and parts) that contractor personnel will need to perform this requirement at DLA Information Operations at New Cumberland, PA.

Contractor RESPONSIBILITY FOR GOVERNMENT FURNISHED EQUIPMENT and training Contractor-Furnished Training The Contractor shall provide training (not designated as Government furnished) which may be required for Contractor personnel to comply with the contract requirements. The Contractor shall be responsible for all costs associated with this training. The Contractor shall maintain copies of training records, designation letters and certificates on site and make them available for the KO or COR to review upon request. The training records shall include, at a minimum, the name of the employee, the name of the course, the source of the training, a description of the training provided and the date the employee successfully completed the training. The Contractor shall furnish the following training:

INFORMATION ASSURANCE (IA) & COMPUTING ENVIRONMENT (CE) TRAINING. Contractor personnel performing tasks associated with this PWS that will be performing an IA function shall be trained and certified in accordance with DoD Directive 8570.1 and DoD 8570.1M. IA functions are defined in chapters 3 and 4 of the DoD 8570.1M. Contractor personnel shall be certified at the appropriate IAT Level in accordance with their designated function (labor category) as demonstrated by possessing one (1) of the authorized certifications listed in table AP3.T2 in DoD 8570.1M (see Attachments 5.1, IA Certifications and 5.2, CE Matrix). The Contractor shall identify personnel performing IA functions identified in the PWS prior to that employee commencing any work under this PWS and provide documentation to the KO or COR showing the employee’s certification(s) and certification status. The Contractor shall demonstrate that they have a process to track certification status of employees to ensure certifications are current or to replace departing employees with employees possessing current certifications in a manner that will not cause program interruption. Contractor personnel shall be required to sign the User Access Agreement, Privileged Rules of Behavior, and General Rules of Behavior and non Discloser agreement prior to working on any government system(s).

EQUIPMENT OPERATION. This training is required for all Contractor employees who operate motor vehicles, MHE, other equipment with the required licensing, certification, or specialized training. Training includes but is not limited to the requirements identified in CFR Title 29, Part 1910.178; CFR Title 49; American Society of Mechanical Engineers (ASME) B30.13-1996, Storage/Retrieval (S/R) Machines and Associated Equipment; and DLAI 4500.36, Management, Acquisition, and Use of DLA Operating Equipment, Sections E3m and E3n; and Federal, State and Local Laws. Refresher training is required at a minimum of every three years or when warranted in accordance with OSHA, DoD, and manufacturer’s guidance.

SECURITY TRAINING. To ensure that all employees know and understand regulations and policy pertaining to physical, information, operations and personnel security, the contractor shall provide security and antiterrorism training to all employees in accordance with applicable DOD regulatory requirements and as deemed appropriate by the COR. At a minimum, security training requirements as required by DLA Issuances and other applicable DOD guidance will be completed annually for; Antiterrorism/Force Protection (AT/FP), Operations Security (OPSEC), Counterintelligence, and Information Security (INFOSEC) and Combating Trafficking in Persons (CTIP).

Specific Tasks ENCLAVE BORDER PROTECTION support requirements The Contractor shall:

1. Plan and deploy Enclave Boundary Defense systems and programs including FW, IDS, and Network Access Control (NAC) devices and applications to all DLA Distribution activities.

2. Provide daily maintenance and support for all DLA Information Operations Enclave Boundary Defense systems including monitoring system and log files.

3. Review and resolve automated firewall log issues as to threats or possible compromises.

4. Plan and deploy De-Militarized Zones (DMZs) for each DLA Information Operations Firewall as required.

5. Provide assistance to DLA Information Operations personnel in maintaining the FW rule sets and provide advice on impact of requested changes to the FW rules on the network and compliance with applicable DoD, DLA and DLA Distribution policy.

6. Assist the DLA Information Operations, New Cumberland Network Services Branch Chief with the coordination of FW, NAC, Virtual Private Network (VPN), and WANOps requirements with other DLA, DoD, and private sector activities.

7. Scan the DLA Information Operations networks in support of the DoD Information Assurance Certification and Accreditation Process (DIACAP) and vulnerability assessment as required.

8. Participate in the development, testing, and implementation of an effective Incident Response (IR) plan.

9. Verify devices are configured in accordance with DISA Security Technical Implementation Guides (STIGs).

10. Enter and maintain network asset status using the DISA Vulnerability Management System (VMS).

11. Respond to incidents as directed in the IR plans and provides investigative and forensic assistance as required.

12. Participate in the development, implementation, and deployment of INFOCON plans, guidance, and test plans.

13. Participate in the development, implementation and maintenance of a secure and effective means of remote access for DLA/DLA Distribution employees who are working offsite.

14. Participate in the DLA Information Operations management meetings as required.

15. Maintain all current applicable firewall, Network Access Control, and WANOps appliance policies to include DoD, DISA, DLA, DLA Distribution, etc.

16. Respond appropriately to reported or identified incidents in accordance with the DLA Information Operations Incident response plan.

17. Review and update the Enclave Boundary and CERT database areas of the CIAK (Comprehensive Information Assurance Knowledge base), located at https://mcdid.hq.dla.mil, at a weekly minimum.

18. Research and provide quotes and documents necessary to renew licenses and equipment maintenance for firewall.

19. Notify appropriate DLA Information Operations personnel of possible threats or systems vulnerabilities.

20. Develop and deliver briefings to the upper level management as required on a variety of subjects relating to Enclave Boundary Defense.

21. Provide knowledge transfer of configuration and maintenance of firewalls, IDS, VPN, NAC appliances, WANOps appliances and their related activities to government employees.

22. Provide documentation, planning, implementation and lifecycle maintenance for NAC.

23. Provide port level modification on a daily basis for every device within the Enclave.

24. Ensure implementation of NAC principles, security best practices as well as lessons learned at an enterprise level.

25. Provide documentation, planning, implementation and lifecycle maintenance for WANOps.

Property Accountability The Contractor shall maintain care of all Government-furnished property. At all times during the performance of the contract requirements, title to government-furnished property shall remain vested with the Government. In exercising care and custody, the Contractor shall safeguard all Government-furnished property.

The Contractor shall provide the proper protection for material under their custody and control. If there is a loss the Contractor shall immediately notify the KO or COR.

6.2.1 Liability for Government Property

The Contractor shall be held financially liable for loss, damage, or destruction of government property caused by negligence, willful misconduct or unauthorized use. The KO or COR will make the pecuniary liability determination when a Contractor’s negligence results in loss, damage, or destruction of Government property.

The Contractor shall:

Notify the KO or COR immediately when it discovers the gain, loss, damage or destruction of government equipment or property.

Conduct an initial search and/or informal investigation into the loss or damage of equipment or property and forward all research data to the KO or COR.

Cooperate in any subsequent investigations.

6.2.2 Indemnification and Limitation of Liability

The Contractor shall indemnify the Government and hold it harmless against claims for injury to persons or damage to property of the Contractor or others arising from the Contractor’s possession or use of the government facilities, from its activities, or from its use, care and custody of government equipment and supplies relating to the performance of this contract.

When the KO or COR determines that any loss, damage or destruction of government property is caused by the Contractor’s negligence, willful misconduct or unauthorized use, the KO or COR may off-set payments under the contract by the determined value of the loss, damage or destruction. The Contractor’s liability per occurrence shall be limited to $50,000 with a total limit of liability of $1,000,000 per year. This limit of liability does not apply to the Government’s right to indemnification.

Recordkeeping A. The Contractor shall utilize the designated Time and Project Tracking System to input consolidated time spent on each assigned task using predetermined codes that will be provided within the tracking system.

B. The Contractor shall utilize the designated Incident Ticket Tracking System to identify, schedule, and complete all trouble call actions and requests.

C. All documentation, records and databases, as described in this PWS, are the property of the Government.

Quality Control PLAN DLA is committed to a highly interactive relationship between quality control by the Contractor and quality assurance by the government recipient of services. This relationship shall be achieved through a Prevention Based Quality System dedicated to ensuring the best possible products and services to DLA end users. The Contractor shall provide their final QCP no later than (NLT) 10 calendar days after the start of full performance in accordance with paragraph 6.4B.

The Contractor’s quality system shall demonstrate its prevention-based outlook by meeting the objectives stated in the PWS throughout all areas of performance (e.g., all functional areas, all APL and non-APL requirements). The QCP shall be developed to specify the Contractor’s responsibility for management and quality control actions to meet the terms of the contract. Within 24 hours of completion, the Contractor shall provide to the KO or COR, all reports generated as a result of the Contractor’s quality control efforts. This shall include any summary information used to track quality control, including any charts/graphs.

The Contractor’s QCP shall be incorporated into and become part of this contract after the plan has been accepted by the Government. Changes made after KO or COR approval shall be submitted in writing to the KO or COR for review and acceptance. The Contractor’s QCP shall be maintained throughout the life of the contract and shall include the Contractor’s procedures to routinely evaluate the effectiveness of the plan to ensure the Contractor is meeting the performance standards and requirements of the contract.

DLA Information Operations at New Cumberland, PA will implement a Quality Assurance Surveillance Plan (QASP) to ensure the contractor provides the required services and adheres to quality standards as specified in this PWS. The KO or COR shall monitor performance. This monitoring by the KO or COR shall be carried out via the QASP as identified in the attachment to this PWS entitled, “Quality Assurance Surveillance Plan (QASP) for DLA Information Operations at New Cumberland, PA. This QASP document shall also ensure the Contractor’s QCP effectiveness and provides a systematic method to evaluate the services the Contractor is required to furnish.

Deliverables The Contractor shall submit the following deliverables:

6.5.1 time and Project tracking The Contractor shall input into the designated Time and Project Tracking System consolidated time spent on each task completed using predetermined codes that are provided within the tracking system.

6.5.2 Work Order/Incident ticket tracking

A. The Contractor shall utilize the designated Incident Ticket Tracking System to identify, schedule, and complete all trouble call actions and requests.

B. Within 24 hours after completion of a work order, the Contractor shall input into the designated Incident Ticket Tracking System completed incident documentation.

6.5.3 weekly status reports The Contractor shall provide a weekly report to the KO or COR that identifies work completed for the specified time period, any issues that could not be resolved, and any suspense that could not be met with an explanation for the delay.

6.5.4 documentation The Contractor shall provide documentation to the KO or COR on the configuration of each FW, NAC device, IDS, and WANOps appliance.

The Contractor shall provide documentation and reports to the KO or COR on all reported or discovered incidents. Documentation and reports shall be in accordance with the DLA Information Operations Incident Response Plan.

The Contractor shall provide a monthly report to the KO or COR detailing network usage by organization. The Contractor shall also provide ad-hoc usage reports as needed.

The Contractor shall provide a monthly report to the KO or COR detailing anomalous activity by organization.

The Contractor shall provide documentation for the analysis of network scans to the KO or COR within one (1) week of the completion of the scan.

The Contractor shall provide documentation of tools and manuals used for troubleshooting problems and research to the KO or COR upon request.

The Contractor shall provide all required certifications of personnel performing work under this contract in accordance with the specifications identified in this PWS (i.e. IA, etc.).

END OF PERFORMANCE WORK STATEMENT (PWS)