12 EPoS Attach 12 Group 1 Task Order 1 Active Directory PWS 20171113 CC.docx

GENERAL DESCRIPTION:

This is a DRAFT of Task Order 1 to be used for IDIQ price evaluation purposes. The vendor who is awarded Group 1 will have an opportunity to revise pricing when the final Task Order 1 is issued. The DRAFT task order is based on information available at the time of IDIQ solicitation.

The contractor shall provide the necessary technical and subject matter expertise to accomplish the tasks described within the PWS of the Task Order (TO) on a Firm Fixed Price basis. The work shall be performed in accordance with all sections of this Task Order and the contractor’s proposal for the overall EPoS Indefinite Delivery Indefinite Quantity (IDIQ) effort for Group 1: Active Directory Services. This Task Order will be the initial task order.

TECHNICAL PROPOSAL:

In accordance with the solicitation, Factor 1: Technical, Subfactor A: Technical Approach of the Solution, Subfactor B: Management Approach and Capabilities, and Subfactor C: Key Personnel Qualification under Group 3, the contractor shall provide a technical proposal that shall include:

1. A list of assumptions used in your proposal

1. Resumes of Key Personnel

1. Documentation demonstrating the contractor’s understanding of the TO PWS and the contractor’s proposed methodology and technical approach to completing the stated tasks. Additionally, the contractor shall provide a proposed plan (including milestones and timelines) for overall implementation and execution of project.

PRICING:

In accordance with solicitation, the contractor shall provide a firm fixed price proposal for this Task Order utilizing sample pricing sheet for task order provided in the attachment section of the solicitation.

Performance Work Statement (PWS)

Table of Contents

ATTACHMENT 12

Solicitation SP4703-17-R-CB01 Electronic Point of Sale (EPoS) and Supporting Services Group 1 Task Order 1 - DRAFT Active Directory Services PWS

Background, Objective and Operational Environment Background DLA Energy requires an electronic Point of Sale (EPoS) turnkey solution for capturing military fleet management fuel retail transactions at unattended military service stations, mobile ground fuel transactions and capturing aviation fuel transactions for mobile airfield/flight line operations that meets the current standards for Cybersecurity and Audit Readiness. The solution shall comply with the security control requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 80053r4, “Security and Privacy Controls for Federal Information Systems and Organizations” and NIST 800-82r2, “Guide to Industrial Control Systems (ICS) Security as specified in this PWS.

Turnkey is defined as immediately ready to use upon implementation and designed to fulfill the requirements including required interfaces.

Operational Environment The operational environment consists of sites described by the Government-provided site diagram and site requirements.

Task Order Scope Project Management The contractor shall provide Task Order project management support activities as needed by the Program Manager (PM). Those activities include coordination, update and maintenance of program deliverables, project status, project plans, and general Task Order oversight.

Active Directory Capability Delivery Active Directory ™ is the core feature of distributed systems in Microsoft® Windows® 2000. The conceptual operational view of the solution is in Section C. Performance Work Statement, 4.0 Scope.

The contractor shall provide Active Directory services to manage the devices connected to the solution.

The contractor shall manage the Active Directory (AD) on behalf of the Government. The AD will be on a server at DISA and the contractor shall manage it remotely. All devices (fixed and mobile) shall communicate with the AD to be authorized for use. Use of default Windows communication will allow the AD to know if there are any problems or communication failures. Mobile devices require user login and require authentication of each individual user in addition to device authorization.

The contractor shall develop, deliver, configure and provide end user training documentation as required for AD services.

0. Active Directory Environment

· A domain controller running an operating system in the Windows Server family

· Hardware that meets the minimum hardware requirements of the edition of the operating system

· The presence of a fully functioning Active Directory replication topology

· The presence of a fully functioning File Replication Service (FRS) topology

· A regular backup schedule

· Regular monitoring of Active Directory, either through manual review of event logs or through an automated monitoring solution, such as Microsoft Operations Manager (MOM) Active Directory Capability Sustainment The contractor shall support Active Directory environments that operate 24 hours a day, 7 days a week.

The contractor shall sustain the Active Directory capability. The contractor shall ensure that the Active Directory is appropriately sized and tuned for the most efficient operations/performance possible. The contractor shall ensure all detected problems are promptly reported to the EPoS PMO.

The contractor shall provide the processes, procedures, people, documentation, operations support, deployment, security, configuration management and training materials required to sustain the Active Directory capability. The contractor shall correct faults, improve performance or other attributes, and adapt the applications to a changing organizational and technical environment. The contractor shall support the resolution of problems discovered through the testing or operation of the Active Directory.

Information System and Industrial Cybersecurity The contractor shall ensure the Active Directory solution:

· Complies with the security control requirements documented in

· National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r4, "Security and Privacy Controls for Federal Information Systems and Organizations"

· NIST 800-82r2, "Guide to Industrial Control Systems (ICS) Security”

· NIST Special Publication 800-82 "Guide to Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems Security

· United Facilities Criteria (UFC) 3-460-01, “Design; Petroleum Fuel Facilities,” 17 June 2015

· UFC 4-010-06, “Cybersecurity of Facility-Related Control Systems,” 19 September 2016

· UFC 4-020-02FA, “Security Engineering: Concept Design,” 1 March 2005 as specified in this PWS

· Obtains an Authorizing Official (AO) Authority To Operate (ATO) by utilizing the Department of Defense (DOD) processes and procedures as defined in the DoD Instruction 8510.1 “Risk Management Framework (RMF) for DoD Information Technology (IT)” as implemented by DLA The contractor shall be responsible for:

· Performing preventative and analytical activities aimed at enhancing the overall cybersecurity posture of the solution associated with integration within DLA networks, information systems, and applications.

· Providing full cybersecurity support for the scope of the solution and services as stated below.

· Ensuring compliance with Federal, DOD and DLA information technology and security requirements, policies, procedures and standards as applicable.

The contractor shall provide cybersecurity support that includes:

· Enterprise Architecture Support and Compliance Support

· Cybersecurity Engineering Support

· Cybersecurity Certification and Accreditation (C&A) Services

· Cybersecurity Plan of Action and Milestones (POA&M) Services

· Cybersecurity General Support Services

· Federal Information Security Management Act (FISMA) Tracking and Reporting

· Applicable Cybersecurity Controls (Baseline)

· Controlled Unclassified Information (Contractor Internal Cybersecurity Controls) System Documentation The contractor shall develop and maintain documentation) for all capabilities delivered in a contractor proposed Government approved format as required by this Task Order.

Tasks Task 1: Project Management The contractor shall provide Task Order project management support activities as needed by the Program Manager (PM). Those activities include coordination, update and maintenance of program deliverables, project status, project plans, and general Task Order oversight.

Project Management Plan The contractor shall prepare a Project Management Plan (PMP) (Contract Data Requirements List ((CDRL) D001) describing the technical approach, organizational resources, and management controls to be employed to meet the cost, performance, and schedule requirements for the proposed effort. The contractor shall provide the planning, supervision, coordination and controls necessary to accomplish all work contained in this PWS. The contractor shall document the approach and plan that defines the activities, tools, and techniques to ensure high-quality products that are defect-free, that meet PWS requirements and that are delivered in accordance with the approved schedule.

The plan shall include a description of the organization structure and assigned responsibilities, including the contractor staff that will deliver and implement this Task Order. The organization structure shall include the identification of key personnel. The contractor shall provide an organization chart and describe other corporate organizations that will support the team.

The contractor shall provide an explanation of how, within the scope of the Task Order, the contractor will perform technical management and will manage personnel and physical resources. The plan shall include a work breakdown structure (WBS) (CDRL D002) that shows tasks required to complete the work and the dependencies of each task. The WBS shall be detailed to the level of effort necessary to support the accomplishment of work to be performed under this PWS. The contractor shall deliver the PMP to the Contracting Officer’s Representative (COR) in a contractor proposed, Government approved format within 30 days of contract award.

Integrated Master Schedule The Integrated Master Schedule (IMS) is a time-based schedule containing the networked, detailed tasks necessary to ensure successful project/ Task Order execution. The IMS is traceable to the PMP, the WBS, and this PWS. The IMS is used to verify attainability of Task Order objectives, to evaluate progress toward meeting project objectives, and to integrate the project schedule activities with all related components.

The contractor shall produce and maintain an IMS (CDRL D003) that shows the activities required for the completion of tasks and deliverables for this Task Order. The contractor shall deliver to the COR a draft and baselined IMS within 30 and 75 calendar days after Task Order award, respectively.

The contractor shall deliver a Project IMS, with updated actuals, to the COR a minimum of two business days prior to each Monthly Performance and Progress Report (See section 3.1.5 of this Task Order). The IMS shall be delivered in a contractor proposed, Government approved format.

Risk Register The contractor shall apply a risk management approach to develop and maintain a risk register that documents and tracks contractor and Government identified project risks. For each risk, the register shall include at least a description of the risk, a rating (high, moderate, low), a description of the impact should the risk occur and a mitigation strategy. The contractor shall deliver a Risk Register (CDRL D004) resulting from the contractor’s risk management process to the COR within 30 calendar days of the issuance of the Task Order and provide updates as changes are made, at least monthly. The Risk Register shall be provided in a contractor proposed, Government approved format.

Monthly Performance and Progress Report The contractor shall monitor activities and deliverables under this Task Order and provide a Monthly Performance and Progress Report (MPPR) (CDRL D005) that describes project progress, costs, issues, problems and their status. The MPPR shall be the contractor’s method of reporting progress against the PMP. The period covered by the MPPR shall include the previous calendar month’s activities; any issues, actions or other MPPR reported information not satisfied or closed in previous reporting periods; and any required interfaces, meetings or other commitments. If applicable, travel costs shall be broken down by destination, duration, purpose, and costs for both monthly and cumulative to date. MPPRs for the previous month shall be delivered to the COR by the fifth day of the following month.

The MPPR shall include but not be limited to the following information:

· Summary of Activities

· Activities and Progress (Integrated Master Schedule)

· Software Engineering Metrics and Measures

· Costs

· Deliverables

· Significant Meetings

· Significant Issues

· Significant Plans

· Travel

· Action Item Status

· Risks to the contractor based on Government pending actions

· Risks to EPoS application performance based on contractor issues Briefing, Meeting, Conference Call Presentation Material and Minutes The contractor shall prepare briefing materials and represent the EPoS program at briefings, meetings and conference calls with organizations of interest, stakeholders, external and internal systems. This representation shall be at a level that functionally and technically represents EPoS mission and capabilities.

The COR or an authorized Government representative will be present at all briefings, meetings and conference calls. Read ahead and presentation material (CDRL D006) shall be delivered to the COR five days prior to any meetings, briefings or conference calls, as required. If meetings, briefings or conference calls are scheduled less than five days in advance, the contractor shall provide read ahead and presentation material as soon as practicable.

The contractor shall document meeting notes including, but not limited to, any action items, status of action items, and summary of discussions. The contractor shall deliver these meeting notes (CDRL D007) to the COR no later than five days after the meeting. Approved meeting notes will be disseminated by the COR.

Kick-off Meeting The contractor shall schedule a kick-off meeting with the PMO, COR, and stakeholders within two weeks of award or as agreed on between the Government and contractor, to introduce the Government team to the contractor’s overall operating plans and approach to this work. The contractor shall present and deliver the Kick-off Meeting Briefing Presentation Material (CDRL D008) and be prepared to discuss the content of the Program Management Plan, to include the staffing plan, schedule and proposed metrics. The contractor shall produce and distribute Kick-off Meeting Minutes (CDRL D009) identifying all the discussion points, agreements and action items within five days following the meeting.

Task 2: Active Directory Delivery The contractor shall provide the necessary software engineering, technical, programming, documentation and analytical services, as directed by this Task Order, in support of configuration, interface/integration, testing and deployment of an EPoS Active Directory.

Configuration Management The contractor shall develop and execute a written configuration management plan that addresses product management and version control for changes to software, hardware, business processes documentation and all other control items; recreates all baseline deliveries from any point in time and supports the EPoS. The contractor shall support the configuration control governance structure; evaluate all changes to the approved system requirements baseline for risk to security, for schedule and cost impact; provide evaluations in writing and in sufficient detail to allow for review and approval by the configuration control governance structure as required.

The contractor shall develop and deliver to the COR a Configuration Management Plan (CMP) (CDRL D010) within 30 days after Task Order award. The contractor shall manage and document the hardware and software configuration baselines. The CMP shall address the process for any initial Active Directory capability delivery changes, changes to the software, hardware, documentation, or any other control item for the established baseline. The process shall also be sufficiently robust to recreate all baseline deliveries from any point in time; it shall address configuration management administration, configuration identification, configuration control, configuration status accounting, and configuration audit procedures for hardware, software, and documentation.

Configuration The contractor shall configure an Active Directory for EPoS.

The contractor shall deliver the Active Directory (CDRL D011) to the COR.

Testing The contractor shall provide testing to ensure system requirements are met. The contractor shall develop and maintain test scripts and architectures for products; write, implement and report status for system test cases; analyze test cases and provide regular progress reports; provide testing procedures for the support of requirements; and provide inputs to risk management assessments on test design and test tools selection.

The contractor shall document Test Results (CDRL D012) and provide them to the COR.

Production Readiness The contractor shall work with the PMO to determine if all requirements have been met for approval to move the solution to production. The contractor shall record the results of the briefing and submit to the COR in a Production Readiness Report (CDRL D013) within 10 calendar days after the briefing.

System Deployment The contractor shall plan, develop and conduct capability implementation; deliver required implementation components; demonstrate the solution; monitor use; verify that the solution works; verify accuracy of the products; verify interface and reports are in accordance with requirements; resolve problems.

Task 3: Active Directory Sustainment Problem Resolution The contractor shall use the system change process in use at contract award, currently Eagle Incident and Request for Change process to document issue resolution and complete all changes to the Active Directory. Instructions on access to and use of the DLA change process will be provided at contract award.

The contractor shall provide issues, resolutions and timeframes related to problem resolution in the MPPR (CDRL D005).

Conditions reported to the EPoS PMO for problem resolution shall be assigned a priority level 1 through 4 based on the following criteria.

capability, or violate security policy and procedures, for example, buyer is unable to obtain account ledger information or a seller is unable to obtain inventory ledger information in order to process base-level transactions.

capability; technical, cost, or schedule risks to the project; or the life-cycle support of the system. No work-around solution is known.

operational or mission-essential capability, and is non-value-added practice for development or support personnel, but does not prevent them from accomplishing their responsibilities.

Problem resolution standard response time will be in accordance with the table below. Response and resolution times are measured from the initial ticket assignment until the ticket is resolved.

System Response and Resolution Time Requirements

Post Production Support The contractor shall provide post production support. The contractor shall provide support to users, business process analysts, others as designated by the Government until the Active Directory capability is within acceptable process and system performance thresholds; support the complete acceptance of the capability as it transitions to normal operations, support and sustainment.

Task 4: Information System and Industrial Cybersecurity The contractor shall ensure compliance with Federal, DOD and DLA information technology and security requirements, policies, procedures and standards detailed in section 2.2.3 of this Task Order as applicable.

Enterprise Architecture Support and Compliance Support The contractor shall provide Enterprise Architecture Support and Compliance support to assist DLA in ensuring compliance with DOD and DLA IA policy and perform the daily activities required for successful IA Architecture. The contractor shall develop:

· DODAF Diagrams/Models for the solution (CDRL D014)

· Implementation Plan for Solution Cybersecurity Architecture (CDRL D015) Cybersecurity Engineering Support The contractor shall provide systems engineering and engineering support as identified in individual tasks for the solution. The contractor shall develop Cybersecurity Engineering Documentation (CDRL D016) to support this effort that includes, but is not limited to the following requirements

· Developing network models

· Providing technical support in assessing the function, security vulnerability, usefulness,

· and potential applications of current and future technology

· Participating in modifications and improvements to existing cybersecurity products

· Supporting and engineering cybersecurity solutions for the upgrade of the solution to conform to Federal, DOD, or DLA initiatives such as Defense-in-Depth (DID) and Department of Defense Information Network (DODIN) Joint Information Environment (JIE)

· Providing advice during technical reviews and selection, development, and testing of IA components

· Providing technical support in assessing the function, security vulnerability, usefulness, and potential applications of current and future technology, available from commercial, Government, or other sources.

Cybersecurity Assessment Program (CAP) Support DLA relies on information systems to carry out its mission and business functions in a global setting. These systems are susceptible to exploitation through targeted attacks, natural disasters, and human and system errors. Compromise of any information system could jeopardize DLA’s logistical operations and endanger other organizations and national interests. To combat these threats, the Department of Defense utilizes cybersecurity as its first line of defense.

Cybersecurity is the collection of tools, policies, security concepts and safeguards, guidelines, training, and best practices, used to protect the cyber environment, and organizational assets. These assets include connected computing devices, applications, services, telecommunications systems, and the transmitted or stored information in the cyber environment. Cybersecurity strives to ensure the confidentiality, integrity, or availability of such information.

DLA has developed, documented, and implemented the Cybersecurity Assessment Program (CAP) to ensure the confidentiality, integrity, and availability of its information. CAP consists of two major subprograms: the COMSEC Assessment and Assistance Program (not part of this PWS) and the Cybersecurity Compliance Review Program (CCRP). CAP was designed to improve the cybersecurity posture of DLA.

The contractor shall provide CAP Documentation (CDRL D017).

Command Cyber Readiness Inspections (CCRI) CCRI inspections utilize the DISA FSO Security Technical Implementation Guides (STIGs), checklists, USCYBERCOM Communication Tasking Orders, and USCYBERCOM CCRI contributing factors as the evaluation criteria to validate compliance with DOD IA policy, best practices, and configuration requirements. DLA performs two types of CCRIs; staff assistance (SA), and formal. Formal CCRIs are performed as prescribed by the USCYBERCOM published schedule. SA CCRIs are generally performed in conjunction with CVAs. The same methodology is used for both types of CCRI. The contractor shall assist DLA in its CCRI efforts by developing and/or updating the DLA CCRI Methodology (CDRL D018) that defines the approach, actions and appropriate responses used in conducting an inspection. The contractor(s) shall participate in CCRIs, as directed by the Primary or Alternate CORs.

Penetration Testing Support DLA employs Penetration testing to evaluate the security of a computer system or network by simulating an attack from outside and inside DLA’s network boundary. The contractor shall assist DLA in its compliance assessment efforts by developing and/or updating the Penetration Testing Methodology (CDRL D019) that defines the approach, actions and appropriate responses used in conducting a test. The contractor(s) shall participate in Penetration testing, as directed by the Primary or Alternate COR. Testing done outside DLA’s network boundary will be accomplished from a safe, secure facility under the contractor’s control.

Cybersecurity Certification and Accreditation (C&A) Services As required by location, the contractor shall provide cybersecurity program support to assist DLA in ensuring compliance with DOD and DLA IA polices and perform the daily activities required for successful C&A program completion.

· C&A Control Compliance Validation Support

· C&A Process Support

· C&A Analysis Support

· C&A Coordination Support

· C&A Security Documentation (CDRL D020) Support Cybersecurity Plan of Action and Milestones (POA&M) Services As required by location, the contractor shall be responsible for monitoring and tracking the status of all Plans of Action & Milestones (POA&M) weaknesses through to a resolution for DLA.

· POA&M Process Support

· POA&M Analysis Support

· POA&M Coordination Support

· POA&M Documentation (CDRL D021) Support Cybersecurity General Support Services As required by location, the contractor shall provide general IA engineering capabilities and services per individual tasks. General support includes:

· Quality Assurance Support

· Program Reviews Support

· Centralized Administrative, Clerical, Documentation and related Support

· Progress/Status Reporting Support (Include in MPPR CDRL D005) Federal Information Security Management Act (FISMA) Tracking and Reporting As required by location, the contractor shall be responsible for validating, compiling, tracking and reporting information in the Federal, DOD or DLA approved Federal Information Security Management Act (FISMA) tracking tool.

· FISMA Process Support

· FISMA Analysis Support

· FISMA Coordination Support

· FISMA Documentation (CDRL D022) Support Applicable Cybersecurity Controls (Baseline) Overall, the contractor shall incorporate and document the security practices used in the development of the solution and changes to the solution. The security practices shall be modeled after industry best security practices and principles. Examples of best practices can be found at http://iase.disa.mil.

The solution shall comply with the specific requirements in the Indefinite Delivery Indefinite Quantity (IDIQ) PWS, section 5.6.9 in accordance with the security requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r4, “Security and Privacy Controls for Federal Information Systems and Organizations”. It is important to note that the section 5.6.9 controls were derived from a preliminary system categorization utilizing the processes and procedures defined in the Federal Information Processing Standards (FIPS) Publication 199. The preliminary system categorization for Confidentiality, Integrity, and Availability (CIA) is MODERATE overall.

It is important to note not all of the controls cited will be the responsibility of the contractor; however, the contractor shall be prepared to provide support services as required.

Cybersecurity controls are specific to Information Technology (IT) Information Systems (IS).

Applicable Cybersecurity Controls (Industrial Control System Enhancements) The solution shall comply with the specific requirements in IDIQ PWS, section 5.6.10 in accordance with the security requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-82r2, “Guide to Industrial Control Systems (ICS) Security”. It is important to note that the IDIQ PWS section 5.6.10 controls were derived from a preliminary system categorization utilizing the processes and procedures defined in the Federal Information Processing Standards (FIPS) Publication 199. The preliminary system categorization for Confidentiality, Integrity, and Availability (CIA) is MODERATE overall.

It is important to note, not all of the controls cited will be the responsibility of the contractor; however, the contractor shall be prepared to provide support services as required.

Cybersecurity controls are specific to Supervisory Control and Data Acquisition (SCADA) Systems and other control system configurations such as Programmable Logic Controllers (PLC).

Task 5: System Documentation The contractor shall develop and maintain Documentation (CDRL D023) for all capabilities delivered in a contractor proposed Government approved format as required by this Task Order.

Key Personnel Note: The labor category responsible for work on the Active Directory requires an Information Technology (IT) Level I. The labor category responsible for application/security development requires an Information Technology (IT) Level II. All other labor categories require that contractor resources possess an Information Technology (IT) Level III security clearance. All clearances are IAW DOD 5200.2-R.

Program Manager The Program Manager shall manage all day-to-day operations including administrative functions, assessing risks and identifying unstated assumptions, and resolving interpersonal conflicts in support of making the program successful.

Duties and Responsibilities:

The Program Manager acts as manager and overall point of contact for all work on this contract and:

· Directs staff and reviews work products for completeness and adherence to customer requirements

· Provides communication to management to review project plans, status reports, and deliverables

· Develops overall project milestones and monitors the execution of the project against planned time lines

· Directs and reviews program plans, status reports, and deliverables with program director and project teams

· Provides technical and functional management to one or more project teams for specific projects or sub-tasks Education and Experience:

The Program Manager shall possess minimum of Bachelor’s Degree from an accredited college or university in related field. Preferred: Technical degree or direct experience in engineering and/or systems development and Master’s Degree. Requires minimum of 10 years of experience as a Program/Project Manager or Team Lead with increasing responsibility, preferably with experience managing fuel industry related projects.

The Program Manager shall have a technical background as well as a management background. The Program Manager has experience with the execution and management of information technology (IT) programs. This includes direct experience in leading and executing IT solutions in the private or public sector. Experience includes:

· Program management of technically and functionally diverse and complex IT programs.

· Implementation of detailed management techniques such as Critical Path Method (CPM) and Earned Value Management.

· Complex product configuration management and control.

· Business case development.

· IT solution architectural analysis and design.

· Detailed migration planning and trade-off analysis.

· System data exchange design, development, and implementation.

· Hosted application support/management in environments without direct contractor control Cybersecurity Engineer The Cybersecurity Engineer shall manage all day-to-day cybersecurity operations including administrative functions, assessing risks and identifying unstated assumptions, and resolving interpersonal conflicts for the solution in support of making the program successful.

Duties and Responsibilities:

The Cybersecurity Engineer ensures the cybersecurity of the system is in accordance with Federal and DOD requirements and:

· Determines applicable enterprise cyber and security standards

· Develops and implements defined cyber/security standards and procedures

· Coordinates, develops, and evaluates security programs for an organization

· Recommends cyber/security solutions to support customer requirements

· Identifies, reports, and resolves security violations

· Establishes and satisfies cyber and security requirements based upon the analysis of user, policy, regulatory, and resource demands

· Supports customers at the highest levels in the development and implementation of doctrine and policies

· Applies know-how to Government and commercial common user systems, as well as to dedicated special purpose systems requiring specialized security features and procedures

· Performs analysis, design, and development of security features for system architectures

· Analyzes and defines security requirements for computer systems which may include mainframes, workstations, and personal computers

· Designs, develops, engineers, and implements solutions that meet security requirements

· Provides integration and implementation of the computer system security solution

· Analyzes general cyber-related technical problems and provides basic engineering and technical support in solving these problems

· Performs vulnerability/risk analyses of computer systems and applications during all phases of the system development life cycle

· Ensures that all information systems are functional and secure Education and Experience:

The Cybersecurity Engineer shall possess minimum of Bachelor’s Degree from an accredited college or university in related field. Preferred: Degree in computer science, computer engineering, advanced analytics, applied mathematics, or physics. Requires minimum of 8 years of relevant experience.

The Cybersecurity Engineer shall have demonstrated an understanding of the cybersecurity requirements and system engineering processes, is aware of business objectives, and shall be proficient in advanced internal/external network routing and switching technologies. Experience includes:

· CISSP at a minimum with a preference for CISSP- IA Workforce System Architect or Engineer (IASAE)

· A clear understanding and relevant experience of at least three years with the design, maintenance and operation of highly complex and high secure communications network environments

· An understanding of embedded systems

· Multi-discipline experience with Firewall/IPS, Antivirus, host-based protection, security incident (i.e. Contingency of Operations Plan (COOP), Investigative Forensic) event management, virtual shared computing environments and network/security management

· A solid understanding of communication protocols, network technologies and the ISO Open Systems Interconnection telecommunications model, solid troubleshooting skills and methodologies

· Knowledge of Defense Information and Accreditation Risk Management Framework (RMF) and process for system and application controls

· Knowledge of DOD/DLA security policies and CERT compliance

· DOD 8570.01 Information Assurance Manager level III Certification Senior Applications Programmer The Senior Applications Programmer is responsible for translating technical software and hardware specifications into software and hardware design and providing IT technical guidance to site-specific installers. The Senior Applications Programmer shall provide project leadership as the principal designer under this PWS.

Duties and Responsibilities:

· Collaborates with business analysts, architects, others to plan, design, develop, test, and maintain applications

· Collects and documents user requirements

· Prepares reports, manuals and other documentation on the status, operation and maintenance of application software

· Designs, develops, and unit tests applications in accordance with established standards

· Participates in peer-reviews of solution designs and related code

· Packages and supports deployment of releases

· Develops, refines, and tunes integrations and interfaces

· Configures services for performance, security, and error handling

· Analyzes and resolves technical and application problems

· Assesses opportunities for application and process improvement

· Assists in determining and enforcing development standards and best practices

· Performs application related Security Technical Implementation Guides (STIGs) and

· vulnerability reporting Education and Experience:

The Senior Applications Programmer shall possess minimum of Bachelor’s Degree from an accredited college or university in related field. Requires minimum of 5 years of combined experience in hardware and software configuration for the selected solution. Two years or more experience in international implementations; this can be in conjunction with the five years of experience requested above. Experience includes:

· Certification in applicable experience areas

· Proficiency in analyzing user-defined functional, technical system requirements as well as writing design and technical specifications

· Proficiency in drafting integration test plans and integration test cases as well as executing and documenting integration testing activities

· Proficiency in complex testing and debugging of hardware and software solution

· Knowledge of Section 508 compliance Database Administrator The Database Administrator (DBA) manages all database administrator functions to include, but not limited to, database design, recoverability, integrity, security, availability, performance and development and testing support.

Duties and Responsibilities:

· Provides all activities related to the administration of computerized databases

· Projects long-range requirements for database administration and design in conjunction with others working EPoS applications

· Designs, creates, and maintains databases in required environments

· Conducts quality control and auditing of databases in required environments to ensure accurate and appropriate use of data

· Advises users on access to various databases

· Designs, implements, and maintains complex databases with respect to access methods, access time, device allocation, validation checks, organization, protection and security, documentation, and statistical methods

· Applies knowledge and experience with database technologies, development methodologies, and front-end/back-end programming languages

· Performs database programming and supports systems design

· Includes maintenance of database dictionaries, overall monitoring of standards and procedures, file design and storage, and integration of systems through database design

· Performs database related Security Technical Implementation Guides (STIGs) and Vulnerability Management System (VMS) reporting Education and Experience:

The Database Administrator shall possess minimum of Bachelor’s Degree from an accredited college or university in related field. Requires minimum of 5 years of experience in projects using the solution database management system. Experience includes:

· DOD 8570.01 IAM level III Certification

· Demonstrated experience with:

· Database designing development and management to include, but not limited to: Web Services/XML, materialized views, performance tuning, and database modeling

· Data engineering or management of data warehouses with multiple environments with multiple sources of inbound data

· Knowledge of:

· Creating, deploying, and executing database scripts and stored procedures as well as in creating, maintaining and optimizing application database table, triggers, materialized views, configurations and interfaces

· Executing data migration tasks to include ETL tasks

· Risk Management Framework (RMF) processes for application controls

· DOD/DLA security policies and CERT compliance Systems Engineer The Systems Engineer provides support of the design, execution, and oversight of IT projects.

Duties and Responsibilities:

· Supports all program and project planning and milestone development.

· Supports business case analysis and identification of alternative solutions and resulting business impacts.

Education and Experience:

The Systems Engineer shall possess minimum of Bachelor’s Degree from an accredited college or university in related field. Requires minimum of 6 years of experience in a network management environment.

The Systems Engineer has experience with the design, execution, and oversight of IT projects. This includes direct experience in the design and development of integrated software and hardware solutions in the private or public sector. Experience includes:

· Security+ or equivalent IAT/IAM/IASAE Level II

· Detailed functional analysis and gap/fit analysis of software solution packages.

· Software solution package selection and business case development.

· Software and system developmental and acceptance testing.

· Legacy system data exchange design, development, and implementation case analysis and identification of alternative solutions and resulting business impacts Deliverables Deliverable Requirements The COR will review all deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance with contract requirements. The contractor shall ensure the accuracy and completeness of all deliverables. Unless otherwise noted, the contractor shall only deliver final completed products to the Government for acceptance. The Government will consider errors, misleading statements, incomplete or irrelevant information, excessive rhetoric, or repetition as deficiencies and the contractor shall make corrections.

Unless otherwise indicated in a deliverable description, the Government will have ten business days to review deliverables. If the Government has comments, the contractor shall have five business days to make corrections to the deliverable and resubmit the deliverable to the Government. In the event that there are exceptional circumstances impacting the delivery of a Contract Deliverables Requirements List (CDRL) item, the COR may grant up to a five business day extension on the delivery of any CDRL item. To be granted an extension the contractor shall submit a written justification to the COR and Contracting Officer no less than 2 business days in advance of the CDRL item due date.

All completed deliverables shall be delivered to the COR and/or Government individual identified for this effort. Except as specified in this PWS, the contractor shall use best commercial practices for formatting all deliverables. Electronic copies of all deliverables shall be sent to the COR via email in Microsoft Office compatible or Portable Document Format (PDF) formats. If deliverable exceeds email size limitations (10 MB), the deliverable shall be sent via Compact Disk (CD) or other media as appropriate for the size of the deliverable and approved by the COR.

Deliverable Schedule Unless otherwise specified all delivery dates are in calendar days.

Table 5.1: Deliverable Schedule

MASTER DELIVERABLES SCHEDULE

Baselined 75 days after Task Order award

Performance Requirements Performance Measurements The performance measurements to be used to assess the contractor’s performance under this contract will determine whether the contractor is performing at acceptable levels to allow for a 100% payment of monthly invoices.

The Government will make objective and subjective assessments of the contractor's performance to determine whether contractor performance is acceptable. The contractor shall perform all functions in a professional manner and prepare accurate and timely documentation.