EPoS_Attach_15_Group_2_Task_Order_3_Fixed_Installation_Sustainment_PWS_20170820.docx

GENERAL DESCRIPTION:

The contractor shall provide the necessary technical and subject matter expertise to accomplish the tasks described within the PWS of the Task Order (TO) on a Firm Fixed Price basis. The work shall be performed in accordance with all sections of this Task Order and the contractor’s proposal for the overall EPoS Indefinite Delivery Indefinite Quantity (IDIQ) effort for Group 2: Fixed Facility Devices.

TECHNICAL PROPOSAL:

In accordance with the solicitation, Factor 1: Technical, Subfactor A: Technical Approach of the Solution, Subfactor B: Management Approach and Capabilities, and Subfactor C: Key Personnel Qualification under Group 2, the contractor shall provide a technical proposal that shall include:

1. A list of assumptions used in your proposal

1. Resumes of Key Personnel

1. Documentation demonstrating the contractor’s understanding of the TO PWS and the contractor’s proposed methodology and technical approach to completing the stated tasks. Additionally, the contractor shall provide a proposed plan (including milestones and timelines) for overall implementation and execution of project.

PRICING:

In accordance with solicitation, the contractor shall provide a firm fixed price proposal for this Task Order utilizing sample pricing sheet for task order provided in the attachment section of the solicitation.

Performance Work Statement (PWS) Table of Contents

ATTACHMENT 15

Solicitation SP4703-17-R-CB01 Electronic Point of Sale (EPoS) and Supporting Services Group 2 Task Order 3 Fixed Facility Device Installation and Sustainment PWS

ATTACHMENT 15

Solicitation SP4703-17-R-CB01 Electronic Point of Sale (EPoS) and Supporting Services Group 2 Task Order 3 Fixed Facility Device Installation and Sustainment PWS ii

Background, Objective and Operational Environment Background DLA Energy requires an electronic Point of Sale (EPoS) turn-key solution for capturing military fleet management fuel retail transactions at unattended military service stations, mobile ground fuel transactions and capturing aviation fuel transactions for mobile airfield/flight line operations that meets the current standards for Cybersecurity and Audit Readiness. The solution shall comply with the security control requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 80053r4, “Security and Privacy Controls for Federal Information Systems and Organizations” and NIST 800-82r2, “Guide to Industrial Control Systems (ICS) Security as specified in this PWS.

Turn-key is defined as complete implementation to include physical site preparation, electrical wiring and full implementation of the solution to include required interfaces.

Operational Environment The operational environment consists of sites described by the Government-provided site diagram and site requirements.

Task Order Scope Project Management The contractor shall provide Task Order project management support activities as needed by the Program Manager (PM). Those activities include coordination, update and maintenance of various program deliverables including the Integrated Master Schedule (IMS), Work Breakdown Structure, project status, program charts, briefing charts, work coordination, monthly status reports, project plans, and general contract oversight.

Fixed Facility Device Installation The contractor shall provide fixed facility device hardware and operating system software.

The contractor shall provide all personnel, equipment, tools, materials, supervision and other items and non-personal service necessary to deliver, install, test and validate that fixed facility devices are operational at all Continental United States (CONUS) and Outside of Contiguous United States (OCONUS) locations listed in Attachment 1, List of EPoS Fixed Device Locations.

This Task Order addresses 30 fixed facility devices to be installed in nine CONUS sites that consist of five small-sized sites (1-2 devices); three medium-sized sites (3-5 devices) and one large-sized site (6-plus devices). An additional fixed facility device will be installed in the DLA Energy Lab in Lorton, Virginia for a total of 31 devices installed in 10 sites.

Fixed Facility Device Sustainment The contractor shall perform preventive maintenance on EPoS as installed.

The contractor shall perform corrective maintenance on EPoS as installed.

The contractor shall provide issues, resolutions and timeframes related to corrective maintenance within specified response and resolution time requirements.

Information System and Industrial Cybersecurity The contractor shall ensure the solution:

· Complies with the security control requirements documented in

· National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r4, "Security and Privacy Controls for Federal Information Systems and Organizations"

· NIST 800-82r2, "Guide to Industrial Control Systems (ICS) Security”

· NIST Special Publication 800-82 "Guide to Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems Security

· United Facilities Criteria (UFC) 3-460-01, “Design; Petroleum Fuel Facilities,” 17 June 2015

· UFC 4-010-06, “Cybersecurity of Facility-Related Control Systems,” 19 September 2016

· UFC 4-020-02FA, “Security Engineering: Concept Design,” 1 March 2005 as specified in this PWS

· Obtains an Authorizing Official (AO) Authority To Operate (ATO) by utilizing the Department of Defense (DOD) processes and procedures as defined in the DoD Instruction 8510.1 “Risk Management Framework (RMF) for DoD Information Technology (IT)” as implemented by DLA The contractor shall be responsible for:

· Performing preventative and analytical activities aimed at enhancing the overall cybersecurity posture of the solution associated with integration within DLA networks, information systems, and applications.

· Providing full cybersecurity support for the scope of the solution and services as stated below.

· Ensuring compliance with Federal, DOD and DLA information technology and security requirements, policies, procedures and standards as applicable.

The contractor shall provide cybersecurity support that includes:

· Enterprise Architecture Support and Compliance Support

· Cybersecurity Engineering Support

· Cybersecurity Certification and Accreditation (C&A) Services

· Cybersecurity Plan of Action and Milestones (POA&M) Services

· Cybersecurity General Support Services

· Federal Information Security Management Act (FISMA) Tracking and Reporting

· Applicable Cybersecurity Controls (Baseline)

· Controlled Unclassified Information (Contractor Internal Cybersecurity Controls) System Documentation The contractor shall provide and maintain operator level, administrative personnel, and equipment maintenance documentation for equipment delivered on this Task Order.

Tasks Task 1: Project Management The contractor shall provide Task Order project management support activities as needed by the Program Manager (PM). Those activities include coordination, update and maintenance of program deliverables, project status, project plans, and general Task Order oversight.

Project Management Plan The contractor shall prepare a Project Management Plan (PMP) (Contract Data Requirements List ((CDRL) F001) describing the technical approach, organizational resources, and management controls to be employed to meet the cost, performance, and schedule requirements for the proposed effort. The contractor shall provide the planning, supervision, coordination and controls necessary to accomplish all work contained in this PWS. The contractor shall document the approach and plan that defines the activities, tools, and techniques to ensure high-quality products that are defect-free, that meet PWS requirements and that are delivered in accordance with the approved schedule.

The plan shall include a description of the organization structure and assigned responsibilities, including the contractor staff that will deliver and implement this Task Order. The organization structure shall include the identification of key personnel. The contractor shall provide an organization chart and describe other corporate organizations that will support the team.

The contractor shall provide an explanation of how, within the scope of the Task Order, the contractor will perform technical management and will manage personnel and physical resources. The plan shall include a work breakdown structure (WBS) (CDRL F002) that shows tasks required to complete the work and the dependencies of each task. The WBS shall be detailed to the level of effort necessary to support the accomplishment of work to be performed under this PWS. The contractor shall deliver the PMP to the Contracting Officer’s Representative (COR) in a contractor proposed, Government approved format within 30 days of contract award.

Integrated Master Schedule The Integrated Master Schedule (IMS) is a time-based schedule containing the networked, detailed tasks necessary to ensure successful project/ Task Order execution. The IMS is traceable to the PMP, the WBS, and this PWS. The IMS is used to verify attainability of Task Order objectives, to evaluate progress toward meeting project objectives, and to integrate the project schedule activities with all related components.

The contractor shall produce and maintain an IMS (CDRL F003) that shows the activities required for the completion of tasks and deliverables for this Task Order. The contractor shall deliver to the COR a draft and baselined IMS within 30 and 75 calendar days after Task Order award, respectively.

The contractor shall deliver a Project IMS, with updated actuals, to the COR a minimum of two business days prior to each Monthly Performance and Progress Report (See section 3.1.5 of this Task Order). The IMS shall be delivered in a contractor proposed, Government approved format.

Risk Register The contractor shall apply a risk management approach to develop and maintain a risk register that documents and tracks contractor and Government identified project risks. For each risk, the register shall include at least a description of the risk, a rating (high, moderate, low), a description of the impact should the risk occur and a mitigation strategy. The contractor shall deliver a Risk Register (CDRL F004) resulting from the contractor’s risk management process to the COR within 30 calendar days of the issuance of the Task Order and provide updates as changes are made, at least monthly. The Risk Register shall be provided in a contractor proposed, Government approved format.

Monthly Performance and Progress Report The contractor shall monitor activities and deliverables under this Task Order and provide a Monthly Performance and Progress Report (MPPR) (CDRL F005) that describes project progress, issues, problems and their status. The MPPR shall be the contractor’s method of reporting progress against the PMP. The period covered by the MPPR shall include the previous calendar month’s activities; any issues, actions or other MPPR reported information not satisfied or closed in previous reporting periods; and any required interfaces, meetings or other commitments. If applicable, travel costs shall be broken down by destination, duration, purpose, and costs for both monthly and cumulative to date. MPPRs for the previous month shall be delivered to the COR by the fifth day of the following month.

The MPPR shall include but not be limited to the following information:

· Summary of Activities

· Activities and Progress (Integrated Master Schedule)

· Software Engineering Metrics and Measures

· Deliverables

· Significant Meetings

· Significant Issues

· Significant Plans

· Travel

· Action Item Status

· Risks to the contractor based on Government pending actions

· Risks to EPoS program performance based on contractor issues Briefing, Meeting, Conference Call Presentation Material and Minutes The contractor shall prepare briefing materials and represent the EPoS program at briefings, meetings and conference calls with organizations of interest, stakeholders, external and internal systems. This representation shall be at a level that functionally and technically represents EPoS mission and capabilities.

The COR or an authorized Government representative will be present at all briefings, meetings and conference calls. Read ahead and presentation materials (CDRL F006) shall be delivered to the COR five days prior to any meetings, briefings or conference calls, as required. If meetings, briefings or conference calls are scheduled less than five days in advance, the contractor shall provide read ahead and presentation material as soon as practicable.

The contractor shall document meeting notes including, but not limited to, any action items, status of action items, and summary of discussions. The contractor shall deliver these meeting notes (CDRL F007) to the COR no later than five days after the meeting. Approved meeting notes will be disseminated by the COR.

Kick-off Meeting The contractor shall schedule a kick-off meeting with the PMO, COR, and stakeholders within two weeks of award or as agreed on between the Government and contractor, to introduce the Government team to the contractor’s overall operating plans and approach to this work. The contractor shall present and deliver the Kick-off Meeting Briefing Presentation Material (CDRL F006) and be prepared to discuss the content of the Program Management Plan, to include the staffing plan, schedule and proposed metrics. The contractor shall produce and distribute Kick-off Meeting Minutes (CDRL F007) identifying all the discussion points, agreements and action items within five days following the meeting.

Task 2: Fixed Facility Device Installation Technical Architecture The contractor shall develop and update solution specific Enterprise Architecture (EA) Documents (CDRL F008) as required to assert to the DOD Enterprise Architecture (BEA) including the appropriate Operational, System and Technical Views required by DLA for fixed facility devices by location.

Systems Engineering The contractor shall develop and update solution specific System Engineering (SE) Documents (CDRL F009) as required by DOD and DLA guidelines for fixed facility devices by location.

Fixed Facility Device Delivery, Installation, Test and Validation The contractor shall provide all labor, travel, test equipment, and tools required to perform the installation or other work as described by the engineering plan and associated reference documents. The contractor shall be responsible for all equipment and material necessary to complete the tasks depicted in the engineering plan or other documents. The contractor shall determine types and quantities of equipment and materials using applicable documents identified for each location.

The contractor shall install, test, and validate fixed facility devices, components, and supporting items, including electrical, electronic, mechanical, and supporting systems. The installations shall conform to the applicable engineering plans, test plans and documents provided by the Government. Fixed facility devices shall be installed in conformance with applicable installation, performance, or other requirements identified for each location.

The contractor shall furnish a complete breakdown of proposed material and material costs to the COR for the sites specified in this Task Order.

Delivery The contractor shall ensure all necessary equipment and material is verified, tested, and properly packed prior to shipment to the site. Additional costs resulting from missing equipment and/or material during the installation phase shall be the responsibility of the contractor. The contractor shall provide a list of all Equipment Shipped to each location (CDRL F010) to the COR five days before shipment.

Installation If any GFE or GFM specified in the individual delivery order is not made available to the contractor by the Government prior to the completion of the tasks specified, the contractor shall still be responsible for installation of all other equipment and material as described in the engineering plan or installation drawings.

The contractor shall perform all work in such a manner that will minimize disruption to normal activities of the site.

Expendable and consumable materials such as clerical supplies, saw blades, drill bits, etc., and material which is considered to be a normal cost of doing business is considered as overhead and is included in labor rates negotiated and agreed upon at award and shall not be billed separately as a material cost.

Fixed Facility Device Preparation As necessary, the contractor shall perform physical preparation and installation of the device to include minor device-related work required to make the device operational.

Permits The contractor shall develop, coordinate, and assist the installation site in applying for and obtaining all applicable permits, access (including off-base easements and leases), agreements, licenses, and certificates required to perform and complete effort as specified in this Task Order. The contractor shall comply with all applicable permit conditions and shall keep all permits current until the work is complete.

Remote and Austere Sites The contractor may be requested to perform work as specified at remote and austere locations. The contractor shall be responsible for all contractor personnel, security, supplies, equipment, and infrastructure.

High Risk/Hostile Environments When work takes place in High Risk/Contingency or Hostile Environments, security and logistical support will be provided by the US Military or host nation forces. The contractor shall be responsible for all contractor support requirements including supplies, equipment, and infrastructure, water, utility systems, housing, dining, transportation, medical care, and security when those facilities and services are not available. The contractor shall screen contractor personnel to ensure the personnel may be issued a weapon in accordance with applicable U.S. and host nation laws, and shall present the screening results to the COR for approval before a weapon is issued. Detailed information on what support will be required from the contractor shall be provided in the requirements document.

Current Capability Decommission The contractor shall abide by FAR 52.245-1 Government Property and Defense Contract Management Agency instructions pertaining to disposal of Government Property in the removal and disposition of any Government Property when decommissioning existing capability.

The contractor shall provide a report detailing the units and unit serial numbers of the decommissioned property to the official identified.

Item Unique Identification Registration In accordance with DFARS clause 252.245-7001, the contractor shall tag, label, or mark all equipment not previously tag, labeled, or marked. In accordance with DFARS clause 252.211-7007 (revised Aug 2012), the contractor shall ensure applicable equipment is identified in the DoD Item Unique Identification (IUID) Registry. If the item is consumed, destroyed, scrapped, lost, or abandoned during the Task Order performance, the contractor shall update the item status and annotate that it has been disposed of.

Test The Government may require equipment testing prior to the delivery of the equipment to the installation site to ensure reliability and minimize troubleshooting, repair or modification on site.

The contractor shall develop Equipment Test Plans (CDRL F011) and provide them to the COR within 5 days of test conduct.

The contractor shall perform preliminary visual and continuity tests shall on all signal and power cables and all cross-connects to ensure proper termination has been made and no short circuits or interconnecting wiring defects exist prior to energizing each system. The contractor shall conduct installation, operational and reliability tests as part of each installation to ensure that all equipment complies with the performance specifications outlined in the applicable technical manuals, test specifications, engineering plans, and other documentation.

The contractor shall record, date, sign, and provide Equipment Installation Test Reports (CDRL F012) to COR on completion of the tests for each location.

Validation The contractor shall provide Compliance Documentation (CDRL F013) validating that the equipment is operational as installed and tested and provide to the COR within 5 days of the completion of site installation tasks.

The contractor shall inventory all equipment by site and create a Site-specific Inventory Listing (CDRL F014) and provide this to the COR within 10 days of the completion of site installation tasks.

The contractor shall prepare As-built Drawings (CDRL F015) to reflect the completed system installation and provide them to the COR within 20 days of the completion of site installation tasks.

Task 3: Fixed Facility Device Sustainment Preventive Maintenance The contractor shall perform preventive maintenance on EPoS as installed and shall:

· Monitor each installation site

· Develop individual Preventive Maintenance Inspections (PMI) checklists for each system and associated equipment

· Conduct a PMI within a period not to exceed six months from the previous inspection

· Complete checklists during the PMI to document all tests and measurements performed, evaluate components and undertake required maintenance actions

· Adhere to manufacturer’s guidelines to the maximum extent possible

· Develop additional steps for the testing, inspection, and preventive maintenance of that customized functionality should there be additional functionality customized for EPoS

· Include Information Assurance Vulnerability Alerts (IAVA Patching)

· Produce a PMI report with copies of the completed checklists identifying all actions required to bring the system back to its intended level of performance

· Provide all test equipment, tools, support equipment and supplies necessary to perform preventive maintenance

· Calibrate test equipment according to manufacturer recommended standards The contractor shall provide issues, resolutions and timeframes related to preventive maintenance in the Monthly Performance and Progress Report (CDRL F005).

Corrective Maintenance The contractor shall perform corrective maintenance on EPoS as installed and shall:

· Repair or replace any malfunctioning hardware and software; reprogramming, replacing, or updating associated firmware and software as required

· Include Information Assurance Vulnerability Alerts (IAVA Patching)

· Replace the component with new equipment after a third service call following two previous repairs within a two-year period

· Provide all support equipment, tools, test equipment, and supplies necessary to perform corrective maintenance

· Calibrate test equipment according to manufacturer recommended standards

· Obtain customer sign-off on each resolved service call and upload the signed document to the Government designated service call system.

· Perform diagnostics from remote locations when this technique speeds the response, prevents travel, or otherwise proves to be time and cost effective (remote connections are subject to cybersecurity Certification and Accreditation (C&A) requirements)

Conditions reported to the EPoS PMO for corrective maintenance shall be assigned a priority level 1 through 4 based on the following criteria.

capability, or violate security policy and procedures, for example, buyer is unable to obtain account ledger information or a seller is unable to obtain inventory ledger information in order to process base-level transactions.

capability; technical, cost, or schedule risks to the project; or the life-cycle support of the system. No work-around solution is known.

operational or mission-essential capability, and is non-value-added practice for development or support personnel, but does not prevent them from accomplishing their responsibilities.

Corrective action standard response time will be in accordance with the table below. Response and resolution times are measured from the initial ticket assignment until the ticket is resolved.

System Response and Resolution Time Requirements

Task 4: Information System and Industrial Cybersecurity The contractor shall ensure compliance with Federal, DOD and DLA information technology and security requirements, policies, procedures and standards detailed in section 2.2.3 of this Task Order as applicable.

Enterprise Architecture Support and Compliance Support The contractor shall provide Enterprise Architecture Support and Compliance support to assist DLA in ensuring compliance with DOD and DLA IA policy and perform the daily activities required for successful IA Architecture. The contractor shall develop:

· DODAF Diagrams/Models for the solution (CDRL F016)

· Implementation Plan for Solution Cybersecurity Architecture (CDRL F017) Cybersecurity Engineering Support The contractor shall provide systems engineering and engineering support as identified in individual tasks for the solution. The contractor shall develop Cybersecurity Engineering Documentation (CDRL F018) to support this effort that includes, but is not limited to the following requirements

· Developing network models

· Providing technical support in assessing the function, security vulnerability, usefulness,

· and potential applications of current and future technology

· Participating in modifications and improvements to existing cybersecurity products

· Supporting and engineering cybersecurity solutions for the upgrade of the solution to conform to Federal, DOD, or DLA initiatives such as Defense-in-Depth (DID) and Department of Defense Information Network (DODIN) Joint Information Environment (JIE)

· Providing advice during technical reviews and selection, development, and testing of IA components

· Providing technical support in assessing the function, security vulnerability, usefulness, and potential applications of current and future technology, available from commercial, Government, or other sources.

Cybersecurity Assessment Program (CAP) Support DLA relies on information systems to carry out its mission and business functions in a global setting. These systems are susceptible to exploitation through targeted attacks, natural disasters, and human and system errors. Compromise of any information system could jeopardize DLA’s logistical operations and endanger other organizations and national interests. To combat these threats, the Department of Defense utilizes cybersecurity as its first line of defense.

Cybersecurity is the collection of tools, policies, security concepts and safeguards, guidelines, training, and best practices, used to protect the cyber environment, and organizational assets. These assets include connected computing devices, applications, services, telecommunications systems, and the transmitted or stored information in the cyber environment. Cybersecurity strives to ensure the confidentiality, integrity, or availability of such information.

DLA has developed, documented, and implemented the Cybersecurity Assessment Program (CAP) to ensure the confidentiality, integrity, and availability of its information. CAP consists of two major subprograms: the COMSEC Assessment and Assistance Program (not part of this PWS) and the Cybersecurity Compliance Review Program (CCRP). CAP was designed to improve the cybersecurity posture of DLA.

The contractor shall provide CAP Documentation (CDRL F019).

Command Cyber Readiness Inspections (CCRI) CCRI inspections utilize the DISA FSO Security Technical Implementation Guides (STIGs), checklists, USCYBERCOM Communication Tasking Orders, and USCYBERCOM CCRI contributing factors as the evaluation criteria to validate compliance with DOD IA policy, best practices, and configuration requirements. DLA performs two types of CCRIs; staff assistance (SA), and formal. Formal CCRIs are performed as prescribed by the USCYBERCOM published schedule. SA CCRIs are generally performed in conjunction with CVAs. The same methodology is used for both types of CCRI. The contractor shall assist DLA in its CCRI efforts by developing and/or updating the DLA CCRI Methodology (CDRL F020) that defines the approach, actions and appropriate responses used in conducting an inspection. The contractor(s) shall participate in CCRIs, as directed by the Primary or Alternate CORs.

Penetration Testing Support DLA employs Penetration testing to evaluate the security of a computer system or network by simulating an attack from outside and inside DLA’s network boundary. The contractor shall assist DLA in its compliance assessment efforts by developing and/or updating the Penetration Testing Methodology (CDRL F021) that defines the approach, actions and appropriate responses used in conducting a test. The contractor(s) shall participate in Penetration testing, as directed by the Primary or Alternate COR. Testing done outside DLA’s network boundary will be accomplished from a safe, secure facility under the contractor’s control.

Cybersecurity Certification and Accreditation (C&A) Services As required by location, the contractor shall provide cybersecurity program support to assist DLA in ensuring compliance with DOD and DLA IA polices and perform the daily activities required for successful C&A program completion.

· C&A Control Compliance Validation Support

· C&A Process Support

· C&A Analysis Support

· C&A Coordination Support

· C&A Security Documentation (CDRL F022) Support Cybersecurity Plan of Action and Milestones (POA&M) Services As required by location, the contractor shall be responsible for monitoring and tracking the status of all Plans of Action & Milestones (POA&M) weaknesses through to a resolution for DLA.

· POA&M Process Support

· POA&M Analysis Support

· POA&M Coordination Support

· POA&M Documentation (CDRL F023) Support Cybersecurity General Support Services As required by location, the contractor shall provide general IA engineering capabilities and services per individual tasks. General support includes:

· Quality Assurance Support

· Program Reviews Support

· Centralized Administrative, Clerical, Documentation and related Support

· Progress/Status Reporting Support (Include in MPPR CDRL F005) Federal Information Security Management Act (FISMA) Tracking and Reporting As required by location, the contractor shall be responsible for validating, compiling, tracking and reporting information in the Federal, DOD or DLA approved Federal Information Security Management Act (FISMA) tracking tool.

· FISMA Process Support

· FISMA Analysis Support

· FISMA Coordination Support

· FISMA Documentation (CDRL F024) Support Applicable Cybersecurity Controls (Baseline) Overall, the contractor shall incorporate and document the security practices used in the development of the solution and changes to the solution. The security practices shall be modeled after industry best security practices and principles. Examples of best practices can be found at http://iase.disa.mil.

The solution shall comply with the specific requirements in the Indefinite Delivery Indefinite Quantity (IDIQ) PWS, section 5.6.9 in accordance with the security requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r4, “Security and Privacy Controls for Federal Information Systems and Organizations”. It is important to note that the section 5.6.9 controls were derived from a preliminary system categorization utilizing the processes and procedures defined in the Federal Information Processing Standards (FIPS) Publication 199. The preliminary system categorization for Confidentiality, Integrity, and Availability (CIA) is MODERATE overall.

It is important to note not all of the controls cited will be the responsibility of the contractor; however, the contractor shall be prepared to provide support services as required.

Cybersecurity controls are specific to Information Technology (IT) Information Systems (IS).

Applicable Cybersecurity Controls (Industrial Control System Enhancements) The solution shall comply with the specific requirements in IDIQ PWS, section 5.6.10 in accordance with the security requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-82r2, “Guide to Industrial Control Systems (ICS) Security”. It is important to note that the IDIQ PWS section 5.6.10 controls were derived from a preliminary system categorization utilizing the processes and procedures defined in the Federal Information Processing Standards (FIPS) Publication 199. The preliminary system categorization for Confidentiality, Integrity, and Availability (CIA) is MODERATE overall.

It is important to note, not all of the controls cited will be the responsibility of the contractor; however, the contractor shall be prepared to provide support services as required.

Cybersecurity controls are specific to Supervisory Control and Data Acquisition (SCADA) Systems and other control system configurations such as Programmable Logic Controllers (PLC).

Task 5: System Documentation The contractor shall provide and maintain operator level, administrative personnel, and equipment maintenance Documentation (CDRL F025) for equipment delivered on this Task Order; deliver documents in a contractor proposed Government approved format.

Key Personnel Note: All Labor Categories will require that contractor resources possess an Information Technology (IT) Level I Security Clearance.

Program Manager The Program Manager shall manage all day-to-day operations including administrative functions, assessing risks and identifying unstated assumptions, and resolving interpersonal conflicts in support of making the program successful.

Duties and Responsibilities:

The Program Manager acts as manager and overall point of contact for all work on this contract and:

· Directs staff and reviews work products for completeness and adherence to customer requirements

· Provides communication to management to review project plans, status reports, and deliverables

· Develops overall project milestones and monitors the execution of the project against planned time lines

· Directs and reviews program plans, status reports, and deliverables with program director and project teams

· Provides technical and functional management to one or more project teams for specific projects or sub-tasks Education and Experience:

The Program Manager must possess minimum of Bachelor’s Degree from an accredited college or university in related field. Preferred: Technical degree or direct experience in engineering and/or systems development and Master’s Degree. Requires minimum of 10 years of experience as a Program/Project Manager or Team Lead with increasing responsibility, preferably with experience managing fuel industry related projects.

The Program Manager shall have a technical background as well as a management background. The Program Manager has experience with the execution and management of information technology (IT) programs. This includes direct experience in leading and executing IT solutions in the private or public sector. Experience includes:

· Program management of technically and functionally diverse and complex IT programs.

· Implementation of detailed management techniques such as Critical Path Method (CPM) and Earned Value Management.

· Complex product configuration management and control.

· Business case development.

· IT solution architectural analysis and design.

· Detailed migration planning and trade-off analysis.

· System data exchange design, development, and implementation.

· Hosted application support/management in environments without direct contractor control Cybersecurity Engineer The Cybersecurity Engineer shall manage all day-to-day cybersecurity operations including administrative functions, assessing risks and identifying unstated assumptions, and resolving interpersonal conflicts for the solution in support of making the program successful.

Duties and Responsibilities:

The Cybersecurity Engineer ensures the cybersecurity of the system is in accordance with Federal and DOD requirements and:

· Determines applicable enterprise cyber and security standards

· Develops and implements defined cyber/security standards and procedures

· Coordinates, develops, and evaluates security programs for an organization

· Recommends cyber/security solutions to support customer requirements

· Identifies, reports, and resolves security violations

· Establishes and satisfies cyber and security requirements based upon the analysis of user, policy, regulatory, and resource demands

· Supports customers at the highest levels in the development and implementation of doctrine and policies

· Applies know-how to Government and commercial common user systems, as well as to dedicated special purpose systems requiring specialized security features and procedures

· Performs analysis, design, and development of security features for system architectures

· Analyzes and defines security requirements for computer systems which may include mainframes, workstations, and personal computers

· Designs, develops, engineers, and implements solutions that meet security requirements

· Provides integration and implementation of the computer system security solution

· Analyzes general cyber-related technical problems and provides basic engineering and technical support in solving these problems

· Performs vulnerability/risk analyses of computer systems and applications during all phases of the system development life cycle

· Ensures that all information systems are functional and secure Education and Experience:

The Cybersecurity Engineer must possess minimum of Bachelor’s Degree from an accredited college or university in related field. Preferred: Degree in computer science, computer engineering, advanced analytics, applied mathematics, or physics. Requires minimum of 8 years of relevant experience.

The Cybersecurity Engineer shall have demonstrated an understanding of the cybersecurity requirements and system engineering processes, is aware of business objectives, and shall be proficient in advanced internal/external network routing and switching technologies. Experience includes:

· CISSP at a minimum with a preference for CISSP- IA Workforce System Architect or Engineer (IASAE)

· A clear understanding and relevant experience of at least three years with the design, maintenance and operation of highly complex and high secure communications network environments

· An understanding of embedded systems

· Multi-discipline experience with Firewall/IPS, Antivirus, host-based protection, security incident (i.e. Contingency/COOP, Investigative forensic) event management, virtual shared computing environments and network/security management

· A solid understanding of communication protocols, network technologies and the ISO Open Systems Interconnection telecommunications model, solid troubleshooting skills and methodologies

· Knowledge of Defense Information and Accreditation Risk Management Framework (RMF) and process for system and application controls

· Knowledge of DOD/DLA security policies and CERT compliance

· DOD 8570.01 Information Assurance Manager level III Certification Senior Applications Programmer The Senior Applications Programmer is responsible for translating technical software and hardware specifications into software and hardware design and providing IT technical guidance to site-specific installers. The Senior Applications Programmer shall provide project leadership as the principal designer under this PWS.

Duties and Responsibilities:

· Collaborates with business analysts, architects, others to plan, design, develop, test, and maintain applications

· Collects and documents user requirements

· Prepares reports, manuals and other documentation on the status, operation and maintenance of application software

· Designs, develops, and unit tests applications in accordance with established standards

· Participates in peer-reviews of solution designs and related code

· Packages and supports deployment of releases

· Develops, refines, and tunes integrations and interfaces

· Configures services for performance, security, and error handling

· Analyzes and resolves technical and application problems

· Assesses opportunities for application and process improvement

· Assists in determining and enforcing development standards and best practices

· Performs application related Security Technical Implementation Guides (STIGs) and vulnerability reporting Education and Experience:

The Senior Applications Programmer must possess minimum of Bachelor’s Degree from an accredited college or university in related field. Requires minimum of 5 years of combined experience in hardware and software configuration for the selected solution. Two years or more experience in international implementations; this can be in conjunction with the five years of experience requested above. Experience includes:

· Certification in applicable experience areas

· Proficiency in analyzing user-defined functional, technical system requirements as well as writing design and technical specifications

· Proficiency in drafting integration test plans and integration test cases as well as executing and documenting integration testing activities

· Proficiency in complex testing and debugging of hardware and software solution

· Knowledge of Section 508 compliance Database Administrator The Database Administrator (DBA) manages all database administrator functions to include, but not limited to, database design, recoverability, integrity, security, availability, performance and development and testing support.

Duties and Responsibilities:

· Provides all activities related to the administration of computerized databases

· Projects long-range requirements for database administration and design in conjunction with others working EPoS applications

· Designs, creates, and maintains databases in required environments

· Conducts quality control and auditing of databases in required environments to ensure accurate and appropriate use of data

· Advises users on access to various databases

· Designs, implements, and maintains complex databases with respect to access methods, access time, device allocation, validation checks, organization, protection and security, documentation, and statistical methods

· Applies knowledge and experience with database technologies, development methodologies, and front-end/back-end programming languages

· Performs database programming and supports systems design

· Includes maintenance of database dictionaries, overall monitoring of standards and procedures, file design and storage, and integration of systems through database design

· Performs database related Security Technical Implementation Guides (STIGs) and Vulnerability Management System (VMS) reporting Education and Experience:

The Database Administrator must possess minimum of Bachelor’s Degree from an accredited college or university in related field. Requires minimum of 5 years of experience in projects using the solution database management system. Experience includes:

· DOD 8570.01 IAM level III Certification

· Demonstrated experience with:

· Database designing development and management to include, but not limited to: Web Services/XML, materialized views, performance tuning, and database modeling

· Data engineering or management of data warehouses with multiple environments with multiple sources of inbound data

· Knowledge of:

· Creating, deploying, and executing database scripts and stored procedures as well as in creating, maintaining and optimizing application database table, triggers, materialized views, configurations and interfaces

· Executing data migration tasks to include ETL tasks

· Risk Management Framework (RMF) processes for application controls

· DOD/DLA security policies and CERT compliance Systems Engineer The Systems Engineer provides support of the design, execution, and oversight of IT projects.

Duties and Responsibilities:

· Supports all program and project planning and milestone development

· Supports business case analysis and identification of alternative solutions and resulting business impacts Education and Experience:

The Systems Engineer must possess minimum of Bachelor’s Degree from an accredited college or university in related field. Requires minimum of 6 years of experience in a network management environment.

The Systems Engineer has experience with the design, execution, and oversight of IT projects. This includes direct experience in the design and development of integrated software and hardware solutions in the private or public sector. Experience includes:

· Security+ or equivalent IAT/IAM/IASAE Level II

· Detailed functional analysis and gap/fit analysis of software solution packages.

· Software solution package selection and business case development.

· Software and system developmental and acceptance testing.

· Legacy system data exchange design, development, and implementation.

Deliverables Deliverable Requirements The COR will review all deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance with…