STATEMENT OF WORK - CCTV draft.pdf

STATEMENT OF WORK

STATEMENT OF WORK

AACS SUSTAINMENT

1. SCOPE

The Fire and Security Directorate of the headquarters of Commander, Norfolk Naval Shipyard (NNSY) in Portsmouth, Virginia provides operational support for the protection of vessels housed in the shipyard. Ships and commands within the shipyard must use a Closed Circuit Television (CCTV) system to monitor any areas that cannot be viewed by a guard from their guard post. The CCTV system function is to record, collect, and allow viewing of security events for quick assessment. The contractor shall provide Life Cycle Support for the NNSY CCTV to include telephonic support, on-site support, hardware/software support, defect corrections, preventative maintenance and inspection, system administration and updates, documentation updates and refresher training.

2. PERIOD OF PERFORMANCE

See Period of Performance for each line item here within.

3. HOURS OF OPERATION

Work shall be performed during the Government's regular business hours, except for time critical responses. Regular business hours are Monday through Friday between the hours of 7:20 AM and 4:00 PM, except federal holidays. The federal holidays are Columbus Day, Veteran’s Day, Thanksgiving Day, Christmas Day, New Year’s Day, Martin Luther King, Jr.

Day, Presidents Day, Memorial Day, Independence Day, Juneteenth, and Labor Day. Time critical responses shall be as follows: Telephonic Support shall be provided within 1 hour, On-Site/hardware/software support shall be within 4 hours of notification, and all defect correctable items shall be corrected within 8 hours, except for during reactor servicing missions, during which on-site/hardware/software support shall be within 2 hours of notification. Exceptions to the above must be reviewed and approved by the customer and scheduled in advance to allow for proper planning and notification of a ected parties.

4. PLACE OF PERFORMANCE

The place of performance will be at NNSY, to include all Naval Sea Systems Command (NAVSEA) controlled areas and spaces.

5. SECURITY CLEARANCE

Work under this contract shall be Secret; access to Navy information systems and to the NNSY Controlled Industrial Area will be required. The contractor shall submit a DD-254 identifying that access to restricted data information will be required. The contractor shall comply with all applicable Department of Defense (DOD) security regulations and procedures during the performance of the contract. Contractor’s employees must be able to obtain and maintain the necessary clearances to perform the work required by the Statement of Work. The contractor shall not disclose, and must safeguard procurement, sensitive information, computer systems and data, privacy act data, and Government personnel work products, which are obtained or generated in the performance of the contract. The Trustworthiness – Security information in Section 12 below is applicable to this solicitation and resulting contract.

Contractor’s employees supporting software/cybersecurity functions must be able to obtain and maintain current DOD Cybersecurity Workforce (CSWF) requirements as well as maintain the appropriate security level clearance.

5.1 DEFENCE BIOMETRIC IDENTIFICATION SYSTEM AND NAVSEA BADGING

All contractors, with the exception of permanent party (or “seated” contractors with Common Access Cards (CACs), will be required to obtain a DBIDS card to gain access to

NNSY.

Procedure for receiving a DBIDS card:

a. Contractor will complete the SECNAV 5512 form(s) and forward them to their NNSY Sponsor/Contracting O icer’s Representative (COR).

b. The sponsor will complete the CVS spreadsheet utilizing the information on the completed SECNAV5512 forms and forward all documents to Commander Navy region Mid-Atlantic (CNRMA) for vetting.

c. CNRMA will add the contractor to the “179-Day List” which is utilized by the Pass and ID o ice to create the DBIDS card.

d. Once on the 179-Day List, the contractor may go to Pass and ID to have their DBIDS card generated.

e. Green NAVSEA access badges can be generated at this point with contractors providing proof of U.S. Citizenship (Birth Certificate/ US Passport).

5.2 PORTABLE ELECTRONIC DEVICES (PEDS)

A PED is defined as any non-stationary electronic apparatus with singular or multiple capabilities of, but not limited to recording, storing, and/or transmitting data, voice, video, or photo images (e.g., cell phones, laptops, tablets and wearable devices such as fitness bands and smart watches).

a. NAVSEA 04 Ser 04/281 IMPLEMENTATION PLAN FOR ALLOWING CAMERA-

PORTABLE ELECTRONIC DEVICES WITHIN THE CONTROLLED INDSUTRIAL AREA

b. NAVSEAINST 2200.1A PORTABLE ELECTRONIC DEVICES POLICY

c. SECPROMAN Vol 1 5510.36 Rev E

In accordance with ref (a), personally owned camera enabled PEDs will be authorized inside of the Controlled Industrial Area (CIA) and all Security Islands. Camera enabled PEDs will remain unauthorized within Controlled Nuclear Information Areas (CNIAs), Nuclear Work Areas (NWAs) and Open Storage Areas.

All PEDs, camera enabled or not, are still prohibited within NWAs and Open Storage Areas.

The allowance of camera enabled PEDs inside of the CIA and Security Islands does not negate existing photography policies. Uno icial photography, filming of video, or live streaming from the camera-enabled PED remains prohibited within the CIA or any NAVSEA controlled space outside of the CIA. Further, audio recordings (both digitally or magnetically) in NAVSEA spaces is prohibited without the approval of the Code 1120 Security Director.

Submarine SPECIFIC PEDs Instructions: In accordance with COMSUBLANT/ COMSUBPACINST 2075.1C, the use of PEDs while in or on Department of Navy Submarines are prohibited.

5.3 ACCESS TO CLASSIFIED INFORMATION OR SPACES

All contractors executing this contract are required to have a minimum security clearance of Secret.

All contractors requiring access to classified information, or those spaces containing un-sanitized classified information, shall possess a final security clearance.

In addition to completing the steps above, if the contractor requires access to classified information, spaces, or equipment in accordance with the requirements of the contract, the contracting company’s Facility Security O icer is required to submit a visit request in the Defense Information System for Security (DISS) to Security Management O ice (SMO) Code 001816.

The SMO Code(s) of the ship or command the contractor is visiting are not to be utilized.

After receiving a DBIDS card, their visit request, security clearance and access permissions (verified in DISS) are reviewed to ensure they meet the minimum security requirements set forth in the contract. Once verified, the contractor will receive the appropriate NAVSEA access badge.

5.4 RESTRICTED DATA SPECIFIC

All contractors requiring a red NAVSEA badge and access to Restricted Data (RD) shall have a final security clearance.

Red NAVSEA badge personnel may require access to Nuclear Areas, Nuclear Information, Nuclear equipment, Naval Nuclear Propulsion Information (NNPI), RD, and Not Releasable to Foreign Nationals (NOFORN) data due to the nature of the work being performed on Naval Nuclear propulsion systems.

A red NAVSEA badge is necessary for the execution of nuclear and some non-nuclear work;

inclusive of the propulsion plant and secondary spaces as well as those systems which support the propulsion plants which may not be located in the propulsion plant when any of those spaces can’t be sanitized.

Access to RD and the issuance of red NAVSEA badges will be issued in accordance with

NAVSEA M-5510.2.

5.5 CONTROLLED UNCLASSIFIED INFORMATION ACCESS

The DoD will provide information to contractors and will identify all information which is Controlled Unclassified Information (CUI) via the contracting vehicle, in whole or part, and will mark such documents, material, or media in accordance with this issuance.

When CUI is generated by non-DoD entities protective measures and dissemination controls, including those directed by relevant law, regulation, or government-wide policy, will be articulated in the contract, grant, or other legal agreement, as appropriate.

DoD contracts must require contractors to monitor CUI for aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information. DoD contracts require contractors to report the potential classification of aggregated or compiled CUI to a DoD representative.

Contractors, pursuant to mandatory DoD contract provisions, will submit unclassified DoD information for review and approval for release in accordance with the standard DoD Component processes and DoDI 5230.09.

All CUI records must follow the approved mandatory disposition authorities whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and this issuance.

6. REQUIREMENTS

Due to the technical nature of the CCTV system, delay of support could result in the delay in use of a Navy Critical asset, denied access to these assets, and will be felt across the Force. The contractor will provide the required services in the form of repair, preventative maintenance and updates for one (1) year. Services to include telephonic support, on-site support, hardware/software support, defect correctable support, preventative maintenance/inspection support, system/application administration and update support, documentation update support and operator/admin refresher training. In order to meet the goals set forth by the Department of the Navy (DON), additional expertise and requirements are needed as follows:

• Company must be a Milestone Certified Partner

• Company must have certified personnel qualified as a Milestone Certified

Integration Technician

• Company must have certified personnel qualified as a Milestone Certified Design

Engineer

• Company must have certified personnel qualified as a Milestone Certified

Integration Engineer

• Company must have experience in deploying CCTV configurations, specifically

Milestone.

• Company must be an ISO9001:2008 registered company without exceptions

• Company must have experience with Federal Government Certification and

Accreditation (DIACAP) processes and procedures

• Company must have experience with Federal procurement procedures (FAR, etc.), GSA Schedules and fair and reasonableness price justifications

• Company must procure materials from manufacturer’s approved, authorized vendors to prevent “Grey Market” products from being provided to customer.

• Company must have personnel capable of acquiring and maintaining the necessary clearances to perform the work of this task order

• Company must have system and equipment qualified personnel capable of responding on site within four (4) hours to a non-emergency and within two (2) hours during reactor servicing operations called by an authorized NNSY representative as designated by a Technical Point of Contact.

7. STATEMENT OF WORK TASKS:

7.1 Hardware & Software Support Coverage

The contractor will provide NNSY with on-site support with customer-owned equipment, troubleshooting and issue resolution for all hardware and software components of the system to include:

• Cameras, power supplies, cabling and other relevant devices.

• Servers, switches and firewalls associated with the security systems installed and managed by NNSYC109.

• Manufacturer software and firmware updates.

• Factory Software Support Agreement (SSA) – Period of Performance 1/1/2022-

12/31/2022

• Test/Inspection – CCTV Camera Hardware – Once per Year

• Corrective Maintenance – CCTV – As needed

7.2 Defect Correctable

The contractor will provide NNSY with coverage for those non-preventative and non-warranty type issues that would typically result in a separate charge. These services will be provided on an as needed basis upon initial inspection/service by NNSY technical personnel. Defect correctable timeframes will be minimized since NNSY has an on-site spare parts pool that can be leveraged to limit downtime. It is assumed that the existing spare parts pool shall be maintained at its current level.

7.3 Preventative Maintenance/Inspection

NNSY will maintain an inventory of all security devices such as servers, cameras, and other system devices. This ongoing inventory list will be updated during each preventative maintenance visit to reflect the status of each device to include any discrepancies found, the time and date of inspection and any recommended corrective actions.

On a scheduled basis, the contractor will provide security system preventative maintenance (PM) services for supported components. During each scheduled PM visit, the contractor will test and inspect a subset of all covered security components, thus providing complete component system testing on an annual basis. All PM testing will be performed in accordance with manufacturer’s recommendations and will address areas that can adversely a ect system performance. Predictive maintenance will include a visual inspection and functional test of all covered security components.

The following software maintenance tasks will be completed by the contractor on a regularly scheduled basis:

• Milestone integrity and inspection with software updates (Monthly) o Software Audit/Maintenance Health Check o HBSS updated HIPS Signature – Audit Research o ACAS patching – Audit Research o Onsite Troubleshooting

• Milestone version upgrades – Test Environment checkout (Semi-Annually) o Software Upgrade Test Configuration/Implementation o HBSS updates HIPS FW Ports & Protocol o Prepare POA&M for upgrade NNSY submission o Software Updates & Associated Documentation – CCTV Software – Ongoing throughout the year (minimally twice per year) Includes both Test & Production Environment deployments o Telephonic Support for all items – As needed

7.4 NNSY C109 Milestone Semi-Annual Maintenance Cybersecurity Assessments:

The contractor will provide the subject matter expertise to support the ongoing RMF compliance and risk mitigation of findings for the NNSY Milestone and related IP based field equipment.

Contractor subject matter experts will perform implementation & testing of controls and risk mitigation of findings discovered during ACAS scan and risk analysis.

The authoritative documents to be used in these phases are, but not limited to the following.

• Risk Assessment Report (RAR)

• Documented POA&Ms

• ACAS and SCAP reports

• Recommended remediations consistent with NNSY IT security policy and RMF systems categorizations

Utilizing the above assessment data, the contractor, in conjunction with the Security o ice team will work together to implement, mitigate and document recommended controls to be consistent with NNSY IT security policy and risk mitigation requirements.

7.4.1 Remediation of findings (Tasks)

Task-1:

a. The contractor /Security o ice team will verify/implement/document the needed technical and administration controls.

b. Modification of Technical Controls will be compared with previous baselines and documented to reflect, but not limited to the following. I.E.

• Resource management needed

• Changes to network attached security devices

• Approved Infrastructure changes modifying the current baseline security posture o Software Versions o Firmware Versions o OS updates and patches

c. Administration of Controls including the following:

• Providing product Subject Matter Expertise (SME) updating and developing Milestone IT security policies I.E.

o Standards o Procedures o Guidelines

• Ensure consistency of controls between both NNSY production and test environments

Task-2

a. The contractor will provide product SME assistance to maintain Milestone Cybersecurity compliance.

b. The contractor will provide SME assistance with the evaluation of current NNSY IT security reporting related to Milestone and the physical security infrastructure. I.E

• Updates to OS STIG-CKLS for each OS related to the Milestone servers and database infrastructure

• Updated SCAP reporting for each OS

• Updated ACAS reports

c. The contractor will provide the product SME expertise to assist in mitigating potential security findings by identifying controls and risk mitigation options compliant with IT Security Policy, while minimizing potential operational impacts to the security infrastructure.

d. The contractor will assist in the ongoing cybersecurity evaluation of both the test and production environments. This will include updating the following documentation to be consistent with the current operating environment:

• Risk Assessment Report (RAR)

• POA&M (Where needed)

• ACSAS and SCAP Reporting

• Document any new recommended remediation’s or changes to the baseline environment

7.4.2 Milestone End-of-Year (EOD) Audit Maintenance (Tasks)

a. Audit EOD Cybersecurity items related to all phases from the previous baseline (where needed)

b. Produce an EOD Milestone Cybersecurity/System/Network updated resolution/ recommendations to NNSY C109 from the audit

7.4.3 Documentation Updates

Proper documentation is critical to ongoing maintenance, support and expansion e orts.

The contractor will maintain documentation of all system components and configurations as follows:

• Drawing Updates: Keep all drawings up to date.

o New projects, system adds/deletes will be covered under the new project.

• CCTV Port Charts:

o Camera Names, Locations, ACS Panel Mappings, etc.

o I/O Point Mappings

• Head-End Components:

o Devices, IP Addresses, Software Versions, Port Assignments, etc.

8. GOVERNMENT TECHNICAL POINT OF CONTACT (TPOC):

8.1 The following persons will be the Contracting O icer’s Technical Point of Contact under this contract and the persons responsible for performing inspection and acceptance of the new AACS system.

**TO BE RELEASED UPON CONTRACT AWARD**

9. TRUSTWORTHINESS - SECURITY

Purpose: Reference is hereby made to contracts requiring contractor access to Navy information systems, sensitive unclassified information or areas critical to the operations of the command. Although these contracts are not classified and therefore contractor employees are not required to have obtained a National Agency Check (NAC) trustworthiness determination, the Department of the Navy (DON) has determined that all DON information systems are sensitive regardless of whether the information is classified or unclassified. A contractor whose work involves access to sensitive unclassified information warrants a judgment of an employee's trustworthiness. Therefore, all personnel accessing DON computer systems must undergo a National Agency Check to verify their trustworthiness. Also, Commands will include Facility Access Determination (FAD) program requirements in the contract specifications when trustworthiness determinations will be required on the contractor employees. The following addresses those requirements for Trustworthiness Security.

“Each contractor employee will have a favorably completed National Agency Check (NAC).

If contractor personnel currently have a favorably adjudicated NAC the contractor will notify the Security Manager of the command they will visit utilizing OPNAV 5521/27 Visit

Request form. The visit request will be renewed annually or for the duration of the contract if less than one year.

If no previous investigation exists, the contractor personnel will complete the requirement for a Trustworthiness NAC.

In accordance with NAVSEA Manual 5510.2C, no Foreign National contractors or sub-contractors are allowed at Norfolk Naval Shipyard (NNSY). Unless previously approved by NAVSEA08 and the Navy International Program O ice (NAVIPO).

The Trustworthiness NAC is processed through the command Security Manager. The NAC will be processed through the use of the Electronic Personnel Security Questionnaire (EPSQ) SF 85P. The EPSQ software can be downloaded at the Defense Security Service (DSS) website http://www.dss.mil/epsq/index.htm. The contractor should provide the completed EPSQ electronically (electronic mail/diskette) to the Command Security Manager along with the original signed release statements and two applicant fingerprint cards (FD 258). The responsibility for providing the fingerprint cards rests with the contractor. The Security Manager will review the form for completeness, accuracy and suitability issues. The completed SF 85P along with attachments will be forwarded to (DSS) who will conduct the NAC.

The Department of the Navy Central Adjudication Facility will provide the completed investigation to the requesting command security manager for the trustworthiness determination. The command will provide written notification to the contractor advising whether or not the contractor employee will be admitted to command areas or be provided access to unclassified but sensitive business information.

Trustworthiness determinations are the sole prerogative of the commanding o icer of the sponsor activity. If the commanding o icer determines, upon review of the investigation, that allowing a person to perform certain duties or access to certain areas, would pose an unacceptable risk, that decision is final. No due process procedures are required.

The contractor employee shall take all lawful steps available to ensure that information provided or generated pursuant to this arrangement is protected from further disclosure unless the agency provides written consent to such disclosure."