Attachment 0010 - Draft PWS 10 Information Technology.pdf

DRAFT

INFORMATION TECHNOLOGY

PERFORMANCE WORK STATEMENT (PWS) 10

June 2025

1. Scope The contractor shall provide the Network Enterprise Center (NEC) services in accordance with (IAW) the Army Information Technology (IT) Portfolio to ensure uninterrupted service to Hawthorn Army Depot (HWAD) on both the Secure and Non-Secure Internet Protocol Routed Networks. The systems supported under this Performance Work Statement (PWS) consist of commercial, modified-commercial and specially designed equipment items (i.e. National Crime Information Center Interstate Identification Index Level III (NCIC III) and Enterprise Energy Data Reporting System).

2. Environment and Infrastructure Overview

2.1. Description

HWAD employees are located in separate offices or cubicles, supported by networked or stand-alone Army IT Portfolio (AITP) systems (unclassified and at various classification levels). The working environment typically requires controlled access to unclassified/classified information.

The AITP is defined as the totality of capabilities which are owned and operated at HWAD.

Included in this definition are the Local Area Networks (LANs) (comprised of copper and/or fiber network media) that reside within the physical spaces controlled by the site and the systems the site takes with them when deployed or travelling in support of other mission requirements.

Services provided by the Enterprise (i.e., Department of Defense (DoD) or Army) are not included in this definition and are not the responsibility of the contractor. Note: the contractor shall be responsible for maintaining the interfaces between HWAD infrastructure and the Enterprise capabilities.

2.2. Typical Infrastructure Description

A typical supported infrastructure may include Commercial Off The Shelf/Government Off The Shelf (COTS/GOTS) hardware and software; COTS/GOTS communication and supporting security equipment; and the AITP including: Local, Metropolitan, and Wide Area Networks; secure storage devices, workstations and servers (of different types, such as Web servers); printers, copiers, scanners, and facsimiles; telephones, smart phones, wireless devices, Voice Over Internet Protocol phones, badge readers, digital senders, and related support devices necessary for the effective operation.

3. Performance Objectives The contractor shall provide all services and support per the AITP necessary to ensure HWAD IT

Systems meet current approved Army imaging standards and provide established operational functions necessary to support HWAD. The contractor shall provide the principal services as outlined in the AITP and this PWS. See AITP in Attachment 1.

3.1. Network Operations

The contractor shall plan for implementing all Government approved and mandated releases and updates as necessary to meet system performance requirements. The contractor shall anticipate updated requirements by staying abreast with industry developments and trends and Government initiatives that are relevant to the components of the AITP systems. The contractor shall plan for and schedule updates and maintenance to minimize service disruptions and accommodate government approvals and configuration management processes. The contractor shall ensure reliable, uninterrupted access, and availability. System operation during surge requirements (i.e., in support of exercises or other mission essential activities) shall be as directed by the Government. The contractor shall provide preventative and remedial maintenance for the site’s AITP systems.

Records shall be maintained and available upon request.

3.1.1. System, Network, and Database Administration. The contractor shall perform administration, maintenance, diagnosis and restoration on all AITP Portfolio systems, databases, and networks. The contractor shall provide monthly reports to the Procuring Contracting Officer (PCO) regarding IT system availability and status of all updates, repairs, and remedial maintenance activities. (CDRL K001).

3.1.2. System Backup. The contractor shall conduct scheduled backups of the site's data (on all networks) in accordance with operational and business requirements. This effort shall include the management and operations of the site’s Network- Attached Storage (as appropriate) and replication of off-site data IAW HWAD Standard Operating Procedures (SOPs).

3.1.3. Network Monitoring. The contractor shall monitor network performance to ensure it is operating efficiently and customers have the capabilities needed for mission execution. The contractor shall identify trends of degrading performance and facilitate fault isolation and preventative and remedial maintenance as appropriate. The contractor shall notify the HWAD PCO when the System experiences a component failure. The contractor shall receive and prepare electronic notifications to the Administrative Contracting Officer (ACO) on all scheduled network outages. The contractor shall monitor services on all local and wide area networks for optimum operability using a variety of network monitoring tools, report outages to the PCO and ACO, and initiate support within 30 minutes of initial loss of service. The contractor shall gather information and track outages until connectivity is restored and provide updates to the PCO and ACO until systems are fully restored.

3.1.4. Emergency Mass Notification System. The contractor shall provide administration and maintenance or all applicable accounts to include the Amerilert System or other designated secure messaging capability.

3.1.5. Account Management. The contractor shall provide server virtualization administration and maintenance for the virtual environments (i.e., virtual private servers, guests, instances, containers or emulations).

3.1.6. Server/System Administration. The contractor shall provide server virtualization administration and maintenance for the virtual environments (i.e. virtual private servers, guests, instances, containers or emulations).

3.1.7. LAN Administration. The contractor shall provide daily LAN administration using government provided products and provide daily system and administration delegated by the government administrators such as creation, maintenance, and deletion of user email accounts IAW all applicable regulations.

3.1.8. Enterprise Active Directory Management. The contractor shall provide Active Directory support, network security administration, and maintenance for all domain controllers. The contractor shall be responsible for authenticating all users and computers within a network of Windows domain type, assigning and enforcing security policies for all computers in a network, and installing or updating software on network computers.

3.2. Operational Maintenance.

The contractor shall perform scheduled maintenance to ensure consistent and reliable service availability to customers. The requirement to perform specific scheduled maintenance may result from manufacturers recommended service intervals, alerts and bulletins, available patches and updates, directions from the government’s change management process, or other sources (to include Information Assurance Vulnerability Alerts).

3.2.1. Change Management. The contractor shall ensure all IT system changes are captured IAW local change management processes and systems and shall provide visibility to any devices being attached to the network. The contractor shall follow change management regulations for all purchases and services and coordinate at the HWAD level through the change management authority. Changes shall include, but are not limited to, changes to HWAD's mission objectives; directives from higher authority;

original equipment manufacturer (OEM) best business practices or warranty requirements; release of new technology; advances in commercial/Government technology, or contractor recommendations. The contractor shall ensure that all software and hardware is net worthy, maintained, and documented.

3.3. Hardware Management

3.3.1. Asset Management. The contractor shall maintain the site’s hardware asset inventory in the Government's Army Enterprise System Integration Program (AESIP), Defense Property Accountability System (DPAS) or another database as directed. The contractor shall employ the Army Systems Integration Management Intelligence Database in accordance with the site’s IT service-level management processes and inventory controls. The contractor shall support the HWAD's equipment receipt and control management business process. The contractor shall document, manage, and maintain the sites hardware baseline and manage and maintain a configuration library for the site’s configuration documentation identified by HWAD’s change management authority. The contractor shall provide AESIP/DPAS maintenance and inventory reports.

(CDRL K002).

3.3.2. Cable Plant Management. The contractor shall update and maintain an active database of cable plant configuration and label cables appropriately to ensure accurate identification of cable locations and equipment supported by that cable. The contractor shall install, maintain, manufacture, and reconfigure as necessary.

3.3.3. The contractor shall support HWAD’s equipment replacement program. This includes, but is not limited to, listing all HWAD AITP equipment, developing a plan to support HWAD’s refresh criteria (age, serviceability, reparability, cost savings, criticality, etc.), and making recommendations for HWAD’s emerging technical and architectural requirements.

3.3.4. Equipment Installation. The contractor shall perform installation/de-installation of supporting hardware including, but not limited to, personal computers, communications closet components and all associated infrastructure supporting the networks in response to automation work requests. No refurbished equipment shall be utilized without prior government authorization. The contractor shall install, and de-install hardware and software as required to ensure consistent and reliable service availability to customers. Installations and de-installations may result from repairs, replacements, or other maintenance actions. All installations and de- installations shall be in accordance with manufacturer and/or HWAD specific instructions. De-installed components and software shall be sanitized IAW appropriate security procedures. The contractor shall ensure all installations include appropriate functional verifications to ensure serviceability and documentation IAW change management authorities.

3.3.5. Update/repair/replace (break fix) system hardware. The contractor shall repair and/or replace system hardware as required to ensure consistent and reliable availability to the site customers (as defined by OEMs, industry best practices, and Federal/DoD mandates). Repair/replace actions may result from a notification (e.g. trouble ticket) and/or malfunction discovered by the system operations staff. The contractor shall track each repair or replacement action from identification through completion of repair or replacement and functional/system verification to ensure all repairs or replacements are completed accurately and in a timely manner utilizing HWAD’s change management system.

3.4. Software Management. The contractor shall provide software management support, in accordance with the change management process, which requires knowledge of current and emerging technologies and trends in the software field, knowledge of inventory, and configuration management procedures as applied to software architecture.

3.4.1. The contractor shall support the software standards and compliancy program. This includes implementing control procedures for updating software baseline documentation as required. The contractor shall perform research to ensure the latest approved software versions are being used.

3.4.2. The contractor shall conduct periodic software baseline verification inventories to correct documentation deficiencies and perform on-the-spot audits of HWAD computer systems documenting findings as required in support of DoD software compliancy directives. The contractor shall keep an accurate, updated inventory of all software licenses to include volume licenses, site and enterprise agreements and shall ensure that media and/or software distribution processes are in place for software installation world-wide. This process could include packaging and mailing media where required or utilizing vendor-supported distribution web- sites.

3.4.3. Utilizing Information Technology Infrastructure Library (ITIL) best practices, the contractor shall support management of the software media library which includes receiving new software, updating the software tracking database, creating back-up copies of software, and filing software in the library. The contractor shall determine and dispose of obsolete software in compliance with applicable disposal policies while ensuring that software requirements are properly staffed through existing requirements approval processes. The contractor shall coordinate with Army Small Computer program to determine if software is available through the Enterprise Software Initiative (ESI) and secure required waivers, as appropriate, set up or delete accounts and provide or remove privileges IAW guidance from the Software Manager or established procedures.

3.5. Business Processes

3.5.1. ITIL Implementation. The contractor shall support and assist in implementing ITIL best practices into AITP processes to improve efficiency.

3.5.2. Business Case Analysis. The contractor shall use business case analysis tools to develop plans to improve processes, efficiency, and effectiveness.

3.5.3. The contractor shall assist the Government representative in conducting organization inspections.

3.5.4. Hardware/Software (HW/SW) Purchases. All IT HW/SW purchases that exceed the micro-purchase threshold shall require PCO approval, in writing, prior to the purchase. All IT HW/SW purchases at or below the micro-purchase threshold shall require COR approval, in writing, prior to the purchase. The Computer Hardware Enterprise Software and Solutions (CHESS) program is mandatory for all purchasers of IT HW/SW IAW AFARS 5139.101-90(b)(1). The contractor must receive authorization, in writing, from the PCO prior to the purchase of IT HW/SW from any source outside the CHESS program. All purchases of IT

3.5.4.1. HW/SW outside of CHESS shall have a Statement of Non-Availability. Any asset purchased as an ODC shall be catalogued as Government-owned Contractor-managed and shall be subject to Army and Federal Acquisition Regulation (FAR) Part 45 property management requirements.

3.6. Storage Management. The contractor shall support tools, processes, and policies used to manage and administer global and local enterprise storage systems to sustain and enhance the capabilities of the infrastructure.

3.6.1. Emergency Data/Disaster Recovery. The contractor shall provide emergency data recovery services which includes, but is not limited to, hard drive/solid state drive recovery, raid data, structured query language (SQL) database repair, and tape data retrieval.

3.7. Service Help Desk

3.7.1. The contractor shall provide service help desk and technical support to address HWAD system and communications problems.

3.7.2. The contractor shall provide surge labor support during contingency/emergency or other mission support operations.

3.7.3. The contractor shall operate the Common Access Card reset.

3.7.4. The contractor shall use Army Enterprise Service Desk (AESD) to log calls and is responsible for timely processing of all trouble tickets opened within the established AESD standards. The contractor shall ensure all necessary data within the trouble tickets is appropriate for proper troubleshooting and monitoring. The contractor shall provide customers a ticket number when a request for assistance is received.

3.7.5. The contractor shall immediately report any problems the local service desk has investigated and cannot resolve to the appropriate support office for final resolution by the appropriate higher level help desk support. The contractor shall determine complexity of the problem and whether or not the ticket should be immediately referred higher or if expertise exists locally to resolve the issue expeditiously and accurately.

3.8. Information Assurance (IA). The contractor shall provide IA support to include, but is not limited to, measures necessary to detect, document, remediate and counter IA threats as directed by the HWAD's Information Systems Security Manager (ISSM). The contractor shall provide advice and guidance and service support concerning IA matters as required. The contractor shall enforce all aspects of the Army Information Assurance Program to include COTS, GOTS, Program Management (PM)/Major Command fielding’s, local unique, beta tests, application and system development, network access, IT acquisition policies, connectivity, IA tools utilization, and authorized software and system management controls.

3.8.1. Accreditations. The contractor shall provide services in support of all Information Security guidance, processes and policies. The contractor shall provide support to the ISSM in ensuring all AITP systems are properly certified and accredited.

3.8.1.1. The contractor shall perform IA IT assessments of all current and future AITP systems and develop risk management guidelines.

3.8.1.2. Authorization to Operate. The contractor shall support compliance of the HWAD's existing Authorization to Operate (ATO) for all IS. The contractor shall assist the Government in achieving ATO compliance on new IS.

3.8.2. Compliance Management

3.8.2.1. The contractor shall ensure IT devices and networks are Army Information

Assurance Vulnerability Management (IAVM) and Anti-Virus (AV) Program compliant.

This includes, but is not limited to, IAVM acknowledgment, patching, updates, completion, and reporting of all other corrective actions within specified timelines as required by the accrediting authority.

3.8.2.2. The contractor shall ensure that log files and audits are maintained and reviewed for all systems and that authentication policies are audited for compliance.

3.8.2.3. Federal Information Security Management Act (FISMA). The contractor shall ensure the HWAD's compliance with the requirements set forth in the FISMA. These requirements include maintaining and/or achieving a valid ATO for each of the HWAD's networks; completion of the HWAD’s annual Self-Assessment Security Readiness Review; completion of annual testing of security controls; and annual evaluation of contingency plans. The contractor shall submit FISMA reporting data and documentation for HWAD’s networks on a monthly basis to the PCO. (CDRL K003).

3.8.2.4. The contractor shall provide assistance with development, implementation and operation of Host Based Security System (HBSS) at various sites throughout the enterprise.

3.8.3. Firewalls. The contractor shall provide installation and maintenance of the firewall, interfacing with the network proponent for network changes/modifications and assessing impacts on the user community, and analysis of connectivity problems and resolution.

3.9. Security Operations

3.9.1. The contractor shall report information systems security violations and incidents to the appropriate authority. The contractor shall review and evaluate the effects of security on system changes, document results and assist the IAM in remediation and restorative processes.

3.9.2. The contractor shall collect, document, and turn in for destruction all applicable media and hardware.

3.9.3. Information System Security Officer. The contractor shall serve as and perform the duties of the HWAD Information System Security Officer as directed by the Government.

3.10. Engineering and Installation.

3.10.1. Site Surveys. The contractor shall perform on-site or desktop engineering surveys to obtain engineering, environmental, and physical plant data required for use in the preparation of Engineering Installation Package (EIP) technical documentation and Information Systems Cost Estimate in Military Construction, Army and Unspecified Minor Military Construction Army projects, and local site projects. The contractor shall provide site survey reports within 30 days of survey completion. (CDRL K004). The contractor shall prepare IT, voice, facsimile, video, Internet Protocol, and data communications equipment installation documentation to include floor layouts, lists of major items of equipment and bills of material, rack face elevation drawings, schematic drawings reflecting equipment interconnection and terminations, cable cut-sheets, labeling, duct layouts, engineering and installation specifications and as-built documentation as required by orders in accordance with 9th Army Signal Command and HWAD configuration management regulations. The duct layouts and schematic drawings shall uniquely identify all cable plant component locations and logical schematics. The layouts shall uniquely identify all components, including a facilities description that clearly defines all operations, procedures, facilities, and capabilities. The contractor shall provide documentation diagrams including inventories for each client’s entire network configuration, where appropriate. Documentation shall be performed IAW Government standards.

3.10.2. Engineering Implementation Plan (EIP)

3.10.2.1. The contractor shall work directly with engineers and area installation and operational personnel to ensure that all system installations and reconfiguration issues are managed quickly and accurately.

3.10.2.2. The contractor shall develop an EIP to include, but not limited to, a current listing of technical installation specifications and documentation of AITP systems and proposed system updates, impacts of the updates, and the contractor’s plan of action to implement. (CDRL K005).

3.10.2.3. The contractor shall initiate, at government request, the process and continued coordination to obtain Long-Haul Information Transfer Services, IAW Government standards, supporting major command exercises, deployments and new equipment fielding in support of user requirements.

3.10.2.4. The contractor shall review and recommend new and existing circuits for alternative routing to balance loading between the systems and/or cost and efficiency improvements.

3.10.3. Installation and Testing. The contractor shall conduct acceptance testing and transition in accordance with the Government approved test and acceptance plans contained in the

EIP.

3.11. Database Services. The contractor shall design, develop, test, operate, enhance, and maintain applications in accordance with established policies, regulations, and guidelines.

The contractor shall conduct training sessions for individuals and groups of users as required. Update and maintain all user manuals, quick reference guides, on-line help, and multi-media tutorials for all modules in the data systems. The contractor shall design, develop, test, operate, enhance, and maintain the database management systems.

3.12. Communications. The contractor shall provide support to all tactical and non-tactical communications. The contractor shall advise the ACO verbally when staffing memorandums, letters, executive summaries, information papers, discussion papers, read-ahead packets, and presentation information.

3.12.1. Tech Control. The contractor shall install, de-install, test, monitor, maintain, troubleshoot, and repair from HWAD to enterprise level network connectivity, telecommunications systems and equipment, communication systems and equipment, communications security equipment and associated terminal and ancillary equipment and supporting cable, duct and conduit systems. The contractor shall conduct acceptance testing and cutover in accordance with government approved acceptance plans and handoff.

3.12.2. Communications Security (COMSEC) Support. The contractor shall assist the HWAD ISSM with touch labor as needed for the operation, and coordinate for repair of COMSEC equipment. The contractor shall be familiar with Encryption hardware and appropriate regulations.

3.13. Systems Engineering and Technical Assistance (SETA) Support. The contractor shall leverage high quality, state-of-the-art, advanced science, analytical, systems engineering and technical services, and Army knowledge expertise to meet the HWAD’s mission to support the Government and the Warfighter. Within the SETA construct, the contractor shall be engaged in an environment focused on supporting HWAD current and future operations.

The contractor shall have knowledge and experience in strategic and operational support of AITP requirements including intelligence systems and supporting communications systems (i.e. NCIC III)

3.13.1. The contractor shall at a minimum have knowledge and development experience in the following applications. This shall include, but is not limited to:

3.13.1.1. Microsoft Office Suite

3.13.1.2. Microsoft SharePoint

3.13.1.3. Microsoft Project

3.13.1.4. Microsoft Visio

3.13.1.5. Current Windows Operating Systems

3.13.1.6. Microsoft Active Directory Services

3.13.1.7. Microsoft SQL

3.13.1.8. Microsoft Teams

3.13.2. The contractor shall always use the approved Army Records Management System when filing documents.

3.13.3. The contractor shall support the development of business cases and associated framework standards needed to comply with AR 25-1 and the Clinger-Cohen Act of 1996, also known as the Information Technology Management Reform Act (ITMRA).

3.13.4. The contractor shall support the review of AITP initiatives and ongoing projects and present recommendations to delay, modify or terminate those based upon risk-value analysis of the overall IT portfolio and support initiatives as a catalyst for change, growth and improvement. This support shall include input on AITP performance planning, training/facilitation, recommending solutions to inefficient business processes, developing supporting case studies which apply appropriate metrics, and implementing approved solutions. These initiatives include the consolidation, aggregation, interfacing, integration and interoperability of data and information across the AITP architecture.

The contractor shall maintain cognizance of, and leverage as appropriate, industry and Government AITP advances.

3.13.5. The contractor shall assist with implementation of ITIL compliant IT Service Management processes and provide support to assigned process owners and managers implementing standard ITIL v4 processes: Service Strategy, Design, Transition, Operation and Continual Improvement. The contractor shall be responsible for planning and tracking ITIL implementation, and assessing IT operational maturity, strategy, design and implementation across the services management processes. The contractor will interface with process owners and senior IT leaders to facilitate business rules and coordinate integration of related functions.

3.13.6. The contractor shall support enterprise IT Capital Planning and Investment Management, IT Portfolio Management, and the IT Capital Equipment Replacement Program. The contractor shall support the lifecycle change management and replacement process for hardware and software. The contractor shall evaluate compliance with governance policies in preparation of future expenditures. The contractor shall support a strategy or plan to allocate AITP resources to support mission priorities.

3.13.7. The contractor shall support functional requirement development and technical solution implementation supporting Business Process Reengineering.

3.13.8. The contractor shall fully understand and be able to provide Government support for related functions listed in the following documents:

3.13.8.1. Army Knowledge Management (AKM) Guidance

3.13.8.2. AR 25-1 Army Information Management

3.13.8.3. AR 25-2 Information Assurance

3.13.8.4. Federal Information Security Management Act (FISMA)

3.13.8.5. Clinger-Cohen Act of 1996 (ITMRA)

3.13.8.6. EO 13011(Federal Information Technology)

3.13.8.7. Office of Management and Budget (OMB) Circular A-11, Part 3, Planning, Budgeting and Acquisition of Capital Assets

3.13.8.8. DoD 5000 Series (DoD Directive 5000.1 and Instruction 5000.2) Global Network

Enterprise Construct (GNEC)

3.13.8.9. Site specific/local policies and SOP’s

3.14. Visual Information (VI)/ Multimedia Resource Planning Support. The contractor shall provide coordination support for VI/Admin Division customer planning meetings, conferences, expositions and trade shows. The contractor shall develop meeting requirements and support recommendations, provide site event support and coordination with cross- functional teams as appropriate, and complete after actions reports.

3.14.1. Closed Circuit and Video Surveillance Services. The contractor shall provide:

3.14.1.1. Video Surveillance Services

3.14.1.2. Media Distribution Capability Sustainment

3.14.1.3. Audio and Video Signal Configuration Services

3.14.1.4. I/Multimedia Resource Planning Support

3.15. Quality Assurance

3.15.1. Contractor Quality Responsibility. The contractor shall be responsible for the quality of all work performed by contractor personnel and shall guarantee all workmanship provided by the contractor regarding repair of all hardware and software for a period of 30 days, except for the fault or negligence of the Government, or causes external to the equipment. Within this 30-day period, the contractor shall furnish labor and material at no additional charge to correct material or workmanship faults.

3.15.2. Quality Control Plan (QCP). The contractor shall prepare a QCP which includes provisions for bi-annual surveys, identified in 3.9 & 3.10 below, to determine customer satisfaction with all contractor provided services, and in accordance with the Government’s performance requirements summary. (CDRL K006). The contractor shall submit a survey plan, detailing the survey questions, how the survey will be conducted, to whom the survey will be furnished, and how the results will be collected, analyzed and reported, as part of its response to this solicitation. (CDRL K007). Data and analysis of the survey results together with the Contractor's plans and recommendations to improve service for deficient areas shall be submitted to the PCO within 30 days of survey completion. (CDRL K008).

3.16. Escort Requirements. The contractor shall be required to escort non-cleared personnel into locations for the purpose of identifying and rectifying problems with software or hardware operated and maintained under this PWS or for facility maintenance as required.

3.17. Security Requirements

3.17.1. All individuals requiring access to information technology (IT) systems shall have the appropriate security clearance and shall be granted access according to their security clearance, need-to-know, and their IT position/category. Personnel shall sign a Non- Disclosure Statement. Personnel shall perform within the security limitations of AR 381- 10, United States Signals Intelligence Directive 1800, and other appropriate security regulations according to their intelligence disciplines.

3.17.2. All individuals requiring access to IT systems shall have the appropriate security clearance and will be granted access according to their security clearance, need-to-know, and their IT position/category. Additional position category and investigation guidance is available in DoD 5200.2-R. As referenced in AR 25-2, personnel requiring access to information systems processing classified information to fulfill their duties shall possess the required favorable security investigation, security clearance, formal access approval (DoD Directive 8570) and need to know. Automated data processing (ADP)/IT tier level positions are detailed in the contract. (DoD Directive 8570) ADP/IT positions are as follows: ADP-III / IT-III.

3.17.3. Additional Security Requirements. This effort requires access to classified Government information at the U.S. Government only level. Additional requirements are contained in the DD Form 254. Additional security requirements may be added at the task order level.

3.18. Special Requirements

3.18.1. Contractor Personnel Required Experience, Training and Certification. The contractor shall ensure all personnel assigned possess appropriate experience, training, and certification. The minimum requirements include:

3.18.1.1. Contractor personnel supporting this effort shall possess sufficient technical certifications, educational degrees, and experiences levels consistent with the requirements of the task that an individual employee will perform.

3.18.1.2. Contractor personnel supporting this effort shall have minimum certifications in accordance with DoDM 8570.01., DoD 8140, Army Regulation 25-2.

3.18.1.3. Minimum level of experience required to perform specific tasks at this site; the personnel structure for HWAD at minimum will be broken down into 3 levels:

3.18.1.4. Level 3: IT/IA Lead:

3.18.1.4.1. Minimum experience level of 7 yrs

3.18.1.4.2. Contractor certification(s) required for advanced user privileges shall be based on Information Assurance Technician (IAT) Level II and IAM Level I IAW DoD 8570.01-M and DoD 8140.

3.18.1.5. Level 2: Senior Technician:

3.18.1.5.1. Minimum experience level of 5 yrs

3.18.1.5.2. Contractor certification(s) required for advanced user privileges shall be based on IAT Level II IAW DoD 8570.01-M.

3.18.1.6. Level 1: Technician

3.18.1.6.1. Minimum experience level of 5 yrs

3.18.1.6.2. Contractor certification(s) required for advanced user privileges shall be based on IAT Level I IAW DoD 8570.01-M and DoD 8140.

3.19. Government Furnished Property, Services, and Equipment

3.19.1. The contractor shall provide adequate space and move government personnel AITP systems, as requested, to include network access and communications.

3.19.2. The contractor shall provide monthly status reports of AITP system technical performance and financial transactions, as appropriate, to the PCO. (CDRL K009).

3.20. Familiarization Training. The Government may request the contractor familiarize Government personnel on new or upgraded hardware and/or software. A representative case where such support shall be required includes:

3.20.1. System (hardware and software) maintenance for equipment that is to be deployed with Government personnel.

3.20.2. Installation of new software versions (e.g., operating system and office automation tools).

3.20.3. The Government will identify personnel to receive such instruction and approve the level of instruction recommended by the contractor. The instruction shall be conducted by resident contractor personnel at the central and/or remote site(s) and shall occur during the presentation/practice/production.

3.21. Non-Disclosure. Prior to obtaining network access, contractor personnel shall be required to sign a Non-Disclosure Agreement (NDA). The contractor shall provide a list of executed NDAs with a self-certification within 15 days of task order award and annually thereafter to the DOIM and ACO.

3.22. Contractor Support and Personnel Qualifications. The contractor shall develop, maintain and make available a current and accurate personnel database which records and tracks the qualifications, training, and security items necessary to meet the requirements of this PWS.

The contractor shall provide sufficient qualified support at HWAD to ensure System Availability and TPRP compliance.

3.22.1. Technical Certifications. Contractor personnel supporting this effort shall possess sufficient technical certifications, educational degrees, and experience to support HWAD's unique requirements. Representative certifications include CompTIA's A+, Network+, and Security+; Microsoft Certified Systems Engineer and Systems Administrator (with emphasis in SharePoint); Cisco Certified Network Associate; and IT Infrastructure Library Certification. Representative software technologies implemented at HWAD to include Office, Office Ultimate Suite, Server, System Center, and DNS; Host Based Security System; McAfee; and Remedy, Contractor personnel performing equipment repair shall possess OEM certification and shall maintain currency on OEM equipment and complete training to receive manufacture's certification to repair equipment. The contractor shall be trained and certified IAW DoD 8140 and DoD 8570 Baseline Certification Requirements.

3.22.2. Government Mandatory Training. All contractors performing work on site shall complete government directed annual mandatory training.

3.23. Material Purchases. In the event the contractor requires replacement parts and components to support AITP Systems, purchases shall be placed through the Computer Hardware, Enterprise Software and Solutions (CHESS) contracts to the maximum extent possible. Procurements shall be cost reimbursable.

3.23.1. Government IT Staff will set internal suspense dates for submission of taskers.

4. Glossary

4.1. Preventative Maintenance

Preventative maintenance is the care and servicing by contractor personnel for the purpose of maintaining equipment in operating condition in accordance with manufacturer's commercial specification by providing for systematic inspection, detection, and correction of incipient failures either before they occur or before they develop into major defects.

4.2. Remedial Maintenance

Remedial maintenance is the act of restoring an item to a state in which it can perform its required function. It includes all technical and corresponding administrative, managerial, and supervisory actions to achieve service restoration.

The Army Regional Cyber Center- CONUS (RCC-C) remotely administers the Army Top Level Architecture (TLA) network security stack (router, firewall, Intrusion Detection System, etc.).

The contractor shall provide 2RCC visual and/or hands-on support when required. Physical repair or replacement of parts is not included in this contract.

4.3. System Maintenance and Repair

All efforts required to ensure availability of AITP Systems consistent with the manufacturer’s performance specifications and the intended use of the system in support of the mission at the direction of the Information Systems Security Manager (ISSM).

4.4. Systems Operations

Systems Operations is defined as all efforts required to provide the day-to-day routine monitoring, operations planning, and operation of the AITP Systems to ensure customers enjoy reliable, uninterrupted access and availability.

4.5. Communications

Is defined as all tactical and non-tactical communications to include telephone, infrared, various radio, various frequency (Ultra High Frequency (UHF), Very High Frequency (VHF), etc.), cryptochannel, telephones, wireless and military spectrum management.

4.6. Configuration Management (CM)

CM is defined as the process during which the changes of a AITP System are implemented in a controlled manner by following a pre-defined framework/model.

4.7. Information Assurance (IA)

IA is the protection of systems and data in storage, during processing, or in transit from unauthorized access or modification; denial of service to unauthorized users; and the provision of services to authorized users.

4.8. Information Assurance Vulnerability Alerts (IAVA)

IAVA are tasks and directives received by the HWAD’s of higher Authority to correct IT vulnerabilities.

4.9. System Availability

System Availability is defined as the degree to which an IT system is operable and in a committable state. It is the proportion of time a system is in a proper and fully useable functioning condition.

4.10. Threshold for Performance Restoration Period (TPRP)

The TPRP is the period of time during which the contractor shall restore the operational capability. The period begins from the point at which the contractor is notified of system failure and ends upon full restoration of its original equipment manufacturer (OEM) capability for use.

4.11. Critical Systems

Critical Systems is defined as the following:

- National Crime Information Center (NCIC) III Network

- Network and Communications Infrastructure (to include at a minimum, infrastructure fiber and/or copper network cables, routers, switches, and cryptographic equipment), and

- Other systems identified by the Government.

4.12. Mission Essential Personnel

Mission Essential Personnel, for the purposes of tasks included in this PWS, are those responsible for ensuring the capabilities the Government considers basic and necessary for the accomplishment of the organization’s mission remain operational during installation or Government closure.

Mission Essential Personnel will be identified at the beginning of the contract award and updated semiannually or when personnel change.

Document Summary List

The contractor shall comply with appropriate Army and DOD regulations, Defense Information Systems Agency (DISA), National Institute of Standards and Technology (NIST), FISMA, Government Performance and Results Act of 1993 (GPRA), and Clinger-Cohen ITMRA. Compliance with the following documents shall also apply to this contract.

The contractor shall work with the HWAD PCO to identify any changes to the references or any applicable regulations or laws, which may affect process, cost, and/or schedule. The PCO will review and provide implementation guidance.

The contractor shall adhere to the most recent version of the Army Regulations (AR) cited in this PWS. Chapter and page numbers are provided for convenience, but do not absolve the contractor of complying with all other applicable parts of the AR. If the ARs are updated during performance, the contractor is responsible for meeting the new requirements as they take effect. Any such Army Regulation changes during the contract period shall be incorporated.

NO. ID NOUN NAME/URL REFERENCE

1 ACERT

Tools ACERT TOOLS; https://www.acert.1stiocmd.army.mil/tools/

2 AR 25-1 Army Knowledge Management and Information Technology;

http://www.apd.army.mil/pdffiles/r25_1.pdf

3 AR 25-2 Information Assurance; http://www.apd.army.mil/pdffiles/r25_2.pdf

4 AR 380-40 Safeguarding and Controlling Communications Security Material.

www.dami.army.pentagon.mil/site/TechSec/COMSEC-AR.aspx

5 AR 380-53 Information Systems Security Monitoring;

http://www.apd.army.mil/pdffiles/r380_53.pdf

6 AR 525-13 Antiterrorism 4 Jan 2002;

http://www.apd.army.mil/pdffiles/r525_13.pdf

7 AR 530-1 Operations Security 19 Apr 2007;

http://www.apd.army.mil/pdffiles/r530_1.pdf

8 BBP Index BBP Index;

https://informationassurance.us.army.mil/bbp/

9 BBP Index Drafts

BBP Index Drafts; https://www.us.army.mil/suite/kc/585383

10 BBP Army Password Standards Version 1.5;

https://informationassurance.us.army.mil/bbp/army_password_standards.pdf

11 BBP Web Filtering;

https://informationassurance.us.army.mil/bbp/web_filtering.pdf

12 BBP Wireless Security Standards Version 2.0;

https://informationassurance.us.army.mil/bbp/bbp_wireless_fin al.pdf http://www.acert.1stiocmd.army.mil/tools/ http://www.acert.1stiocmd.army.mil/tools/ http://www.apd.army.mil/pdffiles/r25_1.pdf http://www.apd.army.mil/pdffiles/r25_2.pdf http://www.dami.army.pentagon.mil/site/TechSec/COMSEC-AR.aspx http://www.apd.army.mil/pdffiles/r380_53.pdf http://www.apd.army.mil/pdffiles/r525_13.pdf http://www.apd.army.mil/pdffiles/r525_13.pdf http://www.apd.army.mil/pdffiles/r530_1.pdf http://www.us.army.mil/suite/kc/585383 http://www.us.army.mil/suite/kc/585383

13 BBP Reuse of Army Computer Hard Drives v1.1;

https://informationassurance.us.army.mil/bbp/computer_hard_drives . pdf

15 Clinger-Cohen Act of 1996

Clinger-Cohen Act of 1996, also known as the Information Technology Management Reform Act (ITMRA). https://fismacenter.com/Clinger Cohen.pdf

16 CJCSM

http://www.dtic.mil/cjcs_directives/cjcs/manuals.htm

17 CNDSP C&A Evaluator Standard Operating Procedure;

https://powhatan.iiie.disa.mil/cnd/CNDSP_SOP_V1.3A_20040304.pdf

18 CNDSP Evaluator’s Scoring Metrics CERTIFICATION AND ACCREDITATION of Computer Network Defense Service Providers;

https://powhatan.iiie.disa.mil/cnd/esm-v60-dtd100206.doc

19 DA PAM 25-5 Preparing and Processing Request for Long-Haul Information Transfer Services.

20 DA Pam 25-6

Configuration Management for Automated Information Systems;

http://www.doim.army.mil/Regulations_Pams_Directives/p25_6.pdf

21 DCID

6/3

Director of Central Intelligence Directive 6/3 Protecting Sensitive Compartmented Information Within Information Systems http://www.fas.org/irp/offdocs/DCID_6-3_20Manual.htm

22 DJSIG DoD Joint Security Implementation Guide (DJSIG).

www.dss.mil/documents/isp/JSIG_2016April11_Final_(53Rev4).pdf

23 FISMA ACT Federal Information Security Management Act (FISMA) https://fismacenter.com

24 DoD 5000 series

(DoD Directive 5000.1 and Instruction 5000.2) Global Network Enterprise Construct (GNEC) www.acq.osd.mil/fo/docs/500002p.pdf

25 DOD

5220.22-M

Department of Defense (DOD) 5220.22-M, National Industrial Security Program Manual (NISPOM)

26 DODD

5200.1

DoD Information Security Program;

http://www.dtic.mil/whs/directives/corres/pdf/520001p.pdf

27 DOD Policy Web Site Administration and Procedures;

http://www.defenselink.mil/webmasters/policy/dod_web_policy_120 7199 8_with_amendments_and_corrections.html

28 DODD 8500.1 Information Assurance (IA);

http://www.dtic.mil/whs/directives/corres/pdf/850001p.pdf

29 DODD

8500.2

Information Assurance (IA) Implementation;

http://www.dtic.mil/whs/directives/corres/pdf/850002p.pdf http://www.dtic.mil/cjcs_directives/cjcs/manuals.htm http://www.doim.army.mil/Regulations_Pams_Directives/p25_6.pdf http://www.fas.org/irp/offdocs/DCID_6-3_20Manual.htm http://www.dss.mil/documents/isp/JSIG_2016April11_Final_(53Rev4).pdf http://www.acq.osd.mil/fo/docs/500002p.pdf http://www.dtic.mil/whs/directives/corres/pdf/520001p.pdf http://www.defenselink.mil/webmasters/policy/dod_web_policy_1207199 http://www.defenselink.mil/webmasters/policy/dod_web_policy_1207199 http://www.dtic.mil/whs/directives/corres/pdf/850001p.pdf http://www.dtic.mil/whs/directives/corres/pdf/850002p.pdf

30 DODD

8520.1 Protection of Sensitive Compartmented Information (SCI);

http://www.dtic.mil/whs/directives/corres/pdf/852001p.pdf

31 DODD

8530.1

Computer Network Defense (CND);

https://powhatan.iiie.disa.mil/cnd/dodd-o-8530- 1.pdf

32 DODD

8530.1-M

Department of Defense Computer Network Defense (CND) Service Provider Certification and Accreditation Process;

https://powhatan.iiie.disa.mil/cnd/dod-o-8530-1-m.pdf

33 DODD

8530.2

Support to Computer Network Defense (CND);

http://www.dtic.mil/whs/directives/corres/html/853002.htm

34 DODD

8570.01

Information Assurance Training, Certification, and Workforce Management; http://www.dtic.mil/whs/directives/corres/pdf/857001p.pdf

35 DODD

8570.01-M

Information Assurance Workforce Improvement Program;

http://www.dtic.mil/whs/directives/corres/pdf/857001m.pdf

36 DoDI 8500.2

Information Assurance (IA) Implementation http://www.diacap.net/Documents/DODI%2085002p-signed.pdf

37 FIPS 200 Minimum Security Requirements for Federal Information and Information Systems; http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf

38 Guidance Software Professional Development and Training EnCE Certification Program;

http://www.guidancesoftware.com/training/EnCE_certification.aspx

39 HSPD-12 Homeland Security Presidential Directive 12, Policy for a Common Identification Standard for Federal Employees and Contractors

40 ICD

Number 503

Intelligence Community Directive, Number 503, Intelligence Community Information Technology Systems Security Risk Management, Certification and Accreditation;

http://www.dni.gov/electronic_reading_room/ICD_503.pdf

41 Information Assurance Risk Management Policy for National Security Systems.

http://www.cnss.gov/Assets/pdf/CNSSP-22.pdf

42 National Security Telecommunications and Information Systems Security Advisory/Information Memorandum (NSTISSAM TEMPEST), December 1995, Red/Black Installation Guidance (FOUO) https://dppsllc1.com/Red_Black.pdf

43 NIACAP National Information Assurance Certification and Accreditation Process http://www.cnss.gov/Assets/pdf/nstissi_1000.pdf http://www.dtic.mil/whs/directives/corres/pdf/852001p.pdf http://www.dtic.mil/whs/directives/corres/html/853002.htm http://www.dtic.mil/whs/directives/corres/pdf/857001p.pdf http://www.dtic.mil/whs/directives/corres/pdf/857001m.pdf http://www.diacap.net/Documents/DODI%2085002p-signed.pdf http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-http://www.guidancesoftware.com/training/EnCE_certification.aspx http://www.dni.gov/electronic_reading_room/ICD_503.pdf http://www.cnss.gov/Assets/pdf/CNSSP-22.pdf http://www.cnss.gov/Assets/pdf/nstissi_1000.pdf

44 NIST Publications Home Page;

http://csrc.nist.gov/publications/index.html

45 NIST SP

800-

Draft Computer Security Incident Handling Guide;

http://csrc.nist.gov/publications/drafts/sp800-61-rev1/Draft- SP800- 61rev1.pdf

46 EO

https://www.hsdl.org/?abstract&did=457178

47 OMB

Circular

OMB Circular A-11, Part 3, Planning, Budgeting and Acquisition of Capital Assets, Office of Management and Budget https://obamawhitehouse.archives.gov/omb/circulars_a11_current

48 NIST

SP

800-48

Draft Wireless Network Security for IEEE 802.11a/b/g and Bluetooth; http://csrc.nist.gov/publications/drafts/800- 48- rev1/Draft-SP800-48r1.pdf

49 NIST

SP

800-80

Draft Guide to Developing Performance Metrics for Information Security; http://csrc.nist.gov/publications/drafts/draft-sp800- 80- ipd.pdf

50 STIGS All Applicable Security Technical Implementation Guidelines (STIGS)

51 TB

380-41

Technical Bulletin Security: Procedures for Safeguarding, Accounting and Supply Control of COMSEC Material.

52 Army

CIO/G

mem o of Aug

Army Gold Master (AGM) Vista 9.X Compliance Guide https://chess.army.mil/ascp/commerce/scp/downloads/cb/AGM _V i sta_%2 09X_Compliance_Guidance.pdf

53 Local Unit

SOP

Applications and assigned networks standardization in look and feel.

54 Sectio n 508

Section 508 Amendment to the Rehabilitation Act of 1973 https://www.section508.gov/manage/laws-and- policies

55 AR

735-5

Policies and Procedures for Property Accountability (2005) http://armypubs.army.mil/epubs/pdf/r735_5_d20050228.

pd f

56 PAM 25-2-1 ACTIVE 04/12/2019 ARMY CROSS DOMAIN SOLUTION AND DATA TRANSFER

MANAGEMENT CIO/G-6

http://csrc.nist.gov/pub…