DRAFT W91249-20-R-0002 Cyber Battle Lab Solicitation.pdf

SEE ADDENDUM

(No Collect Calls)

W9124920R0002

b. TELEPHONE NUMBER

706-791-9208

8. OFFER DUE DATE/LOCAL TIME

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA X ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W912499. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

SHERRILYN U. RICE

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

1 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESSX

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

MICC - FORT GORDON

271 HERITAGE PARK LANE

BLDG. 35200

FT GORDON GA 30905

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE W58MUU 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

CYBER BATTLE LAB (CDID)

AMY LEDFORD

BLDG 19901 850 EAST 13TH AVENUE

FORT GORDON, GA GA 30905

TEL: 706-791-8332 FAX:

706-791-8651FAX:

TEL: 706-791-1800 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$27,500,000

NAICS:

541512

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

W9124920R0002

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES MAX

QUANTITY

UNIT UNIT PRICE MAX AMOUNT

0001 UNDEFINED

Cyber Battle Lab Services

FFP

The contractor shall provide all necessary management, supervision, personnel, equipment, supplies, and other necessary items required to successfully perform non-personal services to support the Cyber Battle Lab (CBL) in accordance (IAW) with the Performance Work Statement (PWS) and other areas of the solicitation.

FOB: Destination

PSC CD: D316

MAX

NET AMT

UNIT UNIT PRICE MAX AMOUNT

0002 UNDEFINED

Other Direct Cost (ODC)

COST

IAW the PWS items located at 1.6.12 and 1.6.13. All expenses associated with this CLIN shall be provided in writing to the Government for approval prior to execution. Travel expenses shall be IAW FAR 31.205-46. Costs are reimbursable up to the Not-To-Exceed (NTE) amount of $1,800,000.00 as the CLIN total amount.

MAX COST

UNIT UNIT PRICE MAX AMOUNT

0003 UNDEFINED

Contractor Manpower Reporting (CMR)

FFP

Contractor is required to provide data on Contractor labor hours (including subcontractor labor hours) for performance of this contract IAW the PWS. The cost, if any, for providing this data shall be entered into the space provided at this CLIN. If no direct cost is associated with providing the data, enter “No Cost”.

Instructions, including the Contractor and Subcontractor User Guides, are available at http://www.ecmra.mil.

MAX

NET AMT

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government 0002 Destination Government Destination Government 0003 Destination Government Destination Government

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 POP 30-APR-2020 TO

29-APR-2025

N/A CYBER BATTLE LAB (CDID)

AMY LEDFORD

BLDG 19901 850 EAST 13TH AVENUE

FORT GORDON, GA GA 30905

706-791-8332

W58MUU

0002 POP 30-APR-2020 TO

29-APR-2025

N/A (SAME AS PREVIOUS LOCATION)

0003 POP 30-APR-2020 TO

29-APR-2025

N/A (SAME AS PREVIOUS LOCATION)

INFORMATION TO THE OFFERORS

1. The requirement is being solicited as a 100% small business set-aside in accordance with FAR 52.219-6 Notice of a Total Small Business Set-aside. The Contracting Officer has designated the North American Industrial Classification System (NAICS) Code for this acquisition as 541512, Computer System Design Services. The corresponding size standard is twenty-seven million five hundred thousand dollars of average annual gross receipts.

To determine how to calculate "average annual gross receipts," please review 13 CFR 121.104.

2. The Government intends to award one (1) Single Award Indefinite Delivery Indefinite Quantity (ID/IQ) contract (see FAR Clause 52.216-22) that will permit for issuance of Firm Fixed Price task orders. The period of performance of the ID/IQ contract will be 60 months from the effective date of the award.

3. In accordance with FAR Clause 52.216-22, delivery or performance shall be made only as authorized by orders issued in accordance with the Ordering clause. The Contractor shall furnish to the Government, when and if ordered, the supplies or services specified in the Schedule up to and including the quantity designated in the Schedule as the 'maximum'. The Government shall order at least the quantity of supplies or services designated in the Schedule as the 'minimum'.

4. The contract resulting from this solicitation shall require the Government to order and the contractor to render at least $5,000,000.00 of services. $5,000,000.00 is the stated contractual minimum. The contract resulting from this solicitation shall require the contractor to furnish any services properly ordered by the Government, not to exceed $63,000,000.00. $63,000,000.00 is the stated contractual maximum.

5. Issuance of Task Orders: Any Contracting Officer within the Mission and Installation Contracting Command, Fort Gordon, GA is authorized to issue task orders against the contract.

6. Period for acceptance offers. The Government requires a minimum acceptance period of 60 calendar days from the date specified for the receipt of offer.

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

CYBER BATTLE LAB EXPERIMENTATION SUPPORT

for the

Cyber Battle Lab (CBL), Cyber Capabilities Development Integration Directorate (CDID), Future Concepts Center (FCC), United States Army Futures Command (AFC), Fort Gordon, Georgia

Part 1

General Information

1. GENERAL: This is a non-personal services contract to provide Experimentation Support for the CBL, CDID, FCC, AFC, Fort Gordon, Georgia. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Experimentation Support as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background: The CBL is the proponent organization within the Cyber CDID, FCC, AFC for concept development and experimentation in support of all areas of Cyber Electromagnetic Activities (CEMA) to include Cyberspace Operations (CO), Electronic Warfare (EW), Department of Defense Information Network – Army (DODIN-A), and Information Operations (IO). Cyberspace Operational concept and capability experimentation is one of the Army Chief of Staff’s priorities.

1.3 Objectives: This contract will support the CBL mission to provide experimentation support to the warfighter with dynamic network experimentation integrated with CO and EW through the following: Live Experimentation (LE), Modeling and Simulation (M&S), Regional Hub Node – Experimentation (RHN-E), and the Battle Lab Collaborative Simulation Environment (BLCSE). The CBL Experimentation Support contract will provide results in the form of experiments, assessments, analyses and network support that will validate proposed new technical solutions to resolve known Doctrine, Organization, Training, Material, Leadership & Education, Personnel, Facilities – Policy (DOTMLPF-P) capability gaps within the CO and EW force modernization lines of effort.

1.4 Scope: The mission of the CBL is to provide overall direction, oversight, vertical and horizontal integration of CO, DODIN-A, and EW activities focused on the development of a Multi-Domain Operations (MDO) Force (2028

– 2035) for the Army as defined by the Army Modernization Strategy (AMS), guided by the Annual Mission Guidance (AMG), and sanctioned by the AFC. The Future Force Modernization Enterprise (FFME) is the unifying construct that will tie multiple line of effort together to accomplish this goal. The CBL’s responsibility in the FFME is to develop, leverage and assess technologies that enhance the Army’s ability to practice the art and science of CO, DODIN-A, IO and EW. The contractor shall support the CBL mission with experimentation support that includes cutting-edge systems engineering, satellite support, analysis, prototyping, assessments, systems administration, network engineering, information assurance, model development, and distributed simulation network operations and security center services. Experimentation support shall include both analytical and systems engineering support in the planning, setup, design, accreditation, execution, data collection, equipment integration, equipment configuration, technical procedure manual development and formal written analysis.

1.5 Period of Performance: The period of performance shall be for a five (5) year ordering period. The Period of Performance is 30 April 2020 – 29 April 2025.

1.6 General Information

1.6.1 Quality Control: The contractor shall develop and maintain an effective quality control program to include the development of a Quality Control Plan (QCP) to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract. The initial QCP shall be delivered with the contractor’s proposal. After award the final QCP shall be delivered within 30 days of start date and within 5 working days when changes are made thereafter. After acceptance of the quality control plan the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to his QC system.

1.6.2 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays: The contractor is not expected to perform services on the following federal holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day

Memorial Day Thanksgiving Day Independence Day Christmas Day

1.6.4 Hours of Operation: The contractor is responsible for conducting business, between the hours of 0800 hours to 1700 hours, with one hour for lunch, except during experimentation surge time as described below. Unless otherwise directed, the contractor work days will be Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential. All contractors supporting this PWS will support various experimentation events throughout the year.

During experiment surge support time, contractors supporting the BLCSE, M&S or LE branches may work on an early or late shift to support distributed sites located in different time zones.

The Regional Hub Node – Experimentation (RHN-E) has the capability to operate twenty-four (24) hours a day seven (7) days a week. Contractors supporting the RHN-E shall work a rotating shift only during experiment surge support time. Rotating Shifts shall be defined as a total of 48 working weeks per year or 2072 hours per year for RHN-E personnel only. Personnel will rotate working 16 weeks at Day shift, 16 weeks at Afternoon Shift and 16 weeks at Midnight Shift in one month intervals before rotating to the next schedule. Day shift is defined as 40 hours, Monday thru Friday 0700hrs to 1600hrs, with one hour for lunch. Afternoon shift is defined as 46 hours per week, Monday thru Saturday or Sunday 1500hrs to 1200hrs, with one hour for lunch. Midnight shift is defined as 46 hours per week, Monday thru Saturday or Sunday 1100hrs to 0800hrs, with one hour for lunch. Personnel must take a one hour break for lunch or dinner and not leave prior to the appointed time.

1.6.5 Place of Performance: The work to be performed under this contract will be performed at the CBL facility located at Building 19901, Fort Gordon, Georgia. Contractors may be required to travel (para 1.6.12) in support of this contract.

1.6.6 Type of Contract: The Government intends to award one (1) Single Award Indefinite Delivery Indefinite Quantity contract that will permit Firm Fixed Price orders. The period of performance will be approximately sixty months (five years) from the effective date of the award.

1.6.7 Security Requirements:

PHASE IN: This contract will require all contract personnel at a minimum have a Secret security clearance on work performance start date. In addition some of the contractor personnel must obtain and maintain a Top Secret with SCI eligibility. The FSO must initiate the investigation for the TS/SCI positions within 30 days of employment.

Contract personnel will not be authorized access to SCI until they receive a final TOP SECRET clearance.

Contractor employees performing on this contract/task order must be a U.S. citizen. The security requirements are in accordance with the attached DD Form 254 see Attachment 1. This requirement encompasses the following labor categories: Program Manager, Information Systems Security Officer, Security Assistant, Logistics Engineer, Technical Writer, Senior System Administrator BLCSE, Network/Data Engineers BLCSE, Security Analyst Engineer BLCSE, Host Based Security System Administrator BLCSE, Security Auditor BLCSE, Network/Data Engineer RHN-E, SATCOM Engineer Associate RHN-E, Senior Systems Administrator RHN-E, Senior Principal Systems Engineer RHN-E, Communications Engineer LE, Principal Engineer LE, Junior Principal Engineer LE, Cyber Analysts LE, EW Analyst LE, Senior RF Engineer LE, M&S Senior Analyst, Computer Programmer/Software Engineer M&S, Database Programmer, and Functional Engineer. Some contract personnel will be required to have Secret Security Clearance and others a Top Secret/SCI security clearance based on a current Tier-5(TS) investigation or Tier-5R(T5R) reinvestigation or equivalent (SSBI/SSBI-PPR). Positions requiring a SECRET clearance need to have a Tier-3 (T3) or Tier-3R (T3R). At work performance start date, all other contractor employees to include subcontractors, performing on this contract shall have a SECRET security clearance and shall maintain the required security clearance throughout the life of the contract (CDRL B004). The contractor is responsible for acquiring the clearances. The contractor shall ensure that all assigned personnel understand applicable security policies and directives found in DOD 5220.22-M, National Industry Security Program Operating Manual (NISPOM); AR 380-5, Information Security Program; and all other applicable policies and regulations.

1.6.7.1 The contractor shall ensure that classified data is controlled, protected, and safeguarded in accordance with AR 380-5 and current Army and DOD policy. Classified information shall be accessed and stored in government spaces only. The contractor shall agree that any data furnished by the government to the contractor shall be used only for performance under this PWS, and all copies of such data shall be returned to the government upon completion of this effort. Compliance with DD Form 254, Department of Defense Contract Security Classification Specification, is required.

1.6.7.2 Handling/Access to Classified Information. The contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified "Confidential," "Secret," or "Top Secret" and requires contractors to comply with (1) the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M), and (2) any revisions to DoD 5220.22-M. Any adverse action preventing a contractor from retaining access to classified material must be brought to the attention of the COR and contractor Facility Security Officer (FSO) immediately.

1.6.7.3 SIPRNET access is required to perform this contract. The COR will identify contract employees that are required to have SIPRNET access. The contractor is not authorized to access, download or further disseminate any classified information from SIPRNET which is outside the scope of the defined contract requirements unless specifically authorized in writing by the Government Program Manager and the KO. The contractor must complete and forward to the KO, a SIPRNET Access Request Form for approval by the Requiring Activity SIPRNET Information Assurance Manager (IAM) prior to receiving access. NOTE: A NATO Awareness brief and acknowledgement is required for all personnel prior to access to the SIPRNET. Since the SIPRNET contains NATO information, a NATO Awareness briefing informing personnel how to protect NATO information is mandatory for everyone who requires access to the SIPRNET. A written acknowledgment shall be maintained by the COR.

1.6.7.4 Cybersecurity (formerly Information Assurance (IA)/Information Technology (IT)) Training. All contractor employees and associated subcontractors must complete the DoD Cyber Awareness Challenge Training (https://ia.signal.army.mil/DoDIAA) before issuance of network access and annually thereafter. Certificates of successful completion, for both initial awareness training and annual refresher training shall be provided to the COR via the Army Training and Certification Tracking System (ATCTS). All contractor employees will successfully complete all required IA training as specified in AR 25-2 and as directed by the Government. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M, DoDD 8140.01, and AR 25-2.

1.6.7.5 Contractor employees, to include subcontractors, requiring access to information systems to fulfill their duties must possess the required favorable security investigation. Contractor employees that require access to the Fort Gordon network shall have a minimum of a National Agency Check with Inquiries (NACI) investigation initiated and favorable review before issuance of network access. The IASO/IANO from the activity that the contractor employee is assigned to, will submit an electronic DD 2875, System Authorization Access Request (SAAR) to Security & Intelligence Division for verification that the contractor employee meets the requirements of AR 25-2 for accessing the Fort Gordon network. (Ref AR 25-2)

1.6.7.6 Cybersecurity (formerly Information Assurance (IA)/Information Technology (IT)) Certification. Per DoD 8570.01-M, / DoD 8140 DFARS 252.239.7001, and AR 25-2, the contractor employees' supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M / DoD 8140 must be completed upon contract award.

1.6.7.7 Annual Security Refresher Training. All contractor employees, including subcontractors, assigned to this contract shall complete the online Annual Security Refresher Training located on the Army Learning Management System (ALMS) site. Log into AKO, “Self Service”, “My Training”, “ALMS”, “Go To Mandatory Training”.

Training must be completed within 30 days of reporting for duty. The contractor shall submit certificate of completion for each affected contractor employee and subcontractor employee to the COR and unit/activity security https://ia.signal.army.mil/DoDIAA manager. (Ref ALARACT 207/2013, DTG 291848Z Aug 13, Subj: Army Wide Rollout and Requirement for Standardized Computer Web-Based Security Training on the Army Learning Management System (ALMS)).

1.6.7.8 Anti-Terrorism (AT) Level I Training. All contractor employees, including subcontractors, assigned to this contract shall receive an initial Antiterrorism Level I Brief by a certified ATO Level II Officer within 30 days of reporting for duty. (Monthly briefings will be offered by the Garrison Antiterrorism Officer.) Annual refresher Antiterrorism Level I Training shall be completed on-line at https://atlevel1.dtic.mil/at/ or they may attend the monthly training offered by the Garrison ATO. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR and unit/activity security manager. (Ref Department of the Army, US Army Contracting Agency, SFCA-CO, 5 Sep 07, subject: Incorporation of Measures into the Contracting Process and AR 525-13, Antiterrorism). Note: Contractor personnel shall receive an AOR briefing when traveling OCONUS on TDY. Briefing must be provided by a certified ATO Level II Officer within 7 working days prior to TDY departure outside the 50 United States, its territories, and possessions. This is separate from the normal annual AT Level I training requirement. (Ref AR 525-13)

1.6.7.9 iWATCH: All contractor employees, including subcontractors, assigned to this contract shall receive a brief on the local iWATCH program (provided in conjunction with the AT Level I Training). This training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 days of reporting to duty and annual refresher training with the results reported to the COR.

1.6.7.10 Operation Security (OPSEC) Training. All contractor employees, including subcontractors, assigned to this contract shall complete Level I OPSEC training within 30 days of reporting for duty and then annually thereafter. Initial Level 1 OPSEC training will be conducted monthly by the Garrison OPSEC Officer or a Level II certified OPSEC Officer. Annual refresher training shall be completed on-line at http://cdsetrain.dtic.mil/opsec/index/htm. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR and unit/activity security manager. (Ref AR 530-1, Operations Security). The contractor shall adhere to local OPSEC policies and procedures of the government requiring activity. When in a TDY status in support of this work effort, the contractor shall also adhere to any OPSEC policies and procedures in effect at TDY locations.

1.6.7.11 Threat Awareness and Reporting Program (TARP) Training. All contractor employees, including subcontractors, assigned to this contract shall complete TARP training within 30 days of reporting for duty and then annually thereafter. TARP training will be conducted monthly by the 902nd MI Group. The COR will ensure contractors are notified of available training. Completion of training shall be reported to the COR and the unit/activity security manager. (Ref AR 381-12).

1.6.7.12 Installation Access. All contractor employees, including subcontractors, shall comply with applicable installation and facility access security policies and procedures at all work and TDY locations. All contractors and subcontractors will be issued a Common Access Card (CAC) or an Installation Pass issued through the Automated Installation entry (AIE) Security System to access the installation. The Fort Gordon military installation is a limited access post. Unscheduled gate closures by the military police may occur at any time. In accordance with Army Regulation 525-13, paragraph 5-19, all prospective contractors will undergo a verification process by the installation Provost Marshal Office, Director of Emergency Services to determine the trustworthiness and suitability prior to being granted access to federal property. This will be accomplished using the National Crime Information Center (NCIC) Interstate Identification Index (III). This is the minimum baseline background check for entrance onto Army Installations for non-CAC holders to include entrance of visitors (Ref AR 190-13, paragraph 8-2). All personnel entering or exiting the installation may experience a delay due to vehicle inspections, registration checks, verification of seat belt use, etc. All vehicles and personnel are subject to search and seizure. The search and seizure provisions shall apply to contractor personnel while within Fort Gordon's area of jurisdiction. Contractor personnel shall comply with all entry control requirements and security policies/procedures in effect. Security procedures may change without notice.

https://atlevel1.dtic.mil/at/ http://cdsetrain.dtic.mil/opsec/index/htm

1.6.7.13 Identification of Contractor Employees. In accordance with FAR 37.114 contractor employees shall identify themselves as a contractor at all times while on the job, e.g., in the workplace, when attending meetings, in email, when answering government telephones, or when making phone calls.

1.6.7.14 ID Badges. The contractor shall provide each contractor employee an identification (ID) badge on contract start date or on employment start date. The ID badge shall be made of nonmetallic material, be easily readable, and shall contain the following minimum information: Employee's Name, Contract Company Name and Employee's Photograph. Contract employees shall wear proper identification at Government workplaces at all times.

1.6.7.15 Display of ID Badges. Contractor employees shall wear the ID badge at all times when performing work under this contract to include attending government meetings and conferences. Unless otherwise specified in the contract, each contract employee shall wear the ID badge in a conspicuous place on the front of exterior clothing and above the waist except when safety or health reasons prohibit such placement.

1.6.7.16 Answering Telephones. Contractor employees shall identify themselves as a contract employee when answering and making calls on government telephones.

1.6.7.17 Utilizing Electronic Mail.

1. When contractor employees send e-mail messages to government personnel while performing on this contract, the contractor employee's e-mail address shall include the company name together with the person's name (ex: John Smith, Contractor, ABC Company).

2. When contractor employees require access to a government computer, the contractor employee shall be required to obtain a Common Access Card. To do so, the contractor employee shall request a CAC Card through the COR.

NOTE: The government issued CAC is the property of the U.S. Government and shall be returned to the COR upon expiration of the contract, replacement or termination of the contract employee. (CAC card must be turned in to the COR on contractor employee's last day of employment.) Unauthorized possession of the CAC can be prosecuted criminally under section 701, title 18, United States Code.

3. All contractor employees shall conduct official communication using Government-owned or provided e-mail, networks, websites, systems, and devices. The use of commercial ISP e-mail accounts or personal e-mail accounts to conduct official communication is prohibited. Remote access / telework technology may be leveraged to ensure compliance with these requirements.

4. Contractor employees are prohibited from using Army-assigned, AKO, and other official e-mail addresses for unofficial business affiliations. Personnel shall not provide official e-mail addresses to businesses, affiliated organizations, or online retailers; unless those entities are known by personnel to be legitimately engaging in official business.

1.6.7.18 Eligibility Verification for Employment. E-Verify is an Internet-based system that compares information from an employee's Form I-9, Employment Eligibility Verification, to data from U.S. Department of Homeland Security and Social Security Administration records to confirm employment eligibility. The U.S.

Department of Homeland Security is working to stop unauthorized employment. By using E-Verify to determine the employment eligibility of their employees, companies become part of the solution in addressing this problem. All U.S. employers must complete and retain a Form I-9 for each individual they hire for employment in the United States. This includes citizens and noncitizens. On the form, the employer must examine the employment eligibility and identity document(s) an employee presents to determine whether the document(s) reasonably appear to be genuine and relate to the individual and record the document information on the Form I-9. The list of acceptable documents can be found on the last page of the form. E-Verify is mandatory for employers with federal contracts or subcontracts that contain the Federal Acquisition Regulation E-Verify clause.

1.6.7.19 PHYSICAL SECURITY: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.6.7.20 Key Control. The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer.

In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

1.6.7.21 Lock Combinations. The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations.

These procedures shall be included in the Contractor’s Quality Control Plan.

1.6.8 Staffing and Personnel Qualifications:

The contractor is responsible for the overall management and oversight of this contract. It is the contractor’s responsibility to staff and deploy qualified contractor personnel to meet all of the PWS requirements. The Government’s historical staffing data is provided under Technical Exhibit 3.” The Government anticipates the requirements within this PWS will require sixty-five (65) contractor personnel with the following breakdown: One

(1) Program Manager, three (3) Information System Security Officer, one (1) Security Assistant, one (1) Logistics Engineer, one (1) Technical Writer, three (3) Senior System Administrator BLCSE, four (4) Network/Data Engineers BLCSE, one (1) Security Analyst Engineer, one (1) Host Based Security System Administrator, one (1) Security Auditor, four (4) Network/Data Engineer RHN-E, four (4) SATCOM Engineer Associate RHN-E, one (1) Senior Systems Administrator RHN-E, one (1) Senior Principal Systems Engineer RHN-E, two (2) Communications Engineer, four (4) Principal Engineer, two (2) Junior Principal Engineer, seven (7) Cyber Analysts, three (3) EW Analyst, one (1) Senior RF Engineer, one (1) M&S Sr Analyst, sixteen (8) Computer Programmer/Software Engineer Modeling & Simulation, one (1) Database Programmer, and one (9) Functional Area Expert. However, it is the Contractor’s responsibility to propose and deploy the correct labor types, mix, number and hours required to satisfactorily and professionally meet all PWS requirements. This information is provided to the vendor as a workload estimate only. Required certifications and/or training certificates shall be presented to the COR upon hire (CDRL B003). Certification requirements that change during the life of the TO must be approved by the COR. Contractors will be given six months to obtain required certificate of training and certification, if the requirements change during the period of performance. Contractor personnel qualifications are as follows.

1.6.8.1 Program Manager (PM) requirements:

• Security Clearance: possess Top Secret (TS) with SCI eligibility.

• Information Assurance Work Force / Cybersecurity Work Force (IAWF / CSWF): no.

• Certification & Training, Baseline, day 1: none.

• Certification & Training, Computing Environment (CE), day 1: active Project Management Professional (PMP) training at a minimum and PMP certification preferred.

• Certification & Training, CE, within 6 months: none.

• Experience: ten years management experience or equivalent on similar government contracts

• Proficiencies: coordinating work schedules/assignments of contractor employees; supervise contractor employees; communicate orally and written with COR; be familiar with all duties and qualifications stated in the PWS; and conflict resolution.

• Key tasks: serve as the key point of contact for this effort; ensure all deliverables described in the PWS are delivered on time; supervise, coordinate work schedules, resolve minor concerns/issues and complete the administrative tasks associated with this PWS; provide analysis of project requirements and accurate cost estimates; provide project coordination and process improvements thru the Quality Control Plan; gather and provide required information to assist with coordination support efforts.

1.6.8.2 Security Assistant requirements:

• Security Clearance: obtain and maintain Secret.

• IAWF / CSWF: no.

• Certification & Training, Baseline, day 1: none.

• Certification & Training, CE, day 1: none.

• Certification & Training, CE, within 6 months: none.

• Experience: three years’ experience or equivalent in the field of security operations and worked directly in the career field during three (3) of the preceding five (5) years.

• Proficiencies: possess skills/knowledge of JPAS or the new Defense Information System for

Security (DISS) in the performance of assigned duties; performing required self-inspections of security programs; managing and implementing physical security safeguards for the protection of personnel and property; preparing and maintains policy and procedures for handling, storing, and keeping records, and for granting personnel and visitors' access to restricted records and materials;

maintaining classified document accounts, preparing assessments involving possible security violations and initiating measures to correct security deficiencies; National Industrial Security Program Operating Manual (NISPOM), NISPOM Supplement, and Director of Central Intelligence Directives (DCIDs); preparing, issuing and maintaining government security forms;

supporting security disciplines, including document control, visit certifications, personnel security processing, and security processes and procedures; possess working knowledge of a variety of physical security disciplines including but not limited to locks, alarms, security containers, risk-management and security countermeasures; possess ability to identify and report inspection checklist facility-related items that are damaged, or are in need of maintenance or repair; and be computer literate (have a working knowledge of Word, PowerPoint, Spreadsheets, etc.).

• Key tasks: Manage building key control program.

1.6.8.3 Logistics Technician requirements:

• Security Clearance: obtain and maintain TS with SCI eligibility.

• IAWF / CSWF: no.

• Certification & Training, Baseline, day 1: none.

• Certification & Training, CE, day 1: none.

• Certification & Training, CE, within 6 months: none.

• Experience: have a minimum of three years’ experience or equivalent in the field of Army logistics operations and worked directly in the career field during three (3) of the preceding five

(5) years; have experience with the Cyber Center of Excellence Command Supply Discipline Program providing 100% inventory control to all items identified on the installation property book; and equipment maintenance processes and procedures.

• Proficiencies: have knowledge in Army supply policies and procedures regarding property inventories, cataloging, maintenance, transfer, and turn-in; and be computer literate (have a working knowledge of Word, PowerPoint, Spreadsheets, etc.).

1.6.8.4 Technical Writer requirements:

• IAWF / CSWF: no.

• Certification & Training, Baseline, day 1: none.

• Certification & Training, CE, day 1: have a Bachelor’s degree in a related technical discipline from an accredited college or university. Four (4) years of additional experience may be substituted for the Bachelor’s degree if the four years of technical writing and editing experience was with the Federal Government.

• Certification & Training, CE, within 6 months: none.

• Experience: project coordination and/or project scheduling.

• Proficiencies: ability to work effectively within a collaborative writing environment; and have the ability to effectively describe technically complex material to a non-technical audience; have excellent oral and written communication skills; and be proficient in Microsoft Word, Excel, and Outlook

• Key Tasks: Write, edit, and proofread technical documents, plans, reports, schedules, papers, and Microsoft Power Point presentations; conduct quality control checks to ensure compliance with Army and DoD regulations, processes, manuals, pamphlets, memoranda, guidelines, and specifications; maintain a comprehensive library of technical and process documentation; and organize and lead peer reviews and work with engineers to ensure documentation is developed and approved in accordance with project schedules.

1.6.8.5 Network / Data Engineer BLCSE CESC requirements:

• IAWF / CSWF: DoD 8570.01 / DoD 8140 IAT Level II.

• Certification & Training, Baseline, day 1: IAT Level II, per DISA at https://cyber.mil.

• Certification & Training, CE, day 1: at least one CME in the BLCSE must have certification in

CCNP R&S; all other CME must have CCNA.

• Certification & Training, CE, within 6 months: provide verification of either (1) CCNP R&S certification; or (2) certificate of completion in CCNP TSHOOT 2015 Video Boot Camp from Udemy or (3) CCNP TSHOOT training approved by the CBL IAM and COR.

• Experience: minimum of five (5) years experience or equivalent in network operational environment consisting of multiple Cisco devices, including routers, switches, and firewalls.

• Proficiencies: expert knowledge and skills with inline encryption devices (e.g., TACLANEs);

expert knowledge and skills on VoIP and secure VTC services; expert knowledge on network management systems and Software Cisco Call Manager, Syslog, Solarwinds, GEMx, SNMPc, and Cisco Security Manager at a minimum; and competent in the use of network monitoring systems and troubleshooting techniques.

1.6.8.6 Senior System Administrator BLCSE CESC requirements:

• IAWF / CSWF: DoD 8570.01 / DoD 8140 IAT Level II.

• Certification & Training, Baseline, day 1: IAT Level II, per DISA at https://cyber.mil.

• Certification & Training, CE, day 1: all CMEs must have Microsoft Certified Solutions Associate

(MCSA) Server; at least one CME in the BLCSE must have certification in Microsoft Certified Solutions Expert (MCSE) Core Infrastructure; at least one CME must have certification in Microsoft (MS) server virtualization (e.g. MS Exam 74-413); and at least one CME in the BLCSE must have certification in NetApp Certified Data Administrator (CDA).

• Certification & Training, CE, within 6 months: none.

• Experience: a minimum of five (5) years’ experience administrating networks and systems, worked directly in the career field during five (5) of the preceding eight (8) years.

• Proficiencies: must have a solid understanding of Microsoft server & workstation operating systems and networking; familiarity with Unix/Linux operating systems preferred; advanced IT administrator skills in remote administration, remote desktop, Group Policy Object (GPO) management, system backup and recovery, and monitor servers for performance evaluation and optimization; advanced IT Administrator skills in Collaboration Services, e.g., Chat Services, SharePoint Portal, Electronic Email (Exchange) Server; advanced skills in datacenter management, Cloud Services, virtualization, storage area networks (SANs), data/system backups, and asset management; and expert remote troubleshooting and customer service skills

1.6.8.7 Security Analyst Engineer (CS-SP Security Analyst (CS-AN)) BLCSE requirements:

• IAWF / CSWF: DoD 8570.01 / DoD 8140 CSSP Analyst.

• Certification & Training, Baseline, day 1: CSSP Analyst, per DISA at https://cyber.mil.

• Certification & Training, CE, day 1: none.

• Certification & Training, CE, within 6 months: CISA or GSNA or CySA+ or cyber/information/network security advanced degrees approved by the IAM/COR (additional training, certifications, and/or years of relevant technical experience may be substituted for a degree); and complete training for HBSS 201 & 501 approved by the IAM/COR.

• Experience: at least two (2) years’ experience with Cyber Security CS disciplines within the DoD and/or other agencies within the United States Government.

• Proficiencies: advanced IT administrator skills in remote administration, remote desktop; working knowledge of Local Area Network (LAN) / Wide Area Network (WAN) technologies; working knowledge of the DoD, IC, and national level system security initiatives; must be familiar with the requirements outlined in the most current Evaluator Scoring Metric (ESM).

• Key tasks: provide Computer Network Defense (CND) support to ensure products, systems, and services comply with all appropriate IA & CSSP policies/procedures, network defense requirements and best practices as prescribed by the Office of the Directory of National Intelligence (ODNI), Defense Intelligence Agency (DIA), Department of Defense (DoD), Defense Information Systems Agency (DISA), Army Cyber Command (ARCYBER), the CSSP TIER-II, and local authorities.

1.6.8.8 Host Based Security System (HBSS) Administrator (CS-SP Infrastructure Support (CS-IS)) requirements:

• IAWF / CSWF: DoD 8570.01 / DoD 8140 CSSP Infrastructure Support.

• Certification & Training, Baseline, day 1: CSSP Infrastructure Support, per DISA at https://cyber.mil.

• Certification & Training, CE, day 1: none.

• Certification & Training, CE, within 6 months: MCSA Server; and complete training for HBSS

201 & 501 approved by the IAM/COR.

• Experience: with McAfee ePolicy Orchestrator (ePO) Server and hands on experience deploying and troubleshooting HBSS products (e.g. HIPS, VSE, and DLP); knowledge and experience in working with the McAfee Host Intrusion Prevention System, McAfee Data Loss Prevention Endpoint, and McAfee product policy tuning

• Proficiencies: expertise managing HBSS; solid understanding of Microsoft and Linus operating systems and networking.

• Key tasks: operate and system administer the HBSS systems of the BLCSE CESC.

1.6.8.9 Security Auditor (CS-SP Auditor (CS-AU)) BLCSE requirements:

• Security Clearance: obtain and maintain TS with SCI eligibility.

• IAWF / CSWF: DoD 8570.01 / DoD 8140 CSSP Auditor.

• Certification & Training, Baseline, day 1: CSSP Auditor, per DISA at https://cyber.mil.

• Certification & Training, CE, day 1: none.

• Certification & Training, CE, within 6 months: CISA or GSNA or cyber/information/network security advanced degrees approved by the IAM/COR; and HBSS 301 training approved by the

IAM/COR.

• Experience: at least two (2) years in a related field or Bachelor of Science degree in cybersecurity / IT security or related field approved by the IAM; periodic and on-demand system audits and vulnerability assessments, including user accounts, application access, file system and Web integrity scans to determine compliance..

• Proficiencies: Must have a solid understanding of Microsoft server & workstation operating systems and networking; familiarity with Unix/Linux operating systems preferred; significant knowledge of particular CS tools, tactics, techniques, and procedures which support their compliance tests

• Key tasks: monitoring through investigative research, forensic examination, internet monitoring and formal reporting

1.6.8.10 Information System Security Officer (ISSO) BLCSE requirements:

• IAWF / CSWF: DoD 8570.01 / DoD 8140 IAM Level I.

• Certification & Training, Baseline, day 1: IAM Level I, per DISA at https://cyber.mil.

• Certification & Training, CE, day 1: ISC² Certified Information Systems Security Professional

(CISSP) or CompTIA Certified Advanced Security Practitioner (CASP).

• Certification & Training, CE, within 6 months: must complete training HBSS 101 or HBSS 201 approved by the IAM/COR.

• Experience: supporting DoD systems accreditation, certification, and authorization processes (e.g.

DIACAP, RMF); assessing & mitigating risk in information systems; performing compliance auditing of information systems; developing and maintaining DoD information systems accreditation documentation; coordinating & leading configuration control board activities

• Proficiencies: assessing & mitigating risk in information systems; DoD systems accreditation, certification, and authorization processes; RMF; eMASS; and collaborative team leading.

• Key tasks: coordinate, guide, manage, and document the information system security posture of BLCSE CESC information systems; and coordinating & leading configuration control board activities.

1.6.8.11 Network / Data Engineer RHN-E requirements:

• IAWF / CSWF: DoD 8570.01 / DoD 8140 IAT Level I.

• Certification & Training, Baseline, day 1: IAT Level I, per DISA at https://cyber.mil.

• Certification & Training, CE, within 6 months: at least 2 CME must have certification and provide verification of Cisco Certified Network Professional (CCNP) security or CCNP R&S; all other Network / Data Engineers in the RHN-E shall provide verification of either (1) CCNP R&S certification;…