ATT001 TEIS IV PWS.pdf

Solicitation No. W9128Z-19-R-0002

Contract No. Attachment 0001

PERFORMANCE WORK

STATEMENT FOR

TOTAL ENGINEERING AND INTEGRATION SERVICES

(TEIS) IV FOR THE

UNITED STATES ARMY INFORMATION SYSTEMS ENGINEERING

COMMAND FORT HUACHUCA, AZ 85613-5300

September 2019

TABLE OF CONTENTS

1.0 SCOPE

2.0 APPLICABLE DOCUMENTS

2.1 General

2.2 Industry Standards

2.3 Department of the Army Regulations and Directives

2.4 Department of Defense Policies, Regulations, Instructions, and Directives

2.5 Miscellaneous Policies and Directives

2.6 Architectures

3.0 TASKS

3.1 General Task Requirements

3.2 Engineering and Site Surveys

3.3 Information Systems Engineering

3.4 Cybersecurity

3.5 Approved Products List Certification

3.6 Information Systems Integration/Installation

3.7 Test and Evaluation

3.8 Software

3.9 Transitional Operations and Maintenance Service

3.10 Information Technology Technical Services

3.11 Information Systems Documentation

3.12 Technical Instruction

3.13 Drafting and Illustration Support

3.14 Project Services

3.15 Project Management

3.16 Systems / Network Administration

3.17 Systems Analysis

3.18 Technology Demonstration and Rapid Prototype Support

4.0 GENERAL REQUIREMENTS

4.1 Facilities

4.2 Laboratory and Warehouse Space

4.3 Government-Furnished Property

4.4 Contractor-Furnished Equipment

4.5 Test, Measurement, and Diagnostic Equipment

4.6 Contract Data Requirements

4.7 Data Rights Contract

5.0 Quality Assurance (QA)

6.0 Travel

7.0 Contractor Manpower Reporting Application (CMRA)

8.0 Security

9.0 Handling Classified Material

10.0 Personnel Qualifications

11.0 Safety

11.1 Area of Responsibility Training

11.2 Contractor Safety Program

11.3 Personnel Accountability During Emergencies

DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

1.0 SCOPE

The contract provides for information systems engineering and information technology support services to United States Army Information Systems Engineering Command (USAISEC). The services will include engineering related activities in support of all aspects of information and communication systems. Support will be required for the full life cycle of USAISEC projects to include planning, design, development, engineering, implementation, procurement, logistics, evaluation, test, sustainment, systems retirement, and ancillary services. Worldwide support is required. Most of the worldwide support is required to occur at sustained locations that are secure and possess adequate infrastructure. However, worldwide support may include areas with challenging environments including remote locations, and sometimes hostile locations with little to no infrastructure. Work in highly secure facilities involving the highest level clearances may be required. Specific tasks are further detailed in Section 3.0.

2.0 APPLICABLE DOCUMENTS

2.1 General

The following documents are incorporated by reference to and form a part of this Performance Work Statement (PWS). In the event of a conflict between the documents referenced herein and the contents of this contract, the contents of this contract shall control and be superseding. The Contractor is responsible for obtaining, and abiding by the most current and approved versions of all applicable references listed with webpage links below.

Other documents required for execution of tasks under this contract will be cited in the relevant task orders.

2.2 Industry Standards

a. National Fire Protection Association (NFPA) 70, National Electric Code (NEC) 2017 version. https://www.nfpa.org

b. NFPA 70E, Standard for Electrical Safety in the Workplace 2018 version. https://www.nfpa.org

c. NFPA 75, Standard for the Fire Protection of Information Technology Equipment 2017 version. https://www.nfpa.org

d. NFPA 780, Standard for the Installation of Lightning Protection Systems 2017 version. https://www.nfpa.org

e. NFPA 2001, Standard on Clean Agent Fire Extinguishing Systems 2015 version. https://www.nfpa.org

f. TIA-568 Commercial Building Set: Commercial Building https://www.nfpa.org/ https://www.nfpa.org/ https://www.nfpa.org/ https://www.nfpa.org/ https://www.nfpa.org/

Telecommunications Cabling Standard Part 1: General Requirements, Part 2: Balanced Twisted-Pair Cabling Components, and Part 3:

Optical Fiber Cabling Components Standard - Includes: TIA-568.0-D, TIA-568.0-D-1, TIA-568.1-D, TIA-568.2-C, TIA-568.2-C Errata, TIA-

568.2-C-1, TIA-568.2-C-2, TIA-568.3-D, TIA-568-4-D.

https://www.tiaonline.org

g. TIA-569-D, Telecommunications Pathways and Spaces, April 2015.

https://www.tiaonline.org

h. TIA-606-C, Administration Standard for Telecommunications Infrastructure, June 2017. https://www.tiaonline.org

i. TIA-607-C, Generic Telecommunications Bonding and Grounding (Earthing) for Customer Premises, January 2017.

https://www.tiaonline.org

j. TIA-942-B, Telecommunications Infrastructure Standard for Data Centers, July 2017. https://www.tiaonline.org

k. TIA-758-B, Customer-Owned Outside Plant Telecommunications Infrastructure Standard, March 2012. https://www.tiaonline.org

l. Local and metropolitan area networks - Port-Based Network Access Control - Amendment 1: MAC Security Key Agreement Protocol (MKA) Extensions - IEEE Computer Society (IEEE 802.1XBX), December 2014.

https://standards.ieee.org/standard/802_1Xbx-2014.html

2.3 Department of the Army Regulations and Directives

a. Army Regulation (AR) 25-1, Army Information Technology, 15 July 2019.

https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/ARN18191_R25_1 _FINAL.pdf

b. AR 25-1, Army in Europe Supplement 1 - Army Information Technology, 21 Nov 2016. https://media.defense.gov/2016/Nov/21/2001921518/-1/- 1/0/AR25-1-S1.pdf

c. AR 25-2, Information Assurance - Rapid Action Revision (RAR), 4 April 2019.

https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/ARN3870_AR25_2 _FINAL.pdf

d. AR 25-13, Army Telecommunications and Unified Capabilities, 11 May 2017.

https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/ARN3184_AR25- 13_Final_for_web.pdf

e. AR 190-13, The Army Physical Security Program, 25 February 2011.

https://armypubs.army.mil/epubs/DR_pubs/DR_b/pdf/web/r190_13.pdf https://www.tiaonline.org/ https://www.tiaonline.org/ https://www.tiaonline.org/ https://www.tiaonline.org/ https://www.tiaonline.org/ https://www.tiaonline.org/ https://standards.ieee.org/standard/802_1Xbx-2014.html https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/ARN3184_AR25-13_Final_for_web.pdf https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/ARN3184_AR25-13_Final_for_web.pdf

f. AR 190-51, Security of unclassified Army Property (Sensitive and Non-sensitive), 30 September 1993.

https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/r190_51.pdf

g. AR 380-5, Department of the Army (DA) Information Security Program, 29 September 2000.

https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/r380_5.pdf

h. AR 380-27, Control of Compromising Emanations, 22 July 2014.

https://armypubs.army.mil/epubs/DR_pubs/DR_c/pdf/web/r380_27.pdf

i. AR 380-53, Information Systems Security Monitoring, 17 January 2013.

https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/r380_53.pdf

j. AR 380-67, Personnel Security Program, 24 Jan 2014.

https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/r380_67.pdf

k. AR 381-12, Threat Awareness and Reporting Program, 1 Jun 2016.

https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/AR%20381- 12%20FINAL%20WEB.pdf

l. AR 525-13, Antiterrorism, 17 Feb 2017.

https://armypubs.army.mil/epubs/DR_pubs/DR_b/pdf/web/AR525- 13_Web_FINAL_2.pdf

m. AR 525-28, Personnel Recovery, 5 Mar 2010.

https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/r525_28.pdf

n. AR 530-1, Operations Security, 26 Sep 2014.

https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/r530_1.pdf

o. AR 602-2, Human Systems Integration in the System Acquisition Process, 27 Jan 2015.

https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/r602_2.pdf

p. Army Directive 2014-05, Policy and Implementation Procedures for Common Access Card Credentialing and Installation Access for Uncleared Contractors, 7 Mar 2014.

https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/ad2014_05.pdf

2.4 Department of Defense Policies, Regulations, Instructions, and Directives

a. Department of Defense Instructions (DoDI) 5000.02 Change 3, Operation of the Defense Acquisition System, 10 August 2017.

https://www.dau.mil/guidebooks/Shared%20Documents%20HTML/DoDI%205

000.02.aspx https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/r190_51.pdf https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/r380_67.pdf https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/AR%20381-12%20FINAL%20WEB.pdf https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/AR%20381-12%20FINAL%20WEB.pdf https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/r525_28.pdf https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/r530_1.pdf

b. DoDI 5200.01, Department of Defense (DoD) Information Security Program and Protection of Sensitive Compartmented Information (SCI), Change 1, 1 May

2018.

http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520001p.pd f?ver=2018-05-01-090712-517

c. DoDI 5200.08, Security of DoD Installations and Resources and the DoD

Physical Security Review Board (PSRB), Change 3, 20 Nov 2015.

http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520008_20

05_ch3.pdf

d. Department of Defense Regulation 5200.08-R, Physical Security Program, Change 1, May 27, 2009.

http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/520008r.p df

e. DoDI 5200.44, Protection of Mission Critical Functions to Achieve Trusted

Systems and Networks (TSN), Change 2, July 27 2017.

http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520044p.pd f

f. DoDI 8100.04, DoD Unified Capabilities, December 9 2010.

http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/810004p.pd f

g. DoD Directive 8140.01, Cyberspace Workforce Management, Change 1, 31

July 2017.

http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/814001_2

015_dodd.pdf

h. DoDI 8500.01, Cybersecurity, 14 March 2014.

http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/850001_20

14.pdf

i. DoDI 8510.01, Risk Management Framework (RMF) for DoD Information

Technology (IT), Change 2, July 28 2017.

http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/851001_20

14.pdf

j. DoDI 8540.01, Cross Domain (CD) Policy, Change 1, August 28. 2017.

http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/854001p.pd f http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520008_2005_ch3.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520008_2005_ch3.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520044p.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520044p.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/810004p.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/810004p.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/814001_2015_dodd.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/814001_2015_dodd.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/850001_2014.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/850001_2014.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/851001_2014.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/851001_2014.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/854001p.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/854001p.pdf

k. Department of Defense 5220.22-M, National Industrial Security Program operating Manual (NISPOM), Change 2, May 18 2016.

http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/522022M.

pdf

l. Department of Defense Directive 8570.01-M, Information Assurance

Workforce Improvement Program, Change 4, November 10 2015.

http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/857001m.

pdf

m. Department of Defense Unified Capabilities Requirements 2013 (UCR 2013)

Change 2, September 2017.

https://disa.mil/~/media/Files/DISA/Services/UCCO/UCR-2013-

Change2/UCR-2013-Change2.pdf

n. Defense Health Agency (DHA) Directives and Guidelines, https://www.health.mil/

o. Defense Information Systems Agency (DISA) Security Technical

Implementation Guides (STIGs), http://iase.disa.mil/stigs

p. Department of Defense Manual 5200.02, Procedures for the DoD Personnel

Security Program (PSP), April 2017.

http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/520002_d odm_2017.pdf

q. Cyber Workforce Management Program, DoDD 8140-01 and DoD 8570.01-

M. https://iase.disa.mil/iawip/pages/index.aspx

r. DoDI 8530.01. Cybersecurity Activities Support to DoD Information Network

Operations. https://apps.dtic.mil/dtic/tr/fulltext/u2/1005132.pdf

s. DoDI 6495.01. Sexual Assault Prevention and Response (SAPR) Program.

https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/649501p.

pdf

t. DoDI 6495.02. SAPR Program Procedures.

https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/649502p.p df

2.5 Miscellaneous Policies and Directives

a. USAISEC Operations Security Plan, August 2017. (ATT002) http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/522022M.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/522022M.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/857001m.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/857001m.pdf https://www.health.mil/ http://iase.disa.mil/stigs http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/520002_dodm_2017.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/520002_dodm_2017.pdf https://iase.disa.mil/iawip/pages/index.aspx https://apps.dtic.mil/dtic/tr/fulltext/u2/1005132.pdf https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/649501p.pdf https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/649501p.pdf https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/649502p.pdf https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/649502p.pdf

b. USAISEC Drafting Guide, April 2018. (ATT003)

c. USAISEC Visual Information System Software Design Criteria, March 2018.

(ATT004)

d. USAISEC Secret Internet Protocol Router Network (SIPRNET) Technical Implementation Criteria, Version 7.0, September 2013. (ATT005)

e. USAISEC Instructional Guide for Developing Engineering Implementation Plan, May 2013. (ATT006)

f. USAISEC Cyber Secuirty Assessment and Security Engineering Manual V2.1

(ATT010)

g. Occupational Health and Safety Standard (OSHA). https://www.osha.gov/law-regs.html

h. Military Handbook MIL-HDBK-419, Grounding, Bonding, and Shielding for Electronics Equipment and Facilities, 29 Dec 87. Volumes 1 & 2.

https://www.wbdg.org/ffc/navy-navfac/criteria-manuals/mil-hdbk-419a-v1 https://www.wbdg.org/ffc/navy-navfac/criteria-manuals/mil-hdbk-419a-v2

i. Unified Facilities Criteria (UFC) 3-580-01, Telecommunications Interior Infrastructure Planning and Design, June 2016.

https://www.wbdg.org/FFC/DOD/UFC/ufc_3_580_01_2016_c1.pdf

j. UFC 4-140-03, Command and Control Facilities (C2F) and other Army

Headquarters, 20 July 2012. (ATT007)

k. Technical Criteria for the Installation Information Infrastructure Architecture (TC-I3A), Outside Plant Telecommunications Cabling System Specifications, November 2017. (ATT008)

l. National Security Systems Advisory Memorandum (CNSSAM) TEMPEST/1- 13, RED/BLACK Installation Guidance, 17 January 2014, https://www.cnss.gov/CNSS/issuances/Memoranda.cfm

m. Committee on National Security Systems Instructional (CNSSI) Protected Distribution Systems (PDS), Sept 2015, http://www.dss.mil/documents/odaa/CNSSI_7003_PDS_September_2015.pdf

n. Intelligence Community Directive (ICD) 705, Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities (SCIF), 28 September 2017.

https://www.dni.gov/files/NCSC/documents/Regulations/Technical- Specifications-SCIF-Construction.pdf https://www.osha.gov/law-regs.html https://www.osha.gov/law-regs.html https://www.wbdg.org/ffc/navy-navfac/criteria-manuals/mil-hdbk-419a-v1 https://www.wbdg.org/ffc/navy-navfac/criteria-manuals/mil-hdbk-419a-v2 https://www.wbdg.org/FFC/DOD/UFC/ufc_3_580_01_2016_c1.pdf https://www.cnss.gov/CNSS/issuances/Memoranda.cfm http://www.dss.mil/documents/odaa/CNSSI_7003_PDS_September_2015.pdf https://www.dni.gov/files/NCSC/documents/Regulations/Technical-Specifications-SCIF-Construction.pdf https://www.dni.gov/files/NCSC/documents/Regulations/Technical-Specifications-SCIF-Construction.pdf

o. DISN Enterprise Network (DISN-EN) Installation Campus Area Network Design & Implementation (ICAN-DI), Artifact Version 1.09f, 5 Dec 2016.

(ATT009)

p. US Army Corps of Engineers, ERDC/ITL TR-12-6 A/E/C CAD Standard, Release 6.0, 25 August 2015. https://www.wbdg.org/ffc/army-coe/technical-reports-tr/erdcitl-tr12-6-r6/

q. National CAD Standard Version 6, September 2014.

https://www.nationalcadstandard.org/ncs6/new.php

r. Department of Defense Contract Security Classification Specifications Form 254, November 2017.

http://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0254.pdf

s. Federal Information Security Management Act (FISMA) Oversight and Compliance Reporting, http://www.esd.whs.mil/Portals/54/Documents/FOID/Reading%20Room/Other /16-F-0418_DoD_FISMA_Oversight_and_Compliance_Report.pdf

t. Federal Information Processing Standard (FIPS) Module Validation Lists, http://csrc.nist.gov/groups/STM/cmvp/validation.html

u. Health Insurance Portability and Accountability Act (HIPAA), http://www.hhs.gov/ocr/privacy/

v. National Institute of Standards and Technology (NIST) Pubs (drafts included);

FIPS Pubs (drafts included); Special Pubs; IRs. http://csrc.nist.gov/

w. NIST 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, Rev. 1, February 2010.

https://csrc.nist.gov/publications/detail/sp/800-37/rev-1/final

x. The Federal Risk and Authorization Management Program, https://www.fedramp.gov/

y. North American Electric Reliability Corporation, Critical Infrastructure Protection Standards.

https://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx

z. Public Law 93-579, Privacy Act of 1974 (Section 552a of title 5, United States Code). http://www.justice.gov/opcl/privstat.htm

aa. Public Law 100-235, Computer Security Act of 1987 (Section 278g-3 of title 15, United States Code). https://www.csp.noaa.gov/policies/csa-1987.htm

bb. OMB Circular A-130, Management of Federal Information Resources, Transmittal 4, 28 November 2000. http://www.whitehouse.gov/omb/ https://www.wbdg.org/ffc/army-coe/technical-reports-tr/erdcitl-tr12-6-r6/ https://www.wbdg.org/ffc/army-coe/technical-reports-tr/erdcitl-tr12-6-r6/ https://www.nationalcadstandard.org/ncs6/new.php http://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0254.pdf http://csrc.nist.gov/groups/STM/cmvp/validation.html http://www.hhs.gov/ocr/privacy/ http://csrc.nist.gov/ https://www.fedramp.gov/ http://www.justice.gov/opcl/privstat.htm https://www.csp.noaa.gov/policies/csa-1987.htm http://www.whitehouse.gov/omb/

cc. U.S. Food and Drug Administration (FDA) Directives and Guidelines, http://www.fda.gov/MedicalDevices/default.htm

dd. Joint Travel Regulations (JTR), November 1, 2018.

https://www.defensetravel.dod.mil/Docs/perdiem/JTR.pdf

ee. Computer Hardware, Enterprise Software and Solutions (CHESS) Statement of Non-Availability. https://www.army.mil/e2/c/downloads/303296.pdf

2.6 Architectures

a. Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance Architecture Framework, Version 2.0, 18 December 1997. http://www.afcea.org/education/courses/archfwk2.pdf

b. DoD Information Enterprise Architecture (DoD IEA), Version 2, August 10, 2012.

https://dodcio.defense.gov/IntheNews/DoDInformationEnterpriseArchitecture.

aspx

c. Enabling the Joint Information Environment (JIE), Shaping the Enterprise for the Conflicts of Tomorrow, 5 May 2014. https://www.disa.mil/About/Our- Work/JIE

d. CJCSI 3170.01I, "Joint Capabilities Integration and Development System," January 23, 2015.

http://www.jcs.mil/Portals/36/Documents/Library/Instructions/3170_01a.pdf?v er=2016-02-05-175022-720

e. CJCSI 6211.02D, Defense Information System Network (DISN) Responsibilities, January 24, 2012. http://www.jcs.mil/Library/CJCS- Instructions/

f. DoD Architecture Framework Version 2.02, August 2010.

http://dodcio.defense.gov/Library/DoD-Architecture-Framework

g. DoD 7000.14-R, Volume 2B, Chapter 18, paragraph 180105.BE, Joint Information Environment.

https://comptroller.defense.gov/Portals/45/documents/fmr/Volume_02b.pdf

3.0 TASKS

3.1 General Task Requirements

The Contractor shall provide information systems engineering and information technology support services in the areas described in section 3.2 in support of USAISEC. This support shall be provided by the Contractor in response to individual task orders. The various elements of work the contractors may be required to perform under this contract are characterized in the following paragraphs. Individual http://www.fda.gov/MedicalDevices/default.htm https://www.defensetravel.dod.mil/Docs/perdiem/JTR.pdf http://www.afcea.org/education/courses/archfwk2.pdf https://dodcio.defense.gov/IntheNews/DoDInformationEnterpriseArchitecture.aspx https://dodcio.defense.gov/IntheNews/DoDInformationEnterpriseArchitecture.aspx https://www.disa.mil/About/Our-Work/JIE https://www.disa.mil/About/Our-Work/JIE http://www.jcs.mil/Library/CJCS-Instructions/ http://www.jcs.mil/Library/CJCS-Instructions/ http://dodcio.defense.gov/Library/DoD-Architecture-Framework/ https://comptroller.defense.gov/Portals/45/documents/fmr/Volume_02b.pdf task orders will further define the required work. The projects to be supported may be located worldwide. The Contractor shall provide all qualified personnel, materials, services, equipment, support software, incidentals, transportation, and facilities for performance of the terms and conditions of this contract.

The requirements listed in this section are generic. Not all requirements will be required on all task orders. Nevertheless, the Contractor must be capable and prepared to perform all of the requirements described below. Specific detailed requirements for the performance of work under this contract will be stated in the individual task orders. The Contractor shall provide solutions to meet the following requirements.

3.1.1 Equipment and Material Procurement. When specified in the task order, the Contractor shall procure, integrate, ship, store, and track equipment and other material required for information systems implementation efforts. All equipment shall be procured in accordance with the "Government Property" clause at Federal Acquisition Regulation 52.245-1 and shall be accounted for and maintained pursuant to that clause. Commercial hardware shall be procured utilizing Army Federal Acquisition Regulation CHESS contracts regardless of dollar value. Any purchase made outside of CHESS contracts requires a waiver. All equipment shall be Trade Agreements Act (TAA) compliant and be version and feature compatible with current Government systems for interoperability. The Contractor shall provide the Government with the equipment/material list(s) and shall receive Government approval prior to ordering. All equipment procured will be stored by the Contractor unless otherwise specified in the individual task order. All environmentally sensitive equipment or material must be stored in a climate controlled storage unit / area.

3.1.2 Software Procurement. When specified in the task order, the Contractor shall procure software as required to accomplish the task specified. All software procured must have a current accreditation with the Army RMF or service equivalent. The Contractor shall purchase all software utilizing Army Federal Acquisition Regulation CHESS contracts and DoD Enterprise Software Agreements regardless of dollar value. Any purchase made outside of CHESS contracts will require a waiver prior to ordering. Software integrity shall be maintained by the Contractor within the licensing agreement of the producer until such software is delivered to the Government, or otherwise disposed of in accordance with Government direction.

3.1.3 Tools and Heavy Equipment. The Contractor shall provide all necessary installation tools and test equipment including any unique or specialized tools or Test, Measurement, and Diagnostic Equipment (TMDE). All tools and test equipment shall be appropriately certified and calibrated in accordance with manufacture’s requirements. Use of Government Furnished Property (GFP) such as tools or TMDE is limited and, if available, will be specified in the individual task orders. The Contractor shall provide all heavy equipment required for successful installation of IT systems on any site. The equipment shall include, but may not be limited to: forklifts; cherry pickers; heavy power tools. The Contractor shall also ensure that, when required by applicable laws, regulations, or contract, only licensed professionals operate the equipment.

3.2 Engineering and Site Surveys

The Contractor shall perform engineering surveys. Engineering and site surveys typically include the following tasks. Additional tasks or details may be provided in the individual task orders.

3.2.1 Develop checklists, forms and procedures to be used as a guideline for the collection of technical and supporting data as required for the specific information systems engineering task to be executed.

3.2.2 Research and analyze technical literature and data as applicable to the specific information systems engineering task.

3.2.3 Perform site surveys to collect, record, and organize the data for system design and detailed engineering.

3.2.4 Identify applicable Government, foreign government, private industry, and international codes, regulations, and standards.

3.2.5 Redline drawings to reflect the existing architecture of the facility or system being surveyed.

3.2.6 Perform site measurements and surveys to determine facility baseline conditions including assessing the types and characteristics of existing systems such as: communications grounding, bonding and potential shielding; power;

Heating, Ventilation, and Air Conditioning (HVAC); fire suppression; physical security; and planned upgrades or replacements. These surveys shall include measurements of power capacity, stability, safety and performance levels.

3.2.7 Conduct surveys and evaluations of information systems equipment currently in use within the DoD and private industry. These shall identify use, type, population, location, current status, and technical features.

3.2.8 Provide drawings pertaining to the systems being engineered for existing infrastructure for both inside and outside plant information.

3.2.8.1 Data to be gathered for inside plant surveys typically includes floor plans that identify telecommunications room and equipment locations, cabinet and rack locations, electrical panel locations, power availability, wireless device locations, cable pathways, ground rod and ground bar locations, and outside plant building entrance location. Inside plant drawings and diagrams also include electrical layouts/wiring diagrams/one-line drawings, logical and physical network diagrams.

3.2.8.2 Data to be gathered for outside plant typically include installation maps that identify utility pathways, vaults, maintenance holes, hand holes, utility poles, pedestals, communication pathways, streets and roads, buildings, and underground hazards. Outside plant drawings and diagrams also include butterflies, cable and infrastructure stick drawings.

3.2.9 Assess existing physical conditions at sites where there are proposed improvements of an existing facility or construction of a new facility. This would typically include assessments of the structural integrity and condition of existing facilities, and site suitability for expansion / modification / renovation, based on topography, geological and soil conditions, road access, climatic conditions and other applicable constraints.

3.2.10 Conduct Radio Frequency (RF) surveys for all forms of RF systems, which typically include satellite (military and commercial), WiFi wireless, and LiFi implementations. Surveys shall include identification of available satellites to the specific location, look angles of available satellites, and recording of heat maps that show signal attenuation between different locations at a site. Surveys shall identify existing RF frequency use; potential locations for new antennas; and physical attributes of the site that would affect RF propagation for satellite antennas or wireless devices; and building characteristics that would impact mounting of wireless devices (such as types of ceilings and walls).

3.2.11 Provide comprehensive site survey reports documenting all data obtained.

This typically include site specific information such as points of contact, phone numbers, mailing and shipping addresses, site access requirements, working conditions, updated drawings and other applicable documents.

3.3 Information Systems Engineering

The Contractor shall perform information systems engineering to translate functional requirements and performance objectives into design criteria, specifications and documentation for the individual elements and subsystems that will comprise that system. System design and development of engineering functions are required to support the engineering and acquisition of information systems that typically include the following: radio, military and commercial satellite systems, digital Intermediate frequency (IF), unified capabilities, multilevel security, serial, Ethernet and IF/RF fiber optic systems; fiber optics and copper cables, inside and outside cable plant, air traffic control and navigational aide, technical control, networks, command and control, space and terrestrial communications, record data, switched data/voice, video, computer, office automation, automation security, communications security, network security, physical security systems, network and systems management and control, enterprise information systems, sustaining base information, logistics, resource management, research and development, libraries, and Audio Visual and Visual Information Systems (AV/VIS) for Strategic Command and Control (SCC), Command and Control Facilities (C2F), Mission Command Facilities (MCF), and SCIF. The engineering of information systems also include the ancillary components which typically include power, grounding, shielding, lightning protection, backup power, system redundancy, and HVAC. Engineering functions typically include the following tasks. Additional tasks or details may be provided in the individual task orders.

3.3.1 Analyze requirements, architectures and other source material, and develope technical requirements, design criteria, performance standards and engineering concepts to support management programming actions and operational objectives.

3.3.2 Develop the engineering requirements, design and documentation for new or modified systems based on requirements analyses, risk assessments, site investigations, cost estimates, and evaluations of relative cost and performance benefits of alternative approaches.

3.3.3 Apply applicable criteria in determining system, subsystem, and facility designs for classified systems (for example, Department of Defense Information Network (DoDIN) Approved Product List (APL), RED/BLACK and SCIF, SIPRNET, installation, or wireless security.

3.3.4 Prepare design specifications and cost estimates, and review proposed plans for facility systems and construction.

3.3.5 Analyze and review DoD and Department of the Army (DA) policy and architecture documentation including developing, revising, and recommending Information Technology/Information Systems policies and architectures.

3.3.6 Apply security considerations to the information systems development process.

3.3.7 Design detailed enterprise data centers to include storage area networks (SAN), fiber channel distribution, server farm clustering, and virtual application hosting.

3.3.8 Perform studies and analyses to develop and implement new concepts and/or applications relating to the electromagnetic spectrum, information systems and information technology.

3.3.9 Configure and analyze network and communications systems and equipment components to find and correct deficiencies.

3.3.10 Perform traffic analyses, network design, information system performance analyses, lab prototyping, and migration studies.

3.3.11 Conduct engineering planning that reflects consideration of a total project to include design, life-cycle cost, possible life-cycle-cost reductions, system/equipment, software, procedures, and personnel.

3.3.12 Provide a holistic engineering design for facilities to include all supporting components which typically include power, grounding, bonding, lightning protection, HVAC, fire suppression, physical security, supporting structures, inside and outside plant pathways, fire stopping, and sealing.

3.3.13 Conduct, document, and provide trade-off analyses to determine relative benefits to be gained by implementing technological innovation.

3.3.14 Assure the interoperability at all interfaces within, and external to, a system (hardware and software), including the necessary supporting equipment, facilities, and other systems and equipment that will be present in the operational environment.

3.3.15 Prepare engineering installation plans in coordination with user, site authorities and customers. These plans shall contain criteria applicable to the particular design (e.g., equipment configuration, placement, equipment layout plans, rack face elevations, cable and duct routing) and preparation of associated drawings, technical data, and guidance for planning, engineering, installation, and cutover of information systems equipment, systems, subsystems, and facilities.

3.3.16 Conduct supporting engineering validations or investigations of systems performance, systems integration, systems interoperability, and problems with fielded systems and recommend alternative solutions.

3.3.17 Engineer military and commercial satellite systems which typically includes siting of new terminals and identification of site preparation requirements for both inside and outside construction of new and modified facilities. Includes evaluation and testing of X-band, Ku-band, Ka-band, C-band, UHF, EHF, Medium Earth Orbit (MEO) terminals, Global Broadcast System (GBS), Time Division Multiple Access (TDMA) and Frequency Division Multiple Access (FDMA) modems.

3.3.18 Conduct IF/RF and optical analysis, including radio and fiber propagation, electromagnetic interference, RF and signal strength coverage, and RF spectrum use and simulations that model wireless coverage for various types of facilities.

3.3.19 Perform cascade analysis and IF/RF alignments for systems which typically include, commercial and military satellite earth terminals, L-band matrix switches, analog fiber optic modems, TDMA and FDMA modems, and signal amplifiers.

3.3.20 Design Net-Centric systems in accordance with Joint Enterprise Infrastructure (JIE) requirements. Includes design and testing of multiple enclaves to include, but not limited to, convergence, SECRET, Sensitive but Unclassified (SBU), Unclassified, commercial internet, IPsec VPN gateways, network accelerators, firewalls, high assurance IP encryptors (HAIPE), Voice over IP (VoIP), Local Area Network (LAN), Campus Area Network (CAN), Metropolitan Area Network (MAN), and Wide Area Network (WAN) designs, to include virtual networks, host naming, port configurations and management, protocols, subnets, port considerations, and assignment of network addresses.

3.3.21 Perform radio frequency propagation path loss, and link budget analysis for satellite, terrestrial, and inside / outside plant optical paths.

3.3.22 Perform capacity requirements analyses and develop implementation plans, to include transition plans, for information processing systems.

3.3.23 Identify test and quality assurance requirements and criteria, and perform front-end quality assurance planning and test engineering.

3.3.24 Program software applications intrinsic to a systems engineering and/or integration effort.

3.4 Cybersecurity

3.4.1 Cybersecurity Engineering. The Contractor shall perform information systems security engineering to identify and integrate required security characteristics, requirements, and Cybersecurity processes into the performance objectives and functional capabilities of the designated systems and operating environment of the operating and maintaining organization. The Contractor shall assist developers and system owners in preparing systems and organizational Cybersecurity processes for assessment and authorization. Security engineering efforts generally include, but are not limited to, the following:

3.4.1.1 Provide system security engineering assistance from concept development through system implementation and operation.

3.4.1.2 Identify and ensure compliance status tracking of the appropriate security requirements as specified in the applicable industry and Government regulations, guidance, and best business practices.

3.4.1.3 Develop security concepts of operations, detailed security plans, allocation of component and sub-system security requirements, and standard operating procedures.

3.4.1.4 Conduct and document security, vulnerability, and risk assessments, making recommendations for eliminating or mitigating deficiencies, and implementing countermeasures as required.

3.4.1.5 Provide input to systems engineering specifications, plans, and designs incorporating security controls and requirements.

3.4.1.6 Review and evaluate systems design plans, Continuity of Operation Plans (COOP), communication plans, engineering change proposals and configuration changes for compliance with relevant security regulations, policies, and best industry practice.

3.4.1.7 Assist the system owner with the preparation of required technical and procedural Cybersecurity documentation.

3.4.1.8 Provide security engineering analysis support. Analysis support typically includes security-related hardware, software, and network component evaluations; security policy, process, and procedure determination/evaluation;

risk analysis; authorization package analysis; and engineering change proposal analysis.

3.4.1.9 Provide organizational security support to ensure that the system developer/owner/operator has all necessary Cybersecurity processes developed, implemented, and documented to ensure that any systems they are responsible for are operated and maintained in a secure and security control compliant manner over the lifecycle of the system.

3.4.1.10 Provide security engineering implementation support. Security configuration/ implementation ensures that systems and components are configured securely and in maximum compliance with Security Technical Implementation Guides, Security Requirements Guides and other authoritative security configuration guidance. All non-compliant settings must be fully documented and mitigated to the extent possible. Required expertise typically includes:

• Operating systems (e.g., UNIX-based or Windows-based)

• Databases

• Firewalls

• Network operating systems

• Software defined networks (SDN)

• Encryption devices/software

• Cryptographic related devices/software (e.g., Common Access Card

[CAC], Public Key Infrastructure [PKI], Public Key Encryption [PKE], Online Certificate

• Protocol [OCSP])

• Network devices (e.g., routers and switches)

• Remote access / network access control

• Client/server environments

• Internet protocols and protocol add-ons

• Intrusion detection / prevention tools

• Security evaluation tools

• Web technology

• Electronic commerce

• Transport technologies (e.g., Internet Protocol, Multi-Protocol

Label Switching (MPLS), Dense Wave Division Multiplexing

(DWDM))

• Physical security

• RED/BLACK security

• Emissions security

• Process Control Systems and Supervisory Control And Data Acquisition (SCADA) / Industrial Control Systems (ICS)

• Voice and telephony technologies

• Video technologies

• Security management

• Voice Over Internet Protocol (VoIP)

• Unified Communications

• Wireless Technologies

• Virtualization

• Cloud Computing

• Biometrics

• Big Data

• Artificial Intelligence / Machine Learning

• Medical Devices

• Cross Domain Solutions

3.4.1.11 Provide product security evaluations. The Contractor shall evaluate commercial and Government security products, which typically include:

developing evaluation plans, procedures, and pass/fail criteria; performing the evaluation; recording and briefing the results; and writing reports.

3.4.1.12 Validate the suitability of products being considered for inclusion as trusted components of supported systems. This typically includes the evaluation evidence provided by the product vendor, developer, or Government agencies; the logical premises for the security service provided by the product; and the consistency of the product’s security policy with the security policy of the supported system.

3.4.1.13 Prepare security-related issue papers or "white papers" as required.

3.4.1.14 Provide security incident tracking support. Recommend courses of action, provide necessary support to an intrusion incident, and analyze real-time or historical intrusion audit data.

3.4.2 Cybersecurity Assessment / Validation. The current DoD assessment and authorization process is the RMF. The Contractor shall perform the comprehensive evaluation, as defined below, of the technical and non-technical security features of an information system/network, and other safeguards, accomplished in support of an assess and authorization process, to establish the extent to which a particular design and implementation meets a set of specified security requirements. Security assessment/validation testing shall typically include the following areas and activities:

3.4.2.1 Coordinate with the system owners or security engineers to ensure the impact value (low/moderate/high) for the security objectives (confidentiality/integrity/availability) of the selected system and that applicable policies, regulations, standards, and other relevant documentation are followed.

3.4.2.2 Participate in and provide support to program security working group meetings.

3.4.2.3 Prepare and present technical security assessment related briefings.

3.4.2.4 Prepare and submit comprehensive security assessment test plans.

3.4.2.5 Review specified system and organizational documentation to identify and evaluate its adequacy against governing directives, standards, and regulations. Provide comments and recommendations.

3.4.2.6 Conduct an assessment in which the information system/network is evaluated to determine its readiness for a final security assessment evaluation. Assess all existing applicable security requirements, artifacts, and controls for accuracy and completeness.

3.4.2.7 Perform independent validation of the information system/network in accordance with approved test plan to determine its level of compliance with applicable security controls, policies, regulations, and standards.

3.4.2.8 Perform analysis of test data/findings in accordance with the security assessment procedures and determine residual risks.

3.4.2.9 Submit security assessment results as specified by the authorization process.

3.5 Approved Products List Certification

Provide Test Sponsorship Support and Test Engineering Support for Department of Defense Information Network Approved Products List (DoDIN APL) Distributed Testing (DT) of commercial products sponsored by Army proponents for placement on the DoDIN APL. Testing consists of functional security, unified capabilities, and interoperability (IO) requirements. Program support includes:

Sponsorship Initial Contact Meeting (ICM) Submission Package Tracking Number Testing Facility

Product testing, which includes:

Cryptography Security Technical Implementation Guides (STIGs) Security Requirements Guides (SRGs)

CAC/PKI

IPv6 Unified Capabilities Requirement (UCR) Interoperability (IO)

3.6 Information Systems Integration/Installation

3.6.1 Information Systems Integration. Perform information systems integration. This includes those activities described below that are associated with establishing or enhancing the information system (hardware, software, security features, data, operations, and personnel) based upon a governing architecture. Information systems integration generally is conducted at the systems level and is implemented under USAISEC’s responsibility for systems engineering technical integration. The nature of the information systems integration process requires a broad, high-level perspective that shall address the following:

3.6.1.1 Develop objective and target system architecture and

configurations. All information systems development and modernization programs shall conform to DoD’s most current Architectural Framework;

3.6.1.2 Develop transition plans and strategies for migration of baseline information systems to the target and objective configurations;

3.6.1.3 Develop, update and maintain DoD and Army information technology engineering and architectural planning documents;

3.6.1.4 Provide assessments of information systems, architectures and networks that address compliance with Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance (C4ISR) system requirements, guidelines and policies;

3.6.1.5 Plan information systems, architectures and networks through such efforts as system descriptions, cost/performance trade-off analyses, systems analyses, integration plans, white papers, and technical concept papers;

3.6.1.6 Develop system cutover plans and perform activation / cutover of new equipment and systems;

3.6.1.7 Review and validate proposed and existing system designs.

3.6.2 Installation Services. Provide installation / de-installation services which includes those activities described below. Installation / de-installation activities are typically performed in operational facilities.

3.6.2.1 Communications Equipment Installation. The Contractor shall install system components consisting of information technology equipment, equipment cabinets, cable ladder and conduit, cables (to include cable fabrication), patch panels, patch cables, cable management, power distribution, equipment grounding, hardware, firmware, and software.

Workmanship shall conform to the practices described in applicable safety codes or standards such as the National Electrical Code, National Fire Protection Association, American National Standards Institute, Telecommunications Industry Association, and in the USAISEC Technical Guides.

3.6.2.2 Material Procurement. The Contractor shall procure, ship, store, and track installation materials as required by the individual task orders. The required Installation List of Materials (ILOM) will either be developed by the Contractor or provided by the Government for procurement, as specified in the individual task order. Contractor shall provide the Government with material list(s) and shall receive Government approval prior to ordering. All material selected shall be free of hazardous materials and comply with material specifications in the individual task orders. All materials selected shall be listed, when applicable.

3.6.2.3 Equipment De-installation. The Contractor shall de-install system components consisting of information technology equipment, equipment cabinets, cable ladder and conduit, cables (to include cable fabrication), patch panels, patch cables, cable management, power distribution, equipment grounding, and miscellaneous hardware. The Contractor shall coordinate disposal of Government property with the local Property Book Officer (PBO).

Non-accountable material shall be disposed of in accordance with existing local, state, federal, and Army guidelines.

3.6.2.4 Inventory Disposal. Upon completion of installation tasks, the Contractor shall inventory all remaining materials and list them in a document to be provided to the Government. At the Government’s discretion, surplus equipment and installation materials may be returned. If the Government elects the return of the surplus equipment and installation material, the Government will identify the location for the return. In addition, the Contractor shall dispose of all installation waste such as packing material and crates in accordance with applicable standards.

3.6.2.5 Red-Lined As-Built Drawings. Upon completion of installation tasks the Contactor shall red-line all applicable system drawings to reflect the final as-built system configuration.

3.6.2.6 Quality Control (QC). Upon completion of installation tasks, the Contractor shall provide a completed QC package to the Government to verify that QC has been conducted throughout the installation and in accordance with applicable standards.

3.7 Test and Evaluation

The Contractor shall conduct evaluations as well as developmental, operational, and acceptance tests of information systems or networks, subsystems, or equipment.

Tests shall be performed in the contractor’s plant, at the site of installation, or other locations as required by the individual task orders. Evaluation and Test functions typically include the following:

3.7.1 Develop test and evaluation planning and reporting documentation.

develop test strategies and methodologies.

3.7.2 Participate at reliability, availability, and maintainability scoring conferences.

3.7.3 Participate in Test Integrated Process Team meetings, Test Readiness Reviews (TRRs) and other test planning meetings.

3.7.4 Perform inspections, acceptance tests, and/or measurements for newly installed information systems.

3.7.5 Develop equipment and system acceptance test plans, to include data collection forms, to evaluate equipment, system and software operation.

3.7.6 Conduct System Acceptance Tests (SAT) in accordance with system specific procedures.

3.7.7 Collect, collate, and evaluate/analyze test data.

3.7.8 Analyze test incident reports.

3.7.9 Present test plans and/or results to the Government.

3.7.10 Participate in data analysis group conferences.

3.7.11 Identify and support test environment configuration.

3.7.12 Test and evaluate Commercial-Off-The-Shelf (COTS) and…