A.07.23_Solicitation_JCSE_W912DY-18-R-0080_FINAL_30_August_2018.pdf

SEE ADDENDUM

(No Collect Calls)

W912DY18R0080 30-Aug-2018

b. TELEPHONE NUMBER

265-895-1858

8. OFFER DUE DATE/LOCAL TIME

12:00 PM 10 Sep 2018

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA X ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W912DY9. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

VELMA D GRANT

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

1 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

US ARMY ENGINEERING & SUPPORT CENTER

4820 UNIVERSITY SQUARE

HUNTSVILLE AL 35816-1822

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE F87700 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

X SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

AF JOINT COMMUNICATIONS SUPPORT ELEMENT

TSGT JULIE N. MADDOX

8532 MARINA BAY DRIVE

MACDILL AFB FL 33621-5504

TEL: 813-828-0794 FAX:

FAX:

TEL: 256-895-1110 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

X 8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$27,500,000

NAICS:

541513

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF66

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

W912DY18R0080

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Technical Support Services

FFP

The contractor shall provide Information Technology and Information Management Support Services as detailed in the attached Performance Work Statement, dated 23 July 2018.

BASE YEAR:

PERIOD of PERFORMANCE 30-SEP-2018 TO 29-SEP-2019

NET AMT

0001AA 1 Job IA/Cyber Network Defense Analyst

FFP

FOB: Destination

0001AB 1 Job Information System Security Engineer

0001AC 1 Job Information System Security Officer

0001AD 1 Job Communications Security Specialist

0002 Job Travel

COST

The contractor shall travel as required in support of JCSE technical support services. The contractor shall be reimbursed in accordance with the limitations set forth in FAR 31.205-16. Travel for this CLIN shall be funded as SubCLINs with the appropriate accounting classifications and paid in accordance with Joint Travel Regulations (JTR). See Performance Work Statement (PWS) dated 23 July 2018.

ESTIMATED COST

0003 1 Job Contractor Manpower Reporting

FFP

Manpower Reporting in accordance with PWS Section 5.8.

OPTION Technical Support Services

FFP

The contractor shall provide Information Technology and Information Management Support Services as detailed in the attached Performance Work Statement, dated 23 July 2018.

1st Option Year:

Period of Performance 30-Sep-2019 to 29-Sep-2020

1001AA 1 Job OPTION IA/Cyber Network Defense Analyst

1001AB 1 Job OPTION Information System Security Engineer

1001AC 1 Job OPTION Information Systems Security Officer

1001AD 1 Job OPTION Communications Security Specialist

1002 Job OPTION Travel

COST

The contractor shall travel as required in support of JCSE technical support services. The contractor shall be reimbursed in accordance with the limitations set forth in FAR 31.205-16. Travel for this CLIN shall be funded as SubCLINs with the appropriate accounting classifications and paid in accordance with Joint Travel Regulations (JTR). See Performance Work Statement (PWS) dated 23

1003 1 Job OPTION Contractor Manpower Reporting

FFP

OPTION Technical Support Services

FFP

The contractor shall provide Information Technology and Information Management Support Services as detailed in the attached Performance Work Statement, dated 23 July 2018.

2nd Option Year:

Period of Perforance 30-Sep-2020 to 29-Sep-2021

2001AA 1 Job OPTION IA/Cyber Network Defense Analyst

2001AB 1 Job OPTION Information System Security Engineer

2001AC 1 Job OPTION Information Systems Security Officer

2001AD 1 Job OPTION Communications Security Specialist

2002 Job OPTION Travel

COST

The contractor shall travel as required in support of JCSE technical support services. The contractor shall be reimbursed in accordance with the limitations set forth in FAR 31.205-16. Travel for this CLIN shall be funded as SubCLINs with the appropriate accounting classifications and paid in accordance with Joint Travel Regulations (JTR). See Performance Work Statement (PWS) dated 23

2003 1 Job OPTION Contractor Manpower Reporting

FFP

OPTION Technical Support Services

FFP

The contractor shall provide Information Technology and Information Management Support Services as detailed in the attached Performance Work Statement, dated 23 July 2018.

3rd Option Year:

Period of Performance 30-Sep-2021 to 29-Sep-2022

3001AA 1 Job OPTION IA/Cyber Network Defense Analyst

3001AB 1 Job OPTION Information System Security Engineer

3001AC 1 Job OPTION Information System Security Officer

3001AD 1 Job OPTION Communications Security Specialist

3002 Job OPTION Travel

COST

The contractor shall travel as required in support of JCSE technical support services. The contractor shall be reimbursed in accordance with the limitations set forth in FAR 31.205-16. Travel for this CLIN shall be funded as SubCLINs with the appropriate accounting classifications and paid in accordance with Joint Travel Regulations (JTR). See Performance Work Statement (PWS) dated 23 July 2018.

3003 1 Job OPTION Contractor Manpower Reporting

FFP

OPTION Technical Support Services

FFP

The contractor shall provide Information Technology and Information Management Support Services as detailed in the attached Performance Work Statement, dated 23 July 2018.

4TH OPTION YEAR

Period of Performance 30-Sep-2022 to 29-Sep-2023

4001AA 1 Job OPTION IA/Cyber Network Defense Analyst

4001AB 1 Job OPTION Information Systems Security Engineer

4001AC 1 Job OPTION Information Systems Security Officer

4001AD 1 Job OPTION Communications Security Specialist

4002 Job OPTION Travel

COST

The contractor shall travel as required in support of JCSE technical support services. The contractor shall be reimbursed in accordance with the limitations set forth in FAR 31.205-16. Travel for this CLIN shall be funded as SubCLINs with the appropriate accounting classifications and paid in accordance with Joint Travel Regulations (JTR). See Performance Work Statement (PWS) dated 23 July 2018.

4003 1 Job OPTION Contractor Manpower Reporting

FFP

PERFORMANCE WORK STATEMENT

Performance Work Statement JCSE Information Assurance (IA) Technical Services

23 July 2018

1. GENERAL: This is a non-personal services contract to provide, communication security, network defense, and information assurance support. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

1.1. Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide Information Technology (IT) support services to the Joint Communications Support Element (JCSE) as defined in this performance work statement (PWS), at MacDill AFB, FL except those items specified as government furnished property and services. The contractor must perform to the standards in this contract.

1.2. Background: The Joint Communications Support Element (JCSE) provides overall Information Technology (IT) services in support of Agencies, Services Components, Combatant Commands, and directed contingency missions worldwide. This support includes all tasks necessary to ensure an effective IT and Information Management structure that fosters timely deployment and optimal operation of all JCSE Information Systems and IT resources. The ongoing National Security effort on the Overseas Contingency Operation (OCO) requires access to global Command, Control, Communications, Computers, Coalition, Intelligence, Surveillance and Reconnaissance (C5ISR) communication configuration information to allow the user to facilitate communication between various commands throughout the Department of Defense (DoD).

1.3. Objectives: The objective of this contract is to obtain high quality personnel and communication security, network defense, and information assurance.

1.4. Scope: The scope of services includes providing actions to provide personnel and communication security, protect, monitor, detect and analyze network attacks; identify system security requirements and recommend a JCSE security architecture. Upon Government approval of the recommended security architecture, the contractor shall implement the architecture for JCSE’s Enterprise network.

1.5. Period of Performance: The period of performance shall be for one (1) Base Year of 12 months and four

(4) 12-month option years for a grand total of five (5) years. The period of Performance reads as follows:

1.5.1. Base Year: 30 Sep 2018 – 29 Sep 2019

1.5.2. Option Year I: 30 Sep 2019 – 29 Sep 2020

1.5.3. Option Year 2: 30 Sep 2020 – 29 Sep 2021

1.5.4. Option Year 3: 30 Sep 2021 – 29 Sep 2022

1.5.5. Option Year 4: 30 Sep 2022 – 29 Sep 2023

1.6. General Information:

1.6.1. Qualifications: The Contractor shall assign employees that possess the qualifications required to perform in accordance with this PWS. The Contractor shall provide personnel assigned under this PWS that are fully competent to perform assigned skills. Contractor personnel shall not be instructed on-the-job or in classes at government expense in basic or generic skills/techniques under this contract.

1.6.2. Advance Resume Review: The contractor shall, in advance of employees reporting to the work site, furnish to the Functional Director or contract Contracting Officer Representative (COR), a summary resume for each position to be filled or replaced on the PWS – providing the proposed employees’ education/training, experience, skill levels, and other characteristics that relate to requirements/qualifications of the work to be done. Although, the Government does not select the employees, any qualification information questioned or requiring verification will be identified to the contractor.

1.6.3. Certifications and Licenses: The Contractor shall provide current and valid certification and licenses as identified by the Government or Federal, State, and local requirements or laws, to accomplish the services of this PWS, prior to employees reporting to work.

1.6.4. JCSE Required Training: Contractors will be required to complete any/all job related JECC/JCSE training that will be provided by the government via email, handouts, web or e-training, and briefings.

1.6.5. Quality Control: The Contractor shall develop, document, implement and maintain a quality system that ensures the products or services are in accordance with this PWS. The contractor shall provide and maintain an inspection system acceptable to the Government covering the services under this contract. The contractor shall develop and implement procedures to identify and prevent defective services from recurring. As a minimum, the contractor shall develop quality control procedures that address the areas identified in the Performance Requirement Summary. The contractor shall prepare a Quality Control Plan that will describe the approach to developing and implementing a quality system that will encompass all aspects of the contract. The contractor shall complete, implement and make the Quality Control Plan available to the government for review within thirty days after contract award and/or prior to contract performance, whichever is sooner. After acceptance of the quality control plan the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to his QC system. All revisions to the plan shall be made available to the COR.

1.6.6. Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.7. Recognized Holidays: Generally, the contractor shall not be required to work nor will payment be made by the Government on holidays and administrative leave. The contractor shall identify any exceptions where contractor support may be required during holidays, administrative leave, and facility closure. In the event contractor personnel work during these periods, the Government will not provide reimbursement, outside of the regular labor rate for hours worked. This does not preclude the contractor from providing holiday/premium time compensation to their employees. The following is a list of Federal holidays and other events that might lead to closure of the facility:

New Year’s Day Labor Day Martin Luther King’s Jr’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day

1.6.8. Hours of Operation:

1.6.8.1. The contractor is responsible for conducting business between the hours of 0700 – 1700, Monday through Friday except Federal holidays or when the government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The duty day will consist of eight (8) hours. The Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.9. Place of Performance: The work to be performed under this contract will be performed at JCSE designated government facilities.

1.6.10. Type of Contract: N/A

1.6.11. Security Requirements:

1.6.11.1. DD Form 254: The Contractor shall abide by the requirements set forth in the DD Form

254. The Contractor shall also abide by the National Industrial Security Program Operating Manual (NISPOM) for the protection of classified information at its cleared facility, if applicable, as directed by the Defense Security Service.

1.6.11.1.1. Personnel Security: Prior to starting the Contract, all personnel performing work under this (PWS) are required to maintain or be cleared to a minimum of a Top Secret clearance to meet the requirements of each labor category and must maintain the level of security required for the life of the contact.

1.6.11.1.2. Reimbursement of all applicable costs associated with obtaining necessary security clearances shall be an indirect cost and not direct billed.

1.6.11.2. Physical Security: The contractor shall be responsible for safeguarding all Government property, official information (classified and unclassified) and controlled forms provided for contractor use. At the end of each work period, all government facilities, equipment and materials shall be secured. When not under the direct control of contractor personnel, all government facilities, equipment, and materials utilized by contractor personnel shall be secured.

1.6.11.2.1. Key Control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer.

1.6.11.2.2. Lock Combinations: The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s Quality Control Plan.

1.6.11.3. Employment Eligibility: Subject to existing law, regulations and/or provisions of this contract, illegal or undocumented aliens shall not be employed in any and all subcontracts.

1.6.11.4. Antiterrorism/Operations Security (AT-OPSEC)

1.6.11.4.1. AT Level I Training - All contractor employees, to include subcontractor employees, requiring access to Air Force installations, facilities, controlled access areas, or require network access, shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. Upon request, the contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website: http://jko.jten.mil/courses/atl1/launch.html; or it can be provided by the RA ATO in presentation form which will be documented via memorandum.

1.6.11.4.2. Access and General Protection/Security Policy and Procedures - All contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation/facility access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any installation or facility change, the Government may require changes in contractor security matters or processes.

1.6.11.4.3. For contractors requiring Common Access Card (CAC) - The contractor and all sub-contractors employees will be issued a CAC only if duties involve one of the following:

(1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an interim CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

1.6.11.4.4. Contractors Employees Who Require Access to Government Information Systems - All contractor employees with access to a government info system must be registered in the Army Training Certification Tracking System (ATCTS) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the information systems and then annually thereafter in accordance with personnel security standards listed in AR 25-2 (Information Assurance), an appropriate background investigation will be conducted prior to accessing the government information systems.

1.6.11.4.5. Requirement for OPSEC Training - All new contractor employees shall complete Level I OPSEC Training within 30 calendar days of their reporting for duty. Additionally, all contractor employees must complete annual OPSEC awareness training. The contractor shall submit certificates of completion for each affected contractor and subcontractor employee, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training. OPSEC awareness training is available at the following websites:

https://www.iad.gov/ioss/ or http://www.cdse.edu/catalog/operations-security.html; or it can be provided by the RA OPSEC Officer in presentation form which will be documented via memorandum.

1.6.11.4.6. Information assurance (IA)/information technology (IT) training - All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8410.01, DoD 8570.01-M and AR 25-2 (or equivalent Air Force Regulation) within six months of employment.

1.6.11.4.7. Information Assurance (IA)/Information Technology (IT) Certification - All contractor employees supporting IA/IT functions shall be appropriately certified upon contract IAW DoD 8570.01-M, DFARS 252.239-7001 and AR 25-2. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

1.6.11.4.8. Require Handling or Access to Classified Information - Contractor shall comply with AR 380-67 (Personnel Security Program) and Homeland Security Presidential Directive 12 (Policy for a Common Identification Standard for Federal Employees and Contractors) as well as FAR 52.204-2, Security Requirements. Additionally, Contractors must comply with -

(1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); any revisions to DOD 5220.22-M, notice of which has been furnished to the contractor. For classified contracts, the DD Form 254 will be attached with the contract.

1.6.11.4.9. Will be escorted in areas where may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas - All contract employees, including subcontractor employees who are not in possession of the appropriate security clearance or access privileges, will be escorted in areas where they may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas.

1.6.11.4.10. Contractor Company to obtain a Facility Clearance and individual clearances at the appropriate Level - The Prime Contractor Company must have a Facility Clearance (FCL) at the appropriate level (IAW the NISPOM DOD 5220.22-M and AR 380-49) prior to the start of the contract awarded period of performance. Contractor personnel performing work under this contract must have the required security clearance, per AR 380-67, at the appropriate level at the start of the period of performance. Security Clearances and FCL requirements are required to be maintained for the life of the contract IAW the DD Form 254 attached to the contract. If no FCL, the supporting Government Contracting Activity will sponsor the prime contract company in obtaining the FCL.

1.6.11.4.11. Threat Awareness Reporting Program (TARP) - All new contractor employees shall complete annual Threat Awareness and Reporting Program (TARP) Training provided by a Counterintelligence Agent, IAW AR 381-12 . The contractor shall submit certificates of completion for each affected contractor and subcontractor employee(s) or a memorandum for the record, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training. Authorized web-based TARP training for CAC card holders is available at the following website: https://www.us.army.mil/suite/page/655474

1.6.12. Special Qualifications:

1.6.12.1. All Contractor with privileged access to a DoD information system performing information assurance (security) functions, regardless of job or occupational series, must be DoD 8570.01-M certified. This includes meeting Computing Environment (CE) certification requirements within 6 months of engagement.

1.6.12.2. All contractor employees are responsible for the task listed here and in this entire document and compliance to and in accordance with locally standard operating procedures (SOP’s) and other JTF and/or JCSE instructions and documents.

1.6.12.3. Government Issued Common Access Card (CAC): Proof of employment and security clearance/favorable background check is required before an ID CAC will be issued authorizing access to the Installation and Government computer systems. CACs may not be issued to contractors unless a data record authorizing CAC issuance is resident in the Defense Enrollment Eligibility Reporting System (DEERS). The Contractor Verification System (CVS) was developed as a secure and authorized means of entering Contractor data into DEERS in addition to automating the CAC application and approval process. In order to enter Contractor data into CVS, the Contractor's data must be resident in an authorized source database. The Joint Personnel Adjudication System (JPAS) is that authoritative source. The Contractor's Facility Security Office (FSO) shall ensure its employee(s) has a record in JPAS prior to its employee(s) requesting a CAC be issued. Contractors without JPAS accounts may request accounts by following the instructions provided in the Frequently Asked Questions (FAQ) topic "How do I get a JPAS account (Industry Users)?" found on the JPAS website.

Personnel eligible for a CAC who are not in JPAS (i.e., certain Contractors, Foreign Nationals, and DoD affiliates) will be required to register at a site where an equivalent background vetting will be accomplished IAW FIPS 201.

1.6.13. The contractor shall provide current and valid certification and licenses as identified by the Government or Federal, State, and local requirements or laws, to accomplish the services of this PWS, prior to employees reporting to work. The Government’s anticipated level of effort based on historical data is as follows:

Base Year Hours IA/Cyber Network Defense Analyst 7680

Information System Security Engineer 3840

Information Systems Security Officer 5760

Communications Security Specialist 1920

Option Year 1 Hours

IA/Cyber Network Defense Analyst 7680

Information System Security Engineer 3840

Information Systems Security Officer 5760

Communications Security Specialist 1920

Option Year 2 Hours IA/Cyber Network Defense Analyst 7680

Information System Security Engineer 3840

Information Systems Security Officer 5760

Communications Security Specialist 1920

Option Year 3 Hours IA/Cyber Network Defense Analyst 7680

Information System Security Engineer 3840

Information Systems Security Officer 5760

Communications Security Specialist 1920

Option Year 4 Hours IA/Cyber Network Defense Analyst 7680

Information System Security Engineer 3840

Information Systems Security Officer 5760

Communications Security Specialist 1920

1.6.14. Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor’s performance. At these meetings, the contracting officer will apprise the contractor of how the government views the contractor’s performance and the contractor shall apprise the Government of problems, if any, being experienced.

Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.15. Contracting Officer Representative (COR): The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.16. Key Personnel: The contractor shall provide a contract manager/performance manager (PM) who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contractual matters relating to daily operation of this contract. The contract manager or alternate shall be available between hours, 8:00 a.m. to 4:30 p.m., Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons. All contractor personnel shall be required to obtain and wear badges during the performance of this service.

1.6.17. Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contractor personnel will be required to obtain and wear JCSE access badge(s) during the performance of this contract.

1.6.18. Contractor Travel:

CONTRACTOR LOCATION FREQUENCY EST

COST

Communication Security Brunswick, GA Once a year $1000

Communication Security Germany Once a year $2500

ISSE

CONUS Once a year $1000

IA/CND CONUS Once a year $2000

1.6.19. Other Direct Costs: N/A

1.6.20. Data Rights: N/A

1.6.21. Phase in/Phase out: The Contractor shall have all personnel on-boarded within 30 days after contract performance start. The Contractor shall transition the requirements listed in this contract to another incumbent or the Government within a sufficient amount of time prior to contract performance end. A detailed transition plan shall be developed and submitted to the Contracting Officer Representative and/or Contracting Officer within 45 Days prior to transition start.

1.7. DEFINITIONS:

1.7.1. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

1.7.2. CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

1.7.3. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

1.7.4. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

1.7.5. DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

1.7.6. FUNCTIONAL DIRECTOR. An employee of the U.S. Government, appointed by the Requiring Agency’s Commander, has overall responsibility for developing the PWS and the Quality Assurance Surveillance Plan and ensuring they satisfy mission requirements, are performance-based, foster innovation, and define metrics. The FC/FD will also assign, as a minimum, a Primary and an Alternate COR and notify the CO of any changes to this designation. Review contractor performance documentation, prepared by the COR on a regular basis to ensure performance is compatible with contract and mission objectives. The FD is also responsible for identifying mission essential services and developing the necessary documents.

1.7.7. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS.

When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

1.7.8. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

1.7.9. QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

1.7.10. QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

1.7.11. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

1.7.12. SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privy of contract with the subcontractor.

1.7.13. WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

1.7.14. WORK WEEK. Monday through Friday, unless specified otherwise.

Part 2 Qualifications

2. Special Qualifications

REQUIREMENT CERTIFICATIONS EDUCATION EXPERIENCE SKILLS CLEARANCE

Communications Security (1) 5.4

DoD 8570 IAT Level II certification

Must be graduate of Key Management Infrastructure course.

2 years of previous hands-on experience working with

COMSEC.

Experience for the receipt, custody, issue, safeguarding, accounting for, and, when necessary, the destruction of COMSEC material.

TOP SECRET

Cyber Network Defense Analyst (4) 5.5

DoD 8570 IAT Level II certification and CSSP Analyst certification

Bachelors’ Degree in Computer Science or related field

2 years with Bachelors’ Degree

OR

If no degree, 5 years direct work experience

Knowledge with application and network security. Understanding of vulnerabilities, exploits, malware, risks to affected systems, and DoD IAVM program. Documented experience with end-point security solutions, intrusion protection systems, intrusion detection systems, firewalls, proxies, log analysis, and vulnerability scanners.

TOP SECRET

Information Systems Security Engineer (2) 5.7

DoD 8570 IASAE Level III certification

Bachelors’ Degree in Computer Science or related field

OR

Masters’ Degree in Computer Science or relevant field

5 years performing security engineering are architecture with Bachelors’ Degree

OR

10 years security engineering and architecture experience

Knowledge of cybersecurity policy, procedures, and workforce structure to design, develop and implement a secure enclave environment.

Documented experience contributing to the A&A of information systems under National Institute of Standards and Technology (NIST) compliant Risk Management Framework

(RMF).

TOP SECRET

Information Systems Security Officer (3) 5.6

DoD 8570 IAM Level I Certification

Associates Degree in a Computer Science OR relevant field

2 years with Associates Degree

OR

Five years direct work experience

Documented experience with Risk Management Framework (RMF).

Knowledge of DISA STIG implementation, vulnerability scanning and mitigation. Documented experience with the following tools: ACAS, Nessus, SCAP compliant tools. Experience with the development of System Security Plans.

TOP SECRET

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1. Facilities: The Government will provide the necessary workspace for the contractor staff to provide the support outlined in the PWS to include desk space.

3.2. Utilities: The Government will provide all utilities in the facility available for the contractor’s use in performance of tasks outlined in this PWS. The Contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount to accomplish cleaning vehicles and equipment.

3.3. Equipment: The Government will provide telephones, computers, and other items necessary to maintain an office environment.

PART 4

CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES: N/A

SPECIFIC TASKS

5. SPECIFIC TASKS:

5.1. Monthly Assessment Report: The Contractor shall provide the COR a Monthly Assessment Report (MAR) within ten (10) calendar days of each month for work performed the prior month. This report shall analyze the contract and provide contract accounting information.

5.1.1. The Contractor shall maintain and report time worked at the project/task level in a monthly report.

The contractor shall pass this requirement to subcontractors.

5.1.2. The MAR shall include, but is not limited to, the following elements:

5.1.2.1. A summary of work performed for the reporting period

5.1.2.2. Milestone and updates against task activities

5.1.2.3. Progress toward open efforts

5.1.2.4. New work started during the reporting period

5.1.2.5. Deliverables submitted or progress on deliverable products

5.1.2.6. Brief summary of activities planned for the next reporting period

5.1.2.7. Total billed hours for the month, as well as, cumulative hours

5.1.2.8. Total costs and charges

5.2. Monthly Financial Summary Report: The financial summary report shall be submitted monthly ten (10) calendar days after the end of the reported month to the COR and Contracting Officer with the corresponding CLIN invoice and shall include labor charges for actual hours worked and other direct costs which may be authorized.

5.2.1. The Government will not pay unauthorized charges. Original receipts, travel vouchers, etc.

completed in accordance with the Government Travel Regulations shall be maintained by the contractor to support charges other than labor hours and made available to Government auditors upon request.

5.2.2. The Contractor shall reconcile within the monthly report with each invoice so they can be matched month-by-month.

5.2.3. The Monthly Financial Summary Report shall include the following:

5.2.3.1. Labor Hours and Costs for each effort

5.2.3.2. Data costs and quantity for each effort

5.2.3.3. Total monthly charges

5.2.3.4. Accumulative total (labor, travel, etc.)

5.3. N/A

5.4. Communication Security Support:

5.4.1. The contractor shall:

5.4.1.1. Maintain accountability for cryptographic materials and related COMSEC information.

5.4.1.2. Assist in administering COMSEC education programs covering Air Force COMSEC security and related security systems topics.

5.4.1.3. Handle and safeguard classified or sensitive information in an appropriate manner to preclude unauthorized disclosure or compromise of information and complies with established security policies, directives, and regulations.

5.4.1.4. Perform destruction, receiving, issuing, and inspection of COMSEC material within the most stringent timelines.

5.4.1.5. Assist in the distribution of keying material to JCSE units and coordinate COMSEC and key management support for all operational and planned deployment units falling under JCSE command.

5.4.1.6. Administer the Cryptographic Access Program (CAP) by conducting briefing prior to granting access to cryptographic information.

5.4.1.7. Prepare and evaluate written plans and emergency actions and ensure personnel are fully qualified in plan execution.

5.4.1.8. Ensure maximum COMSEC safeguards are in place. The contractor shall respond daily to numerous telephonic/email and personal requests for assistance, clarification, guidance, coordination, status checks, resolution of problem areas, or review of documents to ensure compliance with COMSEC all four branches of the services.

5.4.1.9. Abide by Air Force Manual 17-1302 (COMSEC Security Operations) and DoD COMSEC Directives.

5.5. Cyber Network Defense Support:

5.5.1. The Cyber Network Defense Analyst shall:

5.5.1.1. Implement formal procedures to report emerging viruses to USCYBERCOM within report time requirements.

5.5.1.2. Maintain configuration documentation for the JCSE Enterprise to include: network diagrams, technical sensor/administrative & policy POCs, and related information.

5.5.1.3. Ensure proper protection of data in transit, in accordance with DoD policy.

5.5.1.4. Utilize formal network security monitoring policies and procedures that include the appropriate use of DoD-approved IDPS tools that have automated alert capabilities enabled

5.5.1.5. Perform Detection (Monitoring and Analysis) activities on the JCSE using Intrusion Detection

System/Intrusion Prevention System sensors (IDS/IPS), hereafter called sensors.

5.5.1.6. Follow documented procedures for characterizing anomalous events detected by sensors and other network monitoring systems.

5.5.1.7. Review and analyze logs in a timely manner to detect intruders.

5.5.1.8. Provide notice of suspicious/malicious network traffic or similar activities that suggest an impending or on-going attack

5.5.1.9. Search for distributed, long-term, coordinated, low-visibility network based attacks to identify possible unauthorized activity utilizing exploratory problem-solving or self-learning techniques. Suspicious/significant activity will be shared among the CND/IA community.

5.5.1.10. Report potential incidents and correlated information from these incidents/events that occur on sensors using documented procedures in accordance with DoD guidance.

5.5.1.11. Document and escalate incidents.

5.5.1.12. Retain all incident reports for at least one year.

5.6. Information Systems Security Officer (ISSO):

5.6.1. ISSOs shall:

5.6.1.1. The ISSO is responsible for ensuring the appropriate operational security posture is maintained for IS under their purview. This includes the following activities related to maintaining situational awareness and initiating actions to improve or restore cybersecurity posture.

Implement and enforce all AF cybersecurity policies, procedures, and countermeasures using the guidance within this instruction and applicable cybersecurity publications.

5.6.1.2. Ensure all users have the requisite security clearances and need-to-know, complete annual cybersecurity training, and are aware of their responsibilities before being granted access to the

IT.

5.6.1.3. Maintain all authorized user access control documentation IAW the applicable AF Records Information Management System (AFRIMS).

5.6.1.4. Ensure software, hardware, and firmware complies with appropriate security configuration guidelines (e.g., Security Technical Implementation Guides (STIGs)/Security Requirement Guides (SRG)).

5.6.1.5. Ensure proper configuration management procedures are followed prior to implementation and contingent upon necessary approval. Coordinate changes or modifications with the system-level ISSM and SCA.

5.6.1.6. Initiate protective or corrective measures, in coordination with the security manager, when a security incident or vulnerability is discovered.

5.6.1.7. Report security incidents or vulnerabilities to the system-level ISSM.

5.6.1.8. Analyze information assurance-related technical problems and provide engineering and technical support in solving these problems.

5.6.1.9. Perform vulnerability/risk analyses of computer systems and applications during all phases of the system development life cycle.

5.6.1.10. Provide technical support to the IA Cell to develop and maintain IA processes and procedures for computer network defense in-depth protection for the JCSE enterprise.

5.6.1.11. Track all implementation information for assurance directed guidelines for all hardware as well as applicable software ensuring proper security for the JCSE Enterprise. Provide tracking and summary reports based on findings to leadership. Implementation actions include but are not limited to STIGs, compliant patch implementation/management, Information Assurance Vulnerability Management (IAVM) compliance, integration/ implementation of network or firewall approved devices, and react appropriately to cyber threats.

5.6.1.12. Produce monthly status reports of IA compliance for all portions of the JCSE Enterprise.

5.6.1.13. Run IA scans with appropriate and approved tools (e.g. Security Content Automation

Protocol (SCAP), Assured Compliance Assessment Solution (ACAS), etc.) of all items as directed. Scans shall be run using the most recent security definitions of each tool.

5.6.1.14. The contractor shall maintain CCB-approved configurations consistent with DoD and JCSE policies and procedures.

5.6.1.14.1. Update, document, and maintain appropriate IA implementation actions in the Vulnerability Management System (VMS) database and any additional database archives mandated for use by JCSE.

5.6.1.15. Support and perform DoD Risk Management Framework in accordance with NIST 800- 53 and NIST 800-53A for IA controls; 8570/8140 for IA Workforce training and DCID 6/3 for protection of sensitive compartmented information. This also includes the updates to the Risk Management Framework (RMF) package and all updated instructions which support the Assess and Authorize (A&A) process.

5.6.1.16. Interpret and communicate findings to the JNOC, IA cell and JCSE leadership for the impact of implementing of IA hardware/software upgrades/modifications, policy, and directives to JCSE's Enterprise.

5.6.1.17. The contractor shall document and present operational systems/network computer network defense recommendations and issues to JCSE.

5.7. Information Systems Security Engineer (ISSE) Support:

5.7.1. ISSE shall:

5.7.1.1. The ISSE is any individual, group, or organization responsible for conducting information system security engineering activities. Reference NIST SP 800-37, Applying the Risk Management Framework to Federal Information Systems, for additional details.

5.7.1.2. Information system security engineers are an integral part of the development team (e.g., integrated project team) designing and developing organizational information systems or upgrading legacy systems.

5.7.1.3. Information system security engineers employ best practices when implementing security controls within an information system including software engineering methodologies, system/security engineering principles, secure design, secure architecture, and secure coding techniques.

5.7.1.4. System security engineers coordinate their security-related activities with information security architects, senior information security officers, information system owners, common control providers, and information system security officers.

5.7.1.5. Document changes to systems and checklists.

5.7.1.6. Assist with developing and maintaining system policies and procedures for network security, virus protection, user accounts, maintenance and utilization.

5.7.1.7. Engineer and implement security solutions.

5.7.1.8. Provide remediation of vulnerabilities identified on infrastructure devices.

5.7.1.9. Analyze information assurance-related technical problems and provide…