W912DY-19-R-0001_DRAFT_PWS_HITS-R_II.pdf

[Type here]

PERFORMANCE WORK STATEMENT FOR BASE CONTRACT

US Army Corps of Engineers, Huntsville Engineering and Support Center (CEHNC)

High Performance Computing Integration Technical Services - Restricted

(HITS-R) Contract

XX November 201X

1.0 INTRODUCTION

1.1. ACRONYMS

The following table is a key of acronyms used throughout this PWS.

ACRONYMS DEFINITIONS

ADC Allocated Distributed Center

AFARS Army Federal Acquisition Regulation Supplement

ARL Army Research Laboratory

AASD Assisted Acquisition Services Division

AQL Acceptable Quality Level

ASC Aeronautical Systems Center

C&A Certification and Accreditation

CISSP Certified Information Systems Security Professional

CPCM Certified Professional Contracts Manager

CPSM Certified Professional In Supply Management

CCNP Cisco Certified Network Professional

CARD Cost Analysis Requirements Document

CERT Computer Emergency Response Team

CND Computer Network Defense

CSA Comprehensive Security Assessment

CSSP CyberSecurity Service Provider

COEA Cost and Operational Effectiveness Analysis

COR Contracting Officer’s Representative

CREATE Computational Research and Engineering Acquisition Tools and

Environments CTA Computational Technology Areas

CTO Command Task Orders

DHPIs Dedicated HPC Investments

DFAR Defense Acquisition FAR Supplement

DOD Department of Defense

DREN Defense Research & Engineer Network

DSRC DOD Supercomputing Resource Center

DIACAP DOD Information Assurance Certification & Accreditation Process

DIARMF DOD Information Assurance Risk Management Framework

DTS Defense Transportation System

ERDC Engineer Research Development Center

FAR Federal Acquisition Regulations

FAS Federal Acquisition Service

HBSS Host Based Security System

HPC High Performance Computing

HPCMP High Performance Computing Modernization Program

HPCMPO High Performance Computing Modernization Program Office

IAM Information Assurance Manager

IMS Integrative Master Schedule

IT Information Technology

ITIL Information Technology Infrastructure Library

IPT Integrated Product Teams

IAVA Information Assurance Vulnerability Alerts

IAVM Information Assurance Vulnerability Management

INFOCON/CYBERCON Information Operations Condition

JPAS Joint Personnel Adjudication System

KO Contracting Officer

LAN Local Area Network

MCSE Microsoft Certified Systems Engineer

MCSD Microsoft Certified Software Developer

MIPR Military Interdepartmental Purchase Request

MOA Memorandum of Agreement

MSRC Major Shared Resource Center

NAVO Naval Oceanographic Office

OR Operational Requirements

OSD Office of the Secretary of Defense

POC Point of Contact

PWS Performance Work Statement

PMP Project Management Professional

QAP Quality Assurance Program

QCP Quality Control Plan

R & D Research and Development

RDT&E Research, Development, Test, and Evaluation

S&T Science and Technology

SAR Situational Awareness Report

SAV Site Assistance Visits

SDREN Secret Defense Research & Engineer Network

ST&E Security, Test and Evaluations

Security Detection, delay and response

Section 508 Section 508 of the Rehabilitation Act of 1973

SOPs Standard Operating Procedures

Specification Technical characteristics or parameters that describe the operational characteristics of a system or product

T&E Test and Evaluation

Timeliness Within the time specified by the performance objective

UAG User Advisory Group

VMS Vulnerability Management System

VPN Virtual Private Network

VS Vulnerability Scanning

WAP or AP Wireless Access Points

WNC Wireless Network Access

1.2 BACKGROUND

The Department of Defense (DoD) High Performance Computing Program (HPCMP) is a technology-led, innovation-focused program committed to extending High Performance Computing (HPC) to address the DoD’s most significant challenges. The HPCMP accomplishes this goal by developing and maintaining an HPCMP ecosystem consisting of DoD Supercomputing Resource Centers (DSRCs) networking and security, and software applications. The objective of this Single Award Task Order

Contract (SATOC) under this Performance Work Statement (PWS) is to provide internal and external support to the DoD HPCMP to achieve mission objectives. This work will occur at multiple locations within the Continental United States (CONUS) and Hawaii and Alaska.

1.3 PURPOSE

The HPCMP has identified needs within the ecosystem framework related to program management support, DSRC operations, security and infrastructure engineering research and development and operations, network engineering and software applications development. The purpose of this SATOC and PWS is to outline task order requirements to ensure the HPCMP can obtain the support needed.

2.0 GENERAL REQUIREMENTS.

This section describes the general requirements the contractor needs to accomplish. The following sub-sections provide details of various considerations on this effort.

2.1 NON-PERSONAL SERVICES

The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Procuring Contracting

Officer (PCO) immediately.

2.2 BUSINESS RELATIONS

The contractor shall successfully integrate and coordinate all activity needed to execute the requirement.

The contractor shall manage the timeliness, completeness, and quality of problem identification. The contractor shall provide corrective action plans, proposal submittals, timely identification and remediation of issues, and effective management of subcontractors. The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

2.3 CONTRACT ADMINISTRATION AND MANAGEMENT

The following subsections specify requirements for contract, management, and personnel administration.

2.3.1 Contract Management. The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. When operating onsite, the contractor shall maintain continuity between ongoing activities at Vicksburg, MS, Lorton and Alexandria, VA, and the contractor's corporate offices.

2.3.2 Contract Administration. The contractor shall establish processes and assign appropriate resources to effectively administer the requirement. The contractor shall respond to Government requests for contractual actions in a timely fashion. The contractor shall have a single point of contact between the

Government and Contractor personnel assigned to support operations under executed task orders. The contractor shall assign work effort and maintain proper and accurate timekeeping records of personnel assigned to work on the requirement.

2.3.3 Personnel Administration. The Contractor shall provide experienced and qualified personnel with all the skills necessary to perform the work identified. Some Contractor personnel must have and maintain certain valid Licenses and Certifications to perform the work. Various required training, qualifications, licenses, security clearances, or certifications must be obtained prior to commencement of work at

Contractor expense. Contractor employees required to perform tasks must meet certification requirements as defined in Army and DoD Regulations. All contractor personnel shall be able to read, write, speak, and understand English, shall possess good written and verbal communications skills, and shall have sufficient knowledge of proper English grammar, spelling, capitalization, and punctuation rules to identify errors and make corrections.

2.3.4 The contractor shall provide the following management and support as required: The contractor shall provide for employees during designated Government non-work days or other periods where Government offices are closed due to weather or security conditions. The contractor shall maintain the currency of their employees by providing initial and refresher training as required to meet the PWS requirements. The contractor shall make necessary travel arrangements for employees. The contractor shall provide necessary infrastructure for services performed at the contractor's site(s).

2.4 SUBCONTRACT MANAGEMENT

The contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement. The prime contractor will manage work distribution to ensure there are no Organizational

Conflict of Interest (OCI) considerations. Contractors may add subcontractors to their team after notification to the Procuring Contracting Officer (PCO) or Contracting Officer Representative (COR).

Cross teaming may or may not be permitted.

2.5 CONTRACTOR PERSONNEL, DISCIPLINES, AND SPECIALTIES

The contractor shall accomplish the assigned work by employing and utilizing qualified personnel with appropriate combinations of education, training, and experience. The contractor shall match personnel skills to the work or task with a minimum of under/over employment of resources. The contractor shall ensure the personnel utilized in the performance of task orders will be the minimum necessary to accomplish the task. The Contractor shall provide the necessary resources and infrastructure to manage, perform, and administer the task order.

2.5.1 Contractor Employee Conduct. The contractor’s employees shall observe and comply with all applicable departmental and agency regulations, policies, and procedures (e.g., fire, safety, sanitation, environmental protection, security, etc.). The contractor shall ensure that all contractor employees represent a professional appearance at all times, and that their conduct does not reflect discredit on the

United States Government.

2.5.2 When contractor employees are working on Government facilities or participating at Government meetings, they shall wear identification badges distinguishing themselves as such. The badges at a minimum must have the employee name and word "contractor” displayed. Ideally, the company name will appear on the badge.

2.5.3 Notwithstanding any other provisions in the PWS, the contractor shall identify themselves as a contractor in meetings, telephone conversations, all written communications and work situations so that their actions cannot be construed as acts of a Government official. The contractor shall take no actions that bind the government to a final decision or results in the exercise of governmental discretion.

2.5.4 Removal of Contractor Employees for Misconduct or Security Reasons. The Government may, at its sole discretion, direct the contractor to remove any contractor employee from Government facilities for misconduct or security reasons. Such removal does not relieve the contractor of the responsibility to provide sufficient qualified personnel for adequate and timely service. The Contracting Officer will provide the contractor with an immediate rationale for removal of a scontractor employee.

2.5.5 Conflict of Interest. Neither the contractor nor its on-site employees shall utilize their knowledge of access to information, sensitive or otherwise, for individual or company gain.

2.6 LOCATION AND HOURS OF WORK.

2.6.1 Location. Work may be conducted at the following locations: the HPCMP offices in Vicksburg, MS and Lorton, VA; ERDC ITL, Vicksburg, MS; Army Research Laboratory (ARL) DSRC, Adelphi, MD; Air

Force Research Laboratory (AFRL) DSRC, Wright-Patterson, OH; Navy Oceanographic (NAVO) DSRC

Stennis Center, MS; ERDC DSRC, Vicksburg, MS; 3.2

Maui High Performance Computing Center (MHPCC) DSRC, Maui, Hawaii. Telework may be approved on a case by case basis by the COR.

2.6.2 Core Working Hours. Government core working hours are from 0700 to 1730 local time Monday through Friday except US Federal Holidays. Government workers typically work eight (8) hours per day, 40 hours per week.

2.6.3 Government Facility Closure. In case of government facility closure as directed by the government, contractor employees shall be excused from work at no cost to the government.

2.7 TRAVEL

The contractor may be required to travel various locations within the Continental United States (CONUS) and Hawaii and Alaska to perform the tasks outlined in this PWS. All travel requirements (including plans, agenda, itinerary, or dates) shall be pre-approved by the government (subject to local policy procedures), and is on a strictly cost reimbursable basis. Costs for travel shall be billed in accordance with the regulatory implementation of Public Law 99-234 and FAR 31.205-46 Travel Costs (subject to local policy and procedures).

2.8 TASK ORDERS

Task Orders shall be issued by the Contracting Officer (KO) for all work efforts. The contractor/subcontractor(s) shall not use proprietary information, designs, or software, etc. for this contract which is not available on the open market. All information, designs, software, software applications, etc.

developed as a result of this contract become the property of the Government. For each task order, the contractor shall provide project and business management and analysis support in operational and oversight of each task order utilizing Project Management Professional (PMP) and Information Technology

Infrastructure Library (ITIL) standards and practices.

2.9 KEY PERSONNEL

At no direct cost to the Government the contractor shall provide an overall Program Manager (PM) and

Alternate Program Manager (APM) to ensure technical integration of the entire contract and shall provide general oversight to this effort. The Government has determined that these personnel are key to successful completion of the contract. These Key Personnel will be designated in the contract and are subject to the provisions of this PWS. Resumes shall be submitted detailing the qualifications and experience of Key

Personnel. Prior to the replacement of key personnel, the contractor shall notify the Contracting Officer and Contracting Officer Representative reasonably in advance and shall submit justification (including proposed substitutions) in sufficient detail to permit evaluation of the impact on the program. No substitution shall be made by the contractor without the written consent of the Contracting Officer.

These managers will possess at least a Bachelor's degree in computer science, information systems, network engineering, or other related discipline with a minimum of ten (10) years management experience plus a minimum of ten (10) years IT/Networking Engineering experience similar to the size and scope reflected in this PWS. The experience can be Federal or private industry. Qualifications are subject to

Government review and concurrence. The managers shall be available during normal working hours to meet at the HPCMPO with Government personnel designated by the Contracting Officer (KO), HPC

Program Manager (PM) or Contracting Officer's Representative (COR) within two hours of notification.

Additional key personnel may be identified at the task order level.

3.0 GENERAL SCOPE OF WORK.

This PWS identifies the non-personal Contractor Engineering and Technical Support Services that are needed to support the High Performance Computing Modernization Program (HPCMP). This is a Single

Award Indefinite Delivery and Indefinite Quantity (IDIQ) contract. Specific areas of coverage include

3.1 Program Management, 3.2 HPC Centers Support, 3.3 Security Research and Development and

Infrastructure Engineering Support, 3.4 Network Engineering Support, 3.5 Network Operations Support,

3.6 HPCMP CREATE Software Development Support, and 3.7 Government Furnished Equipment

Logistics, Distribution and Inventory support. The Contractor shall possess one or more of the following credentials; ISO 9001:2000, ISO 9001:2008, CMMI Level II (or higher) – DEV or CMMI Level II (or higher) – SVC.

3.1 PROGRAM AND PROJECT MANAGEMENT SUPPORT

The contractor shall perform a variety of support duties to support program management activities across the HPCMP business areas. Program and Project Management Support shall include collecting information and assisting in the preparation of draft planning documents to include draft program budgets, schedules, reports and documentation. The contractor shall also provide meeting management and conferencing support for the HPCMP in all program activities. Task Orders under this PWS can include but are not limited to:

3.1.1 Conduct reviews and analysis on business management aspects of program activities and provide findings to the Associate Director for the respective functional area.

3.1.2 Provide internal and external program management support for program activities.

3.1.3 The contractor shall be cognizant of the many interrelationships between various task orders ensuring any dependencies that arise from the enterprise, if any, are noted and tracked to ensure integration and adherence to schedule.

3.1.4 The contractor shall Performance Management to include verification and measurement to ensure delivery of proposed results, support management and decision-making, facilitate communications, and motivate high performance through use of key performance measures.

3.1.5 Performance Integration. The contractor shall ensure Performance is integrated across all PWS elements and task orders and provide an integrated master schedule (IMS) including task and inter-project, inter-related task order dependencies with resource requirements including labor and materials.

3.1.6 Results management. The contractor shall measure and validate performance accounting for fluctuating workloads and provide a program performance report (PPR) for key measures as defined in the

Quality Assurance Surveillance Plan (QASP) and Service Delivery Summaries in the PWS. The contractor shall conduct a monthly performance review with the COR that includes the IMS and PPR.

3.1.7 Customer Satisfaction. Work with government counterparts to achieve and maintain high customer satisfaction by identifying a customer’s principle needs and interests, managing a customer’s expectations to ensure effective communication, and soliciting feedback and use it constructively to improve customer service.

3.1.8 Use of Government Furnished Equipment. In the performance of the individual tasks, the contractor shall use, to the maximum extent possible, use Government Furnished Equipment, material, and information (GFE/GFM/GFI).

3.1.9 Travel. The contractor shall be required to travel to various locations within the Continental limits of the United States, Hawaii and Alaska to perform the tasks outlined in thePWS. Materials, other direct charges, all travel and subcontractor efforts to support HPCMP shall be approved in advance, by the

Contracting Officer (CO).

3.1.10 Deliverables. The contractor shall perform work and submit deliverables pursuant to each individual task order. Each task order will identify the specific work to be performed and the deliverables that are due. Typical Contract Data Requirement List (CDRL) may include but not limited to:

Deliverable CDRL # Transmittal Form and Quantity

Schedule

Trip Reports A001 electronic copy To Government POC

NLT five (5) days after return and

Consolidated

Monthly

Consolidated Trip

Report

Briefing Material A002 electronic copy As necessary

Weekly SAR A003 electronic copy Two (2) business days after the end of the reported week.

Monthly Status Report A004 electronic copy NLT the 10th day of each month

Trend Analysis Reports A005 electronic copy As necessary

Weekly Financials A006 electronic copy Two (2) days after the reported week.

Comments and

Recommendations Base on

Engineering Studies and

Assessments

A007 electronic copy As necessary

Configuration management plans

A008 electronic copy As necessary

Test & Evaluation Plans, Procedures, and Test Reports including Data

A009 electronic copy As necessary

Briefing Data A010 electronic copy Two (2) days after briefing completion.

Risk Management Framework

(RMF)

A011 electronic copy As necessary

Monthly Inventory A012 electronic copy Five (5) business days after the end of the reported month.

Program Management Plan A013 electronic copy Sixty (60) calendar days after task order award.

Thirty (30) days after the start of each exercised option period.

Phase out Plan A014 electronic copy No later than nine (9) months after task order award and updated annually thereafter. Any final reports due within ten

(10) calendar days after the last month of performance.

Monthly Financial Report A015 electronic copy Ten (10) business days after the end of the reported month.

Initial Kickoff Meeting

Minutes

A016 electronic copy No later than ten (10) calendar days after the meeting.

Specifications A017 electronic copy As necessary

Concept of Operations A018 electronic copy As necessary

Accreditation Documentation A019 electronic copy As necessary

User Guides A020 electronic copy As necessary

Plans of Action and

Milestones

A021 electronic copy As requested by the government POC

Product Evaluation/Study

Reports

A022 electronic copy As necessary

Prototype ancillary hardware, drawings, and preliminary technical manuals

A023 electronic copy As necessary

Standard Operating

Procedures

A024 electronic copy As necessary

Network Diagrams A025 electronic copy As necessary

Regression Test Plans and

Reports

A026 electronic copy As necessary

After Action / Lessons

Learned Reports

A027 electronic copy As necessary

Annual Maintenance Renewal A028 electronic copy As necessary

ISCM Metric Reports

(reporting bug, feature additions and completions)

A029 electronic copy Monthly (5 days after end of each month)

STIG Metric Reports

(reporting bug, feature additions and completions)

A030 electronic copy Monthly (5 days after end of each month)

Authentication Services

Metric Reports (reporting bug, feature additions and completions)

A031 electronic copy Monthly (5 days after end of each month)

Software Assurance Metric

Reports (reporting completions)

A032 electronic copy Monthly (5 days after end of each month)

3.1.11 Monthly Progress Report. The contractor shall submit a written report which outlines the significant elements of the contract to the COR, on a monthly basis CRDL A004. These elements are:

a. Cost and schedule control to include hours of effort expended and travel accomplished in support of each task.

b. Technical performance to include a breakout of time expended and associated cost(s) for each functional task, continuing work efforts, and deliverable items produced/delivered during the reporting period.

c. Identification of pending and planned work efforts including potential problem areas and proposed solutions.

d. Trip reports for all travel activities.

e. Changes in contract personnel.

3.2 CENTERS SUPPORT

The contractor shall perform a variety of support duties to include assistance in status reporting, data gathering, data entry, report preparation, support for briefings, funding profiles, task lists, installation or customer meeting logistics, and other administrative support as required. Perform research, documentation and review support of business processes and procedures. Assist in drafting Performance

Work Statements (PWS), Statements of Work (SOW) and assist in providing independent technical reviews. Provide technical assessments and reviews based on High Performance Computing (HPC) systems engineering analysis. Perform research on various computer software, hardware, and technical services for required services as needed. This may include: evaluation of government performance work statements and independent government estimates; identify technology issues and provide recommendations; serve as the Program technical advisor for IT commodities and technical services contracts; provide technical recommendations for the ITS team and/or customers; and prepare technical briefings for use by Government representatives. Provide engineering and technical resources to perform system engineering and integration functions necessary to accomplish project technical goals in services for HPC Centers projects. Technical activities with projects requiring support include baseline configuration, workload management, data recovery, system administration communities of practice, enterprise systems monitoring, enterprise software management, acting as HPC Centers’ liaison to the

HPCMP information assurance manager panel, and other DSRC technical services project teams, as identified by the Associate Director for HPC Centers.

3.2.1 Support the development and maintenance of goals, high-level strategy, and policy for special projects within and administration of the HPC Centers component of the HPCMP.

3.2.2 Investigate HPC Centers program requirements, perform studies of system performance and submit recommendations for development, upgrades, modifications, or alterations of equipment, policy or configuration as appropriate to improve system performance, operational efficiency and security posture.

3.2.3 Monitor technology trends and determine feasibility of implementation and applicability to address

DoD computational requirements via HPC Center services and capabilities. Participate in design reviews, technical reviews and discussions regarding HPCMP supercomputer systems, equipment and programs as directed.

3.2.4 Support Associate Director for HPC Centers in responding to and informing senior DoD leadership on aspects of the HPCMP and HPC technologies. Provide guidance and direction to HPC center leadership under the direction of the Associate Director for Centers concerning HPC services, operating approaches and coordination required with other HPC Centers.

3.2.5 Investigate program requirements, perform studies, analyze system/equipment performance and submit recommendations for development, upgrades, modifications, or alterations of hardware, software, and/or infrastructure as appropriate to improve system operation and enhance security posture in the field environment.

3.2.6 Review engineering and technical documentation such as technical manuals, test procedures, test plans and drawings, as-built, etc., as delivered by other contractor and Government activities and provide comments and recommendations for acceptance, correction or improvements. The contractor will provide engineering and technical expertise for the review of production contract deliverables and drawings, develop and maintain applicable Standard Operating Procedures (SOPs), develop and maintain deployment and installation documentation (e.g., network diagrams, site surveys).

3.2.7 Provide engineering and technical resources to perform system engineering and integration functions necessary to accomplish project technical goals in services for DSRC projects. Technical activities with projects requiring support may include management of supercomputer support infrastructure, IP- based network architecture, programming of SCADA controls and renewable energy technology.

3.3 SECURITY

Provide security engineering support to the High Performance Computing Modernization Program

(HPCMP), and Defense Research and Engineering Network (DREN)/Secret Defense Research

Engineering Network (SDREN) sites. The contractor shall provide security engineering support for the

DREN and SDREN networks for the High Performance Computing Modernization Program at sites listed in this PWS and other sites as designated by the Government. Task Orders can include, but are not limited to the following:

3.3.2 Maintain a team of software developers to provide the HPCMP with software and systems development and research in support of network and system security.

3.3.3 Investigate HPCMP/DREN program requirements, perform studies, analyze system/equipment performance and submit recommendations for development, upgrades, modifications, or alterations of hardware and/or software as appropriate to improve system operation and enhance security posture in the field environment.

3.3.4 Study Operational Requirements (OR) to determine system performance criteria and to outline functional requirements. When required, performance specification(s) shall be generated/reviewed in order to specify, in detail, system requirements based upon the operational approach and selected alternative. The contractor shall participate in design reviews and other technical reviews and discussions regarding HPCMP systems, equipment and programs as directed.

3.3.5 Conduct R&D and Engineering based upon HPCMP Technical Directions.

3.3.6 Provide modifications of the HPCMP Kerberos distribution to support the authentication mechanisms of RSA SecurID, DoD Public Key Infrastructure (PKI) /Common Access Card (CAC), and HPCMP

PKI/Smartcards/Token/LDAP/ YubiKey/OpenID. Associated with this will be the development of the infrastructure to support HPCMP PKI and the associated processes involved in deployment to HPCMP users.

3.3.7 Install, operate and maintain test and production environments to provide HPCMP information security continuous monitoring and authentication services, and test developed security software applications.

3.3.8 Provide quality assurance testing of security developed software applications in both local and wide-area enclaves.

3.3.9 Provide support and advice in identification and development of new authentication mechanisms and technologies for better and more secure means of access, authentication, and encryption in the HPCMP environment.

3.3.10 Support optimization and deployment of the updated HPCMP Kerberos kit and PuTTY client.

Develop technical documentation to support certification and approval of the updated software in DoD enclaves.

3.3.11 Continue development of a software development infrastructure in support of HPCMP Security

R&D activities that includes software engineering development and analysis functions such as a code repository, bug tracking, and static code analysis.

3.3.12 Provide technical consultation and services on special security engineering and R&D projects identified by the HPCMP Associate Director for Security.

3.3.13 Manage property and inventory, aligning travel and manpower for installation and upgrades with property delivery.

3.3.14 Provide Cybersecurity Defense Service Provider (CSSP) management services to user sites on

DREN and SDREN networks referred to as subscriber sites. CSSP operational entities are required to facilitate information sharing and collaboration with counterpart CND organizations, including attending and participating in official threat briefs. Lessons learned are employed into HPC CSSP tactics, techniques, and procedures to effectively apply security to the Research, Development, Test, and Evaluation (RDT&E) community. As noted in the Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01A, CSSPs are responsible to provide three CND services: (1) Protect, (2) Monitor, Analyze, and Detect, and (3) Respond.

These services are described below but are not limited to:

a. The Contractor shall provide capable staff to perform the technical functions identified in the subtasks below. These discrete tasks represent the underlying job skills necessary to fulfill the larger requirements outlined in DoD O-8530.1-M paragraph C7.1.7. Also included are the technical functions outlined in the “DoD Cybersecurity Services Evaluator’s Scoring Metrics” version 9.x. Attachment 3 identifies which entity has responsibility for ESM v9.x tasks for the HPC CSSP. When integrated, the below tasks will provide the HPCMP an effective unauthorized user disruption capability. These tasks enable the HPCMP to fulfill its role within the DoD’s CND operational hierarchy, quickly adapting to near-term changes and continuously evolving to meet long-range threats and technology trends. The

DoD Cybersecurity Services Evaluator’s Scoring Metrics provides guidelines for the body of documentation suitable for describing CSSP tactics, techniques and procedures.

b. Provide Vulnerability Scanning (VS) Support. Conduct scanning of the Subscriber networks in accordance with Standard Operating Procedures (SOPs) (see attachment 1) per applicable US Cyber

Command Communications Tasking Orders (CTOs) including 08-005 and 05-19 located at https://www.cybercom.smil.mil. Review changes to configurations and advise of potential vulnerabilities, furnish guidelines and provide training to subscribers. Provide support to subscribers regarding Malware Protection to include documented procedures, alerts and responding to subscriber reports. Support Information Assurance Vulnerability Management (IAVM). Monitor Information

Assurance Vulnerability Alerts (IAVAs) and monitor IAVA implementation.

c. Comply with and recommend revisions to all relevant Army Research Lab (ARL) Standard Operating

Procedures (SOPs) and review all SOPs annually as is required by DoD regulation. Additionally, for

HPC specific SOPs, CSSP shall maintain and comply with said SA complete list is provided in attachment 3.

d. Achieve and maintain the DoD 8570.01-M workforce training standards for this position.

e. Maintain a current and comprehensive depiction of HPCMP systems and applications arranged by

Mission Assurance Categories and Confidentiality Levels per DoDD 8500.1 and 8500.2.

f. Develop techniques for evaluating risk presented by vulnerabilities against the operating environment in order to prioritize mitigation efforts and process vulnerabilities provided from Government operational and intelligence reporting sources.

g. Direct subscribers to use patching and mitigation procedures following disclosures of vulnerabilities.

h. Track compliance with directed mitigation actions across the DREN/SDREN in accordance with timelines specified by US Cyber Command.

i. Review the findings of validation scans and direct remediation of non-compliant systems.

j. Identify potential network and system vulnerabilities and mis-configurations through the use and expert employment of all available HPCMP scanning and discovery systems

k. Develop and submit detailed reports of findings, analysis, and recommendations for use by both

HPCMP/ARL Protect and Net Defense Incident Responders.

l. Support the development and implementation of enterprise mitigation actions in response to complex vulnerabilities.

m. Provide sustainment services to CSSP subscribers. The contractor shall:

n. Maintain a subscriber POC list, Standard Operating Procedures, Memoranda of Agreement, and configuration documentation.

o. Maintain records identifying reimbursable HPCMP security customers through the DD1144, memoranda of agreement (MOAs), Interagency Service Agreements, or other required support agreements.

p. Maintain records of services provided by HPCMP to reimbursable customers and provide metrics for initiation and termination of service, as well as quality assurance procedures.

q. CSSP Alignment- Coordinate with subscriber site/enclave representatives to ensure DoD requirements of the Cybersecurity Activities program are established as applicable. Coordinate CSSP services and prepare Memoranda of Agreement (MOAs), as applicable, IAW DoD and HPCMP policy. Coordinate funding for CSSP services with subscriber sites and HPCMP Finance Team. Coordinate POCs and network diagram updates as applicable. Create reports and briefings to show current status of CSSP alignment for sites on the DREN/SDREN.

r. Coordinate with CSSP team and DREN/SDREN sites for CSSP initiation/establishment of services, validation of CSSP services and/or CSSP support issues such as points of contact and network diagrams updates.

s. Customer Outreach- Maintain communications and serve as a liaison between the customer/subscriber site points of contact (POCs) and the HPC CSSP as needed.

t. Staff Coordination and Management- Ensure applicable Sustainment requirements of the DoD

Evaluator’s Scoring Metrics (ESM) are maintained within the HPC CSSP and in support of subscriber sites/enclaves.

u. Coordinate with CSSP team and subscriber site on deployment of intrusion detection and scanning hardware to the DREN community. Coordinate hardware requirements, funding, configuration data, shipping POCs and addresses, deployment of hardware and follow-on customer support pertaining to the provision of the applicable CSSP services.

v. Maintain/enter Cybersecurity information in designated HPCMP data bases. Coordinate updates with staff as needed. Provide Information Operations Condition (INFOCON/CYBERCON) support.

Support the HPCMP in maintaining, monitoring and providing DOD guidance and procedures for

INFOCON/CYBERCON.

w. Host Assessment Analysts. Manage and apply host protection software (e.g. HBSS) directed for use by the DoD (US Cyber Command) to review events and logs to detect anomalies. Scan systems for vulnerabilities and indications of compromise. Provide reports to the HPCMP/ARL Incident

Management Section on identified anomalies and coordinate with Signature Management personnel to develop custom host-based signatures to automate the detection of events of interest.

x. The minimum required functions are to:

i. Maintain and refine the body of documentation that describes HPCMP Host Assessment

Analysts’ tactics techniques and procedures for DREN/SDREN subscribers.

ii. Achieve and maintain the DoD 8570.01-M (dated 20 Apr 2010 or later) workforce training standards for this position.

iii. Provide instruction and training materials for internal Host Assessment training.

iv. Make recommendations to advance current host-based detection technology to meet DoD scanning requirements.

v. Monitor host-based detection consoles for events of interest on end systems and provide anomaly reports to the HPCMP Incident Management.

vi. Assess all systems on the enterprise network to meet DoD scanning requirements for ACAS and Anti-virus applications/software..

vii. Provide reports to HPCMP leadership detailing trends in host anomaly activity and vulnerability statistics across the subscriber base.

viii. Provide Network Security Monitoring/Intrusion Detection support.

ix. Maintain HPCMP related security policies and procedures, perform intrusion detection monitoring, review logs within 30 minutes of detection or analyst notification, analyze logs, and request copies of audit/system logs to supplement analysis. Provide network monitoring services in order to detect and report distributed, long term, coordinated network based attacks. Provide threat mitigation recommendations. Provide Indications and

Warning/Situational Awareness support. Develop tactics/techniques for threat mitigation/remediation and notification to appropriate authorities.

x. Maintain and refine the body of documentation that describes HPCMP Infrastructure

Support tactics, techniques and procedures.

xi. Achieve and maintain the DoD 8570.01-M (dated 20 Apr 2010 or later) workforce training standards for this position.

xii. Provide data based from IDS monitoring tools for creation, editing and management of and configuration management for changes to the signatures, rules and filters of specialized network defense systems including but not limited to network and host-based IDS, IPS, firewall, and proxy systems.

xiii. Coordinate with the HPCMP/ARL NetDefense team to manage required changes to the signatures, rules and filters of specialized network defense systems.

xiv. Identify potential conflicts with implementation and integration of specialized network defense systems within the network to protect the overall availability of the HPCMP.

xv. Perform life-cycle configuration management of applications, signatures, rules, filters and configurations of managed network defense systems in coordination with designated administrators.

xvi. Support enterprise mitigation efforts based on the specific monitoring and filtering capabilities of existing network defense infrastructure.

xvii. Provide support for continuous monitoring of subscriber assets by providing data feeds from host-based and network-based sensors to the HPC Continuous Monitoring team

xviii. Provide Incident Response Support: Incident Notification: Document procedures for incident notification and follow incident notification procedure to/from subscribers. Response:

Follow incident handling and response procedures, utilize automated tools to track incidents, review and update guidelines and maintain a 24x7 incident/event handling capability.

Report Analysis: Conduct incident analysis in accordance with all DOD regulations, policies and procedures and determine the threat, risk or damage an incident may impose.

xix. Incident Response (IR) reacts to previously identified incidents occurring throughout CSSP subscriber sites. IR involves scoping, containing and eradicating incidents based on the processes outlined in CJCSM 6510.01F “Information Assurance (IA) and Support to

Computer Network Defense (CND) dated 9 Feb 2011 or later. Additionally IR shall support the transition of network defense configurations as informed by resolved incidents in order to prevent future occurrences. Data sources as well as analysis and response tools will evolve with changes in the HPCMP technical operating environment as well as by mandates from

US Cyber Command. The minimum required functions are to:

xx. Maintain the body of documentation that describes HPCMP Cybersecurity Incident

Response tactics, techniques and procedures.

xxi. Achieve and maintain the DoD 8570.01-M (dated 20 Apr 2010 or later) workforce training standards for this position.

xxii. Provide instruction and training materials for internal Incident Response Analyst training.

xxiii. Collect and analyze network intrusion artifacts from a variety of sources to include logs, system images and packet captures to enable mitigation of network incidents within the

DREN/SDREN.

xxiv. Provide data in support of intelligence analysts that correlate threat assessment data.

xxv. Document and report incidents from initial detection through final resolution using standard

DoD incident reporting channels and methods.

xxvi. Perform incident triage to determine scope, urgency, and potential operational impact by identifying the specific vulnerability and making recommendations which enable rapid remediation at the enterprise level.

xxvii. Serve as technical experts and liaisons to external incident response personnel and brief incident details as necessary.

xxviii. Provide remote incident handling support for forensics collections, intrusion correlation tracking, threat analysis and direct system remediation tasks to on-site personnel.

xxix. Develop and publish incident response guidance and high-quality incident reports to appropriate audiences.

xxx. Upon resolution of network incidents, create custom signatures or correlation rules to detect future incidents as well as make DREN protection recommendations to enhance passive resistance to future attack.

3.3.15 Provide support in order to maintain the HPC CSSP accreditation status by operating at the minimum ESM Maturity Level Threshold - for each applicable metric. Provide and maintain qualified personnel for CSSP services in accordance with DODD 8570.01-M. Review and recommend updates to

SOP annually to support certification. Ensure that all applicable artifacts are readily available to support the certification test.

3.3.16 The contractor shall support External Assessments (EA) referred to as HPCMP Comprehensive

Security Assessment (CSA). The contractor shall perform security assessments on the following, but no limited to:

a. New HPCMP systems to support RMF certification prior to network connection

b. Existing HPCMP systems every three years before RMF certification expiration to include the

DREN/SDREN backbone, the HPCMP Executive & Operations enclaves, DREN/SDREN Joint

Sensors, etc. There are approximately 29 accreditation boundaries requiring CSA assessment within

HPCMP.

c. All Secret DREN (SDREN) subscribers every three years

d. DREN customers on a case-by-case basis to include commercial entities, universities, government agencies and military branches with DREN connectivity.

e. Newly acquired supercomputing resources annually through the SST process

f. Evaluate new technologies and provide risk insight to the Associate Director for Security

g. The contractor shall support a Security Assessment Team, inclusive of information assurance analysts, security analysts and technical analysts, who demonstrate previous experience supporting sites for security preparedness in pursuit of Certification & Accreditation (C&A).

h. The contractor will also need to integrate with other HPCMP security teams such as the Cybersecurity

Defense Service Provider (CSSP) and Emerging Technologies development teams to provide insight into CSA requirements. The CSSP utilizes the CSA teams onsite view of the connected enclaves to ensure that proper network protection measures are in place. Additionally, the Emerging Technologies team builds tools to support the CSA process.

i. Incorporate Government furnished equipment and software into existing test bed and update this test bed to support CSSP related efforts.

j. For each HPCMP site to be evaluated: Maintain the Assessment Test Plan documents and procedures in accordance with DOD Policies and Guidelines, see Paragraph 12.0; conduct Pre-Assessment, Assessment, and Post-Assessment activities in accordance with the Assessment Test Plan; prepare and deliver the Assessment Test Report (per evaluated site) to include DIACAP Scorecard or RMF

Security Assessment Report; and review baseline script and pre-Assessment script outputs uploaded by the site.

k. Support HPCMP representatives in responding to USCYBERCOMMAND Command Task Orders

(CTO) and IAVAs. Comply with INFOCON Level Information Assurance procedures as directed by the HPCMP.

l. Participate in periodic Assessment Team meetings and prepare minutes of these meetings and provide to the Government Technical POC within 48 hours.

m. CSA Process Tasks The contractor will perform a pre-assessment per the HPCMP Test Plan and

Procedures.

n. Establish an assessment date (8 months from Assessment) - The site will be contacted by the

Assessment Coordinator to provide preliminary information about the pending assessment and request any documentation that may assist the Assessment Team with preparation. This includes, but is not limited to the Authority to Operate (ATO), the Scoping Questionnaire, and copies of necessary security documentation.

o. Handoff the site to the assessment team (2 months from Assessment) - All information will be forwarded to the team to begin preparation for the assessment. The site will be contacted by the

Assessment Team to schedule a Pre-Assessment teleconference 45 days from the scheduled assessment.

p. Teleconference with the site and Assessment Team members (45 days from Assessment) –An initial teleconference will take place; attendees should include the Assessment team, the primary site POC, and other site personnel as the site deems necessary.

q. Final Teleconference with the site and Assessment Team members (2 weeks from Assessment)

r. The Assessment Team will coordinate with the site to ensure that appropriate script/scan outputs for

Security Content Automation Protocol Compliance Checker SCAP, NMAP, MBSA, Llama Tool, Group Policy, Network Configuration, Nessus, Retina, network drawings and site documentation are delivered in an appropriate time frame to be reviewed by the Assessment team.

s. The intent is to provide outputs to the Assessment Team with sufficient time for them to evaluate the results and provide feedback to the site prior to the start of the assessment. This is in the form of a follow-up script/scan output. Issues identified in this manner which are corrected prior to the

Assessment Team’s arrival on site will not be considered findings for the Assessment, nor will they be included in the final Report.

t. The preferred method of scripts and scans output delivery is to the DREN Security Assessment

Database, and the Security Assessment Checklist tool for DREN systems. For SDREN the preferred method of scripts and scans output delivery is to the SDREN Security Assessment Database.

u. Documentation should be provided to the Security Assessment Checklist tool for DREN and electronically to the IA Analyst where encryption options are available for SDREN. Arrangements can be adapted to site specific needs.

v. Typical Onsite Assessment (1 week for non-DSRC, 2 weeks for DSRC)

w. The contractor shall perform an onsite assessment per the HPCMP Test Plan and Procedures document.

The Assessment Team will use only DAA accredited systems for scanning. Sites may request a copy of the Accreditation letter from the Assessment Team at any time. Scan drives used on SDREN will be transferred to the site for destruction or use upon completion of the assessment.

x. Post Assessment – 30 days to deliver CSA Report/Scorecard

y. The contractor will perform post assessment processes per the HPCMP Test Plan and Procedures. A written report in accordance with the HPCMP report template will be provided to the site and/or the site’s CSSP provider for each assessment, based on the site’s requirements. The reports shall be kept

Sensitive Unclassified for electronic storage on Sensitive Unclassified systems. RMF artifacts will be entered into eMASS for systems under the HPCMP AO’s purview.

z. The contractor will maintain the CSA schedule to include the tracking of CSA expiration dates, travel dates, and team member assignments.

aa. The contractor shall provide wide-area secure environment and advisory service and Computer

Network Defense (CND) services for the HPCMP community as part of the DREN/SDREN network security team. Specific tasks include:

bb. Provide monitoring of DREN and SDREN customer sites.

3.3.17 Provide Cybersecurity Defense Service Provider (CSSP) management services to HPCMP community sites on DREN and SDREN networks as described for subscriber sites in section 3.3.14.

3.3.18 Provide technical and administrative support to the HPCMP in working with…