Attachment_B_revised3_-_Sample_Task_Order_PWS_07192016.docx

Performance Work Statement (PWS) SCA-V Service Contract 12/15/2015 Version 2.0 Performance Work Statement (PWS)

ERDC Security Control Assessor-Validator (SCA-V) Service Contract 1 Introduction The U. S. Army Corps of Engineers (USACE) Engineer Research and Development Center (ERDC) has responsibility for investigating, developing and maintaining the nation's water and related environmental resources; constructing and operating projects for navigation, flood control, major drainage, shore and beach restoration and protection, related hydro power development, water supply, water quality control, fish and wildlife conservation and enhancement, and outdoor recreation; responding to emergency relief activities directed by other federal agencies; and administering laws for the protection and preservation of navigable waters, emergency flood control and shore protection.

1.1 Mission

The U.S. Army Corps of Engineers' (USACE) Engineer Research and Development Center (ERDC) helps solve our Nation’s most challenging problems in civil and military engineering, geospatial sciences, water resources, and environmental sciences for the Army, Department of Defense, civilian agencies, and our Nation’s public good.

1.2 Background

The ERDC Information Technology Laboratory (ITL) is responsible for building, staffing and maintaining the computer communications network in support of the Research & Development activities of ERDC. ERDC is an US Army CIO/G6 assigned Security Control Assessor - Validator (SCA-V). The SCA-V is responsible for conducting comprehensive assessments of the management, operational, and technical security controls employed within or inherited by an information system (IS) to determine the overall effectiveness of the controls (i.e., the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system). SCA-Vs also provide an assessment of the severity of weaknesses or deficiencies discovered in the information system and its environment of operation and recommend corrective actions to address identified vulnerabilities.

1.3 Scope

The ERDC ITL requires Risk Assessment and Security Engineering services for its mission-critical activities in the areas of operations: ERDC Security Control Assessor-Validator (SCA-V) activities in support of the US Army Training and Doctrine Command (TRADOC).

2 General Requirements This section describes the general requirements the contractor needs to accomplish. The following sub-sections provide details of various considerations on this effort.

2.1 Non-Personal Services

The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Procuring Contracting Officer (PCO) immediately.

2.2 Business Relations

The contractor shall successfully integrate and coordinate all activity needed to execute the requirement. The contractor shall manage the timeliness, completeness, and quality of problem identification. The contractor shall provide corrective action plans, proposal submittals, timely identification and remediation of issues, and effective management of subcontractors. The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

2.3 Contract Administration and Management

The following subsections specify requirements for contract, management, and personnel administration.

2.3.1 Contract Management

The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. When operating onsite, the contractor shall maintain continuity between ongoing activities at Vicksburg, MS, Alexandria, VA, Champaign, IL, and Hanover, NH and the contractor's corporate offices.

2.3.2 Contract Administration

The contractor shall establish processes and assign appropriate resources to effectively administer the requirement. The contractor shall respond to Government requests for contractual actions in a timely fashion. The contractor shall have a single point of contact between the Government and Contractor personnel assigned to support operations under executed task orders. The contractor shall assign work effort and maintain proper and accurate timekeeping records of personnel assigned to work on the requirement.

2.3.3 Personnel Administration

The Contractor(s) shall provide experienced and qualified personnel with all the skills necessary to perform the work identified. Some Contractor(s) personnel must have and maintain certain valid Licenses and Certifications to perform the work and will be identified at the task order level. Various required training, qualifications, licenses, security clearances, or certifications must be obtained prior to commencement of work at Contractor(s) expense. Contractor(s) employees required to perform tasks must meet certification requirements as defined in Army and DoD Regulations. All contractor personnel shall be able to read, write, speak, and understand English, shall possess good written and verbal communications skills, and shall have sufficient knowledge of proper English grammar, spelling, capitalization, and punctuation rules to identify errors and make corrections.

The contractor shall provide the following management and support as required. The contractor shall provide for employees during designated Government non-work days or other periods where Government offices are closed due to weather or security conditions. The contractor shall maintain the currency of their employees by providing initial and refresher training as required to meet the PWS requirements. The contractor shall make necessary travel arrangements for employees. The contractor shall provide necessary infrastructure for services performed at the contractor's site(s).The contractor shall provide administrative support to employees in a timely fashion (time keeping, leave processing, pay, emergency needs).

2.4 Subcontract Management

The contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement. The prime contractor will manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations. Contractors may add subcontractors to their team after notification to the Procuring Contracting Officer (PCO) or Contracting Officer Representative (COR). Cross teaming may or may not be permitted.

2.5 Contractor Personnel, Disciplines, and Specialties

The contractor shall accomplish the assigned work by employing and utilizing qualified personnel with appropriate combinations of education, training, and experience. The contractor shall match personnel skills to the work or task with a minimum of under/over employment of resources. The contractor shall ensure the labor categories as defined in the Labor Categories document utilized in the performance of each Task Order issued hereunder will be the minimum necessary to accomplish the task. The Contractor shall provide the necessary resources and infrastructure to manage, perform, and administer the contract.

2.5.1 Contractor Employee Conduct

The contractors employees shall observe and comply with all applicable departmental and agency regulations, policies, and procedures (e.g., fire, safety, sanitation, environmental protection, security, etc.). The contractor shall ensure that all contractor employees represent a professional appearance at all times, and that their conduct does not reflect discredit on the United States Government.

When contractor employees are working on Government facilities or participating at Government meetings, they shall wear identification badges distinguishing themselves as such. The badges at a minimum must have the employee name and word "contractor” displayed. Ideally, the company name will appear on the badge. Additionally, not withstanding any other provisions in the PWS, the contractor shall identify themselves as a contractor in meetings, telephone conversations, all written communications and work situations so that their actions cannot be construed as acts of a Government official. The contractor shall take no actions that bind the government to a final decision or results in the exercise of governmental discretion.

2.5.2 Removal of Contractor Employees for Misconduct or Security Reasons The Government may, at its sole discretion, direct the contractor to remove any contractor employee from Government facilities for misconduct or security reasons. Such removal does not relieve the contractor of the responsibility to provide sufficient qualified personnel for adequate and timely service. The Contracting Officer will provide the contractor with an immediate rationale for removal of contractor employee.

Conflict of Interest. Neither the contractor nor its on-site employees shall utilize their knowledge of access to information, sensitive or otherwise, for individual or company gain.

2.6 Location and Hours of Work

This is an on-site task order. The headquarters site of the U.S. Army Corps of Engineers, ERDC is 3909 Halls Ferry Road, Vicksburg, MS 39180-6199.

Core Working Hours. Government core working hours are from 0700 to 1730 local time Monday through Friday except US Federal Holidays. Government workers typically work eight (8) hours per day, 40 hours per week.

Government Facility Closure. In case of government facility closure as directed by the government, contractor employees shall be excused from work at no cost to the government.

2.7 Travel

All travel requirements (including plans, agenda, itinerary, or dates) shall be pre-approved by the government (subject to local policy procedures), and is on a strictly cost reimbursable basis. Costs for travel shall be billed in accordance with the regulatory implementation of Public Law 99-234 and FAR 31.205-46 Travel Costs (subject to local policy and procedures; may reference FAR). Travel locations Ft. Leavenworth, KS, Ft. Bliss, TX, Ft. Lee, VA, and Ft. Huachuca, AZ.

3 Performance Requirements The following section specifies the Performance Objectives and Performance Elements to be accomplished under this task order at each of the locations identified in section 2.7.

Period of Performance is 5 months Cybersecurity The Contractor shall perform activities relative to the ERDC Security Control Assessor-Validator (SCA-V) of the Security Control Assessor-Army (SCA-A).

This consists of Risk Management Framework (RMF) assessments for enclaves and major applications throughout the Army. This requires knowledge of the NIST SP 800-53 controls, as well as DISA STIGs, DoD vulnerability assessment techniques, and applicable DoD and Army cybersecurity regulations.

3.1 Scope of Work

The systems for evaluation include:

Enclave 1 which includes STIG Checklists for sampling of technologies Windows 7, Windows Server 2008R2, RHEL, IIS, VMWare, SharePoint, SQL Server 2008R2, Microsoft Exchange, VTC, VoIP, and Network Devices. Also security assessment test results from the NIST SP 800-53arev4 controls with N/C Risk Assessments.

Enclave 2 which includes STIG Checklists for networks, RHEL, VMWare, SQL Server, Network Devices, and Windows. Also security assessment test results from the NIST SP 800-53arev4 controls with N/C Risk Assessments.

Enclave 3 for (Classified and Unclassified) which includes STIG Checklists for SQL Server, SharePoint, network devices, and VoIP. Also security assessment test results from the NIST SP 800-53arev4 controls with N/C Risk Assessments.

Enclave 4 for (Classified and Unclassified) which includes STIG Checklists for SQL Server, IIS, Windows 2012 Server, source code review, My SQL, and Apache. Also security assessment test results from the NIST SP 800-53arev4 controls with N/C Risk Assessments.

A001 – Monthly Report

3.1.1 Pre-Visit Teleconference

The Contractor shall schedule a pre-visit coordination teleconference with the customer POC to finalize logistics to include travel arrangements, required site visit requests through the site FSO, and onsite testing schedule.

Deliverables A002 Schedule of Pre-Visit Teleconferences

3.1.2 Technical Testing and RMF Controls

The Contractor shall test all applicable security controls as defined in NIST SP 800-53. Technical testing includes using approved automated tools as documented by NETCOM. The contractor shall annotate all assessment procedures (AP) test results (TR) for the system under test’s delineated security controls in The Enterprise Mission Assurance Support Service (eMASS) within 30 days of departing onsite for technical testing. The contractor shall provide the government with the raw test data collected during each assessment.

Deliverables A003 Raw Test Data

3.1.3 Post-Visit Analysis and Documentation

The Contractor shall conduct post-visit analysis, verification and required documentation of all assessment procedures (AP) test results (TR) discovered during the technical testing IAW DISA STIGs. The contractor shall concisely document all test results for security controls for the system in eMASS.

The contractor shall perform a Risk Assessment Summary in eMASS that contains the following information for each security control of the system:

· Status – Current Compliance Status of security controls.

· Control Risk Level – Documented risk level for Non-Compliant controls in the system baseline. Non-Compliant security controls are subjected to a risk assessment process that considers multiple factors in producing the risk level as described in DoDI 8510.01, Enclosure 6 and NIST SP 800-30.

· Vulnerability Severity Value – Assigned to all Non-Compliant security controls to indicate the severity associated with identified vulnerabilities.

· Vulnerability Summary – Details an accurate description of the finding:

· 1) An accurate description of finding detail

· Recommendations – Details potential countermeasures to mitigate/remove the vulnerability.

The contractor shall deliver all documentation to the ITL SCA-V Team Lead.

Deliverables A004 Risk Assessment Summary

3.1.4 Post-Visit Teleconference

The Contractor shall conduct a post-analysis teleconference (sometimes known as a Risk Assessment Working Group – RAWG) with the customer’s point of contact to explain any unresolved issues identified while onsite. The contractor shall provide a draft recommendation memo with a summary of findings and risk determination to the government. A template will be provided through the NETCOM SCA-V TTP on the RMF knowledge Service.

Deliverables A005 Schedule of RAWG teleconferences A006 Draft recommendation memo

4 Special Requirements This section describes the special requirements for this effort. The following sub-sections provide details of various considerations on this effort.

4.1 Security and Safety

4.1.1 All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 5 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website: https://www.lms.army.mil

4.1.2 All contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

4.1.3 The contractor and all associated sub-contractors shall brief all employees on the local iWATCH, Corps Watch, or See Something, Say Something program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 5 calendar days after contract award.

4.1.4 All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the information systems and then annually thereafter IAW AR 380-67 (Personnel Security Program) and Homeland Security Presidential Directive 12 (Policy for a Common Identification Standard for Federal Employees and Contractors).

4.1.5 The Contractor shall develop an OPSEC SOP/Plan within 90 days of contract award. The OPSEC SOP/Plan must be reviewed and approved by the RA OPSEC Officer. The SOP/Plan will include the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator.

4.1.6 All new contractor employees will complete Level I OPSEC training within 30 calendar days of their reporting for duty. Additionally, all contractor employees must complete annual OPSEC awareness training.

4.1.7 All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six months of employment.

4.1.8 All contractor employees supporting IA/IT functions shall be appropriately certified upon contract IAW DoD 8570.01-M, DFARS 252.239-7001 and AR 25-2. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

4.1.9 All contractor employees shall ensure the following AT/OPSEC requirements are meet prior to deploying personnel authorized to accompany U.S. Armed Forces outside the United States: required compliance with laws and regulations, pre-deployment requirements, required training (per combatant command guidance), and personnel data required.

4.1.10 The Contractor shall comply with the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M), any revisions to DOD 5220.22-M and Army Regulation 380-49, Industrial Security. The DD254 will be attached with the contract.

4.1.11 All contract employees, including subcontractor employees who are not in possession of the appropriate security clearance, will be escorted in areas where they may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas.

The Prime Contractor Company must have (or will have) a Facility Clearance (FCL) at the appropriate level (IAW the NISPOM DOD 5220.22-M and AR 380-49) prior to the start of the contract awarded period of performance. Contractor personnel performing work under this contract must have the required security clearance, per AR 380-67, at the appropriate level at the start of the period of performance. Security Clearances and FCL requirements are required to be maintained for the life of the contract IAW the DD254 attached to the contract. If no FCL, the supporting Government Contracting Activity will sponsor the prime contract company in obtaining the FCL.

DD Forms 254: Overarching security requirements and Contractor access to classified information shall be as specified in the basic DD Form 254, which will be further identified in the DD Form 254 for each TO, as required. All contractor personnel with access to unclassified information systems, including e-mail, shall have at a minimum a favorable National Agency Check (NAC).

Visitor Group Security Agreement. The contractor shall sign a Contractor Visitor Group Security Agreement to protect classified information involved in performance under this contract or Task Order. The Agreement will outline responsibilities in the following areas: Contractor security supervision; Standard Practice Procedures; access, accountability, storage, and transmission of classified material; marking requirements; security education; personnel security clearances; reports; security checks; security guidance; emergency protection; protection of government resources; DD Forms 254; periodic security reviews; and other responsibilities, as required.

4.2 Transition

This section is not used

4.3 Government Furnished Materials

Unless otherwise indicated in a particular task order, the Government will provide all facilities, utilities, equipment and materials necessary to accomplish the work:

Laptop computer (PC) Government furnished computers may be hand-receipted to the Contractor. The liability for the repair of damaged Government property shall be subject to the terms of the "Government Property clause set forth in Section I of the solicitation and resulting contract. When Government property is furnished to the Contractor, a Government property control receipt will be completed and signed by the Contractor. The property control receipt will indicate the assigned location for use of the property by the Contractor. A copy of the property control receipt will be furnished to the Contractor. Upon return of the Government property to the Government, the Government property control receipt will be completed indicating the return of the property by the Contractor. A copy of the returned property control receipt will be furnished to the Contractor. All Government property furnished to the Contractor shall be accomplished in accordance with this procedure. The Contractor shall establish a property control system for the use, control, protection, and preservation of Government property assigned to the Contractor.

4.4 Environmental Requirements

Not Applicable.

4.5 Applicable Directives

The contractor shall comply with all documents referenced under paragraph 3.0, Performance Requirements and as identified at the task order level.

4.6 Quality

This section describes the Quality Control components for this effort. The following sub-sections provide details of various considerations on this effort.

4.6.1 Quality Control

The Contractor shall develop an Order Quality Control Plan (QCP) for the base and maintain an effective quality control program to ensure services are performed in accordance with the IDIQ contract and this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractors QCP is the means by which he assures himself that his work complies with the requirement of the contract.

The finalized QCP will be accepted by the Government at the time of the award of the contract. The Contracting Officer may notify the Contractor of required modifications to the plan during the period of performance. The Contractor then shall coordinate suggested modifications and obtain acceptance of the plan by the Contracting Officer. Any modifications to the program during the period of performance shall be provided to the Contracting Officer for review no later than 10 working days prior to effective date of the change. The QCP shall be subject to the Governments review and approval. The Government may find the QCP "unacceptable" whenever the Contractors procedures do not accomplish quality control objective(s). The Contractor shall revise the QCP within 10 working days from receipt of notice that QCP is found "unacceptable."

4.6.2 Quality Assurance Surveillance Plan (QASP)

The Government shall monitor the Contractors performance under this contract in accordance with the Governments QASP. The Government reserves the right to utilize other methods, as necessary, to assure the Contractor's compliance with the terms and conditions of this contract. The Government may inspect services provided by the Contractor both during and/or after performance is complete. If the Government identifies any performance deficiency, the Contractor will be advised of the deficiency as soon as possible. All such notifications will be confirmed in writing with the Contractor by the Government. Such notification will be made only to the Contractor or his/her designated onsite superintendent and not to any other agents, employees, or subcontractors. Upon receipt of such notification, the Contractor shall correct the deficiency within the time specified by the COR. However, in the event that the deficiency represents a hazard to health or safety or it serves to jeopardize operational continuity, then corrective action shall proceed immediately and continue uninterrupted until the correction is affected. In all cases, the correction of performance deficiencies shall not in any way adversely affect other contract performance.

5 Deliverables The contractor shall provide deliverables as described in subsequent task orders. Deliverables shall be specified by the government. Format and delivery schedule for deliverables shall be outlined in CDRLs and/or other means TBD at the task order level. Deliverables will typically fall within the listing below and be specified in individual task orders.

Performance Requirement Summary (PRS)

Disincentive

Cybersecurity

AQL: 95%

b) STD: Identifies deficiencies

AQL: 95%

c) STD: Identifies corrective actions, when applicable

AQL: 95%

d) STD: Deliverables are made in accordance with schedule

AQL: 95%

e) STD: Responsive

AQL: 95%

Rating according to Rating Criteria in Table 1.

Table 1

Performance Requirement Summary (PRS) Performance Ratings

Performance Rating Criteria