PWS.pdf

Performance Work Statement (PWS) For

Command Cyber Readiness Inspection (CCRI) Support

GENERAL INFORMATION

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, tools, materials, supervision, and other items necessary to perform Command Cyber Readiness Inspection preparation assistance as defined in this Performance Work Statement except as Specified in section C-3 as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background: The GAARNG requires assistance in making system changes and upgrades in preparation for the CCRI inspection. Specific expertise is required for network configuration, server administration, and information assurance.

1.3 Objectives: The objective of this contract is to provide skill and expertise in order to successfully pass the CCRI. This work will be performed to bring the GAARNG into compliance with current DOD network security standards.

1.3.1 Resources Required:

1.3.1.1 Network Engineer - Required background – Cisco Route/Switch Architecture, IOS Configuration, QoS, IOS Security, 802.1x, IAVA Resolution, STIG Compliance -

1.3.1.2 Security Engineer - Desired background – Cisco Identity Service Engine and 802.1x, Tenable Nessus via DISA’s Assured Compliance Assessment Solution (ACAS), AnyConnect, IAVA Resolution, STIG Compliance -

1.3.1.3 Data Center Engineer - Required background – Cisco UCS, Nexus & MDS, VMware ESXi, vSphere & vCenter, Microsoft Server Operating Systems (Windows 2012 R2 and 2008 R2), IAVA Resolution, STIG Compliance -

1.4 Scope: NGGA is requesting a Cisco Gold Partner with Specializations in Security, Data Center and Enterprise Network Architectures to provide Subject Matter Experts (SME) to assess and remediate any findings from their recent “PRE” Command Cyber Readiness Inspection (CCRI). The requested engineers will take lead on their respective technology practices configuring and installing hardware and software that will help meet NGGA CCRI goals. The requested Security and Network Engineers will be working with a Sensitive but Unclassified

Network as well as a Classified Network and therefore will require at least a Secret Security clearance. The Data Center Engineer will only be working on the Sensitive but Unclassified Network. Each technology practice will be allotted one hundred sixty (160) hours of SME support. The requested services will be performed at the NGGA JFHQ facility located in Marietta, Georgia.

All configuration tasks should follow published manufactured validated design guidance, industry best business practices, and DoD regulations.

All tasks performed during this engagement will be led by the corresponding SME Engineer with input and guidance from NGGA personnel.

At the conclusion of the project, any completed documentation will be furnished to the NGGA in electronic format. All documentation will become the sole property of NGGA. All deliverables requested will be performed during the purchased block of hours.

1.5 Period of Performance: 21 May 2018 to 30 September 2018

1.6 General Information

1.6.1 Quality Control: The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract. As a minimum, the contractor shall develop quality control procedures that address the areas identified in Technical Exhibit 1, “Performance Requirements Summary”. After acceptance of the quality control plan the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to his QC system. The QC plan will be delivered upon awarding of the contract.

1.6.2 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Government Remedies: The contracting officer shall follow FAR 52.212-4, “Contract Terms and Conditions-Commercial Items” or 52.246-4, “Inspection of Services-Fixed Price” for contractor’s failure to perform satisfactory services or failure to correct non-conforming services.

1.6.4 Recognized Holidays: The contractor is not required to perform services on these days Holidays

New Year’s Day Labor Day

Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day

1.6.5 Hours of Operation/Place of Performance: The contractor is responsible for conducting work at Building 447 Clay National Guard Center Marietta Georgia.

Under this contract the contractor will be on call and available 24x7.

1.6.6 Type of Contract: The government anticipates award of a Firm-Fixed Price Contract.

1.6.7 Security Requirements: Access and General Protection/Security Policy and Procedures. This standard language text is for contractor employees with an area of performance within an Army controlled installation, facility or area.

Contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by Department of Defense Headquarters of the Department of the Army and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

1.6.7.1 Physical Security. The contractor shall be responsible for safeguarding all government property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.6.7.2 Conservation of Utilities. The contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount to accomplish cleaning vehicles and equipment.

1.6.8 Special Qualifications: Contractor is required to have the appropriate Microsoft/Industry certifications/level of expertise and/or demonstrable expertise acceptable to the GAARNG G6 in order to accomplish the goals of this PWS as outlined in item 1.3. Either of these requirements are subject to the scrutiny of the GAARNG G6 and lack of either or both, in the opinion of the GAARNG G6, are unacceptable and grounds for lack of qualification. Contractor shall provide a history of SharePoint 2013 Web site and SharePoint 2013 Web page development with the Department of Defense and or other Federal agencies.

The history of work shall be within the last three years.

1.6.9 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.10 Contracting Officer Representative (COR): The (COR) is identified below:

LTC Copeland Rowell Deputy Chief Information Officer

The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies;

coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.11 Contract Manager: The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract.

1.6.12 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contractors will be required to check into the visitor’s center either on Clay National Guard Center or at Dobbins Air Base. No badge for access to the building will be required

1.6.13 Contractor Manpower Reporting (CMR): MANPOWER REPORTING REQUIREMENTS: The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the contractor will report ALL contractor manpower (including subcontractor manpower) required for performance of this contract. The contractor is required to completely fill in all the information in the format using the following web address: https://cmra.army.mil/.

The required information includes:

(1) Contracting Office, Contracting Officer, Contracting Officer's Technical Representative (COR);

(2) Contract number, including task and delivery order number;

(3) Beginning and ending dates covered by reporting period;

(4) Contractor name, address, phone number, e-mail address, identity of contractor employee entering data;

(5) Estimated direct labor hours (including sub-contractors);

(6) Estimated direct labor dollars paid this reporting period (including sub-contractors);

(7) Total payments (including sub-contractors);

(8) Predominant Federal Service Code (FSC) reflecting services provided by contractor (and separate predominant FSC for each sub-contractor if different);

(9) Estimated data collection cost;

(10) Organizational title associated with the Unit Identification Code (UIC) for the Army Requiring Activity (the Army Requiring Activity is responsible for providing the contractor with its UIC for the purpose of reporting this information);

(11) Locations where contractor and sub-contractors perform the work (specified by zip code in the United States and nearest city, country, when in an overseas location, using standardized nomenclature provided on website);

https://cmra.army.mil/

(12) Presence of deployment or contingency contract language; and

(13) Number of contractor and sub-contractor employees deployed in theater this reporting period (by country).

As part of its submission, the contractor will also provide the estimated total cost (if any) incurred to comply with this reporting requirement. Reporting period will be the period of performance not to exceed 12 months ending September 30 of each government fiscal year and must be reported by 31 October of each calendar year. Contractors may use a direct XML data transfer to the database server or fill in the fields on the website. The XML direct transfer is a format for transferring files from a contractor's systems to the web site without the need for separate data entries for each required data element at the web site. The specific formats for the XML direct transfer may be downloaded from the web site.

PART 2

DEFINITIONS & ACRONYMS

PWS. Performance Work Statement

Contracting Officer’s Representative (COR): A representative from the requiring activity assigned by the Contracting Officer to perform surveillance and to act as liaison to the contractor

CCE. Contracting Center of Excellence

Defective Service. A service output that does not meet the standard of performance associated with it in the Performance Work Statement.

Quality Assurance Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

Quality Control. Those actions taken by a contractor to control the performance of services so that they meet the requirements of the PWS.

Quality Assurance. Those actions taken by the government to assure services meet the requirements of the Performance Work Statement.

IOT. In Order To

BBP. Best Business Practices for industry but catering to Military standards and requirements

SME. Subject Matter Expert

UAT. User Acceptance Testing

TCO. Total Cost of Ownership

GKO. Guard Knowledge Online

CON Certificate Of Net-worthiness

Best Effort: That effort expended by the contractor to perform within the awarded ceiling price all work specified in this task order (TO) and all other obligations under this TO and the basic contract. This effort includes providing required qualified personnel, properly supervised, and following industry accepted methodologies and other practices. The effort is further characterized by operating at all times with the Government’s best interest in mind, using efficient and effective methods, and demonstrating sound cost control. The effort must be identical to the effort that would be expended if this were a firm-fixed price TO and the contractor’s profits were dependent upon reducing costs while meeting the Government’s requirements in terms and quality and schedule. Failure to provide this required effort may result in the withholding of payment for hours expended that do not qualify as best effort or a reduction in the rate per hour to reflect decreased value of services received.

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3.1 GENERAL: The government shall provide, the facilities, equipment, materials, and/or services listed below.

3.2 Equipment: The Government will provide: Functioning network infrastructure, applicable servers, and appropriate software and licenses.

3.3 Services: Fully functional physical and logical environment.

3.3.1 Utilities. All utilities in the facility will be available for the contractor’s use in performance of duties outlined in this PWS. The Contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities

3.4 Facilities: The Government will furnish the necessary workspace for the contractor staff to provide the support outlined in this PWS to include desk space, telephones, computers and other items necessary to maintain an office environment.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 General: Except for those items specifically stated to be government furnished in Part 3, the contractor shall furnish everything required to perform this PWS and abide by timelines outlined within Technical Exhibits 1 and 2.

4.1.2 Contractor will conduct a capabilities brief with COR after award but prior to commencement of contract to ensure that all parties concerns are addressed and that everything is in place for a successful web development.

4.1.3 Provide COR with a daily status regarding particular phase and any issues/successes encountered.

4.1.4 Provide COR with a final rollup prior to final day/completion. This allows the COR to know, understand, and address any issues regarding the status of web site development with time to resolve them.

4.2 Secret Facility Clearance: If access to DOD systems and documents are required, the Contractor shall possess and maintain a SECRET clearance from the Defense Security Service based on required classification and at the discretion of the COR. The Contractor’s employees, performing work in support of the contract shall also possess or be eligible to receive and maintain a SECRET security clearance from the Defense Industrial Security Clearance Office based on required classification and at the discretion of the COR.

4.3 Access to Government Information Systems – The Contractor will have access to Government Information Systems and as such must exercise due care IAW with Army Regulations 25-2 (AR 25-2). Additionally, the Contractor will complete training and certification as outlined in AR 25-2 Chapter 4, paragraph 4- 3, a, (6) for System Administrators.

4.4 Operations Security (OPSEC) – The Contractor will observe Operational Security as outlined in Army Regulation 530-1 (AR 530-1). The contractor will conform to requirements for Security Level I training contained within AR 530-1 Chapter 4, paragraph 4-2, sub a.

4.5 AT Level 1 Awareness Training (AT): All contractor employees requiring access to Army Installations, facilities, and controlled access areas shall complete Level 1 AT within 30 calendar days after contract start date and within 30 calendar days of new employees commencing performance. The contractor shall submit certificates of completion for each affected contractor and subcontractor employee, to the COR, or to the KO if a COR is not assigned, within 15 calendar days after completion of training. Level 1 AT is available at https://atlevel1.dtic.mil/at/.

4.6 Information Assurance (IA)/Information Technology (IT) Training: All contractor employees shall complete the DoD IA Awareness Training before issuance of network access and annually thereafter. All contractor employees performing services involving IA/IT functions shall comply with DoD and Army https://atlevel1.dtic.mil/at/ training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six months of the start of contract performance. In accordance with DoD 8570.01-M , DFARS 252.239.7001 and AR 25-2, contractor employees performing services supporting IA/IT functions shall be appropriately certified upon contract award.

The baseline certification as stipulated in DoD 8570.01-M shall be completed upon contract award.

4.7 Information Awareness: All contractor employees with access to a government information system shall be registered in the ATCTS (Army Training Certification Tracking System) (https://atc.us.army.mil/iastar/index.php) prior to commencement of services, and shall successfully complete the DOD Information Assurance awareness training prior to access to the IS and then annually thereafter. (https://ia.signal.army.mil/DoDIAA/).

4.8 iWATCH Training. The contractor with an area of performance within an Army-controlled installation, facilities, or area shall brief all employees on the local iWATCH program. This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR or the KO. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance. The contractor shall report completion for each affected contractor employee and subcontractor employee, to the COR, or to the KO if a COR is not assigned, within 15 calendar days after completion of training.

4.9 Classified Information. For Contracts That Require Handling or Access to Classified Information. The contractor shall comply with FAR Clause 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M) and applicable updates/changes.

https://atc/ https://ia.signal.army.mil/DoDIAA/

PART 5

SPECIFIC TASKS

5.1 BASIC SERVICES. The Vendor (Contractor) shall provide Subject Matter Expert (s) (SME) for a sufficient amount of time IOT accomplish the scope as outlined within this PWS within a reasonable period as agreed upon by both GAARNG and Vendor (Contractor). The Vendor (Contractor) will abide by timelines and deliverables outlined within Technical Exhibits 1 and 2. The following items specifically describe the level of detail and required:

5.1.1 Network Administration

5.1.1.1 Contractor will verify current Cisco IOS router/switch versions and recommend/assist with upgrades as required.

5.1.1.2 Contractor will assist with QoS implementation of voice traffic over the GAARNG LAN.

5.1.1.3 Contractor will assist with 802.1x implementation and compliance for UNCLASSIFIED and CLASSIFIED networks.

5.1.1.4 Contractor will assess network equipment for current STIG compliance and apply corrections as requested by the GAARNG.

5.1.1.6 Contractor will verify current IAVA compliance and make recommendations/assist with upgrades as requested.

5.1.2 Data Center Administration

5.1.2.1 Contractor will assess STIG compliance for Cisco UCS, Nexus and MDS, VMWare ESXi, vSphere/vCenter.

5.1.2.2 Contractor will assess STIG compliance on WIN2012R2 servers and assist with IAVA compliance issues as required.

5.1.3 Information Assurance

5.1.2.2 Contractor will assist with the design and implementation of Cisco Identity Service Engine and 802.1x.

5.1.2.3 Contractor will assess and make recommendations on the configuration/set-up of the GAARNG Assured Compliance Assessment Solution (ACAS) IAW current DISA recommendations/implementation guides.

5.1.2.4 Contractor will assess and make compliance recommendations for the AnyConnect VPN solution as it relates to the GuardNet Next (GNN) stack.

5.1.2.5 Contractor will assist with STIG and IAVA compliance

assessments as requested.

PART 6

APPLICABLE PUBLICATIONS

6.1 Publications applicable to this PWS are listed below. The publications must be coded as mandatory or advisory, the date of the publication, and what chapters or pages are applicable to the requirement. All publications listed are available via the Internet at the specified e-mail address.

Information Security AR 25-2, Mandatory and as outlined in Part 4.3 of this PWS.

Operational Security, AR 530-1, Mandatory and as outlined in Part 4.4 of this

PWS.

Part 7

MANPOWER REPORTING REQUIREMENTS:

7.1 The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the contractor will report ALL contractor manpower (including subcontractor manpower) required for performance of this contract. The contractor is required to completely fill in all the information in the format using the following web address: https://cmra.army.mil/.

7.1.1 The required information includes:

7.1.2 Contracting Office, Contracting Officer, Contracting Officer's Technical Representative (COR);

7.1.3 Contract number, including task and delivery order number;

7.1.4 Beginning and ending dates covered by reporting period;

7.1.5 Contractor name, address, phone number, e-mail address, identity of contractor employee entering data;

7.1.6 Estimated direct labor hours (including sub-contractors);

7.1.7 Estimated direct labor dollars paid this reporting period (including sub-contractors);

7.1.8 Total payments (including sub-contractors);

7.1.9 Predominant Federal Service Code (FSC) reflecting services provided by contractor (and separate predominant FSC for each sub-contractor if different);

7.1.10 Estimated data collection cost;

7.1.11 Organizational title associated with the Unit Identification Code (UIC) for the Army Requiring Activity (the Army Requiring Activity is responsible for providing the contractor with its UIC for the purpose of reporting this information);

7.1.12 Locations where contractor and sub-contractors perform the work (specified by zip code in the United States and nearest city, country, when in an overseas location, using standardized nomenclature provided on website);

7.1.13 Presence of deployment or contingency contract language; and

7.1.14 Number of contractor and sub-contractor employees deployed in theater this reporting period (by country).

7.2 As part of its submission, the contractor will also provide the estimated total cost (if any) incurred to comply with this reporting requirement. Reporting period will be the period of performance not to exceed 12 months ending September 30 of each government fiscal year and must be reported by 31 October of each calendar year.

7.3 Contractors may use a direct XML data transfer to the database server or fill in the fields on the website. The XML direct transfer is a format for transferring files from a contractor's systems to the web site without the need for separate data entries for each required data element at the web site. The specific formats for the XML direct transfer may be downloaded from the web site.

TECHNICAL EXHIBIT 1

Performance Requirements Summary The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Requirement

Performance Standard

Method of Surveillance

Acceptable Quality Level

Assist with the resolution of all network critical concerns and CAT I findings identified in the Pre-CCRI inspection.

Contractor will provide recommendation s/assist on priorities of work, implementation, and additional resource/training requirements.

100% participation by DOIM select staff.

All remaining findings through self-assessment do not surpass CAT II finding.

Assist with the resolution of all data center critical concerns and CAT I findings identified in the Pre-CCRI inspection.

Contractor will provide recommendation s/assist on priorities of work, implementation, and additional resource/training requirements.

100% participation by DOIM staff.

All remaining findings through self-assessment do not surpass CAT II finding.

Assist with the resolution of all information assurance critical concerns and CAT I findings identified in the Pre-CCRI inspection.

Contractor will provide recommendation s/assist on priorities of work, implementation, and additional resource/training requirements.

100% participation by DOIM select staff.

All remaining findings through self-assessment do not surpass CAT II finding.

Types of Surveillance to select from:

Random Sampling: Appropriate for frequently recurring tasks. Evaluate randomly selected samples of the lot to determine the acceptability of the entire lot.

Random Inspection Guide, Method of surveillance, Lot size, Sample size, Performance requirement, Sampling procedure, Inspection procedure.

100 Percent Inspection: Appropriate for tasks that occur infrequently.

Inspect and evaluate performance each time task is performed.

100 Percent Participation: Appropriate for tasks that require vigilance and observation to ensure requirement and documented intent are accomplished.

Periodic Surveillance: Evaluation of samples selected on other than 100% or statistically random basis. (i.e. monthly, quarterly, semi-annually etc.).

Validated Customer Complaint: Complaints must be validated.

TECHNICAL EXHIBIT 2

DELIVERABLES SCHEDULE

A deliverable is anything that can be physically delivered but may include non-physical things such as meetings.

Deliverable Frequency # of Copies Medium/Format Submit To

NETWORK

CHANGE

RECOMMENDATI

ONS AND

RECOMMENDED

PRIORITY OF

WORK

3 DAYS AFTER

PROJECT START,

UPDATED

WEEKLY UNTIL

CONCLUSION

1 MS EXCEL OR

MS WORD

LTC ROWELL

DATA CENTER

CHANGE

RECOMMENDATI

ONS AND

RECOMMENDED

PRIORITY OF

WORK

3 DAYS AFTER

PROJECT START,

UPDATED

WEEKLY UNTIL

CONCLUSION

1 MS EXCEL OR

MS WORD

LTC ROWELL

INFORMATION

ASSURANCE

CHANGE

RECOMMENDATI

ONS AND

RECOMMENDED

PRIORITY OF

WORK

3 DAYS AFTER

PROJECT START,

UPDATED

WEEKLY UNTIL

CONCLUSION

1 MS EXCEL OR

MS WORD

LTC ROWELL

Deliverable Frequency # of Copies Medium/Format Submit To

PROGRESS

REPORT

WEEKLY 1 MS EXCEL OR

MS WORD

LTC ROWELL

STATUS

REPORT/AAR

UPON

COMPLETION

2 MS EXCEL OR

MS WORD

COL ALLEN

LTC ROWELL