Solicitation_Cybersecurity.pdf

SEE ADDENDUM

(No Collect Calls)

W91CRB19R0025 11-Apr-2019

b. TELEPHONE NUMBER

410-278-5597

8. OFFER DUE DATE/LOCAL TIME

09:00 AM 10 May 2019

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA X ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W91CRB9. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

ASHLEY D. CLARK

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

1 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

ACC - APG - W91CRB

BLDG 4310

6515 INTEGRITY COURT

ABERDEEN PROVING GROUND MD 21005-3013

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE 16. ADMINISTERED BY

SEE SCHEDULE

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

X 8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$27,500,000

NAICS:

541519

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF167

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

W91CRB19R0025

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Cybersecurity Operations Lead

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.1 of the PWS FOB: Destination

PSC CD: D310

NET AMT

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Sr Cybersecurity Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.2 of the PWS FOB: Destination

PSC CD: D310

NET AMT

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Cybersecurity Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.3 of the PWS FOB: Destination

PSC CD: D310

NET AMT

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Sr Cybersecurity Watch Analyst

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.4 of the PWS FOB: Destination

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Cybersecurity Watch Analyst

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.5 of the PWS FOB: Destination

PSC CD: D310

NET AMT

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Incident Response Handler

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.6 of the PWS FOB: Destination

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Cybersecurity Compliance Lead

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.7 of the PWS FOB: Destination

Sr Cybersecurity Compliance Specialist

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.8 of the PWS

Cybersecurity Compliance Specialist

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.9 of the PWS

Software Compliance Analyst

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.10 of the PWS

Sr Configuration Management Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.11 of the PWS

Configuration Management Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.12 of the PWS

Project Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.13 of the PWS

Technical Writer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.14 of the PWS

Information Training Specialist

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.15 of the PWS

Contract Data Requirements List

FFP

Contract Data Requirements List (CDRLs) accordance with Technical Exhibit 1

Contractor Manpower Reporting

FFP

Contractor Manpower Reporting requirement has been added to the statement of work, and contractor is required to provide data on contractor manpower (including subcontractor manpower) for performance of this contract.

This CLIN is NOT SEPARATELY PRICED.

Transition Period

FFP

In accordance with PWS Section 1.5 there will be a Fourty Five (45) day transition period.

OPTION Cybersecurity Operations Lead

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.1 of the PWS

OPTION Sr Cybersecurity Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.2 of the PWS

OPTION Cybersecurity Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.3 of the PWS

OPTION Sr Cybersecurity Watch Analyst

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.4 of the PWS

OPTION Cybersecurity Watch Analyst

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.5 of the PWS

OPTION Incident Response Handler

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.6 of the PWS

OPTION Cybersecurity Compliance Lead

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.7 of the PWS

OPTION Sr Cybersecurity Compliance Specialist

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.8 of the PWS

OPTION Cybersecurity Compliance Specialist

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.9 of the PWS

OPTION Software Compliance Analyst

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.10 of the PWS

OPTION Sr Configuration Management Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.11 of the PWS

OPTION Configuration Management Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.12 of the PWS

OPTION Project Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.13 of the PWS

OPTION Technical Writer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.14 of the PWS

OPTION Information Training Specialist

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.15 of the PWS

OPTION Contract Data Requirements List

OPTION Contractor Manpower Reporting

FFP

Contractor Manpower Reporting requirement has been added to the statement of work, and contractor is required to provide data on contractor

OPTION Cybersecurity Operations Lead

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.1 of the PWS

OPTION Sr Cybersecurity Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.2 of the PWS

OPTION Cybersecurity Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.3 of the PWS

OPTION Sr Cybersecurity Watch Analyst

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.4 of the PWS

OPTION Cybersecurity Watch Analyst

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.5 of the PWS

OPTION Incident Response Handler

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.6 of the PWS

OPTION Cybersecurity Compliance Lead

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.7 of the PWS

OPTION Sr Cybersecurity Compliance Specialist

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.8 of the PWS

OPTION Cybersecurity Compliance Specialist

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.9 of the PWS

OPTION Software Compliance Analyst

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.10 of the PWS

OPTION Sr Configuration Management Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.11 of the PWS

OPTION Configuration Management Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.12 of the PWS

OPTION Project Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.13 of the PWS

OPTION Technical Writer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.14 of the PWS

OPTION Information Training Specialist

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.15 of the PWS

OPTION Contract Data Requirements List

OPTION Contractor Manpower Reporting

FFP

Contractor Manpower Reporting requirement has been added to the statement of work, and contractor is required to provide data on contractor

OPTION Cybersecurity Operations Lead

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.1 of the PWS

OPTION Sr Cybersecurity Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.2 of the PWS

OPTION Cybersecurity Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.3 of the PWS

OPTION Sr Cybersecurity Watch Analyst

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.4 of the PWS

OPTION Cybersecurity Watch Analyst

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.5 of the PWS

OPTION Incident Response Handler

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.6 of the PWS

OPTION Cybersecurity Compliance Lead

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.7 of the PWS

OPTION Sr Cybersecurity Compliance Specialist

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.8 of the PWS

OPTION Cybersecurity Compliance Specialist

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.9 of the PWS

OPTION Software Compliance Analyst

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.10 of the PWS

OPTION Sr Configuration Management Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.11 of the PWS

OPTION Configuration Management Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.12 of the PWS

OPTION Project Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.13 of the PWS

OPTION Technical Writer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.14 of the PWS

OPTION Information Training Specialist

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.15 of the PWS

OPTION Contract Data Requirements List

OPTION Contractor Manpower Reporting

FFP

Contractor Manpower Reporting requirement has been added to the statement of work, and contractor is required to provide data on contractor

OPTION Cybersecurity Operations Lead

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.1 of the PWS

OPTION Sr Cybersecurity Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.2 of the PWS

OPTION Cybersecurity Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.3 of the PWS

OPTION Sr Cybersecurity Watch Analyst

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.4 of the PWS

OPTION Cybersecurity Watch Analyst

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.5 of the PWS

OPTION Incident Response Handler

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.6 of the PWS

OPTION Cybersecurity Compliance Lead

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.7 of the PWS

OPTION Sr Cybersecurity Compliance Specialist

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.8 of the PWS

OPTION Cybersecurity Compliance Specialist

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.9 of the PWS

OPTION Software Compliance Analyst

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.10 of the PWS

OPTION Sr Configuration Management Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.11 of the PWS

OPTION Configuration Management Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.12 of the PWS

OPTION Project Engineer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.13 of the PWS

OPTION Technical Writer

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.14 of the PWS

OPTION Information Training Specialist

FFP

The contractors will be responsible for the tasks outlined in paragraph 1.6.11.15 of the PWS

OPTION Contract Data Requirements List

OPTION Contractor Manpower Reporting

FFP

Contractor Manpower Reporting requirement has been added to the statement of work, and contractor is required to provide data on contractor

Section C - Descriptions and Specifications

PERFORMANCE WORK STATEMENT

CYBERSECURITY SUPPORT SERVICES

US ARMY COMMAND AND CONTROL SUPPORT AGENCY

(CCSA)

GENERAL INFORMATION

1. GENERAL: This is a non-personnel services contract to provide Cybersecurity Service Provider (CSSP) Support.

The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to Contractor who, in turn is responsible to the Government.

1.1. Description of Services/Introduction: Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform CSSP Support as defined in this Performance Work Statement except for those items specified as government furnished property and services. Contractor shall perform to the standards in this contract.

1.2. Background: The U.S. Army Command and Control Support Agency (CCSA) provides support to the Headquarters, Department of the Army (HQDA) with development, installation, operation and maintenance of Command and Control (C2) systems. In addition, CCSA provides Chief Information Officer (CIO) services to the HQDA, Deputy Chief of Staff (DCS) G-3/5/7.

1.2.1. CCSA is the C2 Mission Assurance Category Level I (MAC I) organization responsible for providing C2 IT support services to the Army HQDA, G-3/5/7, Department of the Army Military Operations – Operations, Readiness, and Mobilization Directorate (DAMO-OD), Army Operations Center (AOC), Alternate Army Operations Center (AAOC), and the Resource and Situational Awareness Center (RSAC) located at 3200 Army Pentagon, Washington DC and as required at alternate locations. Access to CCSA support locations require a Top Secret clearance. CCSA provides and or performs IT operations and IT support services for desktop, multifunctional devices, plotters, audiovisual systems, mobile communications, telecommunications, network infrastructure and design services, network support services, systems and server administration, cybersecurity, remote access, application development, troubleshooting, maintenance and administration, and Concept of Operations Planning and support services (COOP).

1.2.2. CCSA supports a local user community fluctuating between 400 and 750 users at any given time based on mission requirements or worldwide events. CCSA further supports a much larger user community remotely through SharePoint environments and systems of record. CCSA contractor manpower equivalents (CMEs) identified as Emergency Response Group (ERG) members are required to relocate to an alternate site and provide support for extended hours and periods. CCSA operates in both a classified and unclassified environment 24/7/365. CCSA maintains a 1500-workstation (subject to mission requirements) community with associated multi-function devices, laptops, mobile devices, phones (secure/unsecure), and other network IT resources. The devices and services are hosted in multi-node clustered environment eliminating a single point of failure, and ensuring Sigma level 5-percentage yield availability of all network services.

1.2.3. The CCSA Audio Visual system is comprised of approximately 60 desktop and Telepresence devices and 18 conference rooms operating at multiple levels of classification. In addition to these devices, CCSA maintains and operates a large number of displays throughout the AOC/RSAC, which are used to monitor outside events. Together these systems are referred to as the AOC Virtual Display System (VDS).

1.2.4. CCSA maintains and operates a virtual server environment with over 116 physical hosts spanning multiple nodes and locations with the capacity for 2320 virtual servers. In addition to the virtual environment, CCSA operates multiple legacy systems supporting both Windows and UNIX based environments.

1.2.5. CCSA continuously researches and invests in new technologies in an attempt to reduce costs, gain performance efficiencies, increase survivability, and reduce reliance on outside sources; all while maintaining a secure and operational environment. CCSA owns and manages its own IP space, servers, server space and remote access assets while working with Pentagon infrastructure providers to manage and maintain the network infrastructure.

1.3. Objectives: To obtain support services to assist CCSA in operating a Cybersecurity Operations Center (CSOC). The CSOC is charged with defending the AOC cyber-terrain that enables the C2 user community and ensures continued mission success for the war fighter community who are the final recipients of the decisions and products developed by the G-3/5/7 HQDA DAMO-OD staff and subordinate organizations.

Provide Cybersecurity Operations support.

Provide Cybersecurity Compliance support.

Provide Information Technology Operations support.

1.4. Scope: Contractor shall provide cybersecurity support services to the DCS, G-3/5/7. Provide direct security engineering support to CCSA-managed networks and systems and its supported customers.

Contractor shall provide a properly trained and certified workforce. Contractor shall perform operational/maintenance and IT support services under accepted best business practices and/or industry standards in regards to workstations, ancillary equipment, software, firmware, associated procedures and services (including support services), and related resources. Section 5 of this PWS provides additional detail on the specific tasks to be performed.

1.4.1. Additionally, there are general tasks for functional areas that may be required under this contract. General tasks are best business practices or industry defined practices required to meet the requirements for a functional area to be successful.

1.4.2. All staff shall provide IT support services for the G-3/5/7 HQDA staff and subordinate organizations in a 24/7/365 work environment and offsite support at alternate locations not to exceed a 150-mile radius of the primary work location.

1.4.3. Contractor shall provide experienced staff to support the following Service Levels:

1.4.3.1. Emergency Relocation Services – Emergency Relocation Group must respond immediately1 and relocate to the alternate site within eight (8) hours.

1.4.3.2. Emergency / VIP Services – Critical IT infrastructure, General Officers, senior level officials as identified by Contracting Officer’s Representative (COR), DAMO-OD, AOC, and Crisis Support Personnel supporting a crisis, national emergency or unplanned events.

Immediate response. Must be on-site within one (1) hour upon recall by either the COR, ACOR or

TL.

Contractor shall notify the COR if VIP service repairs are not completed within one (1) hour and shall provide hourly updates until repairs are completed.

1.4.3.3. Expedited Services

Response within two (2) business hours.

Incident (INC) resolution within four (4) business hours.

Work Order (WO) resolution within eight (8) business hours.

Change Request (CRQ) resolution within three (3) business days or suspense date assigned to CRQ, whichever is greater.

1.4.3.4. Standard Services

Response within eight (8) business hours.

Incident (INC) resolution within three (3) business days.

Work Order (WO) resolution within seven (7) business days.

Change Request (CRQ) resolution within fourteen (14) business days or suspense date assigned to

CRQ, whichever is greater.

1.4.3.5. Status updates for all services provided will be provided every eight (8) business hours.

1.5. Reserved

1.6. General Information

1.6.1. Quality Control: Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services.

The contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract. Contractor shall deliver a comprehensive written Quality Control Plan (QCP) within 30 days after the contract award. [Deliverable A0001] Contractor shall submit two (2) copies of the QCP to the Contracting Officer (KO) and Contracting Officer Representative (COR) within 5 working days when changes made thereafter. After acceptance of the quality control plan Contractor shall receive the contracting officer’s acceptance in writing of any proposed change to his QC system.

1.6.1.1. Contractor shall ensure that all personnel maintain the requisite clearance to work in the designated Government facilities and they maintain technical proficiency in their areas of responsibility. Personnel on this contract are designated Information Assurance Support Personnel IAW AR 25-2 and must be trained and Information Assurance (IA) certified to the labor category as identified in AR 25-2, DoDD 8540.01, and DoD 8570.01m. In addition, personnel shall be certified based on industry standards on the Operating Systems (OS) and Information Systems (IS) they are managing.

1.6.2. Quality Assurance: The government shall evaluate the contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). The plan focuses on performance standards the government will use to ensure that Contractor has performed in accordance with this PWS. It defines how the performance standards are applied, the frequency of surveillance, and the minimum acceptable defect rate(s). Please refer to the Performance Requirements Summary Table for further detail regarding Quality Assurance Surveillance.

1.6.3. Recognized Holidays: Contractor shall not be required to perform work on Federal Holidays except for exercises, contingencies or for extraordinary circumstances, such as incidents and emergency troubleshooting.

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day

1.6.4. Hours of Operation: Contractor is responsible for conducting business, between the core hours of 0800 and 1600 Monday thru Friday except Federal holidays. For other than firm fixed price contracts, Contractor will not be reimbursed when the government facility is closed for the above reasons. Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.4.1. Announced Government Closures. CCSA provides C2 MAC 1 services, which require operations and services to be available 24/7/365 regardless of government operational status. Contractor shall provide Tier III support services regardless of government closures, weather conditions, or events where the primary work location is inaccessible for all non-essential personnel [Deliverable A0002]. It is the responsibility of Contractor to notify the government of staff status during these closures.

1.6.5. Place of Performance: The work to be performed under this contract will be performed at government facilities, such as the Pentagon or other support offices in the National Capital Region (NCR), and remote sites serviced by CCSA at the discretion of the COR. Security engineering personnel are required to be ready to deploy to an alternate location to provide CSSP support services during exercise and emergency situations.

1.6.5.1. Requirements for this contract include work in government facilities and alternate locations. As described above and elsewhere within this PWS the ALTERNATE location is within 150 miles of the primary work location.

1.6.5.2. When hiring personnel, Contractor shall keep in mind the stability and continuity of the workforce are essential. Contractor must be able to provide a sufficient number of qualified employees on a 24/7/365 basis for system failures or in the event of crisis operations. Contractor must provide the Government with designated points of contact, who must be reachable in the event of system failures. Under crisis conditions, work hours and location are subject to change without notice.

1.6.5.3. Contractor shall appoint a group of staff members to an ERG [Deliverable A0003].

Contractor staff identified as ERG members shall relocate to alternate sites, located within 150 miles of the primary work location in response to exercises, crisis events or unplanned operations. As members of the ERG they shall be required to work 12 hours or more shifts and shall be required to board, at the government's expense, within the alternate sites.

1.6.6. Reserved

1.6.7. Security Requirements: Contractor personnel performing work under this contract will be required to have the appropriate security clearance required for their position as identified in Section 1.6.11 at time of the proposal submission, and must maintain the level of security required for the life of the contract. The security requirements are in accordance with the attached DD254.

1.6.7.1. Physical Security: Contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

[Deliverable A0004]

1.6.7.2. Key Control: Contractor shall establish and implement methods of making sure all keys/key cards issued to Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to Contractor by the Government shall be duplicated.

Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer. [Deliverable A0005]

1.6.7.2.1. In the event keys, other than master keys, are lost or duplicated, Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks;

however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the

Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.6.7.2.2. Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

1.6.7.3. Lock Combinations: Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s Quality Control Plan.

1.6.8. Special Qualifications: Contractor personnel performing work under this contract must have the appropriate professional certifications required for their position as identified in Section

1.6.11 at time of the proposal submission, and must maintain the level of certification required for the life of the contract. The Contractor shall have, at a minimum; a current CMMI Maturity Level 3 for Development or CMMI Level 2 for Cybersecurity released in the Carnegie Mellon Software Engineering Institute’s PARS at time of the proposal submission; and a current ISO 9001 Quality Management Systems (QMC) with a focus on the software engineering.

1.6.9. Post Award Conference/Periodic Progress Meetings: Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, COR, and other Government personnel, as appropriate, may meet periodically with Contractor to review the contractor's performance. At these meetings the contracting officer will apprise Contractor of how the government views the contractor's performance and Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.10. Contracting Officer’s Representative (COR): The COR will be identified by separate letter.

The COR monitors all technical aspects of the contract and assists in contract administration.

The COR is authorized to perform the following functions: assure that Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance; maintain written and oral communications with Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.11. Key Personnel: Contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for Contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for Contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 0800 and 1600, Monday thru Friday except Federal holidays. [Deliverable A0006] All personnel identified as KEY are MISSION ESSENTIAL. All KEY billets must be filled within thirty (7) calendar days of vacancy. [Deliverable A0007] The absence of any KEY personnel for any period of time greater than thirty (7) calendar days will have a detrimental impact on the AOC global C2 mission. Listed below are personnel requirements and their required qualifications considered key personnel by the government:

1.6.11.1. Cybersecurity Operations Lead: Shall have an in-depth knowledge of project management and resource allocation. Shall have an in-depth knowledge of systems security engineering, systems security operations, incident response methodologies, general user behavior analytics and general personnel management.

1.6.11.1.1. Security Clearance: Top Secret / Sensitive Compartmented Information

1.6.11.1.2. Position Requirements: Bachelor of Science in Computer Science or Information Technology field or four year equivalent information technology security training and at least 8 years of experience in the field of cybersecurity; or 10-15 years of experience in cybersecurity. Required to be certified IAT Level III, IAW DoDD 8140.01 and DoD 8570.01M at time of contract initiation / on-boarding. These requirements may (but are not required to) be waived in writing by the COR upon receipt and review of the candidate’s individual resume. If waived, the individual will be required to operate at a level commensurate with the requirement above.

1.6.11.1.3. Key duties: Responsible for managing the operations of contractor cybersecurity personnel, applications, and appliances employed to defend the CCSA cyber terrain, to include: Firewall Management; Host Intrusion Detection/Prevention Systems Management; Security Information and Event Management (SIEM), e.g., audit log review and analysis; Vulnerability Scanning; Incident Response; technical analysis & troubleshooting assistance; support the Agency with project tracking with the Integrated Master Schedule (IMS); project presentations to the Agency change boards.

1.6.11.2. Senior Cybersecurity Engineer: Shall have an in-depth knowledge of systems security engineering, systems security operations, incident response methodologies, general user behavior analytics, and general personnel management.

1.6.11.2.1. Security Clearance: Top Secret / Sensitive Compartmented Information

1.6.11.2.2. Position Requirements: Bachelor of Science in Computer Science or Information Technology field or four year equivalent training in information technology security and at least 6 years of experience in the field of cybersecurity; or 8-10 years of experience in cybersecurity. Required to be certified IAT Level III, IAW DoDD 8140.01 and DoD 8570.01M at time of contract initiation / on-boarding. These requirements may (but are not required to) be waived in writing by the COR upon receipt and review of the candidate’s individual resume. If waived, the individual will be required to operate at a level commensurate with the requirement above.

1.6.11.2.3. Responsible for supporting the operations of cybersecurity personnel, applications, and appliances employed to defend the CCSA cyber terrain, to include: Firewall Management; Host Intrusion Detection/Prevention Systems Management; SIEM, e.g.

audit log review and analysis; Vulnerability Scanning; Incident Response; technical analysis & troubleshooting assistance; support the Agency with project tracking with the IMS; project presentations to the Agency change boards.

1.6.11.3. Cybersecurity Engineer: Shall have an in-depth knowledge of systems security engineering, systems security operations, incident response methodologies and general user behavior analytics.

1.6.11.3.1. Security Clearance: Top Secret / Sensitive Compartmented Information

1.6.11.3.2. Position Requirements: Bachelor of Science in Computer Science or Information Technology or four year equivalent training in information technology security and at least 3 years of experience in the field of cybersecurity; or 5-8 years of experience in cybersecurity. Required to be certified IAT Level III, IAW DoDD 8140.01 and DoD

8570.01M at time of contract initiation / on-boarding. These requirements may (but are not required to) be waived in writing by the COR upon receipt and review of the candidate’s individual resume. If waived, the individual will be required to operate at a level commensurate with the requirement above.

1.6.11.3.3. Key duties: Responsible for supporting the operations of cybersecurity applications, and appliances employed to defend the CCSA cyber terrain, to include but not limited to: Firewall Management; Host Intrusion Detection/Prevention Systems Management;

SIEM, e.g. audit log review and analysis; Vulnerability Scanning; Incident Response;

technical analysis & troubleshooting assistance.

1.6.11.4. Senior Cybersecurity Watch Analyst: Shall have an in-depth knowledge of systems security engineering, systems security operations, incident response methodologies, general user behavior analytics and general personnel management.

1.6.11.4.1. Security Clearance: Top Secret / Sensitive Compartmented Information

1.6.11.4.2. Position Requirements: Bachelor of Science in Computer Science or related field or four year equivalent training and at least 3 years of experience in the field of cybersecurity; or 5-8 years of experience in the field. Required to be certified IAT Level III or CSSP Analyst, IAW DoDD 8140.01 and DoD 8570.01M at time of contract initiation / on-boarding. These requirements may (but are not required to) be waived in writing by the COR upon receipt and review of the candidate’s individual resume. If waived, the individual will be required to operate at a level commensurate with the requirement above.

1.6.11.4.3. Key duties: Responsible for monitoring the operations of contractor personnel, cybersecurity applications, and appliances employed to defend the CCSA cyber terrain, to include but not limited to: SIEM, e.g. audit log review and analysis; Vulnerability Auditing and Analysis; Incident Response.

1.6.11.5. Cybersecurity Watch Analyst: Shall have an in-depth knowledge of systems security engineering, systems security operations, incident response methodologies and general user behavior analytics.

1.6.11.5.1. Security Clearance: Top Secret / Sensitive Compartmented Information

1.6.11.5.2. Position Requirements: Bachelor of Science in Computer Science or Information Technology field or four year equivalent training in information technology security and at least 2 years of experience in the field of cybersecurity; or 3-5 years of experience in cybersecurity Required to be certified IAT Level III or CSSP Analyst, IAW DoDD

8140.01 and DoD 8570.01M at time of contract initiation / on-boarding. These requirements may (but are not required to) be waived in writing by the COR upon receipt and review of the candidate’s individual resume. If waived, the individual will be required to operate at a level commensurate with the requirement above.

1.6.11.5.3. Key duties: Responsible for monitoring the operations of personnel, cybersecurity applications, and appliances employed to defend the CCSA cyber terrain, to include but not limited to: SIEM, e.g. audit log review and analysis; Vulnerability Auditing and Analysis; Incident Response.

1.6.11.6. Incident Response Handler: Shall have an in-depth knowledge of systems security engineering, systems security operations, incident response methodologies and general user behavior analytics.

1.6.11.6.1. Security Clearance: Top Secret / Sensitive Compartmented Information

1.6.11.6.2. Position Requirements: Bachelor of Science in Computer Science or Information Technology or four year equivalent training in information technology security and at least 6 years of experience in the field of cybersecurity; or 10-15 years of experience in cybersecurity. Required to be certified IAT Level III or CSSP Incident Responder, IAW

DoDD 8140.01 and DoD 8570.01M at time of contract initiation / on-boarding. These requirements may (but are not required to) be waived in writing by the COR upon receipt and review of the candidate’s individual resume. If waived, the individual will be required to operate at a level commensurate with the requirement above.

1.6.11.6.3. Key duties: Responsible for incident response handling for the network and the focal point for defending the CCSA cyber terrain, to include but not limited to: Incident Response; Coordinating CCIR actions; Coordinating with Federal / DoD CIRT’s;

Firewall Management; Host Intrusion Detection/Prevention Systems Management;

SIEM, e.g. audit log review and analysis; Vulnerability Auditing and Analysis.

1.6.11.7. Cybersecurity Compliance Lead: Shall have an in-depth knowledge of DoD’s Risk Management Framework. Shall develop technical documentation and presentations that are Cybersecurity related, and provide incident response support to include intrusion detection and classified spills, and conduct IA awareness training for customers. Shall have expert knowledge of NIST, DoD and Army applicable Security Regulations. Shall ensure the continuous auditing of Enterprise Mission Assurance Support System (eMASS) and manages the distribution of tasks for this function with the respective stakeholders to maintain the Authority to Operate (ATO) for system’s owned by the Agency.

1.6.11.7.1. Security Clearance: Top Secret

1.6.11.7.2. Position Requirements: Bachelor of Science in Computer Science or Information Technology or four year equivalent training in information technology security and at least 6 years of experience in the field of cybersecurity; or 10-15 years of experience in cybersecurity. Required to be certified IAM Level III, IAW DoDD 8140.01 and DoD 8570.01M at time of contract initiation / on-boarding. These requirements may (but are not required to) be waived in writing by the COR upon receipt and review of the candidate’s individual resume. If waived, the individual will be required to operate at a level commensurate with the requirement above.

1.6.11.7.3. Key duties: Responsible for managing and supervising contractor cybersecurity personnel, applications, and appliances employed to maintain compliance with all regulatory requirements, to include but not limited to: Federal Information Security Management Act (FISMA) Compliance; DoDI 8510.01 Risk Management Framework (RMF) Compliance; DoDI 8551.01 Ports, Protocols, Services Management (PPSM) Compliance; DoD Cyber Scorecard Compliance; Vulnerability Scanning and Analysis;

IT Personnel Security Auditing; Support the Configuration Management (CM) with project tracking with the IMS; Project presentations to the Agency change boards.

1.6.11.8. Senior Cybersecurity Compliance Specialist: Shall have an in-depth knowledge of DoD’s Risk Management Framework. Shall develop technical documentation and presentations that are cybersecurity related, and provide incident response support to include intrusion detection and classified spills, and conduct cybersecurity awareness training for customers. Shall have expert knowledge of NIST, DoD and Army applicable Security Regulations. Shall ensure the continuous auditing of eMASS and manages the distribution of tasks for this function with the respective stakeholders to maintain the ATO for system’s owned by the Agency.

1.6.11.8.1. Security Clearance: Top Secret

1.6.11.8.2. Position Requirements: Bachelor of Science in Computer Science or Information Technology field or four year equivalent training in information technology security and at least 6 years of experience in the field of cybersecurity; or 10-15 years of experience cybersecurity. Required to be certified IAM Level III, IAW DoDD 8140.01 and DoD 8570.01M at time of contract initiation / on-boarding. These requirements may (but are not required to) be waived in writing by the COR upon receipt and review of the candidate’s individual resume. If waived, the individual will be required to operate at a level commensurate with the requirement above.

1.6.11.8.3. Key duties: Responsible for supporting the cybersecurity personnel, applications, and appliances employed to maintain compliance with all regulatory requirements, to include but not limited to: FISMA Compliance; DoDI 8510.01 RMF Compliance; DoDI 8551.01 PPSM Compliance; DoD Cyber Scorecard Compliance; Vulnerability Scanning and Analysis; IT Personnel Security Auditing.

1.6.11.9. Cybersecurity Compliance Specialist: Shall have an in-depth knowledge of DoD’s Risk Management Framework. Shall develop technical documentation and presentations that are cybersecurity related, and provide incident response support to include intrusion detection and classified spills, and conduct cybersecurity awareness training for customers. Shall have expert knowledge of NIST, DoD and Army applicable Security Regulations. Shall ensure the continuous auditing of eMASS and manages the distribution of tasks for this function with the respective stakeholders to maintain the ATO for system’s owned by the Agency.

1.6.11.9.1. Security Clearance: Top Secret

1.6.11.9.2. Position Requirements: Bachelor of Science in Computer Science or Information Technology field or four year equivalent training and at least 4 years of experience in the field of cybersecurity; or 8-10 years of experience in cybersecurity. Required to be certified IAM Level II, IAW DoDD 8140.01 and DoD 8570.01M at time of contract initiation / on-boarding. These requirements may (but are not required to) be waived in writing by the COR upon receipt and review of the candidate’s individual resume. If waived, the individual will be required to operate at a level commensurate with the requirement above.

1.6.11.9.3. Key duties: Responsible for supporting the cybersecurity personnel, applications, and appliances employed to maintain compliance with all regulatory requirements, to include: FISMA Compliance; DoDI 8510.01 RMF Compliance; DoDI 8550.01 PPSM Compliance; DoD Cyber Scorecard Compliance; Vulnerability Scanning and Analysis;

IT Personnel Security Auditing.

1.6.11.10. Software Compliance Analyst: Shall work hands-on with development teams to develop, roll-out, and provide oversight for a comprehensive Secure Software Development Life Cycle (SSDLC) program, including secure coding guidelines and static code analysis. Contributes to raise the application security posture across the organization, by developing an application security framework, including SSDLC development standards and guidelines for application developers; assisting the development teams identify application security vulnerabilities through a combination of security assessment techniques.

1.6.11.10.1. Security Clearance: Top Secret / Sensitive Compartmented Information

1.6.11.10.2. Position Requirements: Bachelor of Science in Computer Science or Information Technology field or four year equivalent information technology security training and at least 6 years of experience in the field of software development and security code review; or 10-15 years of experience in secure code development. Required to be certified IASAE Level II, IAW DoDD 8140.01 and DoD 8570.01M at time of contract initiation / on-boarding. These requirements may (but are not required to) be waived in writing by the COR upon receipt and review of the candidate’s individual resume. If waived, the individual will be required to operate at a level commensurate with the requirement above.

1.6.11.10.3. Key duties: Manages and maintains the Secure Software Development Life Cycle (SSDLC) performing static and dynamic code analysis across multiple coding languages; Vulnerability Scanning.

1.6.11.11. Senior Configuration Management Engineer: Shall ensure delivery of reliable products to customers by maintaining consistent processes governing the coordination, tracking, planning, scheduling, and building of all software components.

1.6.11.11.1. Security Clearance: Top Secret

1.6.11.11.2. Position Requirements: Bachelor of Science with a concentration in computer related technology (and/or business administration) or related field…