PWS MS Sentinel Implementation_ Rev. 2.docx

PERFORMANCE WORK STATEMENT (PWS)

Microsoft Sentinel Implementation for the Army University

PART 1

GENERAL INFORMATION

1. General: This is a non-personal service(s) contract under which the personnel rendering the service(s) are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

1.1 Description of Services/Introduction: This is a non-personal service(s) contract to design, implement, and operationalize Microsoft Sentinel as the centralized Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platform for Army University (AU). This initiative will strengthen the AU’s defense posture by providing real-time monitoring, advanced threat detection, and automated incident response capabilities across approximately 350 Intune-managed endpoints. Furthermore, this deployment will support compliance alignment with NIST SP 800-53 security control frameworks and deliver a scalable foundation to accommodate future integration needs.

1.2 Background: AU’s current SIEM does not provide seamless integration with MS365 services, particularly exchange devaluing the SIEMs ability to alert technicians of incidents and issues. To optimize the security architecture and reduce operational friction, the Government is pivoting toward utilizing native Microsoft 365 (M365) tools, specifically Microsoft Sentinel. Transitioning to a native M365 solution establishes a more comprehensive and cohesive ecosystem, mitigating the risk of API integration failures frequently associated with maintaining connections between M365 and third-party platforms. Furthermore, this deployment aligns with the Government's long-term strategic objective to consolidate all M365-related services under a single contract vehicle, thereby streamlining and simplifying future procurement processes.

Customer has MS 365 A5 which includes all advanced licensing feature for Defender, Entra, and Intune. No additional licensing from the contractor is expected. If additional licensing is required to execute elements of the PWS, contractor will notify the government who will procure licensing through their current MS support partner.

1.3 Scope: The Contractor shall provide non-personal service(s). The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items necessary to perform services as described in the PWS and associated contract documents, except for those items specified in Part 3 Government Property and Services. The Contractor shall perform to the standards and acceptable quality levels identified in this PWS and associated contract documents.

1.4 Objectives: The objective of this contract is to provide the professional services necessary to establish a fully operational Microsoft Sentinel Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platform. This will equip AU with a modern, centralized capability for advanced threat detection, automated incident response, and continuous security monitoring. A key outcome of this effort is to ensure Government personnel receive the necessary training and knowledge transfer to achieve long-term administrative self-sufficiency in operating the platform.

1.5 General Information:

1.5.1 Quality Control Plan (QCP): This acquisition is for commercial services and will be performed using FAR Part 12 procedures. The contractor’s existing quality assurance system shall be utilized In Accordance With (IAW) FAR 12.208.

1.5.2 Quality Assurance: The Government will evaluate the Contractor’s performance under this contract IAW the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed IAW the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the acceptable quality levels (performance thresholds).

1.5.3 Recognized Holidays: The following provides information on recognized holidays for the purpose of the PWS. If submittal of any tasks or documentation (e.g., deliverables, submittals, etc.) deadlines fall on a holiday, the closest workday prior to the holiday will apply as the deadline for submittal.

1.5.3.1 U.S. Holidays: Work shall not be performed on U.S. federally recognized holidays occurring during the normal workweek unless otherwise directed by the Contracting Officer. When a U.S. holiday occurs on a Saturday or a Sunday, the holiday is observed on the preceding Friday or following Monday, respectively.

Independence Day

1.5.4 Operating Hours: The Government facility office hours, facility operating hours, and the Contractor support hour requirements often coincide, however, they may differ. Please refer to the following.

1.5.4 Government Facility Office Hours: The Government facility office hours are 0800 to 1700, Monday through Friday except U.S. Holidays identified in paragraph 1.5.3.1 above or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

1.5.5 Place of Performance: The work to be performed under this contract will be performed from a location from which the Contractor can perform all aspects of this Contract. No performance is required to be on-site at a Government facility.

1.5.5.1 Telework Capabilities: All work under this contract shall be performed via telework from the Contractor's own facilities or other appropriate remote location.

1.6 Clearance Requirements: RESERVED

1.6.1 Facility Clearance Program: RESERVED

1.6.2 Personnel Security Clearance Requirements: RESERVED

1.6.3 Controlled Unclassified Information (CUI): RESERVED

1.7 Installation Access: Access to U.S. installations, buildings and controlled areas is limited to personnel who meet security criteria and are authorized. Failure to submit required information/data and obtain required documentation or clearances will be grounds for denying access to U.S. installations, buildings, and controlled areas. The Contractor shall ensure that any subcontractors used in performance of this contract complies with these requirements and that all employees, of both the Contractor and any subcontractor utilized by the Contractor, are made aware of and comply with these requirements.

The Contractor shall be aware of and comply with the requirements associated with Installation Access Control. The Government is not liable for any costs associated with performance delays due solely to a firm’s failure to comply with Installation Access Control System (IACS) processing requirements.

The Contractor shall return installation passes and/or issued identification to the issuing IACS office when the contract is completed or when a Contractor employee no longer requires access. This includes when an individual is terminated or at the expiration of their employment or when the contract ends (whether due to expiration, termination, or cancellation).

1.7.1 Background Checks: RESERVED

1.7.2 RESERVED

1.7.2.1 RESERVED

1.7.2.1.1 RESERVED

1.7.2.2 RESERVED

1.8 Physical Security: The Contractor shall safeguard all Government equipment, information, and property provided for Contractor use.

1.8.1 Operations Security (OPSEC) Requirements: Contractor personnel shall adhere to facility security policies and restrictions. The Contractor shall immediately report suspicious activities to security personnel. Government-issued access badges shall not be worn outside designated facilities where visible to the general public.

1.8.2 RESERVED

1.9 Post Award Conference/Periodic Progress Meetings: The Contractor shall attend any post award conference convened by the contracting activity or contract administration office IAW FAR Subpart 42.5. The Contracting Officer, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance and the Contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.9.1 The Contractor shall attend, participate in, and furnish input to scheduled and unscheduled meetings, conferences, and briefings that relate to the functions and services herein as required by the Government to provide effective communication and impart necessary information. The Contract Manager or designated representative shall attend meetings as requested by the Government. Meeting attendees shall at times include Contractor managerial, supervisory, and other personnel knowledgeable of the subject matter. Meetings may start or end outside of regular duty hours.

1.10 Contracting Officer’s Representative (COR): Refer to Part 2 of this PWS for the definition of a COR. As determined by the Contracting Officer, a COR will be appointed and identified by letter of designation, a copy of which will be provided to the Contractor by the Contracting Officer. The designation letter states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is not authorized to obligate the Government. If the work is not written in the contract, the COR is not authorized to request new work. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract, perform inspections necessary in connection with contract performance, maintain written and oral communications with the Contractor concerning technical aspects of the contract, issue written interpretations of technical requirements, including Government drawings, designs, specifications, monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies, coordinate availability of Government property, and coordinate site entry of Contractor personnel.

1.11 Key Personnel: The following personnel are considered key personnel by the Government: Contract Manager, Alternate Contract Manager, and Lead Sentinel Architect. The Contractor shall provide a Contract Manager who shall be responsible for the performance of the work. The name of this person and an Alternate Contract Manager, who shall act for the Contractor when the Contract Manager is absent, along with the name of the Lead Sentinel Architect, shall be provided in writing to the Contracting Officer Representative no later than five (5) days after contract award (Deliverable #A.001). The Contract Manager and Alternate Contract Manager shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The Contract Manager, Alternate Contract Manager, and Lead Sentinel Architect shall be available during the operating hours listed in PWS 1.5.4. Required qualifications are listed in (Attachment 1).

1.11.1 Key Personnel Qualifications: Required qualifications are listed in (Attachment 1)

1.11.2 Additional Key Personnel Requirements: Certain experienced professional and/or technical personnel are essential for successful accomplishment of the work to be performed under this contract. These Key Personnel must be identified by name within the contractor’s offer for their resumes (and any additional documents) to be evaluated during the source selection process.

1.11.2.1 The contractor agrees that such personnel shall not be removed or replaced within the performance of this contract unless the following measures are taken:

(a) If one or more of the key personnel, for any reason, becomes or is expected to become unavailable for work under this contract for a continuous period exceeding 30 work days, or is expected to devote substantially less effort to the work than indicated in the proposal or initially anticipated, the contractor shall, subject to the concurrence of the KO or COR, promptly replace personnel with personnel who possess equal or better qualifications as the original employee.

(b) All requests for approval of substitutions hereunder must be in writing and provide a detailed explanation of the circumstances necessitating the proposed substitutions. The request must contain a resume for the proposed substitute, and any other information requested by the KO or COR. The KO or COR must concur in writing with the change.

1.11.2.2. If the KO or COR determines that suitable and timely replacement of Key Personnel who have been reassigned, terminated, or have otherwise become unavailable for the contract work is not reasonably forthcoming or that the resultant reduction of productive effort would be so substantial as to impair successful completion of the contract, the KO may terminate the contract for default or for the convenience of the Government, as appropriate, or make an equitable adjustment to the contract to compensate the Government for any resultant delay, loss or damage.

1.12 Identification of Contractor Employees: All Contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties must identify themselves, to include proper marking of signature blocks in correspondence, to avoid creating an impression in the minds of members of the public that they are Government officials. The Contractor shall ensure that all documents or reports, produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed.

1.12.1 Contractor Identification Badges: RESERVED

1.13 Contractor Travel: RESERVED

1.14 Other Direct Costs (ODCs): RESERVED

1.15 Data Rights: The Government has unlimited rights to all documents and materials produced under this contract. All documents and materials, to include the source codes of software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership and copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.16 Non-Disclosure Requirements: Performance under this contract may require the Contractor to access data and information proprietary to a Government agency, another Government Contractor, or of such nature that its dissemination or use other than as specified in this work statement would be averse to the interests of the Government or others. The Contractor and Contractor personnel shall not divulge, or release data or information developed, or obtained under performance of this PWS, except to authorized Government personnel or upon written approval of the Contracting Officer. The Contractor shall not use, disclose, or reproduce proprietary data, which bears a restrictive legend, other than as specified in this PWS. All documentation showing individual names or other personal information shall be controlled and protected under the provisions of the Privacy Act of 1974, Public Law 93-579, 5 United States Code (U.S.C.) Section 552a.

1.17 Protection of Government and Contract Information: Per Public Use Notice of Limitations stated by Defense Media Activity and contained at www.dma.mil/Services/Visual-Information/References/Limitations/, the Contractor shall not cite any information (e.g., contract information, pictures, locations, etc.) obtained from the Government through this contract on any hard copy or digital marketing tools to include its company website. Information shall not be used in a manner that could imply endorsement of an individual, for-profit business, non-profit organization, or any other non-Federal entity (including DoD contractors), product, or service. This applies to both domestic and international users. Endorsement of a non-Federal entity, event, product, service, or enterprise may be neither stated nor implied.

1.18 Non-Disclosure Statements: The Contractor shall provide signed non-disclosure agreements to the Government no later than ten (10) calendar days (Deliverable #A.002) prior to commencement of work under the contract. Disclosure of information by Contractor personnel may result in removal of Contractor personnel from performance under this contract.

1.19 Organizational Conflict of Interest (OCI): Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent OCI as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI (Deliverable #A.002). The Contractor’s OCI Mitigation Plan will be determined to be acceptable solely at the discretion of the Contracting Officer. In the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.20 Phase In /Phase Out Period: Not Applicable. Operational transition and knowledge transfer requirements are natively integrated into the specific tasks of this PWS (Task 4 – Knowledge Transfer and Administrator Training) to ensure a seamless hand-off of the fully operational platform to Government personnel.

1.21 Safety: All work is performed remotely from the Contractor's facilities. The Contractor is solely responsible for the safety and health of its employees and for complying with applicable safety regulations within its own work environment.

1.22 Environmental Compliance: The services required under this PWS are technical in nature and have no direct impact on environmental compliance at any Government facility.

1.22.1 Environmental Compliance Plan and Program: RESERVED

1.23 Required Training: The following provides information on training requirements.

1.23.1 Anti-Terrorism (AT) “Level I” Training: RESERVED

1.23.2 iWATCH Training: RESERVED

1.23.3 OPSEC Training: All Contractor employees, including subcontractors, shall complete OPSEC “Level I” training within 30 days of employment under this contract. Verification of the training shall be provided to the COR within five (5) days after completion of the training (Deliverable #A.003). “OPSEC Awareness for Military Members, DOD Employees and Contractors GS130.16” training is available at http://www.cdse.edu/catalog/elearning/GS130.html. Contractor personnel must complete refresher training every 12 months. Verification of the training shall be provided to the COR within five (5) days after completion of the training.

1.23.4 Information Assurance (IA) Training

1.23.4.1 RESERVED

1.23.4.2 All contractor employees and associated subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01‐M and AR 25‐2 within six months of appointment to IA/IT functions. Training can be found at https://www.cyber.mil/cyber-awareness-challenge. Verification of the training shall be provided to the COR within five (5) days after completion of the training (Deliverable # A.003). Contractor personnel must complete refresher training every 12 months.

1.23.4.3 Per DoD 8570.01‐M, DFARS 252.239.7001 and AR 25‐2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01‐M must be in place upon contract award and maintained throughout the period of performance. The applicable baseline certification(s) for Key Personnel are identified in ATTACHMENT 1 (Key Personnel Qualifications); a current CISSP or SC-200 satisfies the DoD 8570.01-M baseline for the information assurance functions performed under this contract. (Deliverable # A.003).

1.23.5 Personnel Security Clearance Training: RESERVED

1.23.6 Personally Identifiable Information (PII): All Contractor personnel shall complete the mandatory training on the protection of Personally Identifiable Information (PII). This training requirement is satisfied by completing the annual DoD IA awareness training (DoD Cyber Awareness Challenge) as stipulated in PWS Section 1.23.4.2. Certificates of completion submitted for IA awareness training shall also serve as verification for this requirement.

1.23.7 OPSEC TRAINING. RESERVED

1.23.8 Additional Training Requirements: Contractor shall accomplish any additional training that the Department of Defense, Department of the Army, local commanders may determine necessary for personnel working on military installations or working with military personnel (not to exceed 10 hours of instruction per contract).

1.24 Government Property and Services: RESERVED

PART 2

DEFINITIONS & ACRONYMS

2. Definitions and Acronyms

2.1 Definitions: Although not inclusive of every term used within this PWS, the following provides a list of definitions used throughout this PWS and commonly used in the acquisition field.

Contracting Officer – means a person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

Contracting Officer's Representative (COR) – As defined in DFARS 202.101, means an individual designated and authorized in writing by the Contracting Officer to perform specific technical or administrative functions. DoD Instruction (DoDI) 5000.72, Part II Definitions states the following when defining a COR: “Defined in subpart 202.101 of Reference (f). Any individual delegated responsibilities pursuant to subpart 1.602-2 of Reference (e), regardless of local terminology, must be certified IAW this instruction. For example, local terminology can be COR, Contracting Officer’s technical representative, technical point of contact, technical representative, alternate COR, administrative COR, assistant COR, line-item manager, task order manager, quality assurance personnel, quality assurance evaluator, or COR management.” In addition, Army Regulation 70-13, Chapter 2, paragraph 2-2g, states, in part, the following when providing other surveillance support personnel to assist the COR when needed, “…These other surveillance support personnel may serve as on-site representatives of the COR in performance of actual contract surveillance if they meet all COR requirements and have been appointed by the Contracting Officer as alternate CORs.”

Contractor – means a supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contractor-acquired Property - means property acquired, fabricated, or otherwise provided by the Contractor for performing a contract and to which the Government has title.

Day – means, unless otherwise specified, a calendar day.

Defective Service – means a service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable – means anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Government-furnished Property – As reflected in FAR 52.245-1, Government-furnished Property “means property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

Government Property - means all property owned or leased by the Government. Government property includes both Government-furnished and Contractor-acquired property. Government property includes material, equipment, special tooling, special test equipment, and real property. Government property does not include intellectual property and software.

Property Administrator - means an authorized representative of the Contracting Officer appointed IAW agency procedures, responsible for administering the contract requirements and obligations relating to Government property in the possession of a Contractor.

Physical Security – means that part of security concerned with physical measures designed to safeguard personnel; to prevent unauthorized access to equipment, installations, material, and documents; and to safeguard against espionage, sabotage, damage, and theft.

Quality Assurance – (or Government contract quality assurance) means the various functions, including, inspection, performed by the Government to determine whether a Contractor has fulfilled the contract obligations pertaining to quality and quantity.

Quality Assurance Surveillance Plan (QASP) – means the key Government-developed surveillance process document and is applied to Performance-Based Service Contracting (PBSC). The QASP is used for managing Contractor performance assessment by ensuring that systematic quality assurance methods validate that Contractor quality control efforts are timely, effective, and are delivering the results specified in the contract or task order. The QASP directly corresponds to the performance objectives and standards (i.e., quality, quantity, timeliness) specified in the Performance Work Statement (PWS). It provides specific details on how the Government will survey, observe, test, sample, evaluate, and document Contractor performance results to determine if the Contractor has met the required standards for each objective in the PWS. The QASP, with very few if any exceptions, is an internal to Government document.

Quality Control – means all necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

Statement – means the specific results-based activities required to satisfy objectives. A statement contains a result, the context of the statement, and the required action(s). Statements focus on “what” is to be accomplished; however, they are not prescriptive in describing “how” the outcome is to be achieved. Each objective may have several statements to flesh out the areas necessary to meet the objective. Statements are similar to Level 3 in a Work Breakdown Structure.

Subcontractor – means one that enters into a contract with a prime Contractor. The Government does not have privity of contract with the subcontractor.

Workday - The number of hours per day the Contractor provides services IAW the contract.

Work Week - Monday through Friday, unless otherwise specified.

2.2 Acronyms: Although not inclusive of every term used within this PWS, or that may be included in an acquisition, the following provides a list of acronyms commonly used in the acquisition field.

PART 3

GOVERNMENT PROPERTY (GP) AND SERVICES

3. Government Property and Services

3.1 Services: RESERVED

3.2 Facilities: RESERVED

3.3 Utilities: RESERVED

3.4 Equipment: The Government will provide logical access to the cloud environment.

3.5 Materials: The Government will provide relevant documentation.

3.6 Common Access Cards (CAC): RESERVED

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. Contractor Furnished Property and Services

4.1 General: The Contractor shall furnish all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items necessary to perform services as described in the PWS and associated contract documents, except for those items specified in Part 3 Government Property and Services.

4.2 Secret Facility Clearance: RESERVED

4.3 Materials: The Contractor shall provide all materials and equipment required for performance, including, but not limited to, office supplies, and all necessary Automated Data Processing Equipment (ADPE) such as computers, printers, etc. for its employees. The Contractor is responsible for ensuring its equipment is configured and maintained in a manner that is secure and compliant with industry best practices for remotely accessing Government cloud environments.

PART 5

SPECIFIC TASKS

5. Specific Tasks

5.1 Basic Services: The Contractor shall provide the expert services necessary to execute a full lifecycle implementation of Microsoft Sentinel for Army University. These services shall include all tasks associated with the discovery and assessment of the current environment; the architecture and design of the solution; the deployment, configuration, and integration of the platform; and the formal knowledge transfer and training required to transition the completed system to Government personnel for long-term operation. All services shall be performed in accordance with the specific tasks detailed in Section 5.2 below and the standards identified in the Performance Requirements Summary.

5.1.1 General Objectives and Principles: In the execution of all tasks under this PWS, the Contractor shall adhere to the following core principles:

· Zero Trust & Compliance: The Contractor shall base all implementations on Zero Trust principles and design the system to strictly align with the target environment requirements and NIST SP 800-53 security controls.

· Scalability & Cost Optimization: The Contractor shall design a flexible platform infrastructure capable of seamlessly accommodating future integration of network devices. The Contractor shall maximize cost efficiency through strategic data ingestion scoping and tailored log retention planning.

· Automation & Enablement: The Contractor shall utilize Microsoft-native orchestration and automation toolsets to drive rapid response workflows. The Contractor shall ensure long-term Government administrative self-sufficiency by delivering comprehensive documentation, technical training, and hands-on knowledge transfer.

5.2 Tasks: The Contractor shall perform the following tasks:

5.2.1 Task 1 – Discovery and Environment Assessment

The Contractor shall conduct a comprehensive discovery and assessment phase... The outputs of this task shall be delivered as the Discovery and Assessment Report (Deliverable T.001), Data Source Inventory & Azure Readiness Assessment (Deliverable T.002), Security Monitoring & Compliance Requirements Matrix (Deliverable T.003), and the Sentinel Deployment Roadmap & Cost Estimate (Deliverable T.004).

This task shall include the following sub-tasks:

5.2.1.1 Current Environment Assessment: The Contractor shall conduct technical reviews to assess Army University’s current Microsoft 365 tenant configuration, Entra ID, Intune deployment, Microsoft Defender suite status, and any existing security monitoring or incident response processes.

5.2.1.2 Scope Validation: The Contractor shall validate the current endpoint inventory and confirm readiness for onboarding approximately 350 Intune-managed devices. The Contractor shall also document technical requirements for the future expansion of Sentinel to include other data sources (e.g., firewalls, routers, VPNs), establishing a baseline for subsequent onboarding efforts.

5.2.1.3 Data Source Assessment: The Contractor shall evaluate, verify, and document connectivity requirements for the initial phase of core data sources. These sources shall include, at a minimum: Entra ID, Microsoft Intune, Defender for Endpoint, Defender XDR, M365 Audit Logs, Defender for Identity, and Defender for Office 365.

5.2.1.4 Compliance and Azure Readiness Assessment: The Contractor shall conduct an assessment to map planned Sentinel capabilities to relevant NIST SP 800-53 security controls. As part of this assessment, the Contractor shall review the Government’s Azure subscription readiness, resource group strategies, Role-Based Access Control (RBAC) permissions, and preliminary Log Analytics Workspace requirements.

5.2.2 Task 2 – System Architecture and Design:

The Contractor shall transform the validated requirements from Task 1 into a detailed Microsoft Sentinel architecture and deployment blueprint. All design documentation shall be submitted as a single, comprehensive Solution Design Document (SDD) package for formal Government approval. This package shall include, at a minimum, the following deliverables:

Microsoft Sentinel Solution Design Document (Deliverable T.005)

System Architecture & Data Integration Diagrams (Deliverable T.006)

Analytics & Detection Use Case Matrix (Deliverable T.007)

Automation, IR, & Dashboard Specifications (Deliverable T.008)

Governance and Operational Model Documentation (Deliverable T.009)

Implementation Runbook and Deployment Plan (Deliverable T.010)

This task shall include the following sub-tasks:

5.2.2.1 Sentinel and Workspace Architecture Design: The Contractor shall develop and document a secure, scalable Sentinel deployment architecture. This design shall include a detailed Azure Log Analytics Workspace design, a mapping of all required data connectors, and a Role-Based Access Control (RBAC) model for managing user permissions.

5.2.2.2 Data Ingestion and Retention Strategy: The Contractor shall define and document a comprehensive data strategy. This shall include log collection methods, data normalization requirements, ingestion optimization techniques, and data retention policies that satisfy both cost management controls and Government compliance and investigative requirements. The log collection methodology shall align with OMB M-21-31 guidance, with the Sentinel configuration designed to meet Event Logging Tier 2 (EL2) standards for endpoint logs. Any proposed deviation from EL2 must be documented with a rationale, including cost considerations, and be formally approved by the Government.

5.2.2.3 Security Use Case and Analytics Design: The Contractor shall design and document security monitoring use cases aligned with the NIST SP 800-53 framework. These use cases shall address, at a minimum, identity compromise, privilege escalation, malware activity, lateral movement, authentication anomalies, and device compliance violations. The design shall define the configuration for all proposed analytics rules (both custom and out-of-the-box), alert thresholds, and alert suppression methodologies.

5.2.2.4 Automation and Reporting Design: The Contractor shall design and document automated incident response workflows for triage, escalation, and containment actions using Azure Logic Apps. The design shall also include specifications for security operations dashboards, executive-level reports, and operational health monitoring views.

5.2.2.5 Design Presentation and Approval: The Contractor shall conduct a formal Design Presentation for Government stakeholders to review the complete Design Package. The Contractor shall obtain formal written approval from the Government on this design baseline prior to proceeding to implementation (Task 3).

5.2.3 Task 3 – Platform Implementation and Configuration:

Upon receiving Government approval of the System Architecture and Design (Task 2), the Contractor shall execute the deployment, integration, and operationalization of the Microsoft Sentinel platform.

This task shall include the following sub-tasks:

5.2.3.1 Platform Deployment: The Contractor shall deploy and configure Microsoft Sentinel and the associated Azure Log Analytics Workspace in accordance with the Government-approved design. This includes the implementation of the approved Role-Based Access Control (RBAC) model, governance policies, and data retention configurations.

5.2.3.2 Data Source Onboarding: The Contractor shall successfully onboard and validate the data ingestion pipelines for all approved Phase 1 data sources, including, at a minimum: Entra ID, Intune, Defender for Endpoint, Defender XDR, Defender for Identity, Defender for Office 365, and M365 Audit Logs. There is no requirement to transfer data from the current SIEM platform.

5.2.3.3 Analytics and Detection Rule Enablement: The Contractor shall enable and configure all approved analytics rule templates and custom rules. The Contractor shall establish and apply alert thresholds, suppression strategies, and cost thresholds. As part of this process, the Contractor shall perform iterative alert tuning and optimization to improve accuracy and minimize false positives.

5.2.3.4 Incident Response Implementation: The Contractor shall configure incident creation workflows and notification mechanisms. The Contractor shall deploy the approved automation playbooks for automated incident response actions.

5.2.3.5 Visualization and Reporting Implementation: The Contractor shall develop and deploy the security operations dashboards, compliance reporting views, incident metrics reports, and threat monitoring workbooks as defined in the approved design.

5.2.4 Task 4 – Knowledge Transfer and Administrator Training:

The Contractor shall ensure that Army University and US Army War College personnel have the knowledge and operational understanding required to effectively manage, monitor, and maintain the Microsoft Sentinel environment following project completion. The Contractor shall deliver the training necessary to support Government administrative self-sufficiency and reduce dependency on external resources.

This task shall include the following sub-tasks:

5.2.4.1 Curriculum Delivery: The Contractor shall provide comprehensive knowledge transfer sessions and associated training materials to designated Government personnel. The curriculum shall cover, at a minimum, the final solution architecture, data sources and ingestion pipelines, analytics rules and detection logic, incident management processes, use of dashboards and workbooks, automation capabilities, operational procedures, and day-to-day system administration activities.

5.2.4.2 Operational Enablement: The Contractor shall train designated Government administrators and security personnel to a level of proficiency sufficient to confidently operate the solution. This includes the ability to perform basic troubleshooting, manage incidents, triage and review alerts, and maintain system configurations.

5.2.4.3 System Documentation: The Contractor shall deliver a complete set of "as-built" system documentation. This documentation shall be sufficient to allow Government personnel to understand and manage the system architecture, configurations, and operational workflows independently. This includes, but is not limited to, the final Solution Design Document (SDD) and any associated diagrams or configuration guides. This final submission shall be tracked as the Final 'As-Built' System Documentation & Training Materials (Deliverable T.011).

5.3 RESERVED

PART 6

APPLICABLE PUBLICATIONS

6. Applicable Publications (Current Editions): The following publications, manuals, regulations, etc. are mentioned in this PWS and are listed below.

6.1 National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53: Security and Privacy Controls for Information Systems and Organizations

6.2 Office of Management and Budget (OMB) Memorandum M-21-31: Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents

6.3 DoD Manual (DoDM) 8570.01-M: Information Assurance Workforce Improvement Program

6.4 DoD Instruction (DoDI) 8500.01: Cybersecurity

6.5 DoD Instruction (DoDI) 8510.01: Risk Management Framework (RMF) for DoD Information Technology (IT)

6.6 Army Regulation (AR) 25-2: Army Cybersecurity

6.7 The Privacy Act of 1974 (5 U.S.C. § 552a)

PART 7

ATTACHMENT AND TECHNICAL EXHIBIT LISTING

7. Attachment and Technical Exhibit List

7.1 Technical Exhibit A – Performance Requirements Summary

7.2 Technical Exhibit B – Deliverables Schedule

7.5 Attachment 1 –Key Personnel Qualifications

TECHNICAL EXHIBIT A

PERFORMANCE REQUIREMENTS SUMMARY (PRS)

PRS#1 - (PWS 5.2.1) Task 1: Discovery & Assessment:

The Contractor shall complete a comprehensive discovery and assessment of the current environment and validate the project scope.

PRS#3 - (PWS 5.2.3) Task 3: Platform Implementation & Configuration:

The Contractor shall deploy and configure the Sentinel platform in accordance with the approved design.

PRS#4 - (PWS 1.11 & 1.18) Administrative Compliance:

The Contractor shall provide and maintain qualified Key Personnel and submit all required administrative documentation.

TECHNICAL EXHIBIT B

DELIVERABLES SCHEDULE

ATTACHMENT 1

KEY PERSONNEL QUALIFICATIONS

All personnel shall meet the required qualifications listed below. Documentation of evidence of meeting qualifications may be, but not necessarily limited to, Resume, Curriculum Vitae, proof of certification. Stating that an individual meets a requirement without supporting documentation is insufficient and may cause the offer to be rejected.

The Contractor shall propose a single individual to fill each Key Personnel role.

During execution of this contract, if the evaluated individual who is performing work needs to be excused from work, individuals must be presented to the COR and KO for evaluation IAW PWS 1.11.2

A. Contract Manager (and Alternate Contract Manager)

Experience:

Candidate must have a minimum of three (3) years of experience in a project or contract management role on information technology and/or cybersecurity projects of similar size and scope.

Responsibility:

Candidate's resume must demonstrate experience serving as the primary point of contact for a customer, managing project schedules, overseeing team performance, and ensuring the quality and timely submission of all deliverables.

Certification:

(Desired). A current Project Management Professional (PMP) certification is desired but not required. Absence of a PMP certification shall not render an offer technically unacceptable.

B. Lead Sentinel Architect

Education:

Candidate must possess a minimum of a bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field. An additional four (4) years of relevant, specialized, hands-on experience may be considered in lieu of a formal degree.

General Experience:

Candidate must have a minimum of five (5) years of hands-on experience designing, implementing, and managing enterprise-level Security Information and Event Management (SIEM) and/or Security Orchestration, Automation, and Response (SOAR) solutions.

Specific Experience:

Candidate must have a minimum of two (2) years of direct, hands-on experience with the…