Attachment_J.1_PWS.pdf

PERFORMANCE WORK STATEMENT FOR

INFORMATION TECHNOLOGY (IT) SUPPORT TO

United States Army Regional Cyber Center – Continental United States

TABLE OF CONTENTS

1.0 INTRODUCTION

2.0 BACKGROUND

2.1 Command Relationships

2.2 Major Services

3.0 SCOPE

4.0 GENERAL

4.1 Contractor Transition

4.2 Contractor Personnel

4.3 USARCC-C Work Hours

4.4 Security and Privacy

4.5 Safety

4.6 Access to Protected Information

4.7 Government-Furnished Resources

4.8 Contractor-Furnished Resources

4.9 Travel

5.0 TECHNICAL REQUIREMENTS

5.1 Network Services

5.2 Enterprise Services

5.3 Unified Capabilities

5.4 Computer Network Defense Services

5.5 Continental United States (CONUS) Department of Defense Information Network – Army (DoDIN-A)

Operations

5.6 Defensive Cyberspace Operations (DCO) Support Services

5.7 Mission Support Services

5.8 Information Technology Infrastructure Library

5.9 Administrative/Technical Tasks

6.0 DELIVERABLES

7.0 REVIEWS

7.1 In-Process Reviews (IPR)

7.2 Program Reviews

8.0 QUALITY CONTROL (QC) AND QUALITY ASSURANCE (QA)

8.1 Quality Control

8.2 Quality Assurance

9.0 REFERENCES

9.1 Publications and Forms

9.2 Abbreviations and Acronyms

APPENDIXES

A. Services and Assets

B. Performance Metrics

C. ITIL Key Performance Indicators and Metrics Process Plan

TABLES

1. Skill Certifications for Key Technical Personnel

2. Information Assurance Certification Requirements

3. Contract Deliverables

1.0 INTRODUCTION. This Performance Work Statement (PWS) outlines non-personal Information Technology

(IT) services and support requirements for the US Army Regional Cyber Center - Continental United States

(USARCC-C). The primary place of contract performance is Fort Huachuca, Arizona with limited contract support at Fort Sam Houston, TX, Fort Gordon, GA and Fort Eustis, VA. The Contractor normally shall perform IT support outside Fort Huachuca, Fort Gordon, Fort Eustis, and Fort Sam Houston in a temporary duty (TDY) status. During the life of this contract, temporary duty may be required Outside the Continental United States (OCONUS).

1.1 (Optional Work) During the life of this contract the primary place of contract performance is Fort Huachuca, Arizona. Alternate places of performance include Fort Sam Houston, Texas with limited contract support at Fort

Gordon, GA and Fort Eustis, VA as identified in 5.0 Technical requirements.

1.2 Performance includes baseline requirements identified as “Optional Work.” The Government reserves the right to negotiate these requirements at a future date. The Government shall provide sufficient lead time for the

Contractor to fulfill these requirements. During the life of this contract, when new requirements for the

Government are determined, the Government may implement those PWS paragraphs and supporting subparagraphs marked “Optional Work” as a change order. Optional Work shall not be priced as part of the contract award.

2.0 BACKGROUND.

2.1 Command Relationships.

2.1.1 The US Army Cyber Command (ARCYBER) serves as the Army Service Component Command to

USCYBERCOM for Cyberspace Operations and is under Tactical Control (TACON) to Joint Forces

Headquarters Department of the Defense Information Network (JFHQ-DoDIN) for DoDIN Operations and

Defensive Cyberspace Operations (DCO). ARCYBER is the primary Army headquarters responsible for cyberspace operations in support of Army and Joint requirements and serves as the single point of contact for reporting and assessing Army cyberspa ce incidents, events and operations in Army networks, and for synchronizing and integrating Army responses thereto . U.S. Army Cyber

Command, in coordination with Second Army, plans, coordinates, integrates, synchronizes, directs, and conducts an integrated defense within all Army networks, and, as directed, within Department of

Defense Information Networks. Second Army serves as the single point of contact for Army missions and functions related to reporting on, assessing, planning, coordinating, integrating, synchronizing, directing and conducting Army network operations.

2.1.2 The Network Enterprise Technology Command (NETCOM) plans, engineers, installs, integrates, protects and operates Army Cyberspace, enabling Mission Command through all phases of Joint, Interagency, Intergovernmental, and Multinational operations. The 7th Signal Command (7th Sig Cmd), Theater (T), is a subordinate of NETCOM, and is responsible for delivering seamless, enterprise-level

Command, Control, Communications, Computers, and Information Management (C4IM) common-user services and operating, managing, and defending the enterprise IT infrastructure in support of the CONUS

Army. The three interdependent tasks necessary to operate the Global Information Grid (GIG) are Enterprise

System and Network Management, Information Assurance/Computer Network Defense, and Content

Staging/Information Dissemination Management.

2.1.3 The USARCC- C is a under Operational Control (OPCON) of ARCYBER, Administrative Control

(ADCON) of NETCOM and in Direct support of the 7th Sig Cmd, (T), and is responsible to operate, manage, and defend the Army’s Unclassified But Sensitive Internet Protocol Router Network (NIPRNet) and Secure

Internet Protocol Router Network (SIPRNet) CONUS portion of the Global Information Grid (GIG), and the

NIPRNet and SIPRNet DoDIN-A. The USARCC-C supports the operation and maintenance of the CONUS

Point of Presence (PoP) for the Southwest Asia (SWA) Afghanistan Mission Network (AMN) extension to

CONUS-based units. This network is the Global Mission Network (GMN). The USARCC-C functions as part of a larger joint environment, responding to the Theater Combatant Commanders, the Army Cyber

Command (ARCYBER) and 2nd Army, and Army Cyber Command’s Army Cyberspace Operations and

Integration Center (ACOIC) which operates the GIG in support of Department of Defense (DOD) operations around the world. During the life of this contract, the USARCC-C may support Army Network Enterprise management of Outside the Continental United States (OCONUS) Theaters. The workload of the USARCC-

C is divided into seven major services: Network Services, Enterprise Services, Unified Capabilities (UC), Computer Network Defense Services, CONUS DoDIN-A Operations, Mission Support Services, and

Defensive Cyberspace Operations (DCO) Support Services.

2.2 Major Services.

2.2.1 Network Services. A key part of DoDIN-A operations focuses on the operation of the Internet protocol

(IP) networks that provide data transport for the DoDIN-A. The Defense Information Systems Agency

(DISA) has responsibility for physical management of DoD networks. The USARCC-C has control and operational responsibilities within the boundary between installation local area networks (LAN) and the

DISA-operated wide area networks (WAN). During the life of this contract, the USARCC-C may assume control of devices within the installation LAN and Black Core Routers which are in support of Operation

Guardian Enable. Specific operational missions to be performed by the USARCC-C in the area of network services include NIPRNet and SIPRNet - network operation, Domain Name Service (DNS), Web filtering, Regional - Top Level Architecture (R-TLA), Joint Regional Security Stack (JRSS) Migration and Operation and Maintenance of post migrated sites in the CONUS Theater as it pertains to Base Level Support, Virtual

Private Network (VPN), Installation Processing Node (IPN), theater IP management, and Firewalls.

2.2.1.1 (Optional Work) The USARCC-C provides Army Public Key Infrastructure for Equipment

(PKI-E) support. This Optional Work may be exercised anytime during the life of this contract. The

Government will give the contractor 30 calendar days advance notice prior to exercising the Optional

Work.

2.2.2 Enterprise Services. The USARCC-C has responsibility for Army enterprise assets in the CONUS

Theater and during the life of this contract for OCONUS Theaters. The USARCC-C operates and maintains the NIPRNet and SIPRNet CONUS Theater portion of the Army Active Directory mission. The USARCC-

C stores information in a central AD Directory Information Tree (DIT) making information available to users, computers, and applications. It is both a DIT storage system (directory store) and a set of services that provide the means to securely add, modify, delete, and locate data in the directory store. The USARCC-C operates and maintains the NIPRNet and SIPRNet Information Technology Service Management (ITSM) tool, which is used by the USARCC-C personnel and customers to manage incidents, service requests, problems, and changes on critical items in the Configuration Management Database (CMDB). The

USARCC-C has responsibility for the development and maintenance of the NIPRNet and SIPRNet enterprise web portals. The USARCC-C operates and maintains the enterprise tools used in the CONUS

Theater.

2.2.3 Unified Capabilities. The USARCC-C provides NIPRNet for the operation, management, and monitoring of the Enterprise Telephony Firewall Management (ETFM) system, NIPRNet and SIPRNet

Voice Over Internet Protocol (VOIP) Edge Border Controller (EBC) systems, and NIPRNet and SIPRNet

VOIP Global Mission Network (GMN) support.

2.2.4 Computer Network Defense Services. The USARCC-C provides defensive measures to protect and defend information, computers, and networks from disruption, denial, degradation, or destruction. The

USARCC-C provides sensor management and event analysis and response for network and host based events. For sensor management, the USARCC-C provides management of in-line Network Intrusion

Protection System/Network Intrusion Detection System (NIPS/NIDS) sensors monitoring all CONUS

DoDIN-A NIPRNet and SIPRNet enterprise traffic to detect sensor outages and malicious threat attacks that attempt to compromise the confidentiality, integrity, or availability of the network. During the life of the contract, the USARCC-C may assume control of CND devices within the installation LAN protection. In cooperation with incident handlers within the Defense Cyber Operations – Division (DCO-D), initiates defensive security procedures upon detection of these attacks. The event analysis and response includes the processes involved with reducing a large number of incidents to actual malicious threat determinations and mitigating those threats in accordance with (IAW) guidance received from the incident handlers.

2.2.5 CONUS DoDIN-A Operations. The USARCC-C monitors the DoDIN-A for outages and intrusions, collects reports from other organizations, analyzes and responds to events detected, and reports them to the

ACOIC and 7th Sig Cmd (T). The USARCC-C operates a CONUS Network Common Operational Picture

(NETCOP) that provides Army organizations in CONUS with information regarding the status of the

NIPRNet and SIPRNet DoDIN-A. Twenty-four hours a day, the personnel in service operations take telephonic reports and requests for assistance, monitor the DoDIN-A, initiate action, prepare situational awareness reports, and operate the NIPRNet and SIPRNet trouble ticketing systems that are used to assign and track actions. The USARCC-C supports the process for configuration management services both internally and for the theater at the enterprise level. The USARCC-C is also the conduit for NETOPS task orders and bulletins that are used to promulgate directives from the United States Army Cyber Command and Second Army or the ACOIC to Army installations.

2.2.6 Defensive Cyberspace Operations (DCO) Support Services. DCO provides services for the protection, monitoring, analysis, detection, and response to unauthorized activity within the Department of Defense

Information Systems and Networks. Defense Cyberspace Operations (DCO) services are required to defend against unauthorized activity on all Army assets residing on the NIPRNet and SIPRNet networks. This includes activities from simple external hackers who may attempt to gain unauthorized access, insider threats attempts for unauthorized access, and policy violations that may affect network security and operations, and more. The contractor shall develop reports and products, both current and long-term, in support of Defense

Cyberspace Operation and course of action development.

2.2.7 Mission Support Services. The USARCC-C relies on internal services to support daily operations.

Most of these services are a subset of those provided externally, and support the provision of external services. Internal services in support of overall USARCC-C operations include thin client, workstation, and server management, local area network management, operation of the Service Domain of the CONUS

Forest, facility management, computer room operations, logistics support, security management, storage management, internal tools support, and support for Information Technology Infrastructure Library (ITIL) management processes.

3.0 SCOPE. Non-personal information technology (IT) services and support requirements for the USARCC-C. The

NETCOM IT environment includes any hardware, software, application, tool, system, or network used by the

Government, whether developed, leased, or commercially purchased. The contractor shall provide personnel with requisite training, experience, and skills to perform surveillance and management to accomplish the performance of work under this contract. The contractor shall provide all personnel, management, and other related services, except as specified in paragraph C.4.6, Government-Furnished Resources. The Government will require ITIL-compliant

Contractor performance on tasks identified in section 5.0 in both classified and unclassified network environments.

Work shall include current and new systems at various lifecycle stages, and any future applications/systems not currently identified. During the life of this contract, the USARCC-C may support Outside the Continental United

States (OCONUS) Theaters’ Army Networks Enterprise Management

4.0 GENERAL.

4.1 Contractor Transition

4.1.1 Phase-In

4.1.1.1 The Contractor shall conduct phase-in procedures beginning 30 days prior to the performance date specified in Section F of the contract. The Contractor shall note all discrepancies and problems and submit them to the Government Contracting Officer’s Representative (COR) for resolution. The

Government will not hold the incoming contractor liable for any discrepancy and problem noted and properly reported.

4.1.1.2 During phase-in, the Contractor shall have sufficient staffing to support the transition.

4.1.1.3 At the end of phase-in, the Contractor shall certify to the contracting officer (KO) and to the

COR, that all Contractor employees meet the training and experience criteria as specified in the

Contractor’s proposal. The Contractor shall upload all training certificates into ATCTS as outlined in paragraph 4.2.4.1.2 and provide a listing to the COR identifying the name, labor category and experience for personnel working under this contract, as specified in the Contractor’s proposal.

4.1.2 Phase-Out. At least 60 days prior to contract completion, the COR will notify the incumbent

Contractor of all outstanding requirements the Contractor shall complete prior to completion of the contract.

Any requirements identified by the COR that are not completed prior to the contract expiration date will result in a reduction of fee payable under the contract to reflect the reduced value of the services performed in accordance with the Inspection of Services Clause.

4.1.3 Phase-in/phase-out plan. The Contractor shall submit a phase-in/phase-out plan to the COR and KO at the start of the phase-in period.

4.2 Contractor Personnel.

4.2.1 Personnel Qualifications. The Contractor shall retain personnel with management and technical knowledge, skills, expertise, and experience needed to accomplish the performance of work under this contract. Contractor employees shall have the baseline and computing environment certifications designated in DoD 8570.01-M, Information Assurance Workforce Improvement Program, for the work they will perform. Contractor employees working under this contract shall be able to speak, read, and write English.

4.2.1.1 Personnel supporting DCO: Information Technology Specialized Experience: Within the DCO, analysts shall have expertise in one or more of the following functional categories: Information

Security analysis, cyber security analysis, incident response, systems analysis, database administration, network administration, web application development, penetration testing, computer forensics analysis with specialized experience using Information Technology (IT) cyber security tools (i.e. IPS, IDS, Nessus, Metasploit, Core Impact, Web Inspect, etc.) and operating systems (i.e. Windows 7.x/10.x, LINUX, MAC, etc.).

4.2.2 Key Personnel. Key personnel are those personnel considered essential to successful Contractor performance. (See clause 52.000-4016 (ALT I KEY PERSONNEL) The Contractor shall –

4.2.2.1 Designate on-site managers to provide management, administrative, and technical interface with the COR in accomplishing services under this contract. The contractor shall provide managers that are knowledgeable and experienced in management of all aspects of communications within their designated Area of Responsibility (AOR). These individuals shall be available on a part-time basis during contract transition and full-time by the contract start date.

4.2.2.2 Designate individuals to serve as alternates for those times when the on-site managers are unavailable.

4.2.2.3 Designate other Contractor key technical personnel for this contract. These individuals shall be available by the start date of the contract. Key technical personnel shall have an in-depth understanding of the technical requirements and the ability, knowledge, experience, certifications, and skills to perform those requirements at contract start date. Provide written notification to the COR and

KO a minimum of two weeks prior to replacing or reassigning on-site managers or key technical personnel. The written notification shall include copies of the redacted resumes (see 4.2.2.4) and certifications of any individual proposed as a replacement for Key Personnel. The individual proposed must have equal or higher qualifications and experience. All key personnel shall be ITIL Foundations certified within three months of contract start date or hiring date.

4.2.2.4 Resumes. The Contractor shall provide resumes for Key Technical Personnel with all personally identifiable information (PII) redacted. The PII includes name, address, and telephone number. The Contractor shall provide redacted resumes of each Key Technical Personnel to the

Contracting Officer’s Representative (COR) for U.S. Government review to ensure compliance with

PWS criteria before the individual is employed under this contract. The Contractor remains responsible for compliance with PWS requirements and for ensuring that its employees meet the qualifications set forth in the contract.

4.2.2.5 The USARCC-C services in Table 1 below, as a minimum, require additional technical oversight from IT-certified key personnel:

TABLE 1. Skill Certifications for Key Technical Personnel (not all Key Personnel identified in the

Key Personnel Clause need certifications)

Service/Position Certification

Network Senior Subject Matter

Expert

Cisco Certified Network Professional (CCNP), Juniper Networks Certified Internet Specialist or Juniper Networks Certified Internet

Associate, and IAT Level II Baseline

Certification

Active Directory Senior

Subject Matter Expert

Microsoft Certified Information Technology

Professional – Enterprise Administrator

(MCITP: EA) or the current highest level of

Microsoft certification for Active Directory and

IAT Level II Baseline Certification

Unified Capabilities (UC) Senior

Subject Matter Expert

Cisco Certified Network Professional (CCNP)

Voice, and IAT Level II Baseline Certification

Computer Network Defense Senior

Subject Matter Expert

Global Information Assurance Certification

(GIAC) – Information Security Fundamentals or equivalent and a CND-IS Baseline

Certification

Senior Security Manager IAT Level II Baseline Certification

ITIL Senior Subject Matter Expert

Information Technology Infrastructure Library

Manager’s Expert Certificate or higher

Forensics / Malware Analyst

(DCO)

GIAC Certified Forensic Analyst (GCFA), GIAC Certified Incident Handler, and IAT

Level II Baseline Certification

Threat Analyst (DCO)

Certified Ethical Hacker (CEH), GIAC Certified Intrusion Analyst (GCIA), and

IAT Level II Baseline Certification

Defense Assessment Analysis

Certified Systems and Network Auditor

(GSNA)

Certified Ethical Hacker (CEH)

Certified Wireless Network Administrator

(CWNA), and IAT Level II Baseline

Certification

Application Developer (DCO)

Systems Security Certified Practitioner (SSCP)

Incident Handler (DCO)

GIAC Certified Incident Handler, and IAT

Level II Baseline Certification

4.2.3 Training. All Contractor personnel shall be trained and have the required certification to provide the support as defined in this PWS. The Contractor shall –

4.2.3.1 Provide required initial, supplemental, refresher, upgrade, and proficiency training for its personnel to maintain pace with technological advances. The Government will only provide one-time training to the existing contractor personnel for new technology not previously identified that can be directly correlated to the tasks within the PWS. The COR will provide the Contractor an e-mail authorizing this type of training before it commences. If trained Contractor personnel are replaced, the

Contractor shall be responsible for training the replacement employees at the Contractor’s expense before they begin work on this contract.

4.2.3.2 Maintain a record of required training and IT certifications for its personnel and make them available for review upon COR request.

4.2.3.3. Provide attendance report and maintain a record of government provided training to contractors and make them available for review upon COR request.

4.2.4 Protection.

4.2.4.1 Information Assurance.

4.2.4.1.1 Information Assurance (IA) Training. All Contractor personnel with access to

Government information systems and networks shall successfully complete all required initial and annual refresher IA awareness training as specified in AR 25-2 and as specified by the

Government requiring activity. Training is available at https://ia.signal.army.mil.

4.2.4.1.2 Contractor employees and subcontractor employees performing work under this contract who have access to Government information systems and networks shall create a user account and profile in the Army Training and Certification Tracking System (ATCTS) website at https://atc.us.army.mil, in the unit container designated by the COR. Certificates of successful completion of IA training, Acceptable Use Policies (AUP), applicable baseline and computing environment certifications, and continuing professional education credits, as required by DoD 8570.01-M, shall be uploaded to the ATCTS and provided to the COR for continuous compliance monitoring and reporting.

4.2.4.1.3 The Contractor shall ensure that all contractor employees and subcontractor employees requiring IA awareness training complete the training at start of work performance on this contract and annually thereafter, for the duration of this contract.

4.2.4.2 Information Assurance Workforce Certification. Defense Federal Acquisition Regulation

Supplement (DFARS) clause 252.239-7001 (Information Assurance Contractor Training and

Certification) applies to this contract. This contract is subject to the mandates of DoD 8570.01-M, which establishes baseline technical and management IA skills for personnel performing IA functions within DoD. Functions spanning multiple levels require certification of the highest level functions.

Contractor personnel performing functions in multiple categories or specialties shall hold certifications appropriate to the functions performed in each category or specialty.

4.2.4.2.1 The Contractor shall ensure its IA workforce members have the baseline certifications corresponding to their IA functions, as defined in Chapters 3, 4, 5, 10, 11, and Appendix 3 of

DoD 8570.01-M at work performance start date. Contractors will obtain all required

Computing Environment (CE) certificates within 6 months of being engaged. The IAT Level I https://ia.signal.army.mil/ https://atc.us.army.mil/ baseline certification is the minimum requirement for unsupervised privileged access. The

Contractor shall ensure that all employee certifications remain active and are renewed prior to expiration.

4.2.4.2.2 The Contractor shall ensure that all employees’ IA certifications are released to the

Department of Defense through the Defense Workforce Certification Application at https://www.dmdc.osd.mil/milconnect/faces/index.jspx.

4.2.4.2.3 Table 2 reflects the Personnel Security (IT Level) and IA Workforce Specialty requirements, aligning the IA functional responsibilities and access levels to the contract tasks, in accordance with DoD 8570.01-M and DoDD 8140.01, Cyberspace Workforce Management and AR 25-2.

TABLE 2. Information Technology Access and IA Certification Requirements

Functional Category

IT

Level

(IAW

AR 25-

2)

Security

Clearance

Investigation

Required

IA

Certification

Category and

Level (IAW

DoD 8570.01-

M and BBP

05-PR-M-

0002)

Computing

Environment

Certification

Application Systems Analysis II SECRET TIER 3 (T3) IAT II Yes

Data Security Analysis I SECRET T5 IAT-II Yes

Data Security Analysis (CND

Neat/Policy) I SECRET T5

P: CND-A

E: IAT II Yes

Data Security Analysis (CND

Sensors) I SECRET T5

P: CND-IS

E: IAT II Yes

Database Analysis/Programming II SECRET T3 IAT II Yes

Systems Administration II SECRET T3 IAT-II Yes

Systems Administration (Proxy) I SECRET T5

P: IAT II

E: CND-IS Yes

Systems Administration

(Windows Systems

Management) I

TOP

SECRET/SCI T5 IAT II Yes

Systems Engineering I SECRET T5 IAT II Yes

System Engineering (JRSS

O&M Support) I

TOP

SECRET/SCI T5

P: IAT II

E: CND-IS Yes

Systems Engineering

(Networks, Proxy) I SECRET T5

P: IAT II

E: CND-IS Yes

Information Technology

Security Analysis II SECRET T3 IAM II No

Information Technology

Security Analysis II SECRET T3 IAT II Yes https://www.dmdc.osd.mil/milconnect/faces/index.jsp

Level

(IAW

AR 25-

2)

Security

Clearance

Investigation

Required

IA

Certification

Category and

Level (IAW

DoD 8570.01-

M and BBP

05-PR-M-

0002)

Computing

Environment

Certification

Information Technology

Security Analysis ( CND, CND

Sensors) I SECRET T5

P: CND-IS

E: IAT II Yes

Network Administration I SECRET T5

P: IAT II

E: CND-IS Yes

Network Administration

(JRSS O&M Support) I

TOP

SECRET/

SCI T5

P: IAT II

E: CND-IS Yes

Network Architect Support

(Infrastructure) I

TOP

SECRET/

SCI T5 IAT II Yes

Network Architect Support

(Exchange/AD Server and

Workstation Support/Web Site

Development/ Technical Tasks) I SECRET T5 IAT II Yes

Network Architect Support

(Networks) I SECRET T5

P: IAT II

E: CND-IS Yes

Program Management I

TOP

SECRET/SCI T5 IAM II No

Project Management I SECRET T5 IAM II No

Security Management I

TOP

SECRET/SCI T5 IAT II No

Subject Matter Expert Support

(Active Directory) I SECRET T5 IAT II Yes

Subject Matter Expert (CND) I

TOP

SECRET/SCI T5

P: CND-IS

E: IAM II Yes

Subject Matter Expert Support

(Networks) I SECRET T5

P: IAT II

E: CND-IS Yes

Subject Matter Expert (JRSS

Service Migration Team (SMT) I

TOP

SECRET/SCI T5

P: IAT II

E: CND-IS Yes

Subject Matter Expert (JRSS

O&M Support) I

TOP

SECRET/SCI T5

P: IAT II

E: CND-IS Yes

Subject Matter Expert Support I SECRET T5 IAT II Yes

Account Administration II SECRET

T3 IAT-II Yes

SIPR Systems Integration I SECRET

T5 IAT II Yes

Web Content Administration II SECRET T3 IAT II Yes

Web Software Development II SECRET T3 IAT II Yes

Web Technical Administration II SECRET T3 IAT II Yes

Level

(IAW

AR 25-

2)

Security

Clearance

Investigation

Required

IA

Certification

Category and

Level (IAW

DoD 8570.01-

M and BBP

05-PR-M-

0002)

Computing

Environment

Certification

Incident Handling (DCO) I

TOP

SECRET/SCI T5

P: CND-IR

E: IAT II Yes

Threat Analysis (DCO) I

TOP

SECRET/SCI T5

P: CND-A

E: IAT III Yes

Forensics / Malware Analysis

(DCO) I

TOP

SECRET/SCI T5

P: CND-IR

E: IAT III Yes

Defense Assessment Analysis

(DCO) I

TOP

SECRET/SCI T5

P: CND-AU

E: IAT III Yes

Application Development

(DCO) II

TOP

SECRET/SCI T5

P: CND-IS

E: IAT II Yes

System Administration (DCO) II

TOP

SECRET/SCI T5

P: CND-IS

E: IAT II Yes

Database Administration (DCO) II

TOP

SECRET/SCI T5

P: CND-IS

E: IAT II Yes

Network Engineering

/Architecture(DCO) I

TOP

SECRET/SCI T5

P: CND-IS

E: IAT II Yes

ITIL Support III

SECRET T3 N/A No

Operations Bridge Support III

Help Desk Support III

Logistics Support III

4.2.4.3. Non-Government-owned computing systems or devices. The Contractor shall comply with AR

25-1 and AR 25-2. The Contractor shall not install or connect non-Government-owned computing systems or devices to Government networks without the COR’s coordinating and obtaining proper authorization from the appropriate Information System Security Manager (ISSM), ensuring that all software has a Government Certificate of Networthiness. The non-Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned thumb drives (e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives), removable or external hard drives, Personal Digital Assistants (PDA), PC Cards/Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD)/digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, or any devices that can store data.

4.2.4.4. Protection of Sensitive Unclassified Data. The Contractor shall ensure any sensitive information, including, but not limited to, Personally Identifiable Information (PII) and For Official

Use Only (FOUO), proprietary, and Law Enforcement Sensitive information residing on Mobile

Computing Devices (MCD) or other external media, is protected in accordance with current Data at

Rest (DAR) guidelines and requirements. The Contractor shall use an authorized, approved, and prescribed DAR solution. The MCDs include, but are not limited to, laptop, netbook, notebook, or tablet computers, and Blackberry or equivalent devices. External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives) (when authorization to use them is restored), floppy disks, and other portable digital storage devices.

4.2.5 Antiterrorism

4.2.5.1 Antiterrorism Level I Training. The Contractor shall ensure that all contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas complete Antiterrorism (AT) Level I awareness training within 30 calendar days after start of employee performance on this contract. Within 5 calendar days after completion of training, the contractor shall certify to the COR or KO that all employees performing work under this contract have completed the AT Level I awareness training. AT Level I awareness training is available at https://jkodirect.jten.mil, course #JS-US007.

4.2.5.2 Outside Continental United States (OCONUS) Travel. If this contract requires OCONUS travel, contractor employees shall obtain KO or COR approval prior to such travel. The contractor employees shall contact the Government requiring activity Antiterrorism Office (ATO) to receive a specific theater AT/threat briefing prior to departing on OCONUS temporary duty travel.

4.2.5.3 iWATCH. The Contractor shall ensure that all contractor employees and subcontractor employees performing work under this contract are trained on the local iWATCH program within 30 calendar days of start of employee performance on this contract. The requiring activity ATO will provide the locally developed iWATCH training. The Contractor shall maintain all iWATCH training records and shall provide copies to the COR upon request.

4.2.5.4 Emergencies and Force Protection Conditions. During declared emergencies and/or elevated

Force Protection Conditions (FPCONs) Charlie or Delta, contractor performance, under this contract, shall be determined by the COR or KO. All contractor employees providing services under this contract are required to report for duty as scheduled and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the KO or COR. The Contractor Program

Manager shall keep the COR apprised of all personnel whereabouts when in a temporary duty (TDY) location.

4.2.5.5 Access and General Protection Security Policy and Procedures. Contractor and all associated sub-contractors employees shall provide all information required for background check to meet installation access requirements to be accomplished by the installation Provost Marshal Office (PMO), Director of Emergency Services (DES) or Security Office. Contractor workforce shall comply with all personal identity verification requirements of FAR clause 52.204-9, Personal Identity Verification of

Contractor Personnel. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor security matters or processes.

4.2.6 Operations Security (OPSEC). The Contractor shall comply with DoD Directive 5205.02E, Army

Regulation 530-1, and the requiring activity OPSEC program. The Contractor shall ensure all contractor employees and subcontractors performing work under this contract complete Level I OPSEC training within

30 calendar days of start of employee performance on this contract and annually thereafter. The Contractor shall maintain all OPSEC training records and shall provide copies to the COR upon request.

4.2.7 Controlled Unclassified Information (CUI). The Contractor shall comply with DISA Traditional

Security STIG. The Contractor shall ensure that all on-site support contractors with access to CUI performing work under this contract receive both initial and annual refresher training that reinforces the policies, principles, and procedures covered in CUI policy. CUI Training is located at http://www.archives.gov/cui/training.html and training supplement is provided at the USARCC-C. The

Contractor shall ensure all contractor employees and subcontractors performing work under this contract complete CUI training during new employee in-processing on this contract and annually thereafter. The

Contractor shall maintain all CUI training records and shall provide copies to the COR upon request.

4.2.8 Required Security Training - Army Learning Management System (ALMS) Initial Security Orientation and Annual Refresher Training. The Contractor shall comply with Army Regulation 380-5. Within 30 business days of work start date, contractor personnel shall complete the Department of the Army https://jkodirect.jten.mil/ http://www.archives.gov/cui/training.html standardized computer web-based Initial Security Orientation training and annually thereafter, shall complete the Annual Security Refresher Training, both available at https://www.lms.army.mil, under Information

Security Program training. The system will automatically direct the user to the appropriate course based on their training history. The Contractor shall maintain all security training records and shall provide copies to the COR upon request.

4.2.9 HIPAA- Privacy and Security Refresher: All contractor employees and associated sub-contractor employees must complete the American Health Information Management Association (AHIMA) HIPAA –

Privacy and Security Refresher with 30 calendar days of contract award. Training is hosted on Joint

Knowledge on line, http://jko.jten.mil/. This is an annual training requirement once initial is completed.

Certificates of successful completion, for both initial training and annual refresher training, shall be provided to the COR.

4.2.10 Resignation or Removal. When the Contractor receives a resignation notice from its employees or notifies them of impending removal from contract support, the Contractor shall notify the COR within one hour to determine requirements for continued administrator permissions and network access.

4.3 USARCC-C Work Hours. Core hours for normal operation are 0600-1700, Monday through Friday local time zones, excluding Federal holidays and such other times as identified by the KO. The core hours apply to all the major services except for NIPRNet/SIPRNet Network Management, paragraph 5.4.2.4, Computer Network

Defense, para 5.5, and CONUS DoDIN-A Operations , paragraph 5.6, which require contractor support 24 hours a day, seven days a week.

DCO Incident Investigation and Mitigation requires Contractor support 24-hours per day, 7 days a week. DCO support for Penetration Testing Evaluation, Threat Detection Analysis, and Computer Network Defense

Application Development core hours are Monday – Friday, 0630-1700.

4.3.1 The Contractor shall schedule work hours that coincide with those of the supported activity. The

Contractor shall coordinate the proposed work schedule with the COR. Periodically, the Government may require Contractor support outside established duty hours. Unless the KO authorizes overtime in advance, the

Contractor shall reschedule employees’ work hours to provide the coverage outside established duty hours without overtime.

4.3.2 The Contractor shall provide 24-hour on-call rosters to the COR. The initial on-call roster is due upon start date of the contract. Subsequent rosters are due a minimum of one week prior to expiration of the previous roster. The Contractor shall include the on-site manager or alternate on 24-hour on-call rosters.

On-call Contractor technical personnel shall respond telephonically within 30 minutes of notification and report on site within one hour. The on-site manager shall inform the COR of these after-hour occurrences daily.

4.3.3 The Contractor shall notify the COR and obtain advance Government approval before scheduling overtime for Contractor employees. On-call employees shall follow the procedures outlined in the sub-paragraphs below.

4.3.3.1 On-call Contractor employees shall keep a log of the duration of each call received after their normal duty day. At the end of the day, this time will be added up, rounded up to the nearest tenth of an hour, and reported to the Contractor employee’s on-site manager.

4.3.3.2 If the problem cannot be resolved by telephone and the Contractor employee needs to report on site, he/she shall report a minimum of one hour worked. The Contractor shall round up to the nearest tenth of an hour time beyond one hour.

4.3.3.3 The on-site manager shall provide an email, daily, of these after-hour occurrences, to the COR for approval. The email shall include the Contractor employee’s name, the work performed, and the total time worked. The Contractor shall modify the employee’s schedule, to include these after-hour occurrences as part of the normal workweek, if mission allows.

https://www.lms.army.mil/ http://jko.jten.mil/

4.4 Security and Privacy. The Contractor shall –

4.4.1 Provide physical security for all material, equipment, data, and information handled during contract performance, IAW AR 190-13, The Army Physical Security Program, AR 190-51, Security of Unclassified

Army Property (Sensitive and Non-sensitive), and command policies, procedures, and regulations.

4.4.2 Security Requirements. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves Contractor access to information classified “Confidential,” “Secret.” or “Top Secret” and requires contractors to comply with the Security Agreement (DD Form 441), including the National

Industrial Security Program Operating Manual (DoD 5220.22-M) and any revisions to DoD 5220.22-M. The

Contractor shall perform operations on, have access to, or handle data and information that contain classified, sensitive, proprietary, or Privacy Act information or data. The Contractor shall handle classified and sensitive information IAW the provided DD Form 254, Department of Defense Contract Security

Classification Specification.

4.4.2.1 Classified information generated or received during work performance on this contract shall be controlled, marked, protected, transmitted, and safeguarded IAW AR 380-5 and current Army and DoD policy and shall only be at specified Government requiring activity work locations.

4.4.2.2 The process of extracting, paraphrasing, restating or generating classified information based on a security classification guide or one or more source documents, or both, is derivative classification.

Any derivatively classified information generated in support of this contract shall normally be marked according to the classification markings reflected on the source material(s). However, a compilation of information could warrant a change in classification level of the information, or, it could warrant the classification of previously unclassified information. The contractor shall consult with the COR regarding any potential classification issues when generating information and/or deliverables in support of this contract.

4.4.2.3 The Government requiring activity will identify, or provide, additional instruction or appropriate security classification guides/guidance to the contractor, as required. The Contractor shall notify the COR, in writing, of any instance where referenced security classification guides/guidance cannot be accessed at links or sites specified in this contract or in separate correspondence. The prime contractor shall ensure all applicable security classification guides/guidance are made available to any subcontractor(s), as appropriate.

4.4.2.4 Persons who derivatively classify information and who apply derivative classification markings shall receive training in the proper application of derivative classification principles. The contractor, in coordination with the COR, shall identify by name and position title, those contractor, subcontractor, or any lower tier sub-contractor personnel who will be generating and derivatively classifying information during work performance of this contract. This includes, but is not limited to, personnel who require

SIPRNET or JWICS accounts. These individuals shall successfully complete initial Derivative

Classification Training at work performance start date, and once every two years, thereafter. Training consists of the Derivative Classification Course (IF103.16) and Derivative Classification Exam

(IF103.06) and is available on-line at the DSSA/STEPP website http://cdsetrain.dtic.mil/derivative/index.htm, under Information Security. Certificates of successful completion, of initial and refresher training, shall be provided to the COR within three (3) business days of completion of the training.

4.4.2.5 The prime contractor shall require sub-contractors to include above requirements in their lower tier contracts.

4.4.3 Contractors will require access to classified and controlled or sensitive information and facilities.

Highest level security clearance requirement for this work effort is Top Secret (TS)/Sensitive

Compartmented Information (SCI). Upon contract performance start date, all Contractor personnel shall, possess a SECRET security clearance, with the exception of those identified Contractor personnel, who will require a final TOP SECRET (TS) security based upon a current Tier 5 (T5) or T5-Reinvestigation (T5-R) with ICD 704 eligibility and at work performance start date, will require indoctrination for SCI at the

SI/TK/G/HCS level. New or replacement personnel, who require a security clearance to perform under this contract, shall have the required security clearance at work performance start date. Cleared Contractor personnel may require access to SIPRNET CX-I, JWICS or other classified systems in support of this work effort. Access to classified systems will only be at specified Government work locations and will be sponsored by the COR.

4.4.4 Contractor personnel who require a Secret security clearance and who will require IT Level I system access or who will be performing IT level I functions require a Tier 5 (T5) Investigation completed with fitness determination for IT Level I access. If Contractor personnel do not have a favorable T5 investigation on record, the Contractor shall contact the supporting Government Security Office/G2/S2 for submission of the T5 investigation (SF 86). The Contractor shall provide the contract number as authority to request the investigation. Contractor interim privileged level access to Army systems prior to completion and favorable fitness determination of the required investigation will be in accordance with AR 25-2.

4.4.5 All contractor personnel who require access to classified COMSEC information shall have a FINAL security clearance at the requisite level and will be subject to the Department of the Army Cryptographic

Access Program (DACAP) if access meets the criteria in AR 380-40, Chapter 7. See DD Form 254, Contract Security Classification Specification for additional information and requirements.

4.4.6. New or replacement personnel shall have the required final security clearance at work performance start date. Cleared Contractor personnel may require access to SIPRNET, CX-I, JWICS or other classified systems in support of this work effort. Access to classified systems will only be at specified Government work locations and will be sponsored by the COR.

4.4.7. IT Levels, security clearance requirements, and personnel security investigation requirements, and

IA/CE certification requirements for work to be performed under this contract are reflected by Functional

Category in Table 2 (Information Technology and IA Certification Requirements Table) of this PWS.

4.4.8 North Atlantic Treaty Organization (NATO) awareness/access briefing requirements are stated in the

DD Form 254 for this contract.

4.4.9 TEMPEST. The Contractor shall comply with TEMPEST directives in accordance with AR 380-27, NTISSAM 2/95, RED/BLACK Installation Guidelines (U), 12 Dec 95, amended by NTISSAM TEMPEST

2/95A, dated 3 Feb 2000, when maintaining a SCIF. Information Security:

4.4.9.1 The Contractor shall provide all cleared employees security training and briefings as specified in NISPOM Chapters 3 and 10, commensurate with their involvement with classified information at no additional cost to the Government. For Official Use Only (FOUO) information or Personal Identifying Information (PII), received or generated under this contract, shall be controlled and protected, marked, and safeguarded, as specified in AR 25-55, Department of the Army (DA) Freedom of Information Act (FOIA) Program and Chapter 5, AR

380-5, DA Information Security Program. This includes PII, as defined in Enclosure 2 of DoDD

5400.11 (DoD Privacy Program).

4.4.10 Threat Awareness and Reporting Program (TARP) Training. All contractor personnel assigned to this contract shall complete initial and annual TARP training. Completion of training shall be reported to the

COR. Detailed requirements on TARP are stated in the DD Form 254.

4.5. Safety. The Contractor shall perform in a manner that assures maximum safety and protection for their employees and all personnel while performing work for this contract. The Contractor shall exercise surveillance on a continuing basis and shall eliminate or otherwise control existing or potential safety hazards.

http://www.army.mil/USAPA/epubs/380_Series_Collection_1.html http://www.army.mil/USAPA/epubs/380_Series_Collection_1.html http://www.army.mil/USAPA/epubs/25_Series_Collection_1.html http://www.army.mil/USAPA/epubs/25_Series_Collection_1.html

4.5.1 The Contractor shall participate in the Government’s safety program. Compliance with provisions pertaining to safety of site facilities and equipment is mandatory. The Contractor shall establish and implement a comprehensive Safety Program Plan for use by contractor and sub-contractor employees. This

Plan shall incorporate appropriate elements of 29 CFR 1910 and 1926, AR 385-10, NETCOM Reg 385-1 and applicable OSHA regulatory guidance. The Contractor shall provide the COR and KO with its Safety and Health Plan within 30 calendar days of contract award for acceptance. The COR and KO will approve all updates to the Safety and Health Plan before implementation.

4.5.2 The Contractor shall comply with all federal, state and local policies, directives, laws and regulations.

During the performance of tasks requiring protective equipment and clothing, contractor employees shall wear safety items required by OSHA and as specified in the applicable regulations. The Contractor shall be responsible for providing personal protective equipment, clothing and training.

4.5.3 The COR may require the Contractor to cease operations associated with the performance of this contract for safety violation reasons. The Contractor shall correct any safety violations, caused by a contractor employee, during non-duty hours at no additional cost to the Government.

4.5.4 The Contractor shall ensure all employees receive the safety training required by all federal, state and local laws and policies. The Contractor shall maintain the safety training records and make them available to the COR and KO upon request.

4.6 Access to Protected Information. Protected information means all non-public information, including, but not limited to, trade secrets or proprietary information of other Contractors, Government source selection information, Privacy Act or personally identifiable information (PII), or any other information with distribution limited by the Government. If, during the performance of this requirement, Contractor personnel obtain access by any means to protected information, they shall not disclose, publish, divulge, release, or make known, in any manner or to any extent, the information except as necessary to carry out duties under this contract. Protected information shall be given only to persons specifically granted access to this sensitive information and may not be further divulged without specific prior written approval from an authorized U.S. Government individual.

Further, contractor employees may use any non-public information for official/authorized Government purposes, and they shall not use the information for their personal…