2D Theater Signal Brigade, United States Army Regional Cyber Center - Europe (RCC-E)

NTRODUCTION The Army Contract Command - Aberdeen Proving Ground (CC-APG) - Huachuca Division; 2133 Cushing St, Bldg. 61801, Greeley Hall, AZ 85613-7070 is issuing this sources sought synopsis as a means of conducting market research to identify parties having an interest in and the resources to support the requirement for Non-personal Information Technology (IT) Support Services for the 2D Theater Signal Brigade, United States Army Regional Cyber Center - Europe (RCC-E), 2D Theater Signal Brigade. The intention is to procure these services on a competitive basis. Prospective contractors shall be registered in the System for Award Management (SAM) prior to award of a contract. Contractors are encouraged to obtain further information on SAM registration at the following website: https://www.sam.gov/portal/public/SAM. BASED ON THE RESPONSES TO THIS SOURCES SOUGHT NOTICE/MARKET RESEARCH, THIS REQUIRMENT MAY BE SET-ASIDE FOR SMALL BUSINESSES (IN FULL OR IN PART0 OR PROCURED THROUGH FULL AND OPEN COMPETITON, and multiple awards MAY be made. All Small Business Set-Aside categories will be considered. Telephone inquiries will not be accept or acknowledged, and no feedback or evaluations will be provided regarding submissions. DISCLAIMER "THIS SOURCES SOUGHT IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A "REQUEST FOR PROPOSAL (RFP)" TO BE SUBMITTED. IT DOES NOT CONSTITUTE A SOLICITATION AND SHALL NOT BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A CONTRACT AS A RESULT OF THIS ANNOUCEMENT. NO FUNDS ARE AVAILABLE TO PAY FOR PERPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL DESCRIPTION IS STRICTLY VOLUNTARY. RESPONSES WILL NOT BE RETURNED TO THE RESPONDER, NOT RESPONDING TO THIS NOTICE DOES NOT PRECLUDE PARTICIPATION IN ANY FUTURE REQUEST FOR QUOTE (RFQ) OR INVITATION FOR BID (IFB) OR RFP, IF ANY ISSUED. IF A SOLICITATION IS RELEASED, IT WILL BE SYNOPSIZED ON THE GOVERNMENT-WIDE POINT OF ENTRY 9GPE0. IT IS THE RESPONSILIBILITY OF POTENTIAL OFFERORS TO MONITER THE GPE FOR ADDITIONAL INFORMATION PERTAINING TO THIS REQUIREMENT." PROGRAM BACKGROUND - The United States Army Regional Cyber Center - Europe (RCC-E), 2D Theater Signal Brigade, Non-personal Information Technology (IT) Support Service is designated to continuously conduct Department of Defense Information Network (DoDIN) Operations and Defensive Cyberspace Operations (DCO) - Internal Defensive Measures (IDM) on the Army's portion of the DoDIN in both EUCOM's and AFRICOM's Areas of Responsibility (AOR) in order to ensure Army, Joint, and Coalition Forces' freedom of action in cyberspace while denying the same to our adversaries. The RCC-E manages the European Theater network devices and enterprise services (to include the Domain Name Service (DNS) for USAREUR, USAFRICOM, and USEUCOM as part of the Joint Information Environment (JIE). The RCC-E routinely operates and defends NIPR/SIPR/Coalition networks for customers including SAREUR/USARAF/USAFRICOM/USEUCOM/RHCE, and provides surge capability for ad hoc coalition networks supporting various exercises, and other networks. Types of services provided are: Network Operations (NETOPS) Defensive Cyberspace Operation Mission Support Services Exercise Support Network Services Enterprise Services Enterprise Management & Information Assurance (IA) Services Emergency Management Modernization Program (EM2P)/Web-based Emergency Operations Center (WebEOC) Internal Services Enterprise Configuration Management/Service Level Management (CM/SLM) Cyber Security New Technology and Product Insertion Infrastructure Support Database Administration and Storage Network Management Systems Support Architecture and Development Security Monitoring, Detection and Analysis Intrusion Detection system / Intrusion Prevention system (IDS/IPS) Application Development and Support System Development Support Network Defense Penetration Testing and Evaluation Forensic and Malware Analysis Asset Management Change Management Automated Information System Management DCO Theater Cyber Operations and Integration Center (TCOIC)/Watch Floor Operations Support REQUIRED CAPABILITES The Contractor shall provide qualified personnel and all personnel administration, personnel management, training, maintenance, and services (except as otherwise provided herein and in the basic contract) to the RCC-E in support of Information Technology requirement. Tasks include Network Management; Enterprise Systems Management; Network Operations (NETOPS) and Mission Support; Cyber Security support; Network Infrastructure Security; Network Assistance Visits; Network, System and Web Assessments; Network Security Monitoring, Detection, and Analysis; Forensic and Malware Analysis; and Defensive Cyberspace Operations (DCO) Application Development, on DoD funded or managed networks as required by U.S. Army Europe (USAREUR), U.S. Africa Command (AFRICOM), to include Combined Joint Task Force - Horn of Africa (CJTF-HOA), U.S. European Command (EUCOM), and U.S. Army Cyber Command (ARCYBER) to include but not limited to Non-Secure Internet Protocol Router Network (NIPRNet), Secure Internet Protocol Router Network (SIPRNet), exercise, and designated coalition networks in support of AFRICOM, EUCOM, USAREUR, US Army in Africa (USARAF), and Regional Health Command Europe (RHCE) missions in support of the areas specified in Program Background (above). Further detail is provided in below, a draft Performance Work Statement will not be provided at this time. Requirement - REQUIRED CAPABILITIES: The Contractor shall support the RCC-E mission as follows: Description of Requirements Provide systems and process support for DoDIN and Defensive cyber Operations (DCO). Network Operations (NETOPS) The contractor shall use the RCC-E-provided ticketing system. Requests are received and processed in the form of trouble tickets. The contractor shall report security events within 15-minutes of detection or notification. If the ticketing system is down, trouble tickets will be submitted manually and telephonically to accommodate customer requirements. Upon system restoral, the contractor shall enter manual or telephonic requests into the ticketing system as soon as possible (within 24 hours). - The Contractor shall assign all trouble tickets and ensure work begins on assigned trouble tickets with the current established timelines, for critical, urgent tickets as follows: Critical = Priority 1 / Immediate Response (24/7) Urgent = Priority 2/ 4 - hours Routine = Priority 3/ 24 hours Priority 4 / 3 business days Priority 5 / 5 business days. The contractor may not be able to resolve these tickets at the RCC-E. If so, the contractor shall coordinate with the Government lead at agencies within or supported by the 2nd Signal Brigade. - The immediate and 4 hour response times are for those sections that are manned 24 x 7. For sections that are not manned 24 x 7, the response time begins when notified by the 24 x 7 RCC-E Theater Cyber Operations Integration Center (TCOIC). - The Contractor shall respond to the trouble ticket by initiating corrective action, providing follow up on corrective actions, and perform close out of trouble ticket by entering the required information. The Contractor shall report proper, correct and complete record entries on all assigned trouble tickets. Defensive Cyberspace Operation - The Contractor shall use the RCC-E-DCOD provided cyber event/incident ticketing system for reporting cyber incidents to the Army CERT Incident Database (ACID). Cyber event investigations will be initiated and processed in the form of cyber event investigation and incident tickets. The contractor shall report cyber incidents following timelines required in CJCSM 6510.01B. Cyber events and incidents that require local customer support will be processed via the NETOPS ticketing system described above. If the DCOD, Army Computer Incident Database (ACID), or NETOPS ticketing system is down, cyber incidents will be submitted manually and telephonically to accommodate ARCYBER and customer requirements. Upon system restoral, the contractor shall enter manual or telephonic requests into the ticketing system as soon as possible but not later than within 24 hours of the ticketing system restoral. - The Contractor shall complete cyber event/incident investigations and report results in compliance with reporting requirements and timelines provided in CJCSM 6510.01B. Tools Integration (Full RCC-E tools integration detailed in Appendix - Services and Assets - The RCC-E current monitoring tools are NetCool, and Spectrum which generates alarms directly interfacing with NSS Remedy to open NSS incident tickets. - Microsoft System Center Operations Manager (SCOM) feeds server alarms to Spectrum. - NetApp, Veritas, and EMC storage devices located in APC's send Simple Network Management Protocol (SNMP) traps to Spectrum. - All network devices send SNMP traps, System Logs, and Netflow data (as appropriate) to collectors. - Host, systems, router, firewall, and web proxy logs as well as intrusion prevention and intrusion detection events are ingested into Security Information and Event Management (SIEM) systems such as ArcSight for analysis by network and DCO analysts. - Advanced data analytic platform, such as Splunk or the Army Big Data Platform, that ingests stores, processes, and visualizes data of interest ingests data from various sources such as ArcSight, Host Based Security Systems, Attack, Sensing, and Warning Sensors, router and firewall logs, Syslog data, to perform DCO functional and operational requirements. Mission Support Services The Contractor shall: - Conduct incident, problem, change and release management in accordance with applicable RCC-E procedures. - Processes, Plans, and Procedures support during core hours (Monday - Friday (0630hrs-1800hrs), and provide call out support as required. - Install all required upgrades and patches on managed systems, and configure systems in accordance with applicable DISA Security Technical Implementation Guides (STIGs) to ensure Information Assurance compliance. When the Contractor cannot complete such work by a required suspense date or because of configuration limitations, the Contractor shall provide a Plan of Actions and Milestones (PoAM) to the COR for submission to the Authorizing Official (AO) a minimum of 10 days before the suspense date. - Schedule work in accordance with RCC-E procedures for service interruptions and maintenance windows. The Contractor shall perform backup and restoral operations for all managed systems in accordance with established RCC-E policies for the particular system and on the designated archives. All policies are maintained on the RCC-E SharePoint portal. - Document all work in the current NETOPS and DCO ticketing systems. - Provide call-out support outside core hours seven days a week. - Assist the COR in establishing vendor support requests when a problem exceeds technical capabilities. - Develop and tune telemetry from managed systems to report to and integrate with RCC-E management systems for example Spectrum and System Center Operations Manager (SCOM), to enable efficient and rapid diagnoses of root causes of incidents and providing data for trend analysis. - Prepare Tactics, Techniques, and Procedures (TTP), Standard Operating Procedures (SOP), Executive Summary (EXSUMS), trip reports and white papers and submit in accordance with requirement Deliverables. Contribute in the preparation of agreements, policy, and guidance documentation such as Memorandums of Understanding / Agreement (MOU/A), Service Level Agreements (SLA). Review all SOPs and TTPs annually and update as required to ensure the SOPs and TTPs remain current and in compliance with DoD, Army, and local directives. Annual reviews shall be documented as required by local procedures. - Synchronize DCO programs with ARCYBER personnel as required via working group participation to develop, research, publish, test, and annually update, in accordance with requirement Deliverables, Standard Operating Procedures and Tools, Tactics, Techniques and Procedures (TTTP) related to Threat Detection, Computer Defense Assistance Program (CDAP), and the Cyber Intrusion Analysis Program (CIAP). This includes providing support after core hours due to time zone differences between the RCC-E areas of operations and ARCYBER, other DCODs, RCCs. - Support Cybersecurity Service Provider (CSSP) accreditation. Develop and maintain an automated library or repository of documentation validating compliance with CSSP accreditation requirements. CSSP evaluations are an on-site evaluation and validation of compliance with mandated CSSP requirements as outlined in DoDI 8530.1, Cybersecurity Activities support to DoD Information Network Operations and DOD O-8530.1-M, Department of Defense Computer Network Defense (CND) Service Provider Certification and Accreditation Program. The Contractor shall evaluate their compliance by using the current version of DoD Cybersecurity Services Evaluator Scoring Matrix. CSSP accreditation requirements and the scoring matrix shall be reviewed biannually and SOPs and TTPs updated within five (5) working days of review, if necessary, to ensure SOP and TTPs remain current and are in compliance with DoD, Army and local directives. Success of this task is measured through documented evidence of continuous improvement from the current maturity level to achieving the highest maturity level described in the DoD Cybersecurity Services Evaluator Scoring Metrics. - Provide content management on web portals and web applications located on both the NIPRNet and SIPRNet. The Contractor shall ensure the information posted is relevant to the current cyberspace operations climate. Exercise Support The Contractor shall: - Participate, if tasked, in exercises and assist with the development, planning and support of Combatant Commands (CCMD) and Army directed exercises such as Gaining Cyber Dominance or other cyberspace engagements. Attend exercise-planning conferences (usually two (2) to three (3) per exercise), provide expert advice for development of planning documentation, participate during exercise events, and prepare After Action Report (AAR) and lessons learned during all phases of supported exercises. A minimum of 12 exercises per year is expected to be performed in the theater. Total annual exercises is not expected to exceed 24. Exercises may be conducted in field conditions. During exercises contractor personnel may be required to billet in military barracks or tents and complete pre-deployment/theater specific plans and training to include, but not limited to the following: 1. SERE 100 2. Country Threat Brief 3. Aircraft and Personnel Automated Clearance System (APACS) 4. Anti-Terrorism Training. - Support Cyberspace Operations (CO) and DCO mission planning, mission analysis, and technical analysis. Develop and/or provide input to Operation Orders (OPORDs), CONOPs, and Courses of Action (COA) to support the Information Operations (IO) and DCO mission. Total annual mission planning events is not expected to exceed 24. This does not include exercise planning. Network Services Description of Services - The RCC-E defends the European theater Networks by providing secure operation of the Top Level Architectures (TLAs) and the (JRSS). The Contractor shall provide call-out support after core hours, 24 hours a day, seven days a week, and ensure that the network and services are available 99.9 percent of the time. Contractor Managed Services The Contractor shall: - Remotely manage the TLA ACL configurations on each installation according to AR 25-2, the Joint Technical Architecture (JTA).Currently there are 3 NIPRNET TLA configurations at multiple sites; such as Wiesbaden, RHN and Stuttgart - to include AFRICOM, in Germany. - There are 4 SIPRNET and 2 CENTRIXS-ISAF (CX-I) TLA stacks. The number of TLA stacks will change (SIPRNET, NIPRNET, and CX-I) as the JIE evolves and global JRSS deployment is fully realized. Manage Access Control Lists (ACL) The Contractor Shall: - Make all ACL modifications to the TLA without disruption to service. If a disruption in service is expected to occur, an authorized outage status shall be requested and posted on NSS. Authorized outages must be approved or directed by government before they are executed. - Provide support to the RCC-E Theater Cyber Operations & Integration Center (TCOIC) 24 hours a day, seven days a week, to troubleshoot outages and other network issues according to government policy and direction. Coordinate with the NETCOM Fusion Cell to resolve higher level outages. - Maintain Access Control Lists (ACLs) and firewalls using Deny All Permit by Exception (DAPE). - Manage, monitor, secure, and sustain such devices as security routers, switches, firewalls, and out-of-band (OOB) managers (terminal servers). - Resolve incidents reported via Network Operations (NETOPS) Support System (NSS) trouble ticket. Virtual Private Network (VPN) The Contractor Shall: - Operate the VPN concentrators in the TLAs and the JRSS. - Manage public key infrastructure (PKI) certificates. - Ensure correct routing of VPN traffic. - Install, configure, monitor, secure, and sustain VPN devices. - Monitor, troubleshoot, and resolve VPN related trouble tickets. - Apply software releases, updates, and updates for VPN management, as required. Network Design The Contractor Shall: - Design networks that ensure proper redundancy. - Create internal and external networks through use of the open systems interconnection (OSI) model and management of the Transmission Control Protocol/Internet Protocol (TCP/IP) stack. - Plan and implement procedures to monitor network telecommunications links and such hardware as routers, switches, and IDS. - Install, configure, and operate devices as routers, switches, content engine, and firewalls. - Model and diagram networks utilizing current modeling/networking tools. - Provide status of STIG compliancy, remediation actions and reports. Transport Network (ATM/SONET/DWDM) The Contractor Shall: - Provide onsite technical support and management of the installed ATM/SONET/ Dense Wave Division-Optical Transport Node (DWDM -OTN) network. - Manage and maintain ATM/SONET/DWDM-OTN system to achieve 99.9% operational availability, escalating problems to the appropriate 5RCC-E POC and/or vendor technical support group for assistance as necessary. - Provide advice and assistance to the Government for troubleshooting and general system operation. - Provide technical assistance to maintain a 99.9% level of system availability. - Provide the system administration for the ATM/SONET/DWDM rings and optical equipment. - Operate network management systems; provision and configure equipment, troubleshoot, and fault isolate system malfunctions. - Provide routine network software and hardware installation and replacement. - Provide emergency replacement of failed or upgraded network components and provide on-site support if required. - Provide Network data base backup and restore. Enterprise Services Support Cyber Security Service Provider Accreditation - Support Cybersecurity Service Provider (CSSP) accreditation. Develop and maintain an automated library or repository of documentation validating compliance with CSSP accreditation requirements. CSSP evaluations are an on-site evaluation and validation of compliance with mandated CSSP requirements as outlined in DoDI 8530.1, Cybersecurity Activities support to DoD Information Network Operations and DOD O-8530.1-M, Department of Defense Computer Network Defense (CND) Service Provider Certification and Accreditation Program. - Evaluate their compliance by using the current version of DoD Cybersecurity Services Evaluator Scoring Matrix. CSSP accreditation requirements and the scoring matrix shall be reviewed biannually and SOPs and TTPs updated within five (5) working days of review, if necessary, to ensure SOP and TTPs remain current and are in compliance with DoD, Army and local directives. Success of this task is measured through documented evidence of continuous improvement from the current maturity level to achieving the highest maturity level described in the DoD Cybersecurity Services Evaluator Scoring Metrics. Exchange Messaging - While USAREUR has migrated to DISA's Enterprise Email on NIPRNET and SIPRNET, the RCC-E still maintains a small infrastructure of legacy servers on both networks. The supported COCOM's have not yet, but will transition to Enterprise Email, but are also expected to also have legacy infrastructure to be supported. On the exercise and mission coalition networks, the 5RCC-E provides a full range of exchange services to USAREUR. The Contractor shall manage, monitor, and secure the Enterprise Exchange e-mail system, which supports e-mail users in the USAREUR Forest. The contractor shall provide spam anti-virus protection, a public folder instance, e-mail forwarding to back end servers at installations, mailbox service, and Outlook Web Access (OWA). The Contractor shall /perform remote operation and maintenance of Exchange servers. The Contractor shall ensure the system is secure and operational 99.9 percent of the time. The Contractor shall: - Provide call-out support after core hours, seven days a week. - Ensure connectivity to the Enterprise Exchange e-mail system. - Coordinate with IA branch chief to ensure APC firewalls are configured to protect the Enterprise Exchange e-mail system. - Monitor the Exchange e-mail systems daily to ensure consistent performance. - Perform fault management, preventive maintenance, backup and recovery, and security administration. - Provide Exchange application support, mobile user support, mail operation, and maintenance and service desk operations. Active Directory - The Active Directory Forest is comprised of approximately 160 domain controllers (DCs) (NIPR/SIPR/Coalition). The Contractor shall: - USAREUR and supported COCOMs' Forests Ensure the USAREUR and supported COCOMs forests are secure and operational 00.0 percent of the time.. - Ensure network connectivity to all Domain Controllers (DCs) in AFRICOM, EUCOM, and USAREUR. - Process configuration change requests. - Manage, monitor, secure, and sustain the supported Active Directory Forests (NIPR/SIPR/Coalition). - Perform initial configuration to meet the security requirements for each platform added. - Monitor systems daily to ensure consistent performance. - Provide weekly status reports on the operational environment to the COR. Domain Name Service Management The Contractor shall: - Install, configure, manage, monitor, secure, and sustain DNS servers in accordance with existing policies and government guidance. - Install all required operating system and security patches and scan servers, utilizing Retina, to ensure Information Assurance Vulnerability Alert (IAVA) compliance. Scans are run quarterly. - Manage user accounts, network access control lists, and IP filter lists on DNS servers. - Create and delegate domains, create and delegate networks, create and modify Mail Exchanger (MX), Canonical Name (CNAME), Name-to-address Mapping (A), and Address-to-name Mapping (PTR) records. - Monitor, troubleshoot, and resolve assigned DNS related trouble tickets daily. - Register and update network assignments with the Department of Defense (DOD) Network Information Center (NIC) and ensure that all networks being used by the 5RCC-E and its customers are properly registered. - Assign and reclaim unused IP addresses for Army units and organizations in the USAREUR AOR. - Interface with public sector Internet service providers (ISP) to answer questions regarding Army-managed IP addresses. - Provide IP address usage statistical reports as required by mission needs and provide to the COR and section lead. Area Processing Centers (APCs). This enterprise establishes three APCs at key locations within USAREUR which provide support for consolidated applications to users across the theater, data warehousing, remote end-user IT services, and disaster recovery. All servers that provide an enterprise function are being consolidated at APCs or the installation level (bandwidth dependent) and placed in a server protected by an enterprise firewall. The Contractor shall: - Perform Capacity and Performance Management - Perform access control and manage user accounts, passwords, and virtual local area networks (VLAN). - Perform daily backups, implement system upgrades, and provide CM on all APC system and network devices. - Install all required patches and scan servers, utilizing Retina, to ensure Information Assurance Vulnerability Alerts (IAVA) compliance on all APC systems and network devices. Scans are run quarterly. - Manage and Monitor Trouble Tickets Daily - Provide weekly status reports on the operational environment to the COR. - Provide expertise to maintain and expand the cluster management and Storage Area Network (SAN) technologies implemented in the APC to meet the evolving missions and requirements for USAREUR and supported COCOMs. System Management (SysMan) The Contractor shall: - Configure, maintain, and monitor general purpose and critical computing assets through System Center Configuration Manager (SCCM) and System Center Operations Manager (SCOM). - Monitor, operate, secure, and maintain 75 SYSMAN servers on the NIPR, SIPR, and CENTRIXS-ISAF networks. The Contractor shall monitor, operate, and maintain SCOM agents on over 200 Enterprise Servers. - Maintain the Enterprise SCOM and SCCM application and Structured Query Language (SQL) databases. - Troubleshoot and maintain connectivity between the Tier I Roll-Up server and the APC Tier II servers and the Enterprise Packaging Repository/Data Warehouse Reporting Tier 0 server. - Provide support for troubleshooting SCCM Server Infrastructure issues, for example connectivity between sites, backlog of inboxes, management point issues, and distribution point issues. - Schedule with RCC-E Network and Active Directory Teams to maintain proper Active Directory and subnet Site Boundaries for each site. - Develop Custom Software Packages. - Create, maintain, and deploy Army Gold Master (AGM) Desktop deployment images across the theater using the current Army/DOD Enterprise system (currently SCCM) Operating System Deployment. - Identify unhealthy clients and create processes to self-heal clients (for example; Cache size too small, assigned to wrong site, WUA errors). - Develop and deliver pre-formatted and ad hoc reports, per mission requirements or the government Quality Assurance Evaluator through the COR, as supported by the GNEC tools administration interface(s). Enterprise Management & Information Assurance (IA) Services Enterprise Directory Services (EDS) The Contractor shall support the mission of managing the EDS. The Contractor shall provide call-out support after core hours, seven days a week, and shall: - Network connectivity Ensure network connectivity and that TLA firewalls are configured to Enterprise Directory servers. - Perform daily monitoring to ensure consistent, optimal performance. - Monitor and review all event logs. - Provide Configuration Management support for Enterprise Directory Services. - Install all required patches and scan servers, utilizing Retina, to ensure IAVA compliance. Scans are run quarterly. - Manage, monitor and sustain SQL and Hub Active Directory. - Provide weekly status reports on the operational environment to the COR. Enterprise Security Monitoring - Install and maintain network intrusion detection system components. - Use/Operate current Intrusion Detection System's and Intrusion Prevention System's (IPS) tools to be identified in Appendix - Services and Assets. - Use a Security Information Event Management (SIEM) tool (Government provided, see Appendix - Services and Assets) to aggregate approximately 16 million security events per day from multiple sources, to include Snort, Firewalls, proxies, router, and system logs. - Monitor real-time, correlated events for in-depth investigation and analysis. - Monitor SIEM server status, and initiate necessary corrective action, for any problem identified. - Provide systems backups. Full and incremental backups of operating systems and configurations are required on SIEM devices. Emergency Management Modernization Program (EM2P)/Web-based Emergency Operations Center (WebEOC) The Contractor shall provide all operation and maintenance services necessary to sustain the EM2P and/or WebEOC infrastructure and end user capability within the OCONUS Theater of operations. The Contractor shall install, operate, administer, and maintain the various network management and security monitoring systems, operating systems and network application systems related to EM2P and/or WebEOC and supporting infrastructure. The Contractor shall be fully knowledgeable and capable of providing operation and maintenance support for EM2P and/or WebEOC infrastructure to include managing the Information Assurance requirements. The Contractor shall perform all activities necessary to sustain user access and enclave capability. Internal Services The Contractor shall manage, monitor, and secure all internal systems of the Command and use the internal tools to be described in Appendix - Services and Assets. Server and Workstation Support. The Contractor shall provide support for internal servers and workstations within the RCC-E for which they have administrative responsibilities. This support includes hardware and software installation, Common Office Environment configurations, troubleshooting, scanning, patching, and backup and restoration of internal servers and workstations. The Contractor shall: - Perform hardware upgrades, software upgrades, apply security patches, apply recommended operating system (OS) patches, test and install desktop software, add user accounts, remove user accounts, provide system performance tuning, and perform backups and restorals. - Scan workstations, utilizing Assure Compliance Assessment Solution (ACAS), for IAVA compliance and general vulnerabilities monthly and after patch installation. Scans are run quarterly. - Monitor, troubleshoot, and resolve server and workstation related trouble tickets. - Monitor and maintain Exchange(c) administrative/user groups for the RCC-E. - Manage user accounts for NIPRNET and SIPRNET servers, systems, and Installation Support Module (ISM) applications. - Provide a Subject Matter Expert (SME) for implementing, administering, and providing user guidance for Citrix applications and Thin Client architecture. Enterprise Configuration Management/Service Level Management (CM/SLM) The RCC-E manages identified configuration items (CI) throughout the theater and addresses all aspects of CM, to include configuration identification, configuration status accounting, and configuration audits. The Contractor shall update/modify the existing CM/SLM Plan. The Contractor shall support the CM process identified in the RCC-E C M/SLM Plan and shall make only approved changes to the RCC-E-managed network and associated devices. The Contractor shall document and track 99.9 percent of modifications using established tools.. The Contractor shall: - Follow Government-established software/hardware baseline configurations to set up, maintain, and configure RCC-E mission support servers, associated client workstations, and peripherals. - Operate and maintain the Configuration Management Database (CMDB) and prepare approximately 5 to 15 ad hoc reports per month to supported customers, or reflecting the status of the CMDB to the COR. - Monitor requests for change (RFC) to identify potential new CIs or major changes to existing CIs. - Provide COR accurate, timely information on CIs associated with the RCC-E missio...