DNFSB IT Support Services

Statement of Work (SOW) / Performance Work Statement (PWS)

To provide comprehensive IT and cybersecurity support services to the Defense Nuclear Facilities Safety Board (DNFSB), ensuring a secure, compliant, and audit-ready IT environment. The contractor will support the agency's IT operations, cybersecurity, compliance, and modernization efforts.

This PWS outlines a broad range of IT and cybersecurity services, including:

• Continuous Cybersecurity Monitoring

• Audit Documentation

• Security Assessment and Authorization (SA&A)

• FISMA and CDM Integration

• Insider Threat and Privileged Access Management

• Policy and Regulatory Documentation

• Incident Response and Threat Intelligence

• Security Training and Awareness

• Configuration Management and Change Control

• Project and Task Order Management

• Systems Engineering and Enterprise Architecture

• Compliance Oversight

• Artificial Intelligence (AI) Support

• Asset Management

• Cybersecurity Operations

• Database Administration

• Help Desk Services

• IT Assessments and Risk Management

• Information Technology Compliance and Audit Support

• Mobile Device Management

• Network Operations

• Optional Surge Support

• Program and Contract Management

• SharePoint Development and Administration

• System and Server Administration

• Technical Policy Writing

• Training and Knowledge Transfer

• Web Development and Administration

• Microsoft 365 E5/G5 Security & Compliance (Purview DLP & Defender)

• Base Year: 10 months.

• Option Years: Four (4) option periods of 12 months each.

• Place of Performance: DNFSB Headquarters, Washington, DC 20004. Telework may be authorized, with a hybrid work model targeting 70% contractor staff onsite at HQ.

• Personnel Security Vetting: U.S. citizens required, with background investigations up to Tier 2 Public Trust.

• Privileged User Access: Compliance with DoD Directive 8140.01 and DNFSB-specific training.

• Physical Security: Safeguarding government equipment and information.

• Information Security: Protection of CUI, PII, OUO, and UCNI.

• Personal Identity Verification (PIV): Required for unescorted physical/logical access.

• Government Furnished Equipment (GFE): Laptops and necessary equipment will be provided.

• Prohibited Practices: Use of thumb drives, sharing credentials, and unauthorized security violations.

• Key Personnel: Program Manager, Cybersecurity Lead, AI/Advanced Technology Lead, Help Desk Manager, System Administrator Lead, Network Operations Lead, Compliance and Risk Analyst, Technical Policy Writer.

• Offeror Experience: Minimum 3 years of experience with Microsoft 365 E5/G5 security & compliance tools. Two examples of prior project experience required. Methodology for government tenant operationalization must be described.

Other / Unclassified

This document is an "Industry Day Notice" for market research purposes only. It announces an upcoming Industry Day event on March 18th, 2026, related to a planned full and open competition for Information Technology (IT) Operations & Maintenance (O&M), Helpdesk, embedded cybersecurity operational support, audit/compliance services, and AI-enabled operational enhancements. This notice is not a solicitation and does not request pricing.

• Purpose of Industry Day: To provide industry awareness, present a draft Performance Work Statement (PWS), validate assumptions, gather capability feedback, confirm performance metrics and contract structure, and ensure transparent engagement before a formal solicitation.
• Contemplated Requirement: Includes IT O&M, tiered Helpdesk, system monitoring, SLA management, surge support, transition services, integrated cybersecurity operational support (vulnerability management, compliance validation, security monitoring, patch management), IT audit and compliance support, and AI-enabled tools/automation within a Microsoft-centric, cloud-supported environment.
• AI Clarification: Focus is on commercially available AI capabilities integrated into the existing environment, not standalone AI development.
• Cybersecurity Clarification: Requirements are integrated into the operational scope, not a standalone SOC requirement.
• Industry Day Details:
  • Date: March 18th, 2026
  • Location: Teams
  • Attendance: Voluntary
• Registration: Required by March 16th, 2026, via email to industryday@dnfsb.gov, including company name, UEI, CAGE, NAICS codes, business size, and POC information.
• Capability Brief Submission: Vendors are invited to submit a brief (max 5 pages) by March 13th, 2026, to capabilitystatement@dnfsb.gov, addressing experience in IT O&M, Helpdesk, cybersecurity, AI, audit/compliance, transitions, SLA management, staffing, and risks in the draft PWS.
• Anticipated Timeline:
  • Industry Day: March 18th, 2026
  • Draft Solicitation Release (Estimated): Q3 2026
  • Anticipated Award: Prior to September 2026
• Important Notes: Participation is voluntary, costs are not reimbursed, no evaluation or pricing discussions will occur, and participation does not obligate DNFSB to issue a solicitation.