NIWDC EWD

Statement of Work (SOW) / Performance Work Statement (PWS)

This Performance Work Statement (PWS) supports Cybersecurity services for the Naval Information Warfighting Development Center (NIWDC) in support of the Electronic Warfare Database (EWD) requirements.

• Encompasses support for NIWDC EWD technical, professional, and administrative cybersecurity operations within the current Amazon Web Services (AWS) Information Level 6 (IL6) certified environment.
• Includes full lifecycle management: engineering, implementation, configuration management, patching, documentation, and sustainment for technologies within the PWS.
• Ensures systems security posture, safeguarding of sensitive data, specified deliverables, and overall hygiene of the cloud environments.
• Requires qualified and cleared personnel capable of performing cybersecurity workforce (CSWF) roles to support the Department of the Navy (DoN) network, systems infrastructure, and applications.

1. Navy Information Operations Database (NIODB) / Cybersecurity Support:

• Ensure confidentiality, integrity, and availability of cloud information assets.
• Develop and maintain knowledgebase on regulatory, threat, and technology landscapes.
• Provide security for cloud technologies, analyze existing cloud structures, and develop security policies.
• Implement and configure security controls as dictated by organizational policies.
• Monitor security alerts and logs for incidents.
• Manage vulnerabilities, analyze scans, and coordinate remediation.
• Develop and maintain configuration management plans.
• Develop and maintain comprehensive disaster recovery plans and strategies.
• Develop and implement cybersecurity audit processes.
• Apply coding and testing standards, security testing tools, and conduct code reviews.
• Conduct Privacy Impact Assessments (PIA).
• Develop methods to monitor and measure risk, compliance, and assurance.
• Formulate and update cybersecurity policies and procedures.
• Carry out risk assessments and develop strategies to mitigate identified risks.
• Maintain detailed documentation of security policies, incident response plans, and compliance audits.
• Provide expert advice and guidance on threats and cybersecurity findings.
• Respond to security incidents (initial investigation, containment, reporting).
• Assist in preparing for and participating in security audits.
• Deliverables: A&A Review reports, Contingency Plan reviews, Monthly Status Reports, incident reports, and situational reports.

2. Navy Information Operations Database (NIODB) / Cloud System Administrator Support:

• Provision and operate cloud environment (AWS), manage and optimize cloud environments, provide continuous operation, security, and scalability.

• Provision and configure cloud resources (virtual machines, storage, networking components).

• Monitor system performance, respond to alerts, and ensure high availability and reliability.

• Perform routine maintenance tasks, software updates, patch management, performance tuning.

• Run monitoring and operations (logs/metrics/traces, alerting, on-call response, troubleshooting).

• Perform patching and vulnerability remediation.

• Administer backup/restore and disaster recovery.

• Document standard operating procedures and maintain configuration/asset inventories.

• Install, configure, update, patch, monitor, and troubleshoot cloud-hosted systems.

• Monitor system resource availability, performance, functionality, integrity, scalability, and operational efficiency.

• Conduct functional, integration, and connectivity testing.

• Perform periodic system maintenance.

• Design, implement, and manage Microsoft Active Directory / identity policies, group policies, role-based access controls, security groups, and access control lists.

• Develop, maintain, and document system administration standard operating procedures, cloud operational runbooks, recovery procedures, and configuration management processes.

• Comply with approved organizational system administration procedures, cloud governance requirements, and configuration management controls.

• Implement and enforce local and cloud network usage policies, segmentation rules, access restrictions, and approved connectivity procedures.

• Ensure timely testing and application of security patches, hotfixes, firmware updates, and vendor-released mitigations.

• Maintain approved secure baselines for operating systems, servers, cloud resources, and hosted applications.

• Deliverables: Not explicitly detailed in this section but implied through task responsibilities.

• Compliance with all applicable DoD, DoN, cybersecurity requirements.

• Safeguarding of sensitive data.

• Ensuring systems security posture and overall hygiene of cloud environments.

• Adherence to established standards and procedures for confidentiality, integrity, and availability.

• Timely updates and patches applied to all cloud-based systems.

• Application of current and relevant DISA STIGs, Zero Trust, and RMF compliance.

• Monitoring of security alerts and logs to detect security incidents.

• Development and maintenance of disaster recovery plans and strategies.

• Compliance with organizational standards, business rules, and mission needs for Active Directory and group policies.

• Period of Performance: Base Year: 28 September 2026 – 27 September 2027, with four Option Years extending through 27 September 2031. An additional FAR 52.217-8 period is noted from 28 September 2031 to 27 March 2032.

• Place of Performance: Naval Information Warfare Training Group Norfolk, 1247 West C Street, Building U-132, Naval Station, Norfolk, VA. 23511. Vendor approved office upon COR approval.

• Security Clearance: Contractor personnel working on-site shall possess a Top Secret clearance with SCI access as a condition of hire.

• Personnel Qualifications: Specific years of experience and certifications are required for Key Personnel (Information System Security Engineer III, Site Lead) and Cloud System Administrators.

• Contractor Identification: Personnel must identify themselves as Contractor personnel and display distinguishing badges.

• Government Furnished Equipment/Information: Government will provide access to current information and data on a case-by-case basis. Workspace and normal office equipment will be provided for permanent on-site personnel.

• Hours of Operation: 0700-1600 Monday through Friday, except Federal holidays.

• Contractor Training: Annual training requirements include CUI, Records Management, Derivative Classification, DoD Cyber Awareness Challenge, and others.

• Background Investigations: Requirements for Non-Critical Sensitive [ADP/IT-II] positions include a favorably completed NACLC or T3/T3R equivalent investigation, SF-86 Questionnaire, and fingerprint submission. For non-sensitive duties, a NACI or T1 equivalent investigation is required.

• Access to IT Systems: Requires a DoD Common Access Card (DoD CAC) and may require a successful investigation depending on access level. SAAR-N form completion is required for all individuals accessing Navy IT resources.

Sources Sought Notice

This notice is for planning purposes only and is not a solicitation. The Naval Supply Systems Command (NAVSUP) Fleet Logistics Center Norfolk is seeking information from qualified sources to support the Naval Information Warfighting Development Center (NIWDC) with Electronic Warfare Database (EWD) professional, technical, and administrative support. This requirement involves support for cybersecurity operations within an existing Amazon Web Services (AWS) Information Level 6 (IL6) certified environment.

• Professional, technical, and administrative support for the NIWDC EWD.

• Support for cybersecurity operations within an AWS IL6 certified environment.

• A draft Performance Work Statement (PWS) detailing tasks, personnel qualifications, and deliverables is attached.

• Anticipated contract type: Firm Fixed-Price.

• Product Service Code: DB02 IT and telecom - compute support services, non-hpc (labor).

• Responses are due no later than 11 AM, EST on May 7, 2026.

• Responses must be emailed to Justin Hall (justin.d.hall12.civ@us.navy.mil) and Benjamin Fisher (benjamin.d.fisher8.civ@us.navy.mil).

• Specific format requirements for responses are detailed in the notice, including company information, CAGE code, UEI, business size, capability statement, past performance, TS/SCI clearance proof, and any questions.

• Standard company brochures will not be reviewed. Submissions are limited to five pages.

• NAICS Code: 541512 Computer Systems Design Services.

• Small Business Size Standard: $34.0 million.

• The government is determining acquisition strategy; a small business set-aside is possible if sufficient interest and capability exist among small businesses.

• Respondents interested in a small business set-aside should provide details on compliance with FAR clause 52.219-14, including teaming and subcontracting plans.

• This is not a request for proposals, and no contract will be awarded from this notice.

• The government will not pay for information submitted.

• Attachment 1: PWS-NIWDCEWD-SSN-Draft