RISK MANAGEMENT FRAMEWORK AUTHORIZATION PACKAGES & ADMINISTRATION

Background
The Department of the Navy Assistant for Administration (DON/AA) Navy Office of Information (CHINFO) manages U.S. Navy content for flagship websites, social media placements, and digital archives.
CHINFO requires Risk Management Framework authorization packages and administration services to accredit existing information systems, ensure system availability for Navy public affairs, satisfy FISMA requirements (Title 44 U.S.C. Subchapter III), and align with DoD 8510.01 RMF guidance.

Work Details
The contractor shall:
create Risk Management Framework (RMF) authorization packages and provide RMF support services to achieve RMF Authority To Operate (ATO);
install, configure, deploy, and provide training for Security Services appliances, including Host Based Security System (HBSS), Assured Compliance Assessment Solution (ACAS), and Microsoft Software Update Solutions (SUS) upgraded to the latest DISA baselines;
perform RMF processes for an on-premises workstation network of 40 computers and an AWS network of seven Windows server instances, following current U.S. Navy RMF guidance;
access Navy Enterprise Mission Assurance Support Service (eMASS) as ISO and ISSE;
create RMF Step 1–3 artifacts and support artifacts for Steps 4 and 5;
develop package documentation including System Security Plan, Security Assessment Plan, System Categorization Form, Hardware List, Software List, Architecture Diagram, POAM, Ports, Protocols, and Services Table, Risk Assessment, Incident Response Plan, Configuration Management Plan, and other required artifacts;
deliver virtual appliance training;
provide AWS monitoring: daily HBSS monitoring, daily system monitoring, daily audit log review, weekly patch compliance, monthly STIG compliance;
coordinate deliverables around a third-party AWS server migration expected within 90 days;
and perform follow-on option year monitoring and compliance per daily, weekly, and monthly periodicities.

Period of Performance
Base Year: January 2, 2023 – January 1, 2024;
Option Year 1: January 2, 2024 – January 1, 2025;
Option Year 2: January 2, 2025 – January 1, 2026;
Option Year 3: January 2, 2026 – January 1, 2027.

Place of Performance
Onsite at U.S. Navy Office of Information (CHINFO) facilities in the Pentagon, Washington, D.C., supporting an on-premises network of 40 workstations;
remote support of an AWS-based network of seven Windows server instances.

Bidder Requirements
Set-aside: Small Business Set Aside – Total (SBA);
contractor personnel must have Security+ certification, Windows Server Administration qualifications, and ACAS and HBSS training/qualifications;
for onsite support at the Pentagon and CHINFO spaces, personnel must hold at least a Secret security clearance;
separate individuals must fulfill the ISO and ISSE roles;
personnel must meet DON baseline job qualification standards per Appendix 4 of SECNAV M-5239.2 and maintain required certifications and continuing professional education for CSWF positions.