Navy Insider Threat Program

PERFORMANCE WORK STATEMENT (PWS) Professional Support Services for the U.S. Navy Insider Threat Program Prepared By: NIA/N72 Effective Date: March 2027 Version: 1.0 -- 1 of 30 -- NIA/N72 | Performance Work Statement (PWS) Page 2 of 30 1.0 INTRODUCTION, BACKGROUND, AND SCOPE 1.1 Introduction The U.S. Navy Insider Threat Program (InTP) is a centralized Navy program, mandated by Executive Order 13587 and focused on early identification and reporting of potential malicious activity. The Director of Navy Staff (DNS) is the Navy’s designated Senior Official for Insider Threat, and the OPNAV N2 under the Deputy Chief of Naval Operations (DCNO) for Intelligence, Operations, Plans, Strategy, and Warfighting Development (N2N3N5N7) is the Navy’s executive agent for the Navy program. The Naval Intelligence Activity (NIA) manages the day-to-day execution of the Navy InTP in support of OPNAV N2 and the DNS. The NIA requires professional support services to meet National and DoW InTP requirements and advance policy and capabilities to ensure program effectiveness in ensuring Navy warfighting, personnel, and operational readiness. The Navy InTP is a capability executing the Navy Insider Threat (InT) mission to prevent, detect, deter and mitigate insider threats from witting or unwitting insiders that may harm or place at risk Navy personnel, information, or resources. 1.2 Background Executive Order and National policy documents issued in response to compromises of classified information, active shooter, physical destruction and unauthorized disclosure incidents provide specific guidance to Departments and Agencies to counter threats from insiders. Per Executive Order 13587, “Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information” (October 7, 2011), and the “National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs”, agency heads “shall build and maintain an insider threat analytic and response capability.” The National Insider Threat Task Force identified an established hub as a “best practice” for agency insider threat programs and is an inspectable requirement. Navy received approval of an InT program of record in 2015/16 and began execution of the program in 2018. In accordance with guidance in the FY17 National Defense Authorization Act, Sec 951; the Navy InTP is focused on maintaining a program for protection and mitigation of insider threat risks to include loss or degradation of government information, resources, or capabilities as well as destructive acts/physical harm to others in the workplace. The elements of the program shall include the latest information protection technologies, capable of detecting, analyzing and coordinating the mitigation of insider threats and associated support capabilities. 1.3 Scope The primary purpose and scope of support services is to provide the Navy InTP with studies, research, analysis, advisement, and execution of requirements/deliverables supporting capabilities across the program’s multiple lines of operations that include: 1. Navy insider threat policy 2. User Activity Monitoring (UAM) on Navy classified and other designated networks -- 2 of 30 -- NIA/N72 | Performance Work Statement (PWS) Page 3 of 30 3. Navy Insider Threat Analytical Hub 4. Random Polygraph Program (RPP) for Privileged Users (PUs) 5. Navy InTP Strategic Outreach and Engagement (SOE) 6. Emerging InTP standards and requirements The services required under this task order are grouped into Program (Policy, RPP, and SOE), UAM, Hub, and Other Related support. Support within these groups include Executive Level (short-term projects, special studies, strategic analyses support, and high-level briefings) and Basic Level (analytical, technical, financial management support, programmatic support, data collection, policy review, process research and ADHOC task as applicable). 1.4 Period of Performance The base period of performance for this requirement is from 09 March 2027 through 08 March 2028 and will include four 12-month option periods. • Base: 09 March 2027 through 08 March 2028 • Option Period I: 09 March 2028 through 08 March 2029 • Option Period II: 09 March 2029 through 08 March 2030 • Option Period III: 09 March 2030 through 08 March 2031 • Option Period IV: 09 March 2031 through 08 March 2032 1.5 Place of Performance The place of performance will primarily be at the Government’s facilities in the Washington DC metropolitan National Capital Region/NCR (i.e. areas to include NSF Arlington (NSF-A), VA, Pentagon, Northern Virginia and Southern Maryland (Office of Naval Intelligence/ONI), etc.). The contractor may be required to have a facility in the Northern Virginia metro area to house contractor personnel should the need for personnel exceed those accommodated at the Government facilities. In those exceptional cases when contractor personnel work efforts are performed outside of Government facilities due to events which cause these facilities to be inaccessible, performance of appropriate work efforts will be limited to contractor facilities that comply with all requirements of the contract, including but not limited to facilities that comply with applicable security requirements. The contractor shall submit a request to the NIA/N72 leadership via the COR prior to contractor personnel commencing any work efforts outside Government facilities; this includes adhoc or situational telework upon government approval. In accordance with U.S. Navy policy and responsibilities for the implementation of a U.S. Navy Continuity of Operations (NAVCOOP) in the event of a Pandemic that restricts access to the contractor’s government facilities place of performance to include the Pentagon, the contractor will be notified by NIA/N72 leadership via the COR that normal access has been restricted and to whom such restrictions apply. In that event the contractor shall change the pl…