1. FY25 AGD PWS_04 Nov 24 v2.docx

FA8723-25-R-0003

FA8723-25-R-0003

FA8723-25-R-0003

Performance Work Statement FY25 AGD Upgraded Early Warning Radar (UEWR) FY25 Array Group Driver (AGD) Integration and Test 13 November 2024

Contract No.: TBD Task Order: TBD Performance Work Statement (PWS) Prepared by:

Space Systems Command Strategic Warning and Surveillance Systems Directorate Hardware Branch

SSC/SZBQ

1050 East Stewart Avenue Peterson SFB, CO 80914-2902

DISTRIBUTION STATEMENT D: Distribution authorized to the DoD and DoD Contractors only; Administrative/Operational Use (23 Aug 2023).

WARNING - This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et. seq.) or the Export Administration Act of 1979, as amended, Title 50, U.S.C., App. 2401 et. seq. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.

DESTRUCTION - Destroyed by any method that will prevent disclosure of contents or reconstruction of the document.

TABLE OF CONTENTS

1. Background

1.1. The US Space Force, Space Systems Command (SSC), Strategic Warning and Surveillance Systems-Hardware Branch (SZBQ) procures and sustains systems providing Missile Warning (MW), Missile Defense (MD), and Space Domain Awareness (SDA) capabilities in support of US and international activities. This Performance Work Statement (PWS) describes the required tasks in support of the Upgraded Early Warning Radar (UEWR) Product Division (PD).

1.2. Objective

1.3. Integrate and test new AGD cabinets into three unique UEWRs to resolve obsolescence issues, improve reliability, maintainability, and availability of the microelectronics.

1.4. The purpose of this task is to: (1) Integrate seven upgraded AGD cabinets consisting of two at Thule (THL) radar site in Pituffik Space Base, three at Fylingdales (FYL) Royal Air Force Station, and two at Clear (CLR) Space Force Station; (2) Update Software as required to install AGD cabinets to include, but not limited to, Mission Application Software (MAS) and Receiver Exciter Software (RES); (3) Deliver Level III Technical Data Package (TDP) and Technical Order (TO) data; and (4) Test upgraded AGD cabinets into the three aforementioned UEWR sites.

2. Description of Services

2.1. The scope of this effort will provide expertise and engineering to SSC/SZBQ through a partnership with contractor in support of the following major lines of effort during a 14-month Period of Performance (PoP):

2.1.0. Install AGD cabinets at THL and FYL.

2.1.1. Integrate AGD cabinets at THL, FYL, and CLR.

2.1.2. Test AGD cabinets at THL, FYL, and CLR.

2.1.3. Train site personnel on AGD cabinets at THL, FYL, and CLR.

2.1.4. Dispose of legacy AGD cabinets at THL, FYL, and CLR.

2.2. Specific requirements of this Task Order are fully defined in subsequent paragraphs.

3. Government Property and Services

3.1. Government-furnished information (GFI) may be required during performance of this Task Order (TO). Examples of GFI to be provided may include previous Government analyses and studies, USAF/USSF policy and guidance, DoD Security Classification Guides (SCG’s), operational plans and other references and sources that may be necessary to effectively perform analyses or other tasks. When required, contractor shall request GFI via the Contracting Officer Representative (COR) or designee and shall protect such information according to any applicable restrictions. Government Furnished Property (GFP) and Government Furnished Equipment (GFE) may also be required during the performance of this Task Order. Specific examples include:

3.1.1 GFP/E

1. Access to the Product Support Facility (PSF), Building 2025, Peterson Space Force Base (SECRET level clearance required)

1.1. Pre-coordination with PSF personnel and PD required to determine dates and times of access as well as number of personnel.

2. Access to radar hardware and software at System Integration Laboratory (SIL) within PSF

2.1. Pre-coordination with PSF personnel and PD required to determine dates and times of access as well as number of personnel.

3. Enhanced Technical Information Management System (ETIMS)

4. Operational accesses as listed below for THL, FYL, and CLR sites (SECRET level clearance required):

4.1.1. Access to site owned test equipment to support data collection and recording

4.1.2. Common Hand Tools and Expendable Shop Items Access

4.1.3. Access for interface verification and data collection

4.1.4. Access for cabinet installation, integration, and test

4.1.5. Access for training site personnel

4.1.6. Access for AGD cabinet part stripping, packaging, and shipping of legacy AGD cabinets

3.1.2 GFI

1. RBF PAVE PAWS & BMEWS I&III B1 Spec H293614 Rev F (23 Feb 05)

2. REX Software System Requirements Specification (SRS) G760500 Rev E (26 Jan 04)

3. REX Software SDD G760164 Rev C (20 Sep 06)

4. REX Software Version Description (SVD) R102093 Rev (14 Dec 10)

5. REX to Array ICD G760219 Rev E (29 Jan 04)

6. RBF to REX ICD G781771 Rev B (15 Oct 03)

7. REX B1 Spec G760205 Rev L –(11 May 05) Classified Addendum G760205-1 Rev H (11 Mar 04)

8. PAVE PAWS Array Face B1 Specification G264315-1 (30 Dec 09)

9. BMEWS I Array B1 Spec G226211 Rev B (12 Dec 12)

10. BMEWS III Array B1 Spec G452005 Rev E (1 Apr 92)

11. Ballistic Missile Defense System (BMDS) Upgraded Early warning- Radar Element Specification (ES) V2.0 (classified document) (5 Aug 15)

12. Pave Paws and BMEWS Prime Item Product Fabrication Spec (3 Sep 09)

13. Programmer, Electronic Command Signals 914205

14. Prime Item Development Specification Rev G H293101 (classified document) (1 Jul 10)

15. Critical Item Development Specification (CIDS) for the Receiver-Transmitter, Radar RT-1244/FPS-115 CI# 911446-1, CI# 911446-3 (CIDS 914203 B2 Rev C (12 Feb 16)

16. AGD Cyber Security Assessment from UEWR AGD Cabinet Replacement Program (ATSP3 CET # 15-520 Critical Design Review Briefing) (31 Jan 17)

4. Requirements

4.1.0. General

4.1.1. Travel: The contractor is required to travel to accomplish this requirement. Negotiated travel is considered acceptable upon delivery order award. Additional/changed travel requiring an increase in delivery order funding shall be forwarded to the Procuring Contracting Officer (PCO) for processing a delivery order modification prior to travel. Additional/changed travel shall be briefed at PD Program Management Reviews (PMRs).

4.1.2. In documentation, the contractor shall avoid the use of passive voice, so as to clearly identify the roles and responsibilities of the contractor, government and associated contractors.

4.1.3. Notification of Rights: The government requires unlimited data rights with delivered items. If required, the contractor shall identify and receive written government approval from the PCO prior to committing to the use of any privately developed items, components, processes, computer software, and/or technical data which they:

(i) intend to deliver with Limited Rights

(ii) intend to deliver with Government Purpose Rights

(iii) intend to deliver with Restricted Rights

(iv) have not yet determined if such rights should apply

4.1.4. Disposition of Excess Material and Contractor-Acquired Property (CAP): The contractor shall deliver a list of all CAP items and input it into the Data Accession List (DAL). CAP items selected for delivery to the Government will be identified in an Exhibit under Section B of the contract. Excess material and CAP shall be dispositioned in accordance with the Government Property clause in this contract and the contractors approved property management system.

4.2. Program Management Requirements

4.2.0 Management of Contract

4.2.1 Contractor shall utilize its performance management system to plan, schedule, budget, monitor, manage and report the cost, schedule and performance for this contract.

4.2.2 Contractor shall enable transparency through integrating the government PD into all applicable technical and managerial meetings (e.g. integrated product teams, working groups, planning meetings).

4.2.3 Associated Deliverables:

4.2.3.1 CDRL A001, Integrated Program Management Data and Analysis Report (IPMDAR) (Integrated Master Schedule).

4.2.3.2 CDRL A002, Funds and Man-Hours Expenditure Report

4.2.4 Contract Kickoff Meeting: The contractor shall plan, host and conduct a kickoff meeting with the Government for this contract within 30 calendar days of contract award.

4.2.5 To guide and summarize all planned, contractor-led discussions, the contractor shall provide briefing slides at least 5 business days prior to the kickoff meeting and provide meeting minutes within 10 calendar days into the DAL. The contractor shall include the following topics in the kickoff briefing:

4.2.6 Identification of key points of contact for this contract

4.2.7 Identification of required tasks for this contract and the contractor’s plan for supporting these tasks

4.2.8 A time-phased resource plan (spend plan and staffing plan) for this contract.

4.2.9 Integrated Master Schedule (IMS): As a minimum, the Contractor shall include key critical path tasks for install, integration, test, and disposition of the AGD cabinets and updated / submitted to PD on a monthly basis.

4.2.10 Risk mitigation plans for this contract.

4.2.11 Other topics as conditions warrant.

4.2.12 Contractor shall input relevant briefing material and conference minutes into the DAL.

4.2.13 Program Management Reviews (PMR): The contractor shall conduct a quarterly PMR. The PMR shall provide the current status of the cost, schedule, technical performance, and risk items. The PMR shall fully define the relationship between cost, schedule, and performance, and explain changes in those relationships over the course of the project. The PMR shall synchronize with the Contract Funds Status Report deliverable.

4.2.14 Contractor shall input relevant briefing material and conference minutes into the DAL.

4.2.15 Technical Interchange Meetings (TIMs): The contractor shall conduct TIMs and capture minutes as necessary in the performance of this task. The TIM with the contractor shall be scheduled when there is need for technical interchange between the government and the contractor. The content of the meeting can include the discussion of any information that has impact upon the task activities, including documentation contents or format.

4.2.16 TIM slides due 5 calendar days before TIM and minutes within 10 calendar days after TIM. Contractor format is acceptable. Include presentation materials in the TIM minutes. TIMs may be conducted via telecom.

4.2.17 Contractor shall input relevant briefing material and conference minutes into the DAL.

4.2.18 Commander’s In/Out Briefs: The contractor shall brief the UEWR site Commander to inform him/her of the purpose, scope, schedule, support needed, safety, pre-arranged downtime required, and results.

4.2.19 The Government will respond with approval/disapproval within 2 business days or during the applicable briefing (upon site Commander and /or PD approval).

4.2.20 Contractor Microsoft Power Point format is acceptable.

4.2.21 Contractor shall input relevant briefing material and conference minutes into the DAL.

4.2.22 Final Report: The contractor shall summarize all work accomplished under this task including significant technical accomplishments, problems encountered, solutions implemented, recommendations for improvement, and a comparison of planned schedules and costs with final performance. The contractor shall present a Final Report at the Closeout TIM.

4.2.23 Date of submission is 10 calendar days prior to the end of the period of performance indicated in the delivery order.

4.2.24 Contractor format is acceptable and is to be submitted for PD approval.

4.2.25 Contractor shall input relevant briefing material and conference minutes into the DAL.

4.3. Engineering Requirements

4.3.1 AGD Cabinet Installation, Integration and Test:

4.3.2 The contractor shall install, integrate and test two (2) AGD cabinets at THL and verify functionality in accordance with Government F3I specifications at UEWR Site THL. The AGD cabinets at THL are still crated and the installation floor will require an x-ray to bolt down AGD cabinets

4.3.3 The contractor shall install, integrate and test three (3) AGD cabinets at FYL and verify functionality in accordance with Government F3I specifications at UEWR Site FYL.

4.3.4 The contractor shall integrate and test two (2) AGD cabinets at CLR and verify functionality in accordance with Government F3I specifications at UEWR Site CLR.

4.3.5 The contractor shall fully perform specified data analysis activities on-site.

4.3.6 The contractor shall provide a Work Plan (WP) for work to be performed at each site.

4.3.7 The contractor shall provide an updated Test Plan, along with detailed Test Procedures for all test activities to be completed at each site a minimum of five days prior to initial Site Deployment Readiness Review (SDRR).

4.3.8 The contractor shall coordinate radar line numbers with SZBQ.

4.3.9 If necessary, the contractor shall conduct an Initial and Final SDRR for any non-test related activities conducted at each site.

4.3.10 The contractor shall conduct an Initial and Final Test Readiness Review (TRR) for all site integration and testing activities.

4.3.11 The contractor shall identify software changes required for installation and implement these changes in their checkout, in accordance with (IAW) all PD stated standards and policies to include this document’s cybersecurity section.

4.3.12 The contractor shall determine software changes needed to execute during normal operations, shall develop the appropriate software build working with the PD’s Agile Software Development Team, and shall test and document the software build.

4.3.13 The contractor shall calibrate AGD and connected / supported equipment output Radio Frequency (RF) signals to each array face.

4.3.14 The contractor shall simulate test targets through the radar utilizing approved scenarios as well as tracking orbiting space objects such as real-world satellites.

4.3.15 The contractor shall troubleshoot, update test procedure, and be available during the execution of Government testing and Trial Period.

4.3.16 The contractor shall provide one person to remain at site for the first three days of Trial Period.

4.3.17 The contractor shall resolve all quality and performance issues related to the new cabinets to include resolving Deficiency Reports (DRs), implementing cabinet modifications and applicable redesign until the site achieves Operational Acceptance (OA). Any and all Category-1 Deficiency Report (DR) will be closed before the project is operationally accepted.

4.3.18 The contractor shall analyze data and present results of cabinet integration and test at a TIM.

4.3.19 Utilizing the final TDP developed under the previous contracts (Contract Number H94003-04-D-0006, Delivery Order 0351 and Contract Number HQ0727-16-D-0006, Task Order HQ072719F1604), the contractor shall identify changes and provide TDP updates per site in accordance with MIL-STD-31000B.

4.3.20 Contractor shall input relevant briefing material and conference minutes (SDRR, TRR, TIMs) into the DAL.

4.3.21 Contractor shall provide a Test / Inspection Report for each site, after installation and testing is complete at that site.

4.3.22 Associated Deliverables:

4.3.22.1 A003 Work Plan

4.3.22.2 A004 Test Plan

4.3.22.3 A005 Test Procedures

4.3.22.4 A006 Test/Inspection Report

4.3.22.5 A007 Technical Data Package

4.4 Facility Modifications:

4.4.1 The contractor shall provide any updates to previously delivered Facilities Requirement Document (FRD) packages per site, and review the content at a TIM.

4.4.2 The contractor shall implement previously approved facility modifications to perform AGD installation, integration, and testing.

4.4.3 The contractor shall modify the facility hardware at the installation site and remove temporary facility modifications after AGD integration and test is complete.

4.4.4 The contractor shall verify the facility structure is back to its original state.

4.4.5 Contractor shall input relevant briefing material and conference minutes into the DAL.

4.4.6 Associated Deliverables:

4.4.6.1 A008 Facilities Requirements Document (FRD)

4.5 Software Modifications:

4.5.1 The contractor shall develop Site-Unique Adaptive Parameters Software (SAPS) and follow PD processes to have them compiled into the Mission Application Software (MAS) and/or the Receiver Exciter Software (RES).

4.5.2 The contractor shall verify the AGD CCAs firmware coding through CCA tests and/or actual radar operation.

4.5.3 The contractor shall develop AGD CCAs firmware and integrate the modified software and CCA firmware into the AGD Cabinet Hardware.

4.5.4 The contractor shall document changes to the MAS and/or RES System Requirements Specification (SRS) during AGD integration and test.

4.5.5 The contractor shall document changes to the Software Version Description (SVD) during AGD integration and test.

4.5.6 The contractor shall provide a Software Configuration Management Plan (CMP) for all firmware / software.

4.5.7 Associated Deliverables:

4.5.7.1 A009 Computer Software Product end items

4.5.7.2 A00A Software Version Description (SVD)

4.5.7.3 A00B System Requirements Specification (SRS)

4.5.7.4 A00C Software Configuration Management Plan (CMP)

4.6 AGD Cabinet Disposition:

4.6.1 Upon successful installation, integration, and testing of each AGD cabinet, the contractor shall remove the legacy cabinet and dispose of the legacy cabinets according to their Government approved disposal plan.

4.6.2 The contractor shall provide the proposed disposition plan to the Government No Later Than (NLT) 60 calendar days prior to commencement of installation per site.

4.6.3 The contractor shall coordinate with Defense Logistics Agency (DLA) Disposition Services for turn-in of legacy cabinets.

4.6.4 The contractor shall prepare all necessary turn-in documents as required by DLA. A copy shall be supplied to the Government and a copy shall be shipped with the equipment.

4.6.5 The contractor shall provide a drain and purge statement following the guidance from DLA. A copy shall be supplied to the Government and a copy shall be shipped with the equipment.

4.6.6 The contractor shall provide Certificates of Volatility (COV) or Letter of Volatility (LOV) for all equipment and components being removed from site. A copy shall be supplied to the Government. After COVs are received and prior to removal of the equipment, the contractor shall remove all classified markings from equipment.

4.6.7 The contractor shall follow guidance as prescribed in MIL-STD-2073-1E and DID DI-PACK-80120D.

4.6.8 Contractor shall input relevant COV and LOV documents into the DAL.

4.7 AGD Cabinet Materials:

4.7.1 The contractor shall procure materials as required for mitigation of risks associated with the installation and integration of the cabinets after receiving approval from the Government.

4.7.2 The contractor shall deliver information required by PD in the case any new material or parts are required for the installation and integration of the AGD cabinets.

4.8 Asbestos Remediation:

4.8.1 The contractor shall provide asbestos abatement during installation of the new AGD cabinets and removal of the legacy AGD cabinets where necessary.

4.8.2 Asbestos abatement shall be required if any existing floor tiles are required to be removed and/or modified to accommodate installation and/or removal of the AGD cabinets.

4.9 Technical Order:

4.9.1 Data: The contractor shall provide technical data in accordance with the Air Force Technical Manual Requirement (TMCR) for AN/FPS132 30 Jan 2024 to support AGD Sites at THL, FYL and CLR).

4.9.2 Contractor shall input associated technical manuals into the DAL.

5. Cybersecurity

5.1. Cybersecurity Engineering

5.1.1. The contractor shall ensure that personnel performing cybersecurity functions are certified IAW DoD Directive (DoDD) 8570.01 M, DoDD 8140.01 M, and Air Force Manual (AFMAN) 13-1303.

5.1.2. Where applicable, the Contractor shall ensure the order-related changes to the DO-impacted systems are categorized IAW CNSSI 1253 and documented in the Security Plan, as part of the DoD Risk Management Framework (RMF) Package Deliverables.

5.1.3. In conjunction with above, the Contractor shall comply with current applicable NIST 800-53v5 or updated/superseded NIST RMF Guidance as applied by DoD in DoD Instruction (DoDI) 8500.01, “Cybersecurity” and DoDI 8510.01, “Risk Management Framework (RMF) for DOD Information Technology (IT)” as well as Air Force Instruction (AFI) 17-101, “Risk Management Framework (RMF) For Air Force Information Technology (IT)” and AFI 17- 130, “Cybersecurity Program Management.”

5.1.4. In conjunction with above, the Contractor shall ensure that common control identification has been accomplished or that current system security controls are applied as appropriate for the order-related changes to the DO-impacted systems and documented in the Security Plan as part of the DoD RMF Package Deliverables for the DO-impacted systems.

5.1.5. Where applicable, the Contractor shall ensure that security controls have been selected, or that current system security controls are applied as appropriate, including application of overlays and tailoring, for the order-related changes to the DO-impacted systems and documented in the Security Plan as part of the DoD RMF Package Deliverables for the DO-impacted systems.

5.1.6. In conjunction with above, the Contractor shall document security control implementation for the order-related changes to the DO-impacted systems in the Security Plan as part of the DoD RMF Package Deliverables for the DO-impacted systems.

5.1.7. The Contractor shall source all compatible components from verified USAF/USSF/DISA/DoD Approved Products/Software (APL) lists. Please see below for a compilation of AP resource listings. In cases where new/unique products are developed by the Contractor, the expectation is that subcomponents will still be utilized to the maximum extent possible (e.g. approved H/W components utilized for build process). Deviations from approved products requires detailed justification per the processes described in this section.

The current DISA Approved Products List (APL) may be accessed via the DoD Cyber Exchange at https://cyber.mil under “Resources.” Additional recognized APL (SW/H/W) Resources:

1. https://www.afway.af.mil

2. https://aplits.disa.mil/processAPList

3. https://usaf.dps.mil/teams/EAO/Lists/COTSGOTS%20Software/EPL.aspx

4. https://storefront.disa.mil/kinetic/disa/service-catalog#/forms/dod-information-network-dodin-apl-testing-and-certification

5. https://www.commoncriteriaportal.org/products/

6. https://www.niap-ccevs.org/Product/PCL.cfm

7. https://intelshare.intelink.gov/sites/afisra-a6s/a6sc/Lists/APL

8. http://www.esi.mil/

5.1.8. The Contractor shall provide Letters of Volatility (LoV) in all cases where said documentation can be sourced from the manufacturer.

5.1.9. The Contractor shall create LoVs in all cases where documentation cannot be sourced from the manufacturer.

5.1.10. The Contractor shall perform static code analysis of all unique/developed software (S/W) products via a DoD-approved scan engine such as Hewlett Packard (HP) Fortify, Synopsis Coverity, SonarQube or similar approved product. Raw scan data with accompanying report of analysis will be provided identifying all vulnerability findings.

5.1.11. The Contractor shall perform Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) configuration of all compatible hardware and software (HW/SW) and provide scan data via Security Content Automation Protocol (SCAP) analysis or other DoD approved product. The DISA Secure Host Baseline (SHB) standard will be utilized for all applicable systems.

5.1.11.1. Current DISA STIG SCAP, and SHB information may be accessed via the DoD Cyber Exchange (https://cyber.mil).

5.1.11.2. Deviation from approved DISA STIG and/or SHB configuration (if applicable) can only result from incompatibility oof product HW/SW and/or degradation of mission functionality as a result of application. In such cases, evidence of same must be provided via explicit test result data.

5.1.12. In cases where STIGs or similar pre-existing guidance as noted above is unavailable the Contractor shall employ a methodical and documented hardening process for all components ensuring that all only functionality essential to the mission requirements remains following the hardening process.

5.1.13. Where applicable, the Contractor shall ensure employment of and/or compatibility of all applicable HW/SW with existing Antivirus (AV) and related infrastructure provisioning and sustainment as necessary, to include regular updates as required by RMF and other applicable DoD guidance (see above)

5.1.14. In conjunction with above, the Contractor shall ensure employment of and/or compatibility of all applicable HW/SW with existing Host-based security System (HBSS) and related Intrusion Protection System (IPS) infrastructure provisioning and sustainment as necessary, to include regular updates as required by RMF and other applicable DoD guidance (see above)

5.1.15. The Contractor shall obtain, test, and evaluate all applicable Information Assurance Vulnerability Management (IAVM) IAVAs and IAVBs applicable to product HW/SW and apply applicable patches/updates as necessary prior to final delivery. If available, the approved DoD Assured Compliance Assessment Solution (ACAS) will be utilized for compliance with above. Additional information is available via the DoD Cyber Exchange (https://cyber.mil)(1). In addition to above, the following websites include information re: IAVA and IAVB patches as well as announcements applicable to order-related changes of the DO-impacted systems:

5.1.15.1. https://patches.csd.disa.mil and

5.1.15.2. https://iavm.csd.disa.mil.

5.1.16. The Contractor shall review all applicable NOTAMs, TCNOs, CTOs, and SRGs (see DoD Cyber Exchange (https://cyber.mil) for HW/SW applicability and impact to the order-related changes to the DO-impacted systems. The Contractor shall validate against the DoD RMF Package Deliverables, updating the documentation to reflect the evaluation.

5.1.17. The Contractor shall provide unique/developed Static Code Analysis scan raw data results and report no less than 90 days prior to final delivery for review and potential remedial action prior to same. Static Code Analysis shall be used as article of evidence and included in the submission of the Security Impact Assessment.

5.1.18. In addition to above, the Contractor shall provide Information Assurance Vulnerability Alert/Management (IAVM) (e.g. ACAS), STIG and additional vulnerability scan files and results as appropriate via approved DoD vulnerability scanning solutions (ACAS, Xylok/ Security Compliance Checker (SCC), etc.) no less than 90 days prior to final delivery for review and potential remedial action prior to same.

5.1.19. Prior to final delivery, the Contractor shall ensure all products are capable of reporting auditing data compatible with both existing and known (planned) UEWR audit collection and reporting capability, to include both UEWR internal audit and Defensive Cyber Operations (DCO) data collection requirements.

5.1.20. Prior to final delivery, the contractor shall eliminate or otherwise mitigate all Category (CAT) I and CAT II cyber vulnerabilities/weaknesses that degrade confidentiality, integrity or availability, within the boundary of the software changes for the task-related change to the impacted systems. The contractor shall provide updated assessments of the product to verify the addressed vulnerabilities/weaknesses have been eliminated and no new vulnerabilities/weaknesses have been introduced.

5.1.21. Critical/high and/or CAT I findings shall be corrected prior to acceptance.

5.1.22. The Contractor shall provide a product Ports, Protocols and Services Matrix (PPSM) formatted as per the DoD PPSM Registry located at https://pnp.cert.smil.mil/pnp.

5.1.23. In addition to above, the Contractor shall provide a Product Cybersecurity Developmental Test Plan enumerating the development process per above.

5.1.24. In addition to above, the Contractor shall provide a Security Impact Analysis (SIA) in the nature of a risk assessment encompassing all of the above. This product may be provided in memorandum format and should adhere to the principles of the “DoD Cybersecurity Risk Assessment Guide” dated 22 April 2014. Copies of this guide and memorandum examples may be requested from the ECQR Cybersecurity Team as necessary to complete the assessment.

5.1.25. Associated Deliverables:

5.1.25.1. A00D DoD Risk Management Framework (RMF) Package Deliverables

5.2. Cybersecurity Artifacts

5.2.1. The Contractor shall provide Cybersecurity documentation actions enumerating results of product development and all assessments, adjusting the operational site RMF Package to support the change, documenting/coordinating results of System Impact Assessments (SIA), and documenting/coordinating Interim Authority to Test (IATT) request. This shall include product hardening as necessary as noted above.

5.2.2. The Security Plan, Security Assessment Report (SAR), Risk Assessment Report (RAR), Plan of Action and Milestones (POA&M) and Authorization Decision Document constitute the core RMF Security Authorization Package, as specified in DoDI 8510.01 Enclosure 6, paragraph 2.e.(2).

5.2.3. The associated artifacts to the core RMF Security Authorization Package are any and all artifacts required to support the content of the core RMF Security Authorization Package and are considered part of the DoD RMF Package Deliverables.

5.2.4. The Contractor shall provide the following associated artifacts reflecting the order-related changes to the DO-impacted systems with the DoD RMF Package Deliverables as applicable per above:

5.2.4.1. Topology, to include Accreditation Boundary conforming to current DoD CIO SV-1: Systems Interface Description guidance;

5.2.4.2. Hardware List;

5.2.4.3. Software List;

5.2.4.4. RMF Common/Security Control(CCI) selection matrix;

5.2.4.5. Static Code Analysis scan raw data results and report (original S/W as applicable);

5.2.4.6. STIG applicability list, compliance scans and results (including deviation as result of degradation to mission function as verified by provided test findings);

5.2.4.7. Ports, Protocols, and Services Matrix (PPSM) to include compliance with and registration on the DoD PPSM Registry located at https://pnp.cert.smil.mil/pnp.;

5.2.4.8. IAVM, STIG and additional vulnerability scan files and results as appropriate via approved DoD vulnerability scanning solutions (ACAS, Xylok/SCC, etc.); and

5.2.4.9. Authorization boundary network device configuration files.

5.2.4.10. Applicable waivers as obtained via official DoD channels and approved by EQCR.

5.2.5. Associated Deliverables

5.2.5.1. A00D DoD Risk Management Framework (RMF) Package Deliverables

5.3. Product Cybersecurity Developmental Test Plan

5.3.1. The Contractor shall provide an Interim Authorization To Test (IATT) and/or equivalent SIA request no less than 90 days prior to beginning Formal Contractor Testing at the DO-impacted systems.

5.3.2. The Contractor shall provide the following associated artifacts with the IATT/SIA Request, as applicable per above:

5.3.2.1. Updated POA&M, part of the DoD RMF Package Deliverables;

5.3.2.2. Topology, part of the DoD RMF Package Deliverables;

5.3.2.3. Hardware List, part of the DoD RMF Package Deliverables;

5.3.2.4. Software List, part of the DoD RMF Package Deliverables;

5.3.2.5. RMF Common/Security Control (CCI) selection matrix, part of the DoD RMF Package Deliverables;

5.3.2.6. Static Code analysis scan raw data results and report as applicable; part of the DoD RMF Package Deliverables.

5.3.2.7. STIG applicability list, compliance scans and results, part of the DoD RMF Package Deliverables.

5.3.2.8. IAVM Vulnerability scan files and results as applicable, part of the DoD RMF Package Deliverables;

5.3.2.9. Ports, Protocols, and Services Matrix, part of the DoD RMF Package Deliverables;

5.3.2.10. Applicable waivers as obtained via official DoD channels and approved by SZBQ.

5.3.3. Associated Deliverables:

5.3.3.1. A00D DOD Risk Management Framework (RMF) Package Deliverables

6. Product Support Elements

6.1. Product Support Management

6.1.1. The Contractor shall include and address all integrated product support elements as contributors to the design, development and implementation of the PWS changes to impacted systems.

6.2. Sustaining Engineering

6.2.1. The Contractor shall plan and execute technical tasks, engineering and logistics investigations and analyses to ensure continued operation and maintenance of the system being developed. This includes:

6.2.1.1. Collection and triage of all service use and maintenance data.

6.2.1.2. Analysis of safety hazards, failure causes and effects, reliability and maintainability trends, and operational usage profiles changes.

6.2.1.3. Root cause analysis of in-service problems (including operational hazards, deficiency reports, parts obsolescence, corrosion effects, and reliability degradation).

6.2.1.4. The development of required design changes to resolve operational issues.

6.2.1.5. Other activities necessary to ensure cost-effective support to achieve readiness and performance requirements over a system's life-cycle.

6.2.2. The Contractor shall recommend engineering changes which would improve technical performance, improve reliability and maintainability, or reduce operating costs.

6.2.3. Diminishing Manufacturing Sources and Material Shortages (DMSMS)

6.2.4. The contractor is responsible for developing, funding, and implementing all DMSMS resolutions subject to Government approval. Contractor responsibility includes all costs associated with mitigating DMSMS issues, including;

6.2.5. -investigating the continued availability, interchangeability, and substitutability of parts, material, and software;

6.2.6. -locating alternate/substitute parts, material, and software;

6.2.7. -vendor interface;

6.2.8. -any required redesign activities;

6.2.9. -system compatibility assurance;

6.2.10. -interface with the government networks;

6.2.11. -engineering efforts;

6.2.12. -testing and qualification.

6.2.13. The contractor-proposed DMSMS mitigation strategies will seek to prevent or minimize future costs to the government over a 5-year planning horizon. Life of Need buys are generally considered interim resolutions and will not be adopted without government concurrence. Any design changes considered necessary by these DMSMS management requirements will be made in accordance with the configuration management requirements of this contract.

6.2.14. Associated Deliverables.

6.2.14.1. A00E Life cycle Management Data - DI-MGMT-82274, DMSMS

6.3. Packaging, Handling, Storage & Transportation (PHST)

6.3.1. The Contractor shall execute PHST IAW MIL-STD-2073-1, MIL-STD-129 and MIL-STD-130 “Standard Practice for Military Packaging Requirements”; the Contractor may use ASTM D3951 15 as additional guidance.

6.3.2. The Contractor shall execute transportation as much as practicable in accordance with DoDI 4500.9E (Transportation and Traffic Management, SEP 2007.

6.4. Technical Data – Manuals

6.4.1. The contractor shall submit recommended additional, contractor-identified TM/TO, TMCR TM-86-01R, as a TM Contractor Furnished Aeronautical Equipment or Contractor Furnished Equipment (CFAE/CFE) Notices, accompanied with a numbered contractor contracts letter to the Government CO requesting review and approval of the recommended requirement prior to developing additional data.

6.4.2. The contractor shall notify the Government Program Office of location, dates and times of all TO Certification activities.

6.4.3. The contractor shall obtain a TO Distribution Account (TODA) in ETIMS, as described in TO 00-5-1, in order to obtain baseline TOs for the BPP-related Contract-covered systems.

6.4.4. Contractor shall input relevant briefing material (TO certification) and conference minutes into the DAL.

6.4.5. Associated Deliverables:

6.4.5.1. A00F Engineering Change Proposals (ECP)

6.5 Resource Management

6.5.1 The Contractor shall identify and provide all resources (including hardware, firmware, software, and documentation) necessary for the operation, maintenance and sustainment of the changes to the impacted systems.

6.5.2 Associated Deliverables:

6.5.2.1 A008 Facility Requirements Document (FRD)

6.6 Support Equipment

6.6.1 The Contractor shall identify, plan, resource and implement management actions to acquire and support the equipment (mobile or fixed) that includes but is not limited to associated multiuse end items, ground handling and maintenance equipment, tools metrology and calibration equipment, test equipment and automatic test equipment.

6.6.2 The Contractor shall maintain Calibrated Test Measurement Diagnostic Equipment (TMDE) against known standards and document in a Calibration, Measurement and Requirements Summary.

6.6.3 The Contractor shall submit a Support Equipment Recommendation Data (SERD) recommending specific items of support equipment for the items as applicable.

6.6.4 The Contractor shall provide the final content for Maintenance Test and Support Equipment List for integration into the UEWR technical baselines.

6.7 Training and Training Support

6.7.1 System Specific Training

6.7.2 The Contractor shall develop and deliver a training plan and training materials to train all maintainers on sustaining the impacted systems. The training must be consistent with MIL HDBK 29612 2 and IAW MIL PRF 29612B paragraphs 3.1 and 3.2, excluding paragraphs 3.2.1, 3.2.9, 3.2.11 and 3.2.12 and evaluated IAW MIL PRF 29612B paragraph 4, excluding paragraphs 4.3.1, 4.3.9, 4.3.11 and 4.3.12.

6.7.3 The Contractor shall integrate into the training the design, operational concepts, employment environments, and maintenance concepts.

6.7.4 The contractor shall provide three (3) three-hour training classes to site personnel during cabinet deployment.

6.7.5 Associated Deliverables:

6.7.5.1 A00G Training Materials

6.8 Computer Resources

6.8.1.1 The Contractor shall acquire and deliver all software licenses required to install, operate, and maintain the task-related changes to the impacted systems. All software licenses shall be in the Government’s name.

6.8.1.2 The Contractor shall ensure software, firmware, and hardware of computer resources comply with DoD and/or US Space Force cyber protection and information defense.

6.8.1.3 The Contractor shall provide documentation to support future software maintenance to correct faults, improve performance or other attributes, conduct preventive maintenance, and adapt to a changing organization and technical environment to include operations, deployment, security, configuration management, training (users and sustainment personnel), and technology refresh.

6.8.2 Associated Deliverables:

6.8.2.1 A00A Software Version Description (SVD)

7. Configuration Management

7.1. The Contractor shall brief at the JCCB prior to implementing any change at site. Briefing template will be provided by the Government.

7.2. The Contractor shall support a Government Physical Configuration Audit.

7.3. Associated Deliverables:

7.3.1. A00H Configuration Audit Summary Report and Certification

8. Data Rights

8.1. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government.

8.2. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer.

8.3. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

8.4. In order to implement the provisions at Defense FAR Supplement (DFARS) 252.227-7015(b) and (e) and DFARS 252.227-7014(b) and (e) and DFARS 252.227-7017, the Contractor shall disclose to the ordering Contracting Officer and ordering office in any proposal for a task order, or after award of a task order if not previously disclosed in the proposal any technical data or non-commercial computer software and computer software/source code documentation developed exclusively at Government expense in performance of the task order.

8.5. At or before the conclusion of the period of performance of this contract, the Government will acquire all AGD technical data, Model-Based Systems Engineering (MBSE) models, deliverables, databases, tools, computer software, and computer software documentation delivered, produced or otherwise provided to the Government during the performance of this contract in an editable format and accessible in the Government environment.

9. General Information

9.1. This Task Order (TO) requires classified processing facilities for data analysis, modeling, and report generation. In the event Contractor performance requires special security access, SSC/SZBQ will provide access to its facilities or coordinate the use at other sites specified on the DD Form 254.

9.2. Security Requirements

9.2.1. Classified work shall be performed on this task including SECRET per the basic contract DD Form 254. The Contractor shall ensure applicable Contractor personnel are United States citizens and have, at a minimum, a Secret security clearance. Contractor shall adhere to all Security Requirements outlined in Section 5.3 of the basic IDIQ contract (FA8730-21-D-0001) PWS.

9.2.2. Contractor is authorized access to the following information in performance of their contract:

9.2.2.1. Secret

9.2.2.2. Restricted Data (RD)

9.2.2.3. Formerly Restricted Data (FRD)

9.2.2.4. Non-SCI

9.2.2.5. Controlled Unclassified Information (CUI)

9.3. Safety Requirements

9.3.1. The Contractor shall implement the documented system safety program in the System Safety Program Plan consistent with MIL-STD-882, AFI 91-202 and AFI 91-217, Chapter 6.

9.3.2. The Contractor shall adhere to Occupational and Environmental safety regulatory guidance, to include state and site safety directives.

9.3.3. The Contractor shall document/report safety concerns and hazards in the appropriate system safety reports, including Mishap Risk Assessment Report, Safety Assessment Report.

9.3.4. Contractor shall input relevant reports (Accident Report, Mishap Risk Assessment Report, Safety Assessment Report) into the DAL.

9.4. Temporary Duty (TDY) Travel

9.4.1. The Contractor shall perform TDY non-local travel as required in the performance of this TO. All travel required by the Contractor under this task order will be reimbursed to the Contractor on a cost reimbursement Contract Line Item Number (CLIN) in accordance with Joint Travel Regulations (JTR). Other Direct Costs and General and Administrative (G&A) costs may be reimbursed for travel, but fee will not be added to travel costs.

9.4.2. Travel Request Submissions

9.4.3. The Contractor shall submit all requests for travel by email to the Government Contracting Officer Representative (COR) for approval.

9.4.4. Program Support Agreement (PSA)

9.4.5. The Contractor shall submit a PSA prior to efforts at the operational site. The PSA will include, at a minimum:

1. Program Information

2. Site and Project Installation Data

3. Facility Engineering Support Requirements

4. Communication – Computer System Support Requirements

5. Site Support/Supplies Requirements

6. Implementation Schedule

9.4.5.1. Associated Deliverable

9.4.5.2. A00J Technical Report-Study/Services (Program Support Agreement)

9.4.6. Trip Report

9.4.6.1. The Contractor shall include trip reports for any contract related travel during the reporting period and as requested by the Government. The trip report shall be posted to the DAL.

9.4.7. Access/Entry to Radar Sites

9.4.7.1. In accordance with RAFB IDP 31-101, Contractor personnel granted qualified base access may receive installation entry and circulation privileges under limited circumstances or conditions. They do not have the authority to sponsor anyone for access to UEWR sites or vouch for anyone to enter UEWR sites.

9.4.7.2. Identification of Contractor Personnel Requiring Access

9.4.7.3. In accordance with RAFB IDP 31-101 and BAFB IDP, a Contractor awarded a contract/order that requires services to be performed at radar sites shall provide the badging agent and PCO a list of all Contractor/Subcontractor personnel requiring access to the sites, the contract/order number and the period of performance. The Contractor shall also provide, if possible, the location of the work site and the days/hours during which the Contractor/Subcontractor personnel will require access to the sites.

10. Task Order Deliverables

10.1. The Contractor shall provide contract documentation as required by the DD 1423, Contract Data Requirements List (CDRL), for all tasks and subtasks performed in this TO. CDRLs will be delivered 100% on time as required by each respective form DD 1423-1. Content of each CDRL should be accurate, thorough, and fulfill the Data Item Description (DID) and PWS requirements. Furthermore, the Contractor’s deliverable format will be easy to follow and consistent among all deliveries for each CDRL type. Any corrections required to a CDRL will be accomplished and returned to the Government within five (5) workdays.

10.2. DAL: The Contractor shall establish a DAL on the Integrated Data Environment for data of interest to the Government, yet not requiring formal review and delivery via DD Form 1423.

10.3. Associated Deliverable:

10.3.1. A00K Data Accession List (DAL)

10.4. Markings

10.4.1. All deliverables will be marked with the following Distribution Statement: DISTRIBUTION STATEMENT D: Distribution authorized to the DoD and DoD Contractors only for Administrative/Operational Use. Other requests for this document shall be referred to SSC / SZBQ.

10.4.2. All deliverable documents will also be marked with an Export Control Warning Label:

WARNING – This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et seq.) or the Export Administration Act of 1979 (Title 50, U.S.C., App. 2401 et seq.), as amended. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.

10.5. CDRL Deliverables

10.5.1. Table 1 identifies CDRL items to be delivered under this contract. The DID references in table 1 can’t supersede the “Authority” references in the corresponding DD Form 1423 for the CDRL.

10.5.2. The contractor shall provide all unclassified deliverables as described in the DD form 1423 and upload the deliverable(s) within the SZBQ data environment.

Table 1 Contract Data Requirements List

4.2.3.1

image1.png