189AW CYBER SHIELD_PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

Simulation and Hands-on Instruction for Effective Learning and Development (SHIELD) 223 Cyberspace Operations Squadron

Background

The 223 Cyberspace Operation Squadron (COS) wants to further the development of the current cyber training environment, SHIELD. SHIELD is a fork of the Cyberarena developed by the University of Arkansas at Little Rock. This application is used to deliver a realistic and customizable training environment with the main goal of maintain cost effectiveness while keeping training environments realistic. SHIELD uses the Google Cloud Platform along with multiple programming, scripting, markup languages, and other web applications to orchestrate individualized training environments.

The 223 COS is seeking qualified sources to advance the SHIELD platform and add to the functionality, and security of this platform.

Objective

The objective of this performance work statement is to facilitate the development, enhance the security, and optimize the performance of the web application known as SHIELD. The goal is to deliver a robust and efficient application that ensures the utmost protection against cyber threats while achieving significant performance gains. The successful completion of this objective will result in an enhanced user experience, increased operational efficiency, and strengthened security measures for the SHIELD application.

Scope

Development:

a. Conduct a comprehensive analysis of the existing SHIELD web application, its functionalities, and user requirements.

b. Design and implement necessary enhancements, features, and updates to improve the overall functionality and user experience of SHIELD.

c. Ensure compatibility with modern web browsers and mobile devices, adhering to responsive design principles.

d. Implement best practices for code quality, maintainability, and scalability.

e. Conduct thorough testing, including functional, integration, and regression testing, to ensure the stability and reliability of the application.

Security:

a. Perform a detailed security assessment of the SHIELD web application to identify vulnerabilities, potential risks, and areas of improvement.

b. Implement appropriate security measures, such as encryption, secure authentication mechanisms, and access controls, to protect against unauthorized access and data breaches.

c. Conduct regular security audits and penetration testing to identify and address any potential security vulnerabilities.

d. Ensure compliance with industry standards and best practices for web application security, such as OWASP (Open Web Application Security Project) guidelines.

Performance Optimization:

a. Analyze the current performance of the SHIELD web application, including page load times, server response times, and overall system performance.

b. Identify performance bottlenecks and areas for improvement, such as database queries, caching mechanisms, and network latency.

c. Implement performance optimization strategies, including code refactoring, database optimization, and caching mechanisms, to enhance the overall speed and responsiveness of the application.

d. Monitor and measure the performance of the SHIELD application using appropriate tools and techniques and provide regular reports on performance metrics and improvements.

Documentation and Knowledge Transfer:

a. Create detailed documentation, including system architecture, installation instructions, and user manuals, to facilitate future maintenance and support of the SHIELD application.

b. Provide knowledge transfer sessions and training to relevant stakeholders on the functionality, security, and performance aspects of the SHIELD application.

Requirements

The following section specifies the Performance Objectives and Performance Elements for the contract.

1. Response Time:

a. The SHIELD web application shall have a maximum average response time of 2 seconds for typical user interactions, such as page loads, form submissions, and data retrieval.

b. The application shall maintain a minimum level of responsiveness, ensuring that users experience minimal delay or waiting time during their interactions.

2. Scalability:

a. The SHIELD application shall be designed and optimized to handle increasing user loads without significant degradation in performance.

b. The system shall be capable of accommodating a minimum of 500 concurrent users without any noticeable impact on response time or overall system performance.

3. Availability:

a. The SHIELD application shall maintain a minimum uptime of 99.999%, ensuring that it is accessible to users with minimal disruption.

b. Scheduled maintenance windows or downtime should be communicated in advance to minimize impact on users.

4. Security:

a. The application shall adhere to industry-standard security protocols and best practices to ensure the confidentiality, integrity, and availability of user data.

b. All sensitive data transmitted over the network shall be encrypted using secure protocols (e.g., HTTPS) to prevent unauthorized access or tampering.

5. Error Handling:

a. The application shall handle errors gracefully, providing clear and user-friendly error messages to users in case of any failures or exceptions.

b. Proper error logging and monitoring mechanisms shall be implemented to enable timely identification and resolution of errors.

6. Database Performance:

a. Database queries and operations performed by the SHIELD application shall be optimized for efficient and timely execution.

b. The application shall maintain a satisfactory level of database performance, ensuring that queries return results within an acceptable time frame.

7. Load Testing:

a. The SHIELD application shall undergo comprehensive load testing to evaluate its performance under high traffic conditions.

b. The load testing shall simulate realistic user scenarios and assess the application's ability to handle peak loads while maintaining acceptable response times.

Deliverables

Deliverable Quantity Due Date Development Reports 12 Monthly reports Security Analysis Reports 12 Monthly reports Performance Optimization Reports

12 Monthly reports

Documentation and Knowledge Transfer

1 Within 2 weeks of contract termination

Inspection and Acceptance:

The COR will perform inspection and acceptance of services to be provided. The COR will be named upon contract award.

A final inspection and acceptance of all work performed, reports and other deliverables will be performed by the COR and/or COR designee to ensure the services/products provided meet the requirements of the PWS and the Contractor shall make changes as requested during the inspection and acceptance process.

Inspection and acceptance will occur at the place of performance and take place within five (5) business days of task being completed. The Government will provide written notification of acceptance or rejection within five (5) business days. Inspection will include review of the deliverables to ensure adequacy.

The Government will accept goods, reports, and services only if they conform to all terms and conditions of the PWS and satisfy the performance standards developed under this PWS.

The Government will reject non-conforming products and services. The Contractor shall correct any deficiencies within fifteen (15) business days of when the Government issues the rejection notice. If the Contractor cannot correct the deficiencies within this period, the Contractor shall immediately notify the COR of the reason for the delay and provide a proposed corrective action plan within five (5) business days.

1. Quality Assurance (QA)

The Government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government will do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and acceptable quality level(s) or defect rate(s).

Performance Objective

Performance Standard

Acceptable Quality Levels (AQL)

Surveillance Method / By Whom

Response Time The contractor will show results of performance testing.

95% of user interactions with a response time of 2 seconds or less

Performance Review

/ COR

Scalability The contractor will show results of performance testing.

Handling a minimum of 500 concurrent users without noticeable performance degradation.

Random monitoring /

COR

Availability The contractor will show results of performance testing.

Maintain a minimum uptime of 99.99% with no more than

4.38 minutes of downtime per month.

Random monitoring /

COR

Security The contractor shall provide any documentation pertaining to the security of the application

No critical security vulnerabilities and timely resolution of identified vulnerabilities based on severity level

Random monitoring /

COR

Error Handling The contractor shall provide any documentation that

Displaying clear error messages within 2 seconds for

Random monitoring /

COR

explain the operations and handling of errors encountered errors and resolving critical errors within 1 hour

Database Performance

The contractor shall provide documentation showing the performance metrics of the database

Database queries executed by the SHIELD application shall have a response time of 10 milliseconds or less for 98% of queries

Monthly monitoring /

COR

Load Testing The contractor will provide reports showing all load testing metrics

500 concurrent users with an average response time of 2 seconds or less during load testing.

Random monitoring /

COR

2. Place of Performance:

223 Cyberspace Operations Squadron 310 CMSgt Williams Drive LRAFB AR, 72099

COR: To be identified at time of award

3. Period of Performance:

The Period of Performance begins the date of contract award execution and continues for one year from the date of formal government acceptance.

4. Contracting Officer Authority

The Contracting Officer (KO) is the sole person authorized to make or approve any changes to any of the requirements, terms and conditions of the contract, and notwithstanding any provisions contained elsewhere in the award, the said authority remains solely with the KO.

In the event the Contractor makes any changes at the direction of any person other than the KO, the change shall be considered to have been made without authority and no adjustment will be made in the contract terms and conditions, including price.

The KO shall be the only individual authorized to accept nonconforming work, waive any requirement of the order, and modify any term or condition of the order. The CO is the only individual who can legally obligate Government funds.

The Contracting Officer’s Representative (COR) is not authorized to make any commitments or otherwise obligate the Government or authorize any changes which affect the order price, terms, or conditions. The COR is responsible for the technical aspects of the project and serves as technical liaison with the contractor and is responsible for the final inspection and acceptance, and such other responsibilities as may be specified in the order.

5. Contract Type

Firm-Fixed-Price (FFP). All deliverables shall be clearly identified, complete with clear descriptions; due dates, and at a predetermined, agreed-upon price.

Government Contacts

Contracting Officer (KO):

189 MSG/MSC

MSgt Hope Townes Email: hope.townes@us.af.mil

Contracting Office Representative (COR): TBD

Contract Manager (CM):

The contactor shall designate a CM who shall ensure performance under this contract.

The name of this person, and an alternate who shall act for the contractor when the CM is absent, shall be designated in writing to the KO. The CM or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The CM shall work through the COR, to resolve issues, receive technical instructions, and ensure adequate performance of services. The CM shall ensure that contractor employees do not perform any services outside the scope of the contract without an official modification issued by the KO. The CM shall ensure contractor employees understand that services performed outside the scope of the contract are performed wholly at the expense of the contractor.

6. Government Holidays

Unless otherwise specified, the Contractor shall perform work Monday through Friday (excluding Federal Holidays) between the hours of 8:00 a.m. and 4:30 p.m. EST. Supplies or services scheduled for delivery on a Federal holiday shall be made the next business day.

Workplace is not available on the Government Holidays stated below, or as prescribed by an Executive Order (EO) due to inclement weather.

January (New Year’s Day) September (Labor Day) January (Martin Luther King Day) October (Columbus Day) February (President’s Day) November (Veterans Day) May (Memorial Day) November (Thanksgiving Day) June (Juneteenth) December (Christmas Day July (Independence Day)

OPERATION SECURITY (OPSEC)

Access and General Protection/Security Policy and Procedures. The contractor shall comply with all applicable installation/facility access and local security policies and procedures, which may be obtained from the Contracting Officer’s Representative (COR). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the local installation’s Security Forces, Director of Emergency Services or local Security Office. The contractor shall ensure compliance with all personal identity verification requirements as directed by DoD, Headquarters Air Force (HAF) and/or local policy. Should the Force Protection Condition (FPCON) change, the Government may require changes in contractor security matters or processes.

The contractor shall obtain base identification and vehicle passes, if required, for all contractor personnel who make frequent visits to or perform work on the Air Force installation(s) cited in the contract. Contractor personnel are required to wear or prominently display installation identification badges or contractor-furnished, contractor identification badges while visiting or performing work on the installation.

When reporting to the registration office, the authorized contractor individual(s) should provide a valid driver’s license, current vehicle registration, valid vehicle insurance certificate to obtain a vehicle pass.

SPECIAL QUALIFICATIONS

The contractor shall ensure all employees possess all required licenses in the performance of this contract. This includes education or other qualifications for the position in which the contractor employee is performing, dress codes, or other information. (NOTE: The Government does not provide training to contractors. Contractors must ensure that any personnel performing under a contract are fully trained, licensed, certified, and otherwise qualified to provide services.)

DEFINITIONS:

Contractor: A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Defective Service: A service output that does not meet the standard of performance associated with the PWS, SOW, PWS.

Deliverable: Anything that can be physically delivered and includes non-manufactured things such as meeting minutes or reports.

Key Personnel: Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the PWS, SOW, PWS.

When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

Physical Security: Actions that prevent the loss or damage of Government property.

Quality Assurance: The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

Quality Control: All necessary measures taken by the Contractor to ensure that the quality of an end product or service shall meet contract requirements.

Subcontractor: One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

Acronyms:

AEI Army Enterprise Infostructure AF Air Force ANG Air National Guard AR Army Regulation AT/OPSEC Antiterrorism/Operational Security BI Background Investigation CM Contract Manager COR Contracting Officer Representative COS Cyberspace Operations Squadron DD254 Department of Defense Contract Security Classification Specification DFARS Defense Federal Acquisition Regulation Supplement DoD Department of Defense DSCA Defense Counterintelligence and Security Agency FAR Federal Acquisition Regulation GFP/M/E/S Government Furnished Property/Material/Equipment/Services HQDA Headquarters, Department of the Army HSPD Homeland Security Presidential Directive IA Information Assurance IS Information System(s) KO Contracting Officer NGB National Guard Bureau OCI Organizational Conflict of Interest PII Personally Identifiable Information PIPO Phase In/Phase Out

POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program SCR Service Contract Reporting SSN Social Security Number TE Technical Exhibit USD(I) Under Secretary of Defense for Intelligence