20R0109 amendment 1 add PWS.docx

W911SD20R0109

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

The following have been modified:

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

United States Military Academy U.S. Army Cyber Institute

JACK VOLTAIC 2020 CYBER RANGE SUPPORT

Part I

General Information

1. GENERAL: This is a non-personal services contract to provide cyber range support for Jack Voltaic 3.0 exercise. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government. The Contractor, in turn, shall be accountable to the Government for Contractor or subcontractor personnel.

1.1. Description of Services/Introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide cyber range support for Jack Voltaic 3.0 as defined in this Performance Work Statement (PWS), except for those items specified as government furnished property and services. The Contractor shall perform in accordance with (IAW) the terms and conditions of the contract and consistently with the established standards in this PWS and contract.

1.1.1. Jack Voltaic 3 is a multi-sector, public-private cyber security research project that will culminate in the form of an experimental exercise. The purpose of the project is to demonstrate the potential for a simultaneous physical and cyber-attack in two large cities that impacts multiple critical infrastructure sectors throughout Charleston, SC, and Savannah, GA. This project will produce a set of findings that will be published in an academic setting in order to increase the resilience of the civilian critical infrastructure that supports the operation of U.S. Army installations, enables the mission of DOD to protect the homeland and conduct operations, and facilitates rapid and safe force projection in support of worldwide missions. These findings must be published in a professional technical report that can be used to share common trends we have observed throughout multiple sectors, and recommendations to improve the resilience of these specific areas by implementing best practices that we have gleaned from our industry partners.

1.2. Background: The Army Cyber Institute has conducted two previous iterations of Jack Voltaic that have helped identify potential threats to critical infrastructure in the cities of New York and Houston. By working together with industry partners across multiple sectors, the ACI helped to identify gaps in existing policies, procedures and resources throughout these cities and bring these gaps to the attention of senior leaders. In the past however, some of the findings of the inaugural Jack Voltaic were considered sensitive and not released to the public in an academic forum. The purpose of this technical report will be to inform and educate on common problem areas across multiple infrastructure sectors and make recommendations to other municipalities in the U.S. to improve their resilience to natural disaster or deliberate attack.

1.3. Objectives: The basic service objective includes the following:

1.3.1. Provide pre-exercise support to include participation in planning meetings, building of the cyber range in accordance with the scenario and anticipated players, and testing of the cyber range..

1.3.2. Provide on-site support for the cyber range during the Exercise.

1.3.3 Collect, tag, and store exercise data both on-network and off-network

1.4. Scope: Service support in preparation for a 3 day execution event sometime between August – December 2020 of Jack Voltaic 3.0, participation in planning meetings, execution and support for up to three (3) day primary research event in two locations, and post-event feedback on data collection and event execution.

1.5. Period of Performance: To Be Determined. to cover design, implementation, review, and research in support of the Jack Voltaic 3.0 research experiment as well as various planning meetings and workshops. Execution for JV 3.0 is targeted for 3 consecutive days anticipated at to be held between August - December 2020 in both Charleston SC and Savannah, GA.

1.6. General Information

1.6.1. Quality Control: Quality Control is the responsibility of the Contractor. The Contractor is responsible for the delivery of quality services/supplies to the Government (see FAR 52.246-1 Contractor Inspection Requirements).

1.6.1.1. Quality Control Program: The Government is committed to a highly interactive relationship between quality control by the Contractor and quality assurance by the government recipient of services. This relationship shall be achieved through an effective Prevention Based Quality Control Program dedicated to ensuring the best possible products and services to end users. The Contractor shall provide their final written Quality Control Plan (QCP) no later than (NLT) the official contractor proposal and within five (5) days of any proposed changed to the Contracting Officer Representative (COR) or Contracting Officer (KO).

1.6.1.1.1. The Contractor’s quality program shall demonstrate its prevention-based outlook by meeting the objectives stated in the PWS throughout all areas of performance. The QCP shall be developed to specify the Contractor’s responsibility for management and quality control actions to meet the terms of the contract. The QCP as a minimum shall address continuous process improvement; procedures for scheduling, conducting and documentation of inspection; discrepancy identification and correction; corrective action procedures to include procedures for addressing Government discovered non-conformances; procedures for root cause analysis to identify the root cause and root cause corrective action to prevent re-occurrence of discrepancies; procedures for trend analysis; procedures for collecting and addressing customer feedback/complaints.

1.6.1.1.2. Within one (1) week from the completion of the training courses or upon request from the COR or KO, the Contractor shall provide, all reports generated as a result of the Contractor’s quality control efforts. This shall include any summary information used to track quality control, including any charts/graphs.

1.6.1.1.3. The Contractor’s QCP shall be incorporated into and become part of this contract after the plan has been accepted by the KO. Proposed changes made after KO acceptance shall be submitted in writing through the COR to the KO for review and acceptance prior to implementing any revision. The Contractor’s QCP shall be maintained throughout the life of the contract and shall include the Contractor’s procedures to routinely evaluate the effectiveness of the plan to ensure the Contractor is meeting the performance standards and requirements of the contract.

1.6.1.2. Contractor Discrepancy Report (CDR): When the Contractor's performance is unsatisfactory, a CDR will be issued. The Contractor shall reply in writing within five (5) work days from the date of receipt of the CDR, giving the reasons for the unsatisfactory performance, corrective action taken, and procedures to preclude recurrence.

1.6.1.3. Quality Assurance: The COR will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the COR must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s). When an observation indicates defective performance, the COR will require the Contractor or designated on-site representative to initial the observation to acknowledge the defective performance. The acknowledgement of the observation does not necessarily constitute Contractor concurrence with the observation, only that the Contractor has been made aware of the defective performance.

1.6.2. Property Management System: N/A

1.6.3. Recognized Federal Holidays: The Contractor shall not be required to perform services on recognized federal holidays. The recognized federal holidays include:

1.6.3.1. When a holiday occurs on a Saturday, Federal employees are normally granted the previous Friday as the holiday observance. When a holiday occurs on a Sunday, Federal employees are normally granted the following Monday as the holiday. The contractor shall work on the days the Government is scheduled to work.

1.6.3.2. When an unforeseen installation closure occurs on a regularly scheduled day of work, the Contractor will have the following options:

1.6.3.2.1. Reschedule the work so it is performed the following day unless the following day falls on a weekend.

1.6.3.2.2. Reschedule the work on any day that is mutually satisfactory.

1.6.4. Hours of Operation: The Contractor shall be responsible for providing services, between the hours of 0800 and 1700 EDT Monday through Friday, except federal holidays or when the government facility is closed due to local or national emergencies, administrative closings or similar government directed facility closings. The Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential to successful performance under this contract. No overtime (OT) or compensatory time (CT) is authorized. Contractor personnel shall not exceed a 40 hour work week; flexible work schedule may be considered.

1.6.5. Place of Performance: IAW PARC Policy Alert 14-33, Homeland Security Presidential Directive 12 (HSPD-12) issued 31 Dec 13. Contractor shall have routine access to Government-controlled facilities. Specific building location will be determined by the customer based on scheduling and will be communicated to the contractor in advance of the start of the training.

1.6.6. Security Requirements: Contractor personnel shall have a federally recognized identification and the ability to access military installations (no outstanding warrants or citations) at the time of the training, and must maintain the level of security required for the duration of the contract. Contractor personnel shall comply with all applicable security and safety regulations, guidance, and procedures, including local, referenced in this PWS and in effect at the work sites. All personnel must meet requirements IAW DODD 8570.

1.6.7. Special Qualifications. None

1.6.7.1. General:

1.6.7.1.1. The Contractor shall be responsible for ensuring all personnel performing work under this contract possess and maintain current certifications as indicated in the PWS and security requirements during the execution of this contract.

1.6.7.1.2. Contractor personnel performing work under this contract shall be able to read, write, speak, and understand the English language to effectively carry out all contract requirements. They shall have a command of both the written and spoken English language to properly clearly, and effectively communicate in person or via electronic devices (telephone or Email) with co-workers, customers, and the general public.

1.6.7.1.3. Contractor personnel performing work under this contract shall be U.S. citizens unless the provisions of Army Regulation 25-2, Information Assurance have been fully completed and approval has been granted by the Government for the non-U.S. citizen to perform the required support.

1.6.7.1.4. Access and General Protection/Security Policy and Procedures: All Contractor personnel performing work under this contract shall comply with applicable installation, facility and area commander installation/facility access, local security policies and security procedures provided by the Security Manager Government representative. Contractor personnel shall provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor personnel shall comply with all personal identity verification requirements as directed by Department of Defense (DoD), HQ Department of Army (DA) or local policies. Sponsoring organizations, activities, and persons will be responsible for monitoring contractor access by submitting a completed and approved DES Form 118 to the Installation All American VCC, detailing the contracted services to be performed, location of services, and duration of the contract. Contractors requesting access for less than one year may receive an AIE visitor card on a case by case basis, or a temporary vehicle pass for 90 days. Contractor cards will be issued for periods of one to three years depending on the terms of their contract. AIE card expirations may be updated to reflect a new contract period by submitting an approved DES Form 118 to the All American VCC. Renewed short term passes must be re-processed at the All American VCC. In addition to the changes otherwise authorized by this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor and subcontractor security matters or processes.

1.6.7.2. Other Qualifications: Instructors must have a deep and demonstrable understanding of the material and a background with practical experience that can validate the understanding of the material being taught.

1.6.8. Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation (FAR) Subpart 42.5. The post award conference will also be utilized to ensure contractor understands all HSPD-12 requirements. The KO, COR (and other government personal) will hold a quarterly progress meet with the Contractor to review the Contractor's performance. At these meetings the KO and COR will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.6.9. Contracting Officer Representative (COR): The COR will be identified by separate letter of appointment. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: Assures that the Contractor performs the technical requirements of the contract; performs inspections necessary in connection with contract performance; maintains written and oral communications with the Contractor concerning technical aspects of the contract; issues written interpretations of technical requirements, including government drawings, designs, specifications; monitors Contractor's performance and notifies both the KO and Contractor of any deficiencies; coordinates availability of government furnished property, and provides site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.6.10. Key Personnel: Key personnel shall not be added to or removed from the contract without express acknowledgement of the COR. Any changes to the working status of these key personnel shall be transmitted (in writing) to the KO/COR within ten (10) work days of the proposed change. If, for any reason, any of the key personnel becomes, or is expected to become, unavailable for work under this contract for a continuous period exceeding 30 work days the contractor shall promptly replace personnel with personnel who possess qualifications equal to or better than that of the original employee. The Contractor shall ensure all key personnel terminated or released from employment under this contract are replaced within ten (10) work days of the termination.

1.6.10.1. The follow are considered key personnel by the Government: The Contractor shall provide a Program Manager (PM) who shall be responsible for the performance of the work under this contract. The name of this person, and an Alternate PM (APM), who shall act for the Contractor when the PM is absent, shall be designated in writing to the KO at the post award conference. The PM or APM shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The PM or APM, with coordination with the customer, shall be available for communication throughout the period of performance.

1.6.10.2. Qualifications for all Key Personnel:

1.6.10.2.1. Program Manager (PM): The PM shall meet or exceed the following minimum qualifications: Project Managers must have a deep and demonstrable understanding of the material and a background with practical experience. The APM shall meet or exceed the same qualifications as the PM.

1.6.11. Contractor Personnel:

1.6.11.1. Identification of Contractor Personnel: All Contractor personnel attending meetings, answering government telephones, and working in other situations where their Contractor status is not obvious to third parties, are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are government officials. Any information systems or information processing systems which store, forward, or retain information which is the property of the United States Government must utilize software and hardware which is approved according to the Federal Information Processing Standard (FIPS) Publication (PUB) 201 when the devices or systems process For Official Use Only (FOUO) Information.

1.6.11.2. Contractor Personnel Appearance and Performance: It is essential that all Contractor personnel meet the highest standards of professionalism and personal integrity. The Contractor shall ensure their personnel do not perform work under the influence of alcohol, illegal prescribed drugs or any other incapacitating agents. Contractor personnel shall be neatly groomed and dressed in business casual attire to present a professional appearance at all times.

1.6.12. Organizational Conflict of Interest:

1.6.12.1. Purpose. To aid in ensuring that:

1.6.12.1.1. The Contractor does not obtain an unfair competitive advantage by establishing the ground rules for a future competition;

1.6.12.1.2. The Contractor's objectivity and judgment are not biased because of its present or future interests (financial, contractual, organizational, or otherwise) which relate to work performed under this contract; and

1.6.12.1.3. The Contractor does not obtain an unfair competitive advantage by virtue of its access to non-public or proprietary information belonging to others.

1.6.12.2. Definitions.

1.6.12.2.1. The term “Contractor” herein used in section 1.6.16., Organizational Conflict of Interest, means: (a) the organization (hereinafter referred to as "it" or "its") entering into this agreement with the Government; (b) all business organizations with which it may merge, join or affiliate now or in the future and in any manner whatsoever, or which hold or may obtain, by purchase or otherwise, direct or indirect control of it; (c) it’s parent organization, if any and any of its present or future subsidiaries, associates, affiliates, or holding companies, and; (d) any organization or enterprise over which it has direct or indirect control now or in the future.

1.6.12.2.2. The term "proprietary information" for purposes of section 1.6.16., Organizational Conflict of Interest, means any information considered so valuable by its owners that it is held secret by them and their licensees. Information furnished voluntarily by the owner without limitations on its use, or which is available without restrictions from other sources, is not considered proprietary.

1.6. 12.3. Organizational Conflicts of Interest Examples. The following examples illustrate situations in which organizational conflicts of interest may arise. These examples are not all inclusive.

1.6. 12.3.1. Biased Ground Rules. This type of conflict may arise in situations where a company sets the ground rules for a future competition. For example, when a Contractor develops requirements then competes to provide products or services to satisfy those requirements, thus obtaining a competitive advantage.

1.6. 12.3.2. Impaired Objectivity. This type of conflict may exist where a Contractor’s obligations under a contract require objectivity, but another role of the Contractor casts doubt on its ability to be truly objective. An example of this type of conflict is where a Contractor’s work under one contract entails evaluating itself, its affiliates, or its competitors under a separate contract.

1.6. 12.3.3. Unequal Access to Information. This type of conflict may arise when a Contractor has access to nonpublic or proprietary information as part of its performance under a contract that gives it an unfair advantage in a competition for a later contract.

1.6. 12.4. General Constraints. The provisions of FAR Subpart 9.5, Organizational and Consultant Conflicts of Interest, concerning organizational conflicts of interest govern this contract. Potential conflicts may exist in accordance with FAR 9.505-1, Providing Systems Engineering and Technical Direction, through 9.505-4, Obtaining Access to Proprietary Information. In this regard, the Contractor is responsible for identifying any actual or potential organizational conflicts of interest to the KO that arise as the result of performance under this contract. To avoid or mitigate a potential conflict related to performance under this contract, the KO will impose appropriate constraints such as the constraints discussed below. Since it is impossible to foresee all of the circumstances that might give rise to organizational conflicts of interest, the constraints discussed below are not all inclusive and the KO may impose constraints other than, or in addition to, the constraints listed below.

1.6. 12.4.1. The Contractor agrees that if it provides, under a contract or task order or delivery order, systems engineering and technical guidance for systems and programs, but does not have overall contractual responsibility, it will not be allowed to be awarded a contract or task or delivery order to supply the system or any of its major components or be a subcontractor or consultant to a supplier of the system or any of its major components (FAR 9.505-1).

1.6. 12.4.2. The Contractor agrees that if it prepares complete specifications for non-developmental items or assists in the preparation of work statements for a system or services under a contract or task order or delivery order, it will not be allowed to furnish these items, either as a prime Contractor, a subcontractor or as a consultant (FAR 9.505-2).

1.6. 12.4.3. The Contractor agrees that it will neither evaluate nor advise the Government with regard to its own products or activities. The Contractor will objectively evaluate or advise the Government concerning products or activities of any prospective competitors (FAR 9.505-3).

1.6. 12.4.4. The Contractor agrees that if it gains access to proprietary information of other companies, it will exercise diligent effort to protect such proprietary information from unauthorized use or disclosure (FAR 9.505-4). In addition, the Contractor agrees to protect the proprietary information of other organizations disclosed to the Contractor during performance of this contract with the same caution that a reasonably prudent Contractor would use to safeguard highly valuable property. The Contractor also agrees that if it gains access to the proprietary information of other companies it will enter into written agreements with the other companies to protect their information from unauthorized use or disclosure for as long as it remains proprietary and to refrain from using the information for any purpose other than that for which it was furnished. The Contractor shall provide copies of such agreements to the KO.

1.6. 12.4.5. If the Contractor, in the performance of this contract, obtains access to plans, policies, reports, studies, financial plans, data or other information of any nature which has not been released or otherwise made available to the public, the Contractor agrees that without prior written approval of the KO, it shall not: (a) use such information for any private purpose unless the information has been released or otherwise made available to the public, or (b) release such information unless release is otherwise authorized under the contract or such information has previously been released or otherwise made available to the public by the Government.

1.6. 12.5. Non-Disclosure Agreements. The Contractor shall obtain from each employee who has access to proprietary information under this contract, a written agreement which shall in substance provide that such employee shall not, during his/her employment by the Contractor or thereafter, disclose to others or use for their benefit, proprietary information received in connection with the work under this contract. The Contractor will educate its employees regarding the restrictions imposed by FAR 9.505-4, so that they will not use or disclose proprietary information or data generated or acquired in the performance of this contract, except as provided herein.

1.6. 12.6. Training. The Contractor shall effectively educate its employees, through formal training, company policy, information directives and procedures, in an awareness of the legal provisions of FAR Subpart 9.5 and its underlying policy and principles, so that each employee will know and understand the provisions of that Subpart and the absolute necessity of safeguarding information from anyone other than the Contractor's employees who have a need to know, and the U.S. Government.

1.6. 12.7. Subcontracts. The Contractor agrees that it will include the provisions in paragraphs 1.6. 12.4., 1.6. 12.5., and 1.6. 12.6., above and this paragraph in consulting agreements, teaming agreements, and subcontracts of all tiers, which involve access to information or the performance of services described in paragraph 1.6.15.4., above. The use of section 1.6.15., in such agreements, shall be read by substituting the word "consultant" or "subcontractor" for the word "Contractor" whenever the latter appears.

1.6.15.8. Additional Constraints. If this contract provides for the issuance of task or delivery orders, such orders may impose additional requirements and/or restrictions relating to 1.6.15., to include the requirement for the Contractor and its subcontractors and employees to furnish the Government with written non-disclosure agreements or statements of no conflict of interest. With regard to any proposal submitted by the Contractor, in response to a Request for Task or Delivery Order Proposal, by submitting its proposal the Contractor represents that it has disclosed to the KO, prior to the issuance of the task or delivery order, all facts relevant to the existence or potential existence of organizational conflict of interest as that term is used in FAR Subpart 9.5.

1.6. 12.9. Conflicts Involving Future Procurements. The award of contract, government taskings or acquiescence in the Contractor’s performance of services hereunder shall not constitute or be interpreted as a determination that the Contractor is eligible to participate in future procurements, developmental efforts, implementation efforts, or related activities. Only the KOs for such efforts, applying the rules, principles, and procedures of FAR Subpart 9.5, have the authority to determine whether a conflict exists, in connection with such procurements.

1.6. 12.10. Representations and Disclosures.

1.6. 12.10.1. The Contractor represents that it has disclosed to the KO, prior to award of this contract, all facts relevant to the existence or potential existence of organizational conflict of interest as that term is used in FAR Subpart 9.5.

1.6. 12.10.2. The Contractor represents that if it discovers an organizational conflict of interest or potential conflict of interest after award of this contract, a prompt and full disclosure shall be made in writing to the KO. This disclosure shall include a description of the action the Contractor has taken or proposes to take in order to avoid or mitigate such conflict.

1.6. 12.11. Remedies and Waiver.

1.6. 12.11.1. For breach of any of the above restrictions or for non-disclosure or misrepresentation of any relevant facts required to be disclosed concerning this contract, the Government may terminate this contract for default, disqualify the contractor for subsequent related contractual efforts, and pursue such other remedies as may be permitted by law or this contract. If, however, in compliance with section 1.6.16., the Contractor discovers and promptly reports an organizational conflict of interest (or the potential thereof) subsequent to contract award, the KO may terminate this contract for convenience, if such termination is deemed to be in the best interest of the Government.

1.6. 12.11.2. The parties recognize that this clause has potential effects, which will survive the performance of this contract, and that it is impossible to foresee each circumstance to which it might be applied in the future. Accordingly, the Contractor may at any time seek a waiver from the cognizant KO by submitting a full written description of the requested waiver and the reasons in support thereof (FAR 9.503).

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.2. CONTRACTING OFFICER (KO). A person with authority to enter into, administer, and/or terminate contracts, and to make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

2.1.3. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor, as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4. CONTRACTOR PERSONNEL. Contractor and subcontractor employees performing working under this contract.

2.1.5. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement (PWS).

2.1.6. DELIVERABLE. Anything that can be physically delivered, but may include non-physical things, such as meeting minutes or reports.

2.1.7. FACILITY CLEARANCE. A facility clearance (FCL) is an administrative determination that, from a national security standpoint, a facility is eligible for access to classified information at the same or lower classification category as the clearance being granted. The FCL may be granted at the Confidential, Secret, or Top Secret level. The FCL includes the execution of a Department of Defense Security Agreement (DD Form 441). Under the terms of the agreement, the Government agrees to issue the FCL and inform the Contractor as to the security classification of information to which the Contractor will have access. The Contractor, in turn, agrees to abide by the security requirements set forth in the National Industrial Security Program Operating Manual, commonly referred to as the NISPOM.

2.1.8. GOVERNMENT-FURNISHED PROPERTY (GFP) OR GOVERNMENT PROPERTY (GP). Property in the possession of or directly acquired by the Government and subsequently made available to the Contractor.

2.1.9. KEY PERSONNEL. Contractor employees who are critical for achieving PWS objectives. Key personnel shall meet position qualification and experience requirements indicated in the PWS. When key personnel qualifications are used as an evaluation factor in “Best Value” procurement, the Contracting Officer is the only one authorized to concur with key personnel replacement after award of the contract. When proposed key personnel resumes are used as an evaluation factor in best value procurement, a letter of commitment may be required from the individual whose resume is provided.

2.1.10. LOCAL TRAVEL: Any travel that is required to perform services IAW the PWS that is within a 50-mile radius of the place of performance.

2.1.11. N/A

2.1.12. PERFORMANCE PREQUIREMENT SUMMARY (PRS). A listing of the service outputs under the contract that are to be evaluated by the COR on a regular basis, the surveillance methods to be used for these outputs, and the performance requirement of the listed outputs.

2.1.13. PHYSICAL SECURITY. Actions that prevent the loss or damage of government property.

2.1.14. PROPERTY ADMINISTRATOR (PA). The authorized representative of the Contracting Officer appointed in accordance with agency procedures, responsible for administering the contract requirements and obligations relating to government property in the possession of a Contractor.

2.1.15. PROPERTY MANAGEMENT SYSTEM. System established by the Contractor that is used to manage GFP/GFE in its possession to control, use, preserve, protect, repair, and maintain.

2.1.16. QUALITY ASSURANCE. A planned and systematic pattern of all actions necessary to provide confidence that adequate technical requirements are established; products and services conform to established technical requirements; and satisfactory performance is achieved. For the purposes of this document, quality assurance refers to actions by the Government.

2.1.17. QUALITY ASSURANCE SURVEILLAND PLAN (QASP). The Government’s organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

2.1.18. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.19. SUBCONTRACTOR. One that enters into a contract with a prime Contractor. The Government does not have privity of contract with the subcontractor.

2.1.20. WORK DAY. The length of time during a day in which the Contractor provides services, in accordance with the contract. Also referred to as Business Day.

2.1.21. WORK WEEK. Monday through Friday, unless otherwise specified.

2.2. ACRONYMS:

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES: ACI will coordinate with the 91st Cyber Brigade (ANG) to utilize the ShadowNet range for Jack Voltaic 3.0. As such, the government will provide:

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1. General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Part 3 of this PWS.

4.2. Secret Facility Clearance: Not required

4.3. Materials: The Contractor shall provide training materials and information systems necessary to meet the requirements under this PWS.

4.4 The Contractor shall be prepared to migrate the virtual environment to a cloud solution of their choice, provided it meets the other access and utility requirements listed in part 5.

PART 5

SPECIFIC TASKS

5. Specific Tasks:

Phase I – Exercise Planning and Workup

5.1.1 The Contractor shall participate in person at a series of workshops of the Operational Exercise Design Team (OEDT), not to exceed 4 separate events lasting 2-4 days each. The ACI will determine the membership of the OEDT, which will include at a minimum ACI and Contractor personnel. The Contractor will provide onsite support during the actual exercise in both locations.

5.1.2 The Contractor shall gather and document the technical requirements for the development of customized virtualized networks that mimic the architecture and behavior of each participant organization. The contractor will coordinate with participating organizations and ACI to determine priority and level of detail to be included in the virtualized network.

5.1.2.1 The contractor shall develop up to twenty (20) distinct but integrated organizational virtual network enclaves. Twenty enclaves is the upper limit; expectation is that the total number of enclaves will not exceed that amount.

5.1.2.2 The contractor shall incorporate into the cyber range, to the degree possible, network architectures, number and type of hosts, and specific software platforms as requested by the Exercise participants.

5.1.2.3 If an organization is unable to provide any information on the technical nature of their networks, the contractor shall use a generic virtual network that is representative of the organization’s sector (e.g., finance, power).

5.1.2.4 The list of network tools and business software shall include:

5.1.2.4.2 Enterprise Resource Planner (ERP) Software, specifically for Human Resources and Accounting.

5.1.2.4.3 Network file sharing and accounts.

5.1.2.4.4 Human Machine Interfaces for City Traffic, Power Infrastructure, Port Authority operations, and transportation of goods to and from ports by truck and by rail, as determined by level of involvement from participating organizations.

5.1.3 The contractor shall produce a common operating picture (COP) which accurately displays the scenario events which have transpired to all participants in the tabletop exercise and range. These events will be provided to the contractor by exercise planners and will be geolocated on the Master Scenario Events List (MSEL).

5.1.3.1 The contractor shall prepare two detailed visualizations of cyberattacks from the provided scenario and their effects on participant systems. The specific events will be determined by the ACI. These visualizations will be for display purposes to showcase the impacts real cyberattacks could have. The visualizations should show before and after in a side-by-side display and be available for distinguished visitors. The visualizations should be available for exercise participants as well as determined by the white cell.

Phase II – Exercise and Post Exercise Activities

5.2.1 The Contractor shall provide the following on-site support for the Exercise in Savanah GA and Charleston SC:

5.2.1.1 Mission impact analysis to inform the participants of the mission effects of technical outages or compromises.

5.2.1.2 Network engineering to respond to any system failures.

5.2.1.3 Opposing forces (OPFOR)and scripted injects to attack the participants’ networks in accordance with the Exercise Schedule and MSEL. MSEL events will be programmed in advance and triggered by contract personnel within the white cell. OPFOR will continually attack participant systems throughout the exercise under direction from the white cell to ensure all participants are engaged during the live fire exercise.

5.2.2 Contractor shall perform offensive reconnaissance in advance of the Exercise in order to test and prepare the network environment based on the training objectives. The contractor shall perform testing to ensure all scripted cyberattacks on participant networks will function as intended during the exercise.

5.2.3 Contractor shall provide a virtual cyber range for utilization in preparation for and during the Exercise.

5.2.3.1 The contractor shall build the cyber range to include participants from up to ten sectors multiplied by two locations for a total of twenty participating sectors including: power, telecommunications, rail transportation, port transportation, healthcare, finance, state governance, city governance, emergency services, and defense industry.

5.2.3.2 The cyber range include virtual hosts and networks that mimic the relevant portions of the participants’ real information technology systems.

5.2.3.3 The cyber range shall integrate all participant networks into a holistic network that simulates the larger Internet.

5.2.3.3.1 Participant networks shall be able to communicate with each other using standard internet working protocols.

5.2.3.4. The contractor shall be prepared to integrate licensed software pursuant to participant requirements if the participating organization provides that license.

5.2.3.4.1 If licenses can be acquired at no cost or are provided by exercise participants, each organization’s network will include network and business software in use by the organization.

5.2.3.4.2 If licenses cannot be acquired at no cost or are not provided by exercise participants, the contractor shall ensure each organization’s network includes network and business software which meets industry standard (if applicable).

5.2.3.5 The contractor shall ensure the range is extensible to allow external red team or blue team organizations to connect systems with their own attack and defense tools.

5.2.3.6 The contractor shall construct the virtual range and host it in a cloud environment.

5.2.3.6.1 The contractor shall ensure exercise virtual workstations for exercise participants are Internet accessible using a web browser application. Participants shall not be required to install additional software on their devices which are not already common (i.e. Web Browser).

5.2.3.7 Contractor shall coordinate between the Persistent Cyber Training Environment (PCTE) administrators, Cyber Protection Brigade (CPB), and 91st Cyber Brigade as part of development and implementation of the cyber range infrastructure. The customer will provide all relevant contact information

5.2.3.7.1 The contractor shall coordinate with exercise participants and range owners to establish representative environments which incorporate virtual or physical devices from city traffic, energy, rail, and port operations sectors such that there are exercise interdependencies between the virtual range and physical range (i.e. attack effects on physical devices shall be reflected in the information available to exercise participants, or otherwise tangibly affect exercise participants ability to perform exercise roles) as needed for the scenario or determined by exercise participants in the planning events and ongoing communication.

5.2.3.7.2 Contractor shall incorporate physical devices volunteered from partner organizations into the range (if applicable).

5.2.3.7.3 Contractor shall ensure integration of all devices volunteered by partner organizations, and accepted by exercise planners, into the exercise with a cutoff date being 45 days prior to execution of Jack Voltaic 3.0.

5.2.4 The contractor shall collect and store exercise data both on-network and off-network

5.2.4.1 The contractor shall perform full packet captures of all network traffic for the duration of the Exercise

5.2.4.2 To the best degree possible, the contractor shall ensure all online and offline interactions are timestamped according to a synchronized exercise clock

5.2.4.3 Contractor shall ensure data capture includes properly tagged networking information, to include Operational Technology protocols used by physical devices and transmitted over the network.

5.2.4 The Contractor shall participate in an after-action review conference within 60 days of the conclusion of the Exercise.

5.2.5 The Contractor may retain a copy of the virtual environment. However, all final documents and network traffic capture developed pursuant to the contract shall be the sole property of the government upon conclusion of the contract. The contractor shall deliver all documents and data to the ACI on a Pegasus Drive.

Enterprise Contractor Manpower Reporting (ECMRA). Guidance can be found at: https://www.ecmra.mil

The Enterprise Contractor Manpower Reporting Application (ECMRA) is designed to collect information on funding source, contracting vehicle, organization supported, mission and function performed, and labor hours and costs for contracted efforts providing services to the Department of Defense (DoD) from contractors and DoD activities requiring contracted services from supporting contracting offices.

(End of Summary of Changes) image1.wmf