22-R-7701_CVR_RFP Attachment 5-Task Order 1 PWS v2.5 (sam.gov).pdf

UNCLASSIFIED

CYBER VULNERABILITY RESEARCH

(CVR)

PERFORMANCE WORK STATEMENT

Task Order 1: Vulnerability Research, Reverse Engineering, Exploit Procurement, and

Target and Market Analysis

7 June 2022

Version 2.0

FOR RELEASE TO THE PUBLIC

i

This Page is Intentionally Left Blank

PM MCCO UNCLASSIFIED M67854-22-D-7701-0001

ii

TABLE OF CONTENTS

1. GENERAL

1.1 Description of Services/Introduction

1.2 Background

1.3 Objective

1.4 Scope

1.5 Period of Performance

1.6 General Requirements and Information

1.6.1 Quality Control

1.6.2 Quality Assurance

1.6.3 Recognized Holidays

1.6.4 Hours of Operation

1.6.5 Place of Performance

1.6.6 Type of Contract ......................................................................................... Error! Bookmark not defined.

1.6.7 Security Requirements

1.6.8 Post Award Conference/Periodic Progress Meetings

1.6.9 Contracting Officer Representative (COR)

1.6.10 Organizational Conflict of Interest

1.6.11 Dress and Conduct

2. DEFINITIONS AND ACRONYMS ...................................................................... Error! Bookmark not defined.

2.1. Definitions ....................................................................................................... Error! Bookmark not defined.

2.2. Acronyms.......................................................................................................... Error! Bookmark not defined.

3. GOVERNMENT FURNISHED ITEMS AND SERVICES ................................... Error! Bookmark not defined.

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES

5. SPECIFIC TASKS

5.1 Cyber Vulnerability Overview

5.2 Lead VR/RE and Exploit Procurement Subject Matter Expert .......................... Error! Bookmark not defined.

5.2.4 Target and Market Analysis

6. APPLICABLE PUBLICATIONS (CURRENT EDITIONS)

7. ATTACHMENT/TECHNICAL EXHIBIT LISTING

7.1 Attachment 1 - Performance Requirements Summary (PRS) for TO 1

7.2 Technical Exhibit 1 - Deliverables

7.3 Technical Exhibit 2 – Deliverables Schedule .................................................... Error! Bookmark not defined.

Cyber Vulnerability Research

PART 1

GENERAL INFORMATION

1. GENERAL

This Cyber Vulnerability Research (CVR) Task Order (TO) 1 Performance Work

Statement (PWS) supports requirements for the Joint Cyber Weapons (JCW) program for the United States Marine Corps.

1.1 Description of Services/Introduction

The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform cyber vulnerability research as defined in this PWS except for those items specified as Government furnished property and services. The contractor shall perform to the standards in this PWS and the CVR Single Award Task Order Contract (SATOC)

PWS.

1.2 Background

The JCW program provides advanced cyber warfare capabilities in direct support of U.S.

Cyber Command, Combatant Commanders, and national agencies to enable and accomplish global operations. Activities within the JCW program deliver cyberspace superiority capabilities though research, development, testing, evaluation, and integration of cyber technologies. The JCW program includes support to a Combat Support Team to develop prototypes for testing new cyber weapons to outpace modernized defenses used by peer adversaries and to enhance lethality and relevance of software constructed cyber weapons.

1.3 Objective

The objective of this requirement is to research, develop, integrate, and purchase software, firmware and supporting hardware to enable Commanders to disrupt, deny, degrade, or destroy targets in cyberspace.

1.4 Scope

The scope of this effort is to provide services and products to research, develop, test, deliver and employ exploits, payloads, and implants to execute the necessary components of the cyber kill chain to enable Commanders to disrupt, deny, degrade, or destroy targets in cyberspace.

1.5 Period of Performance

The period of performance for TO 1 shall be for 1 year from date of award.

1.6 General Requirements and Information

1.6.1 Quality Control

No change from base contract.

1.6.2 Quality Assurance

1.6.3 Recognized Holidays

1.6.4 Hours of Operation

The contractor is responsible for conducting business, between the hours of 0800 – 1700

Eastern Time (ET), Monday through Friday, except Federal holidays or when the

Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

1.6.5 Place of Performance

The work to be performed under this task order shall be performed at the contractor’s facility.

1.6.7 Security Requirements

1.6.8 Post Award Conference/Periodic Progress Meetings

See Section 5.2.

1.6.9 Contracting Officer Representative (COR)

The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance;

maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including

Government drawings, designs, specifications; monitor contractor's performance and notifies both the Contracting Officer and contractor of any deficiencies; coordinate availability of Government furnished property, and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.10 Organizational Conflict of Interest

1.6.11 Dress and Conduct

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES

3.1 Services: The Government will support the contractor in obtaining badges and access to Government facilities during required meetings.

3.2 Facilities: The Government will not provide facilities. The performance of work under this task order will be at the contractor’s facilities.

3.3 Utilities: The Government will not provide utilities.

3.4 Equipment: The Government will not provide equipment.

3.5 Materials: The Government will not provide materials.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES

4.1 The contractor shall furnish all supplies, materials, equipment, facilities and services required to perform work under this contract that are not listed under Section 2 of this

PWS.

PART 5

SPECIFIC TASKS

5. SPECIFIC TASKS

5.1 Cyber Vulnerability Overview

Additional requirements regarding SATOC PWS paragraph 5.2.14 – Task 14 are specifically tailored for this TO 1 PWS and are provided below in Section 5.2.

5.2 Additional Requirements Specifically Tailored for this Task Order (TO) 1

5.2.1 Target and Market Analysis

Within 30 days of award, the Government will provide classified and unclassified information to the contractor discussing the Government’s missions, targets, objectives, goals, and other amplifying information. Using the information provided by the

Government, the contractor shall analyze and search the market place for payloads, exploits, and implants relevant to the Government’s mission and provide a catalog and study to the Government every month on the most recently discovered and developed payloads, exploits, and implants that advance the Government’s mission, objectives, and goals.

The submission of each monthly catalog and study shall be no later than five (5) days after the end of each calendar month.

Each monthly submission of the catalog and study shall include the contractor’s

Cybersecurity Workforce Report as an attachment, which shall comply with all of the criteria delineated in the SATOC’s PWS paragraph 1.6.7.6.

Deliverables:

CDRL A005: DI-MISC-80508B Technical Report - Study/Services (The submission of this CDRL shall be no later than five (5) days after the end of each calendar month.)

5.2.2 In Process Working Meetings (IPWMs)

Government and contractor IPWMs shall be conducted not more than once every two weeks, to review and discuss risks/issues (i.e., cost, schedule, performance), and provide a forum to promote and sustain the continuous interchange of ideas in accordance with the SATOC’s PWS paragraph 1.6.8.3. The Government and the contractor shall meet at a Top Secret/Sensitive Compartmented Information (TS/SCI) Facility; the location shall be specified by the Government at a location within 30 miles of Fort Meade, Maryland to conduct the IPWMs.

Not every IPWM will require the deliverables referred to below. However, to the extent that updated schedules, timelines, or proposed, in scope, resolutions to performance issues are resolved at an IPWM or at the direction of the COR, then the appropriate supporting documentation shall be generated as specified below.

CDRL B004: DI‐ADMN‐81249B Conference Agenda (The submission of this

CDRL shall be no later than five (5) days before the IPWM.)

CDRL B005: DI-ADMN-81250B Conference Minutes (The submission of this

CDRL shall be no later than five (5) days after the IPWM.)

CDRL B006: DI-MGMT-81605 Briefing Material (The submission of this CDRL shall be no later than five (5) days before the IPWM.)

5.2.3 Task Order Post Award Orientation Conference (TOPAC)

Within 30 days of TO 1 award, the contractor shall organize and conduct a TOPAC. The

Government and the contractor shall meet at a TS/SCI Facility. The location shall be specified by the Government at a location within 30 miles of Fort Meade, Maryland. The contractor shall discuss their method for processing and assigning tasks during TO 1’s period of performance. The contractor shall prepare a conference agenda and briefing material no later than five (5) days before the TOPAC. The contractor shall capture and disseminate conference minutes within five (5) business days following the TOPAC.

CDRL shall be no later than five (5) days before the TOPAC.)

CDRL B005: DI-ADMN-81250B Conference Minutes (The submission of this

CDRL shall be no later than five (5) days after the TOPAC.)

shall be no later than five (5) days before the TOPAC.)

5.2.4 Program Management Reviews (PMRs)

Within 90 days of the TOPAC and quarterly thereafter, the contractor shall conduct a

PMR. The contractor shall prepare a conference agenda and briefing material no later than five (5) days before the PMR. The contractor shall capture and disseminate conference minutes within five (5) business days following the PMR.

CDRL shall be no later than five (5) days before the PMR.)

CDRL B005: DI-ADMN-81250B Conference Minutes (The submission of this

CDRL shall be no later than five (5) days after the PMR.)

shall be no later than five (5) days before the PMR.)

PART 6

APPLICABLE PUBLICATIONS

6. APPLICABLE PUBLICATIONS (CURRENT EDITIONS)

See CVR SATOC Section 6.0 and all subsections.

PART 7

ATTACHMENT/TECHNICAL EXHIBIT LISTING

7. ATTACHMENT/TECHNICAL EXHIBIT LISTING

7.1. Performance Requirements Summary

7.2 Technical Exhibit 1 – Deliverables & Schedule

7.3 Labor Category Descriptions and Qualifications

7.1 Performance Requirements Summary (PRS) for TO 1

This PRS includes performance standards and Acceptable Quality Levels (AQLs) that relate directly to mission essential items. The Government will use these performance standards and AQLs to assess contractor performance under TO 1.

PWS

Paragraph

Task Performance Standard Acceptable Quality

Levels (AQL)

Surveillance

Method / By

Whom

5.2.1 Target and

Market

Analysis

The contractor shall analyze and search the market place for payloads, exploits, and implants relevant to the

Government’s mission and provide a catalog and study to the

Government every month on the most recently discovered and developed payloads, exploits, and implants that advance the

Government’s mission, objectives, and goals.

Quality:

Nine (9) of the twelve

(12) monthly reports are accepted by the

Government on the first submission without comments that require adjudication by the contractor.

No more than three (3) of the 12 monthly reports are accepted by the

Government with no more than two revisions required. The contractor shall adjudicate any comments identified by the Government within five (5) calendar days of receipt of the

Government’s comments.

Timeliness:

No more than one (1) monthly report is submitted past the date identified in the corollary

CDRL for this TO.

100% Inspection by the COR

7.2 Technical Exhibit 1 – Deliverables & Schedule

Deliverable Frequency # of Copies Medium/Format Submit To

CDRL A005: DI-

MISC-80508B

Technical Report

- Study/Services

Monthly One (1) PDF COR

CDRL B004: DI‐

ADMN‐81249B

Conference

Agenda

No later than five (5) days before the TOPAC before the PMR before the IPWM

One (1) PDF COR

CDRL B005: DI-

ADMN-81250B

Conference

Minutes after the TOPAC after the PMR after the IPWM

CDRL B006: DI-

MGMT-81605

Briefing Material before the TOPAC before the PMR before the IPWM

7.3 Labor Category Descriptions and Qualifications

See CVR SATOC Section 7.3 and all subsections for preferred qualifications of key personnel.