4.01c PWS_ASL RMF Support Services.pdf

Statement of Work (SOW)

Arctic Submarine Laboratory (ASL) Risk Management Framework (RMF) Support

Services

A. Introduction. The following Statement of Work (SOW) defines the cybersecurity engineering, test and evaluation, and Risk Management Framework (RMF) support efforts required to sustain Continuous Monitoring and execute the mandated RMF

Revision 5 (NIST SP 800-53 Rev. 5) control migration for the applicable VICE and

SWAT systems. These systems support the Virginia Ice Capability Equipment (VICE) and the Seawolf Arctic TEMPALT (SEAWOLF/LA-Class) mission environments at the Arctic Submarine Laboratory (ASL).

B. Scope. The contractor shall generate documentation required to meet RMF requirements and submit required documentation to the Arctic Submarine Laboratory (ASL) as required in support of Assess & Authorize (A&A), Assess Only (AO), and Non-IT packages for

ASL systems. All RMF activities shall follow the most current applicable guidance including DON RMF Process Guide, DoD Instruction 8510.01, NAVSEA Business Rules, NAVSEA Standard Operating Procedures (SOPs), and the business rules of cognizant review offices for each package. These efforts include, but are not limited to:

1. VICE Continuous Monitoring Cybersecurity Services

A. Conduct and document annual security reviews, including validation of security controls, execution of ACAS/SCAP scans, and application of all required STIGs.

Document all findings, artifacts, and results within eMASS in support of Assess

Only ATO sustainment.

B. Execute all tasks identified within the Plan of Action and Milestones (POA&M) to ensure timely remediation, mitigation, or documented risk acceptance in support of continuous monitoring and Assess Only ATO sustainment.

C. Implement and maintain a vulnerability management and patch management plan to support ongoing cybersecurity risk reduction and system authorization requirements.

D. Sustain the current VICE Windows 10 environment utilizing the WIN10SonarFish baseline image. The contractor shall review all vendor-provided security documentation to ensure compliance with applicable cybersecurity controls. Any identified deficiencies shall be documented in the POA&M with appropriate mitigation strategies.

E. The contractor shall coordinate with external vendors and supporting engineering stakeholders to transition VICE systems from the current WIN10SonarFish environment to the previously approved Windows 11 operating system image, ensuring compatibility with specialized hardware platforms and applicable STIG requirements. The contractor shall support validation, integration planning, and cybersecurity compliance of the Windows 11 image prior to deployment.

F. ASL-SB and ASL-SS systems are currently operating on the approved Windows 11 environment. The contractor shall ensure continued cybersecurity compliance by installing and maintaining VICE-related applications, applying all applicable STIGs, and updating the POA&M to reflect any residual vulnerabilities, risks, or compliance gaps identified during sustainment activities.

G. The contractor shall coordinate with VICE system engineers and key stakeholders to evaluate, test, and validate any new or proposed software for system compatibility within the VICE environment. The contractor shall determine the appropriate Use

Case submittal package required for approval within the VICE accreditation framework, including updates to system boundary definitions, system architecture documentation, and all applicable cybersecurity and technical diagrams supporting

ATO decision-making.

H. The contractor shall coordinate with ASL engineers to conduct regression testing and validation to ensure VICE applications function correctly following STIG implementation, Windows 11 sustainment activities, and integration of new software

Use Case submittals and approvals.

I. The contractor shall provide additional cybersecurity engineering, systems integration, and continuous monitoring support as required to sustain Assess Only

ATO authorization, Annual Security Reviews, enforce all TASKORDs and

FRAGORDs release by Fleet Cyber Command to ensure mission readiness, and support VICE system operational requirements.

2. SEAWOLF/ LA Class Submarine Continuous Monitoring Cybersecurity Services

A. Conduct and document annual security reviews for the SEAWOLF/ LA system in support of LA-Class submarine operations. Activities shall include validation of security controls, execution of ACAS/SCAP scans, and application of all applicable

STIGs. All findings, artifacts, and results shall be documented within eMASS.

B. Execute all tasks identified within the Plan of Action and Milestones (POA&M) to ensure timely remediation, mitigation, or documented risk acceptance in support of continuous monitoring and system authorization requirements.

C. Implement and maintain a vulnerability management and patch management plan to support ongoing cybersecurity risk reduction across the SEAWOLF/ LA system.

D. Sustain the current VICE Windows 10 environment utilizing the WIN10SonarFish baseline image. The contractor shall review all vendor-provided security documentation to ensure compliance with applicable cybersecurity controls. Any identified deficiencies shall be documented in the POA&M with appropriate mitigation strategies.

E. The contractor shall coordinate with external vendors and supporting engineering stakeholders to transition SEAWOLF/ LA systems from the current

WIN10SonarFish environment to the previously approved Windows 11 operating system image, ensuring compatibility with specialized hardware platforms and applicable STIG requirements. The contractor shall support validation, integration planning, and cybersecurity compliance of the Windows 11 image prior to deployment.

F. The contractor shall coordinate with ASL engineers and SEAWOLF/ LA-Class submarine stakeholders to perform regression testing and validation to ensure

SEAWOLF/ LA applications function correctly following STIG implementation and

Windows 11 migration activities.

G. The contractor shall coordinate with ASL engineers to conduct regression testing and validation to ensure SEAWOFL/ LA- Class applications function correctly following STIG implementation, Windows 11 sustainment activities, and integration of new software Use Case approvals.

H. The contractor shall provide additional cybersecurity engineering, systems integration, and continuous monitoring support as required to sustain Assess Only

ATO authorization, Annual Security Reviews, enforce all TASKORDs and

FRAGORDs release by Fleet Cyber Command to ensure mission readiness, and support SEAWOLF/ LA-Class submarine operational requirements.

3. VICE, SEAWOLD/ LA- Class System Revision 5 Migration

The contractor shall perform the mandated RMF Revision 5 (NIST SP 800-53 Rev. 5) control migration for the applicable VICE and SWAT/ LA-Class systems in support of cybersecurity authorization and continuous monitoring requirements. The contractor shall ensure that the completed RMF Rev 5 migration supports continued Assess Only ATO sustainment, maintains compliance with DoD cybersecurity policy requirements, and enables accurate representation of system cybersecurity posture within the authorization boundary.

Upon completion, the contractor shall validate that all controls are properly updated, assessed, and aligned with current DoD cybersecurity guidance, and shall support any required reviews or adjudication actions from cybersecurity assessors, SCA-L, or Authorizing Officials.

Tasking:

1. Review and update documentation in eMASS as required.

2. Update hardware and software configuration documentation and system diagrams.

3. The contractor shall perform RMF Revision 5 (NIST SP 800-53 Rev 5.)

Migration

4. The contractor shall provide a Navy Qualified Validator to perform the necessary scans, (e.g., Assured Compliance Assessment System (ACAS), Security Content Automation Protocol (SCAP), etc.), run all relevant Security

Development Security Technical Implementation Guidance (STIG), and present all findings discovered during testing in a report.

5. The contractor shall assist ASL in the coordination of the Windows 11 baseline image to deploy on specialized hardware operation on Windows 10 Security

Assessment Plan.

4. Base Access

On-site access shall be coordinated with the Point of Contact (POC).

5. Period of Performance

09 Jul 2026 to 08 Jul 2027

6. Place of Performance

Arctic Submarine Laboratory

53370 Cabrillo Memorial Drive, Bldg. 370 San Diego, CA 92152

7. Point of Contact

Joseph C. Hardy

Engineering Department Head

(N4) Arctic Submarine

Laboratory

53370 Cabrillo Memorial Drive, Bldg. 370 San Diego, CA 92152 joseph.c.hardy8.civ@us.navy.mil

Work: 619-553-9113