(Solicitation Attachment 1) Statement of Work COTHEN Support Services DRAFT.pdf

PURCHASE REQUEST NUMBER 2014-6945, SOLICITATION NUMBER 70B04C25P20146945

ATTACHMENT 1 STATEMENT OF WORK

Statement of Work (SOW)

For

Cellular Over the Horizon Enforcement Network (COTHEN) Support Services

Purchase Request Number 2014-6945

May 2025

SOLICITATION NUMBER 70B04C25P20146945

Attachment 1

COTHEN Support and HF Services

Table of Contents

Table of Contents Statement of Work (SOW) For COTHEN Support and HF Services

BACKGROUND:

History of the COTHEN Program Current Operating Environment

SCOPE:

APPLICABLE DOCUMENTS:

REQUIREMENTS:

• HF Radio Infrastructure

• Compliance and Security

• Software Program Management Services Support and HF Services Security Services Transition Services

DELIVERABLES:

Deliverable Schedules Deliverable Descriptions

GOVERNMENT-FURNISHED EQUIPMENT AND INFORMATION:

PLACE OF PERFORMANCE:

PERIOD OF PERFORMANCE:

SECURITY:

Personnel Security / Clearance Physical Security Information Technology (IT) Security Security Training

SPECIAL CONSIDERATIONS:

Contractor / Key Personnel Inspection and Acceptance Travel Contract Administration Invoice Instructions Unique Standards

Section 508 Requirements

ADDENDA

Addendum A: Acronyms and Glossary Addendum B: Site Support Locations Addendum C: Major Components by Site

COTHEN Support and HF Services Statement of Work

BACKGROUND:

History of the COTHEN Program The initial design for the COTHEN HF radio network was conceived in 1984, to help meet the demanding requirements of Customs’ drug interdiction aircraft and marine vessels in their fight against smuggling activities. The system combined antennas, radios, computers, and voice encryption devices into an integrated radio communication system.

The first HF Fixed Antenna Sites (FAS), located near Memphis, Tennessee and Atlanta, Georgia, became operational in 1985. The user base grew significantly with the successful deployment of subscriber radios. Selective scanning (SELSCAN) waveform integration provided more reliable HF communications and evolved into Automatic Link Establishment (ALE). FED STD-1045A helped to establish ALE standards and compatibility among vendors. Phone patch technology expanded operational and communication access across the agency. In 2000, CBP collaborated with Rockwell Collins to develop and integrate control software that automated selection of the best FAS, improving call quality. In 2008, all HF FASs were upgraded from HF- 80 equipment to URG-III equipment.

The network architecture expanded to include 22 FASs containing 31 transmitter stations, which provide HF coverage throughout the United States, Central and South America, and into the Atlantic and Pacific areas of operation. Five (5) U.S. Coast Guard (USCG) HF split-site locations were added to the network to enhance overall coverage, between 2015 and 2017. In 2016 and 2017, COTHEN added IP-based monitoring, managing, and patching capabilities, resulting in more effective management and improved security.

COTHEN is a multi-agency, voice communication network that encompasses remote command and control systems, airborne and marine mobile systems, and many special-purpose ancillary systems, controlled by software and network switching technology. The system is frequency adaptive and employs upgraded AES 256, type three (3) voice encryption.

The Primary Operations Center for the network, located in Orlando, Florida, is staffed 24 hours a day, 365 days a year to provide tactical, emergency, and disaster response communications assistance for authorized government and law enforcement agencies.

Architecture, engineering, hardware, software and support services have been primarily provided by a single vendor for 30+ years.

Current Operating Environment

COTHEN communications are facilitated by a geographically distributed network of strategically placed FASs and Remote Communications Consoles (RCC), connected to the

Operations Center via a commercial Multi-Protocol Label Switching (MPLS) telecommunications network. The system is supported by the Government and contractor personnel. Figure 1 provides a graphical representation of the current radio network infrastructure and support model.

1.2.1 Major System Components

This section provides a high-level description of major system components and diagrams (see Figure 2) how they are connected to facilitate COTHEN communications. Detailed equipment lists can be found in Addendum C (Major Components by Site).

Operation Centers: COTHEN users are supported by one (1), a Primary Operation Centers.

Major Operation Center components include the MPLS circuits, various network components, cellular controller system, RCC systems, audio control system, data control system, phone patch systems, FAS monitoring system, encryption key management system, and operator consoles that integrate these components into graphical views of the network and its users to facilitate network management and operational support.

Fixed Antenna Sites: FASs are located on CBP sites, and customer-supplied land typically contains a building, MPLS circuit, router and WAN interface card, network extension unit (NXU), signal converter, HF radio antenna and tower, radio (receiver/exciter), power amplifier, building

Figure 1: Current COTHEN Radio Network Infrastructure and Support Model monitoring system, switch over (SO) system, and uninterruptible power supply (UPS).

RCC Node/Sites: RCCs are located at the Primary Operations Center, Backup Operations Center, and customer locations. Typical components include an MPLS circuit, router, and an RCC (consisting of a computer, RCC software, audio console, and digital voice privacy (DVP) processor and NXU).

End User Components: End-users employ a variety of interoperable, HF radio communication systems for air, marine, and mobile operations. Various models of Rockwell Collins HF radios are used, as well as Micom and Codan mobile radios and manpacks.

Figure 2: COTHEN - Component Topology

1.2.2 Communication Flows

This section outlines the communication flow for three (3) communication scenarios - Mobile User to Mobile User, Mobile user to RCC Site, and RCC Site to Mobile User.

1.2.2.1 Mobile User to Mobile User

Mobile User to Mobile User calls can be accomplished in two (2) ways - In-Network (with reliance on the COTHEN infrastructure) and Out-of-Network (without use of the COTHEN system).

In-Network Calls: In-Network communications between mobile users utilize the COTHEN infrastructure as depicted in Figure 3.

Figure 3: Mobile User to Mobile User – In Network Calls

1. A Mobile User initiates a call to another Mobile User.

2. The call is routed through a Fixed Antenna Site (FAS), to the MPLS, and then to the

Operations Center.

• FAS radios are not engaged in calls, actively scan available channels/frequencies using the

ALE protocol. When a call is detected, the FAS stops scanning, concentrates on the call, and sends its Link Quality Analysis (LQA) data (via the MPLS network) to the Cellular Controller at the Operations Center.

3. The Cellular Controller evaluates available LQA data, selects the best FAS, and establishes a link with the calling mobile user.

4. The Cellular Controller then establishes a link with the destination mobile user (via the MPLS and best Fixed Antenna Site signal) to complete the connection.

Out-of-Network Calls: Out-of-network communication between mobile users can occur when two mobile HF radios are within range for direct connectivity that does not require the support of the COTHEN infrastructure.

1.2.2.2 Mobile User to RCC

Communication between a mobile user and a fixed or mini RCC Node can be established using a single FAS (shown below in Figure 4) or multiple FASs, when needed. Both scenarios follow essentially the same flow, except that with a split FAS connection, the system uses different FASs for signal transmission and reception.

Figure 4: Mobile User to RCC

1. A Mobile User initiates a call to a RCC Node Site.

2. The call is routed through a Fixed Antenna Site through, to the MPLS, and then to the

Operations Center.

3. The Cellular Controller evaluates available LQA data, selects the best FAS, and establishes a link with the calling mobile user.

4. The Cellular Controller routes the call, via the MPLS, to the RCC Node.

1.2.2.3 RCC to Mobile User

An RCC to Mobile user call is essentially the reverse operation of the previous section depending on the type of Fixed Antenna Site that is selected for completing the call, see Figure 5.

Figure 5: RCC to Mobile User

1. A RCC Node Site initiates a call to a Mobile User.

2. The call is routed, via the circuit, to the MPLS and from there to the Operations Center.

3. The Cellular Controller establishes a link with the mobile user (via the MPLS and best Fixed Antenna Site signal).

4. The Cellular Controller routes the call to the mobile user to complete the connection.

SCOPE:

The Government is seeking collaborative partner(s) to deliver innovative and cost-effective solutions and services that meet the requirements and scope of work specified in this Statement of Work (SOW). This includes the maintenance, support, and enhancement of COTHEN infrastructure components and supporting systems, as well as the introduction of new capabilities and functionalities.

The Contractor shall provide all necessary services, qualified personnel, materials, equipment, facilities, and supplies not otherwise supplied by the Government. The scope and organization of the work to be provided are outlined below and detailed in the corresponding sections of the SOW.

The Contracting Officer is the only authorized government authority to sign on behalf of the

Government. Any changes to the scope of this SOW must be authorized in writing through a bilateral modification signed by both the Contractor and the Contracting Officer.

• Program Management Services

• Support and Modernization Services

Integrated Software Services CBP Primary Operations Center Services CBP Fixed Antenna Site Services Backup Operations Center – Ashburn, VA (CBP Facility) Subscriber Equipment Services HF as a Service On Demand Services

• Security Services

• Transition Services

APPLICABLE DOCUMENTS:

The Contractor shall adhere to all applicable Federal/DHS/CBP/Office of Information and

Technology (OIT) policies, standards, directives, processes, and procedures in performing the work identified. Prior to the Contractor performing work requiring adherence to any policy, standard, directive, process, or procedure (collectively “Protocols”) not listed below, CBP and the

Contractor shall mutually agree on any such Protocol These include, but are not limited to, the following.

• Code of Federal Regulations (CFR): https://www.ecfr.gov, with special note of, Title 14 Code of Federal Regulations (CFR) Part 145 Airworthiness Certification Standards

• DHS Directive 140-01, Rev 02, “Information Technology Security Program”

• Customs Directive No. 51715-006, Separation Procedures for Contractor Employees

(CF-242)

• HB 1400-05D, R7, “CBP Information Systems Security Policies and Procedures

Handbook”

• Management Directive 11042.1 “Safeguarding Sensitive But Unclassified (For

Official Use Only) Information”

• Management Directive (MD) 4300.1, “Information Technology Systems Security Program”

• DHS 4300A, V13.1 “Sensitive System Policy”

• DHS 4300A, V12.0 “Sensitive Systems Directive”

• NIST SP 800-47, “Security Guide for Interconnecting Information Technology Systems”

• NIST SP 800-53 Rev 4 “Security and Privacy Controls for Federal Information Systems and Organizations,” April 2013, with updates as of January 22, 2015

• FIPS-197 Advanced Encryption Standard (256)

• FIPS-140-2 Security Requirements for Cryptographic Modules

• FIPS-199 Standards for Security Categorization of Federal Information and Information Systems

• FIPS 201-2 “Personal Identity Verification (PIV) of Federal Employees and Contractors”

REQUIREMENTS:

General Requirements: Proposed solutions and services must ensure compliance with the general requirements, guidelines, standards, directives, regulations, and protocols specified throughout this document.

• HF Radio Infrastructure o Network Coverage: The network infrastructure must provide HF coverage and support communications/operations across the United States, Central and South America, and into the Atlantic and Pacific, without interruption by natural or man-made interference, based on validated propagation analysis of the required coverage area. This includes the contiguous United States plus Hawaii and Alaska, as well as Guam and the Caribbean.

o Unified Communications: The HF network infrastructure must provide interoperable, cross-platform, IP-based communications that seamlessly https://www.ecfr.gov/ support secure voice and data communications across other frequency bands (VHF, Satellite, Cellular, etc.).

o Network Availability: The network infrastructure should be architected and engineered (with sufficient redundancy and backups) to effectively eliminate single points of failure and ensure maximum system availability for COTHEN users.

o Open Standards: Systems and supporting architecture components should, where possible, embrace open standards and interfaces that support the integration of software and hardware from multiple manufacturers and suppliers.

o Global Positioning: Infrastructure solutions shall provide for the collection, storage, and display of positioning data from enabled mobile HF assets (in aircraft, vehicles, and vessels), connected to the COTHEN network. The solution should display graphical representations of assets at their appropriate position on a graphical/map interface on all RCC systems.

• Compliance and Security o Compliance Standards and Regulations: Software and hardware must comply with and support applicable: voice, data, and encryption standards; Federal Information Security Management Act (FISMA) and Department of Homeland Security (DHS) sensitive system policy directives; and federal regulations.

Solutions should support the following, where applicable.

Baseline (existing) ALE standard is MIL-STD 188-141B, 1 Mar 1999.

Target ALE standard is MIL-STD 188-141D, 22 Dec 2017Common Air Interface (CAI) Standards

Federal Information Processing Standards Publications (FIPS) 140-2 Encryption Standards o System and Information Security: Solutions/services must meet applicable system and information security standards outlined below and described in detail in the Security Services section of this document.

National Institution of Standards and Technology Special Publication

(NIST SP) 800-53 rev 4 Department of Homeland Security (DHS) Sensitive System Policy

Directive 4300A FIPS Publication 199

• Software o Interoperability and Compatibility: New software components and/or new releases must be fully interoperable and backward compatible (as appropriate) with existing integrated software components and older software versions to allow for phased software upgrades, since not all systems can be upgraded at the same time.

o Integration: Software solutions must integrate with current equipment (radios, audio consoles, network extension units (NXUs), digital voice privacy (DVP) processors, routers, switches, etc.), from multiple vendors using standard protocols.

o Open Architecture: Software solutions should, where possible, embrace open architecture standards and interfaces that support the Governments objective to move away from proprietary software.

The COTHEN system has been granted an Ongoing Authorization (OA) based on the current architecture and configuration. Proposed changes to the baseline configuration must be properly documented, reviewed, and approved prior to implementation. This includes maintenance and enhancements to existing hardware and software, as well as the introduction of any new hardware, software, and/or systems related to the Contractor’s proposed solution.

Program Management Services

The Contractor shall provide Program Management Services, to include: program planning;

staffing and personnel security; facilitation of background investigations; contractor team training;

work coordination and direction; quality control; IT security management and compliance; risk management; project management (as assigned); performance reporting; invoicing; and subcontract/vendor management.

Components of the required Program Management Plan are highlighted below and detailed in

Section 5 (Deliverables).

• Program Management Plan Components o Program / Contract Management Plan o Staffing/Resource Management Plan o Quality Control Plan o Risk Management Plan o Subcontract/Vendor Management Plan

4.1.1 Program and Project Management Services

The Contractor shall identify and apply sound program management principles and practices to projects, initiatives, operations, maintenance, and enhancement of the COTHEN infrastructure in order to ensure efficient and successful performance of the contract. The Contractor shall provide ongoing Program Management for all activities to include the following.

• Guidance and management of project teams

• Resource allocation to projects and operations

• Improvements and changes to project and operational processes

• Reviews of significant deliverables and artifacts

• Maintenance of project and task schedules

• Submission of reports as required and/or requested by the Government

• Program financial and contract management

• Subcontract/vendor management

• Management and execution of multiple projects

The Contractor shall provide Project Management support for all projects required to plan, design, develop, test, implement, operate, and maintain their proposed solution.

4.1.1.1 Communications and Meetings

Transparent and effective communications are a key enabler of the Government’s objective for a collaborative partner that will work closely with leadership to maintain and evolve COTHEN services and capabilities for our customers. More specifically, the Contractor must identify, establish, and adopt communication strategies and methodologies that enable cooperative and collaborative information sharing with the Government, external partners, and other Government contractors.

4.1.1.2 Risk and Opportunity Management

The Contractor shall identify and adopt an effective approach and methodology for the identification, tracking, analysis, disposition, and reporting of risks and opportunities. The scope shall, at a minimum, include direct program, security, and supply chain risks and opportunities.

The Contractor shall provide a detailed Risk Management Plan, as a part of the Program Management Plan, per the schedule specified in Section 5 (Deliverables), which includes the following.

• Identification • Response Planning

• Qualitative Analysis • Disposition and Control

• Quantitative Analysis • Monitoring and Reporting

4.1.1.3 Quality Assurance (QA)/Quality Control (QC)

The Contractor shall identify and adopt internal controls and supporting processes to ensure the quality of deliverables to the Government. The Contractor shall identify and adopt an effective approach and methodology for the identification, tracking, review, and approval of deliverables.

The Contractor shall provide a detailed Quality Control Plan (QCP), as a part of the Program Management Plan, per the schedule specified in Section 5 (Deliverables).

4.1.2 Staffing and Key Personnel

The Contractor shall prepare and provide CBP with a hierarchical organizational structure depicting the team that will perform the work identified and how that team will interface with the Government. The Contractor shall notify CBP of any proposed modifications to the organizational structure, at least 15 days prior to implementation of the organizational change.

Personnel security (prescreening, background investigation, and clearance) requirements are documented in Section 9 (Security) of this document.

4.1.2.1 Key Personnel

The Contractor shall propose Key Personnel for the contract and provide resumes consistent with the positions and descriptions identified below. Key Personnel require CBP notification and CBP shall be notified within five (5) days of Contractor becoming knowledgeable of any vacancies and/or proposed replacements. Key personnel for this contract include the Program Manager and the Lead System Engineer.

• Program Manager: The Program Manager will serve as the Contractor’s point of contact for the Contracting Officer’s Representative (COR) and senior level Government managers. While Project Management Institute (PMI) Project Management Professional (PMP) certification is desirable, the Program Manager must, at a minimum, have the following qualifications.

o Bachelor’s degree in a related technical field o Minimum of 5 years of Program Management experience, preferably in HF communications

• Lead Systems Engineer: The Lead System Engineer will provide subject matter expertise and oversight for technical support services. At a minimum, the Lead System Engineer shall have the following qualifications.

o Bachelor’s degree in a related technical field, preferably engineering (Electrical Mechanical, or Industrial) o Minimum of 7 years of experience working with and detailed knowledge of HF/ALE technologies (e.g., designing, installing, operating, and maintaining)

• Field Technician: The Field Technician will provide subject matter expertise and oversight for technical support services. At a minimum, the Field Technician shall have the following qualifications.

o Associate degree in a related technical field, preferably electronic/communication (Electronic Technology, or Communication) or in the absence of an Associate degree, a minimum of 5 years’ experience working with the COTHEN system o Minimum of 5 years of experience working with and detailed knowledge of HF/ALE tactical communications both facility and in the field o Experience with the installation of HF system infrastructure, ancillary equipment, antennas, preparing reports, testing/troubleshooting, programming, and operations & maintenance in a dynamic environment.

o Able to lift over 30lbs without restriction to perform duties.

4.1.2.2 Training Personnel

In addition, the Contractor shall ensure that all personnel responsible for providing training are proficient in HF/ALE technologies, and have the following qualifications.

• Minimum of 5 years of experience working with HF/ALE technologies

• Detailed working knowledge of an HF/ALE communication network

• Excellent communication skills and strong verbal and interpersonal skills; as daily interaction with government customers will be required

4.1.3 Subcontract/Vendor Management

The Contractor shall identify and adopt internal controls and supporting processes to effectively manage subcontracts and vendors to ensure the delivery of quality services to the Government. The Contractor shall provide a Subcontract/Vendor Management Plan that identifies their Subcontractors/Vendors, as well as their approach and methodology, as a part of the Program Management Plan, per the schedule specified in Section 5 (Deliverables).

Support and HF Services

4.2.1 Integrated Software Services

Background Information: CBP currently uses an integrated suite of proprietary, commercial software for the control and management of HF voice and data traffic, into and out of the COTHEN system. The three (3) major software components are the Cellular Controller Software, Phone Patch Software and Remote Communications Console (RCC) Software.

Software components are hosted on Government provided Windows-based computers at

Government, vendor, and subscriber sites (see Figure 6). Host computer systems are networked to facilitate maintenance, software/patch distribution, and remote management. The integrated software suite allows the Government to control, monitor, and manage HF traffic, the radio network infrastructure, and supporting systems, throughout the coverage area.

General Requirements: The Contractor shall provide software, hardware and system engineering support services to ensure network security and to sustain and support the COTHEN network.

The Contractor shall provide (develop or acquire), test, deploy, integrate, maintain, and support

(remotely or onsite), for HF, software to provide the capabilities specified below. The Contractor must provide patches and bug fixes, as required, to maintain software functionality and system security.

For software developed by or under the control of the Contractor, used as a part of the solution, Figure 6: Control Software Distribution the Contractor will:

• In collaboration with the COTHEN team, identify and prioritize software changes and enhancements.

• Develop, test, and provide new releases annually (at a minimum), with approved changes/enhancements.

• Provide formal, on-site training (that coincides with new releases) to designated

COTHEN personnel, at the Primary Operations Center, to ensure the Government fully understands and is able to take advantage of existing software capabilities and enhancements.

The Responsibility Matrix (Attachment 1) details Contractor responsibilities for each software package. Support responsibilities span the following areas.

• Provide, Test, and Ship: Architect/engineer; develop/acquire; test; deploy/ship

• Install, Integrate, and Transition: Install; configure; integrate; transition

• Support and Enhance: Diagnose problems; resolve issues; develop, test, provide, and deploy patches/fixes; train users; enhance software

Software solutions can be commercial software, new software developed specifically for COTHEN, or a combination of both. Proposed software must provide equal or better capabilities to our current solution (as described below), in a combined application or as separate programs.

4.2.1.1 Cellular Controller Software - Capabilities and Requirements Cellular Controller Software performs link quality analysis, determines the best signal, automatically establishes radio links to ensure the best link quality, and manages traffic across the HF spectrum to satisfy and adapt to voice and data priority parameters. Proposed software solutions must provide these capabilities and satisfy the requirements outlined below.

• Automated Link Enablement (ALE): The software must identify and establish the best link, with respect to the optimal frequency and path. The system must route incoming calls outbound via the best frequency/path.

o Best Station Linking: The control software must automatically select the most favorable site location and frequency to initiate ALE links.

• Alternate Station Routing: The control software must provide the ability to manually, re-route automatically established links with marginal or unacceptable quality.

• Seamless HF Communications Coverage: The software must ensure that the loss of a single or multiple sites does not negatively affect overall coverage or an authorized user’s ability to link and communicate.

• Multi-Net Coverage: The control software must provide the ability to actively monitor and simultaneously display, via icons, all active radios on more than one (multiple) monitored scan list.

• Simultaneous Calling (Collision Avoidance): The software must distinguish between simultaneous calls and route each to avoid collision and any loss of communications.

• Busy Channel Avoidance: The software must employ a method to efficiently check a frequency prior to initiating a call and avoid interfering with ongoing communications.

• Intercom Call Routing: The software must provide all users, directly connected into the central control server, with intercom voice capability.

• SOS Priority Call Routing: The software must provide priority for all SOS links (emergency calls) received.

• System and Performance Monitoring and Management:

o Detect and Avoid Faulted Radios: The software must perform automated polling and/or bit checking on a periodic basis to determine the operational status of HF/ALE radio components.

o Active Icon Display: The software must actively monitor and display, via icons, all active radios on monitored scan lists.

o Scan, Detect, Identify, Store, and Display Information: The software must scan, detect, identify, store and display information about networked components. The software must identify the device type, attach an appropriate device icon and display device information on the system console. The system must identify and display active call signs (ALE Address) for attached radios.

o Network Analysis at a Glance: The software must parse out data into usable information and display the information on a user display terminal to facilitate analysis and management of the network.

o Alarm Threshold Establishment: The software must provide the ability to set thresholds for alarms. Users must be able to establish alarms based on thresholds for system components / faults / health indicators (i.e. “low power faults”).

o Performance Monitoring: The software must collect, store, display, and provide ability to report on system performance (i.e. streaming metrics and network health / network component status.

o Call Completion Data Log: The software must collect, store, and display the status of all calls placed within the network. The software must record, store, display, and provide the ability to report on call data (calls coming in, calls going out, who connected to who, and call duration).

• Peripheral Device Control: The software must provide Operations Center Personnel the ability to manipulate peripheral devices (radios/smart devices) to change frequencies, power levels, change modes (receive/transmit), etc.

• Call Forwarding: The software must provide the ability to forward calls (automatically or manually) to another user.

• End-to-End Testing: The software must provide the ability to troubleshoot performance issues from users and fixed tower systems via end-to-end testing.

• Voice over Internet Protocol (VoIP) Ready: The software must be able to support VoIP communications equipment.

• Downward Compatibility: The software must be able to interface with ethernet, MPLS or frame relay devices.

4.2.1.2 Phone Patch Software - Capabilities and Requirements

Phone Patch Software provides the ability to route incoming digitized HF transmissions to other radios, POTS numbers, and cellular phone systems. Proposed software solutions must provide these capabilities and satisfy the requirements outlined below.

• Integration: Phone patch software must be capable of integrating HF calls with standard phone, cellular, and other phone and radio systems.

• Call Patching: The software must provide the ability to automatically or manually connect an incoming call (user) to a Private Branch Exchange (PBX) system.

o Automated Patching is accomplished when a call is placed to an ALE address tied to a predefined phone number. The software automatically patches the user’s call to the predefined number. Automated patching assumes the phone number be predefined in the software.

o Manual Patching is currently accomplished by Operations Center personnel, who (using the Phone Patch Software) call the desired phone number directly and cross connect the RCC linked call, to complete the connection. The Operations Center technician manually types in the phone number to make the call to a PBX and establish the connection.

4.2.1.3 RCC Software - Capabilities and Requirements

RCC Software remotely facilitates HF radio connections/communications utilizing the Cellular

Controller software. Proposed software solutions must provide this capability and satisfy the requirements outlined below.

• Call Facilitation: The RCC software must facilitate the placement and receipt of calls.

Currently, RCC software integrates with the Cellular Controller and Phone Patch software to allow users, via the audio console, to place calls to the Operations Center, mobile platforms, and via direct interconnection to other RCCs throughout the COTHEN infrastructure.

Configuration and Management: RCC software must provide role-based access control for administrative and maintenance functions for viewing, configuring, and managing components, access and scan lists, HF email addresses, helpline telephone numbers, call signs, RF power output levels, port setup and configuration, LQA data, and log-in passwords.

4.2.2 Primary Operations Center Services

The Contractor must provide on-site configuration, preventive maintenance inspection (PMI), troubleshooting, maintenance, repair, and support services, for in scope COTHEN equipment located at the Primary Operations Center/NLECC facility in Orlando, Florida. This includes: work coordination (planning, scheduling, and execution); PMI services; diagnostic and troubleshooting services (parts, tools, equipment, supplies, packaging, transport, shipment, in transit visibility, and materials necessary to diagnose, troubleshoot and correct malfunctions or failures); logistics;

corrective maintenance; preventative maintenance and repair services. Corrective maintenance, preventative maintenance and repair services must be performed in accordance with original equipment manufacturer (OEM) or Government required intervals for each equipment make, model, and type. The Contractor is also responsible for facilitating/coordinating 3rd party depot-level maintenance and repair services for components not repairable on-site.

The Responsibility Matrix (Attachment 1) details Contractor responsibilities for each major component identified below.

Primary Operations Center – Major Components

• Network Components and Cabling • RCC Systems

• Audio Control System • Phone Patch Systems

• Data Control System • FAS Monitoring System

• Cellular Controller System • Encryption Key Management System

4.2.3 CBP Fixed Antenna Site Services

The Contractor shall provide software, hardware, and system engineering, evaluation, installation, configuration, integration, corrective maintenance, preventative maintenance, repair, and support services for existing equipment at COTHEN (CBP) fixed antenna sites (identified in

Addendum B (Site Support Locations)) and/or Contractor proposed equipment that will reside at these sites. This includes: work coordination (planning, scheduling, and execution); PMI services;

diagnostic and troubleshooting services (parts, tools, equipment, supplies, packaging, transport, shipment, in transit visibility, and materials necessary to diagnose, troubleshoot and correct malfunctions or failures); logistics; corrective maintenance; preventative maintenance; and repair services. Corrective maintenance, preventative maintenance and repair services shall be performed in accordance with OEM or Government required frequency for each equipment make, model, and type. The Contractor is also responsible for facilitating/coordinating maintenance and repair services for components not repairable at the facility.

The Responsibility Matrix (Attachment 1) details Contractor responsibilities for each major component identified below.

CBP Fixed Antenna Sites – Major Components

• Network Components and Cabling • Environmental Control Unit

• Radio Systems • Building Monitoring Unit

• RF cabling and components • UPS System

Proposed changes to the CBP fixed antenna site infrastructure and/or supporting components must be documented, evaluated, vetted (by key stakeholders), approved and tested prior to implementation. The Contractor shall perform comprehensive site surveys for any locations being considered for integration into the COTHEN infrastructure. The Contractor shall evaluate the proposed site and equipment against COTHEN security, compatibility, and configuration requirements prior to integration into the COTHEN HF Network.

4.2.4 Subscriber Equipment Services

The Contractor shall provide on-site corrective maintenance, preventative maintenance and repair services (in accordance with OEM or Government required frequency for each equipment make, model, and type), including: work coordination (planning, scheduling, and execution);

preventive maintenance inspection (PMI) services; diagnostic and troubleshooting services (parts, tools, equipment, supplies, packaging, transport, shipment, in-transit visibility, and materials necessary to diagnose, troubleshoot and correct malfunctions or failures); replacement parts;

logistics; and repair services. The scope includes all equipment (specified in Addendum C (Major Components by Site)) located at subscriber aircraft, vessel and RCC sites (specified in Addendum B (Site Support Locations)). The Contractor is also responsible for facilitating/coordinating 3rd party depot-level maintenance and repair services for components not repairable on-site that are included on the agreed upon repair list. The Contractor is responsible for repair services that are included on the repair pricing list.

The Contractor shall address the requirements specified below, for support of subscriber equipment and software. The Responsibility Matrix (Attachment 1) provides a list of major components for each area and details support responsibilities.

• Subscriber Radios: Contractor support models must provide the evaluation, installation, configuration, integration, maintenance, and repair services highlighted below and detailed in the Responsibility Matrix (Attachment 1), for all subscribers (desktop, portable (manpacks, etc.), aircraft and vessel) radios.

o CBP HF Subscriber Radios: Provide configuration, maintenance, and repair services to integrate, maintain, and repair CBP HF Radio Network subscriber radios.

o Non-CBP HF Subscriber Radios: Provide configuration services for the integration of non-CBP HF subscriber radios into CBP HF Radio Network.

o CBP and Non-CBP HF Subscriber Radios: Provide product evaluation services for subscriber radios being considered for integration into our network.

• Subscriber Remote Communications Consoles (RCCs): Contractor support models must provide the installation, configuration, integration, maintenance, and repair services highlighted below and detailed in the Responsibility Matrix (Attachment 1), for all subscriber RCCs.

o Provide installation, configuration, integration, maintenance, and repair services for all CBP HF Radio Network subscriber RCCs.

o Provide product evaluation services for subscriber remote consoles being considered for integration into our network.

4.2.5 On Demand Services (optional)

As required, the Government may request additional services be performed or commodities be delivered by the Contractor in support of the COTHEN program. The Contractor shall bid for any On Demand Services, and such work shall be mutually agreed upon in writing by the Parties. These On Demand requirements would be issued as a separate CLIN under this Contract. On Demand Services will be Firm-Fixed Price (FFP) and would support new COTHEN requirements and/or projects related to additional infrastructure or subscriber equipment, software/equipment upgrades (beyond life cycle replacement at time of repair), repair of damage occurring from natural disaster, facility access support, or other components, systems, capabilities and functionality. Deliverables and schedule requirements will be defined as each need occurs.

Security Services

This section identifies requirements/requirements, as they relate to solutions and systems provided to the Government by the Contractor or used by the Contractor to deliver and manage the services identified in this SOW. The Contractor must comply with administrative, physical and technical security controls to ensure that the Government’s security requirements are met.

During the course of this contract, Contractor must not use, disclose, or reproduce data which bears a restrictive legend, other than as required in the performance of this SOW.

All Government furnished information must be protected to the degree and extent required by

DHS policies, regulations, and procedures. Contractor must conform to all security policies contained in the Security Policies and Procedures documentation. All services provided under this contract must be compliant with Information Security Policy, identified in MD4300.1, Information Technology Systems Security Program and 4300A Sensitive Systems Directive.

Additional security-related requirements and Contractor responsibilities are identified in

Section 9 (Security) and Addendum D (Acquisition Clauses).

https://www.dhs.gov/publication/dhs-4300a-sensitive-systems-handbook

4.3.1 Contractor System Security Services

As it relates to the Contractor’s development, test, and production systems and components

(applications, servers, network devices, etc.) that support the COTHEN program, in the event the Contractor is required to store/process federal information/data or classified information, the Contractor shall follow the Federal Information Security Management Act (FISMA) of 2002 (P.L.

107-347) to help document, develop, and implement an Enterprise Security Program (ESP).

The Contractor’s ESP shall adhere to the U.S. Customs and Border Protection (CBP) and National Institute of Standards and Technology (NIST) publications that provide guidance in the establishment of security controls for management, operational, and technical safeguards needed to secure and protect the confidentiality, integrity, and availability of systems and information that comprise and support COTHEN.

The Contractor shall identify and implement information security policies, processes, and controls to meet the following CBP requirements.

• Establish and maintain the technical expertise necessary to understand, provide, and manage security services.

• Protect the systems and data critical to the COTHEN mission.

• Identify, document, report, and respond to security-related issues (personnel, operations, system, and information), vulnerabilities, and attacks.

• Evaluate and test new software and components from a security perspective.

o Develop security-related test scenarios.

o Test on the Contractor’s network and equipment first.

o Adjust scripts/scenarios, based on results.

o Present scripts/scenarios to the Government for review and approval.

• Obtain and maintain an Authorization To Operate (ATO) throughout the contract.

As a part of the ESP, the Contractor shall perform the tasks and generate the deliverables identified below, in accordance with CBP and NIST standards and guidelines. The collection of CBP policies, procedures, standards, and guidelines are located at http://www.dhs.gov/publication/dhs-security-authorization-templates.

Enterprise Security Program

Tasks and Deliverables

Categorization • Categorize Contractor’s System(s) using NIST 800-60 Volume II. Must provide using DHS template. Security Assessment Report Template

SSP

Contractor can review NIST 800-53 over Microsoft Teams.

SORN and PIAs • Prepare System of Records Notification (SORN) and Privacy Impact

Assessments (PIA). Must provide using DHS template.

Ownership Letters • Prepare Ownership Records/Letters. Must provide using DHS template.

http://www.dhs.gov/publication/dhs-security-authorization-templates https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.dhs.gov%2Fsites%2Fdefault%2Ffiles%2Fpublications%2FSecurity%2520Assessment%2520Report%2520Extensible.docx&wdOrigin=BROWSELINK

Risk Assessment(s)

• Conduct and support Risk Assessment(s). Must provide using DHS template.

3rd Party Control Assessments

• Manage Third Party Security Control Assessments (SCA)

POA&M Tool • Implement and support a POA&M Data Entry and Tracking Tool POA&M(s) • Develop and maintain Plan of Action and Milestones (POA&M) Contingency Plan

• Develop Contingency Plan and conduct and report annual tabletop testing exercises. Test Results must be submitted using DHS template.

ATO • Obtain Authority To Operate (ATO) Letter from CBP Authorizing Official (AO). Must provide using DHS template.

The Contractor shall create and make available at the Contractor’s facility or through electronic screen share for CBP’s review additional security documentation, as required, to include policies, procedures, standards, guidelines, and any other CBP required documentation in order to meet CBP and Federal security mandates for the COTHEN infrastructure and supporting system.

The SSP shall be finalized, in coordination with the COTHEN ISSO, not later than 40 business days after contract award. The Contractor shall update and make available at the Contractor’s facility or through screen share for CBP’s review every year following award or when a major modification has been made to the system, as defined by the COTHEN ISSO.

4.3.2 COTHEN Information Security Services

The Contractor shall work in cooperation with the CBP CISO, COTHEN ISSO, business owners, and other stakeholders to assist in providing IT Security Services on the COTHEN network. The Contractor shall follow and support all COTHEN and applicable CBP policies and procedures.

4.3.2.1 The Contractor shall work with the Government to: analyze ad-hoc requirements that arise based on new information security requirements and the formulation and implementation of controls to satisfy these new requirements; identify and provide new ideas/innovations to increase the information security posture of the COTHEN network; and ensure integration with the System Development and Life Cycle process for the maintenance and evolution of the COTHEN Network.

Transition Services

The Contractor shall provide Incoming and Outgoing Transition Services that address the Government’s transition requirements identified below.

4.4.1 Incoming Transition

The Contractor shall develop and execute a detailed plan to provide for the smooth, orderly assumption of duties described in this Statement of Work. The plan shall also address the transition of current COTHEN components and systems to the Contractor’s proposed solution. The Incoming Transition Plan should emphasize continuity of operations and minimize impact to the

COTHEN user community. The plan must, at a minimum, describe the following.

• The Contractor’s approach, including what and how the work will be accomplished

• The plan for transition of operational and maintenance responsibilities to the Contractor

• The plan for transition of COTHEN infrastructure components, as identified and applicable, to the Contractor’s proposed solution timelines and milestones for major transition activities as applicable, including on boarding of personnel software/hardware testing, software/hardware configuration and deployment, etc.

The Contractor shall plan for the assumption of duties/responsibilities as quickly as possible after contract award. As determined by the government, appropriate contractor personnel shall obtain CBP Background Investigation (BI) security clearance/approval prior to performing work defined under each contract. In addition, access to some remote support locations may require Department of Defense (DOD) Secret security clearance. If contractor IT system(s) house CBP sensitive information, an Authority to Operate (ATO) will be required.

4.4.1.1 Performance Requirements

• Plan Execution / Transition Completion: The Incoming Transition Plan should address the transition of operational responsibilities and new component integration as described below.

o Operational Responsibilities: The plan should be fully executed to ensure transition of operational and system support responsibilities within three (3) months of the contract start date.

• CBP Background Investigations: Security request forms/packages should be prepared and submitted in the specified time frames, with a focus on accuracy and completeness to minimize rework.

o Initial Forms: The Contractor shall ensure that security clearance request forms (Contractor Employee Initial Background Investigation - CBP Form 77, Background Investigation Reciprocity Determination, and Financial FCRA) are submitted to the COR within 15 business days from contract award or on boarding of personnel.

o E-QIP Information: The Contractor shall ensure that security clearance information is entered in e-QIP within 30 days from receipt of e-QIP invitation.

4.4.2 Outgoing Transition

The Contractor shall plan for and support an orderly and efficient transition of responsibilities to the new Contractor and/or the Government, beginning at the direction of the COR or as required in the contract. The Outgoing Transition Plan shall include the full range of activities and tasks required to bring contracted work to logical completion or transition. The plan must, at a minimum, describe/include the following.

• The Contractor’s approach, including what and how the work will be accomplished

• Key events, activities, and tasks

• The plan to for knowledge transfer to the new contractor or Government personnel

• Timelines and milestones for major transition activities

• Out-processing activities for all contractor employees o Exit interviews and security debriefs as deemed appropriate by the COR o Return of badges and other credentials;

o Return of GFE / GFI

The Contractor shall provide bi-weekly Status Reports on progress against major transition activities and a final Transition Out Report upon successful completion.

4.4.2.1 Performance Requirements

• Plan Completion: The Outgoing Transition Plan shall be submitted to the COR 120 calendar days prior to the end of the period of performance or as directed by the COR.

DELIVERABLES:

The Contractor shall submit all deliverables and work products (identified in the table below) on time and in the format specified. All electronic files shall bear filenames that clearly reflect the title of the deliverable or work product. All information contained in the deliverable or work product will become the property of the Government. The Contractor shall inform the Government before delivery if work products/deliverables include patent, intellectual property, financial, personal, or other information that the Contractor believes is proprietary or otherwise restricted, Deliverable Schedules

Unless otherwise specified, the Contractor shall provide deliverables, in electronic format, as an attachment(s) to email. The Contractor shall develop documentation in Portable Document Format (PDF) and Microsoft Office 2021 (or higher) format. Embedded content (images, tables, spreadsheets, etc.) shall be delivered in a modifiable format.